diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 31fd088d324..189428c47fe 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -56,17 +56,15 @@ CI enforces this for `src/preload/` and `src/shared/` — see `docs/preload-type
 
 ## Pull Requests
 
-Each pull request should:
+Each pull request should follow [`.github/pull_request_template.md`](./pull_request_template.md). In particular:
 
-- explain the user-visible change
-- stay focused on a single topic when possible
-- include screenshots or screen recordings for new UI or behavior changes
+- open with an ELI5 of the change (plain language paragraph; the PR title is the one-liner)
+- explain what changed and why, and stay focused on a single topic when possible
+- for any UI or interaction change, attach **before and after** screenshots (or short videos); if there is no visual change, say `No visual change` and why
 - include high-quality tests when behavior changes or bug fixes warrant them
 - include a brief code review summary from your AI coding agent that explicitly checks cross-platform compatibility, SSH/remote/local compatibility, supported agent and integration compatibility, performance risk, UI quality when applicable, and basic security risk
 - mention any platform-specific, remote/SSH-specific, agent-specific, integration-specific, or git-provider-specific behavior and testing notes
-- **Include your X (Twitter) handle!** We love giving shoutouts to our contributors when we merge features on [@orca_build](https://x.com/orca_build).
-
-If there is no visual change, say that explicitly in the PR description.
+- **Include your X (Twitter) handle** in the PR template Author section — we shout out contributors when we merge features on [@orca_build](https://x.com/orca_build).
 
 ## Release Process
 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index b69e2dcc233..21f7fa08eb8 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,29 +1,52 @@
-## Summary
+## ELI5
 
-Describe the user-visible change.
+<!-- Simple high-level explanation -->
 
-## Screenshots
+## What Changed
 
-- Add screenshots or a screen recording for any new or changed UI behavior.
-- If there is no visual change, say `No visual change`.
+<!-- Describe the change clearly and keep scope tight. -->
+
+## Why
+
+<!-- What problem does this solve, and why is this approach right? -->
+
+## Linked Issue
+
+<!-- Link the issue this PR addresses, there should ALWAYS be one -->
+
+Fixes #
+
+## Visual Proof
+<!-- REQUIRED for UI / behavior changes. Please attach a BEFORE and AFTER that can easily tabbed/switched. Use videos for when appropriate over screenshots -->
+<!-- If there is truly no visual or interaction change, write exactly: `N/A` and briefly say why. -->
+<!-- For attachments NEVER add directly to the PR files (do not commit to files), use `gh image` extension or drag + drop (works for any attachment) -->
 
 ## Testing
 
-- [ ] `pnpm lint`
-- [ ] `pnpm typecheck`
-- [ ] `pnpm test`
-- [ ] `pnpm build`
-- [ ] Added or updated high-quality tests that would catch regressions, or explained why tests were not needed
+<!-- How did you verify this? Steps a reviewer can follow. Which platforms did you actually test (macOS / Linux / Windows / SSH)? -->
 
-## AI Review Report
+- [ ] I manually tested these changes locally
+- [ ] Automated tests added/updated, or explained why not below
 
-Summarize the code review you ran with your AI coding agent. Include the main risks it checked, what it flagged, and what you changed or verified as a result.
-Confirm that the review explicitly checked cross-platform compatibility for macOS, Linux, and Windows, including shortcuts, labels, paths, shell behavior, and any Electron-specific platform differences touched by this PR.
 
-## Security Audit
+## AI Disclosure
+<!-- DO NOT FILL IN IF YOU ARE STABLYAI TEAM MEMBER (INTERNAL CONTRIBUTOR), IGNORE SECTION: -->
+<!-- Which AI model if anyone was used, please state the details -->
 
-Provide a basic security audit summary from your AI coding agent. Call out any input handling, command execution, path handling, auth, secrets, dependency, or IPC risks that were reviewed, plus any follow-up needed.
+## Review
 
-## Notes
+Ensure no issues in: Security, Cross-platoform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance
 
-Call out any platform-specific behavior, risks, or follow-up work.
+## Checklist
+
+- [ ] This PR is small and focused
+- [ ] I explained what changed and why (including ELI5)
+- [ ] Before/after screenshots or videos attached for UI changes, or `N/A` with reason
+- [ ] Self-reviewed for correctness, security, and performance
+- [ ] Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
+- [ ] `pnpm lint`, `pnpm typecheck`, `pnpm test`, and `pnpm build` pass (or CI will cover; local preferred)
+
+## Author
+
+- X / Twitter: @your_handle
+  <!-- Optional but appreciated -->
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 5455d0b7fb8..9838baf4afd 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -126,7 +126,7 @@ jobs:
       # scripts still need the Linux toolchain even though this shard reuses
       # the prebuilt Electron output.
       - name: Install native build tools
-        run: sudo apt-get update && sudo apt-get install -y build-essential python3
+        run: sudo apt-get update && sudo apt-get install -y build-essential python3 zsh
 
       # Why: Electron on Linux needs an X display even when the app
       # suppresses mainWindow.show() via ORCA_E2E_HEADLESS. xvfb provides a
@@ -174,7 +174,7 @@ jobs:
       # ORCA_E2E_FORWARD_APP_LOGS keeps startup failures visible when Electron
       # launches but never creates a BrowserWindow.
       - name: Run E2E tests (${{ matrix.shard_name }})
-        run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e --shard=${{ matrix.shard }}
+        run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 pnpm run test:e2e --shard=${{ matrix.shard }}
 
       # Why: Playwright retains traces/screenshots only on failure. Uploading
       # them as an artifact makes post-mortem debugging on CI possible without
@@ -202,7 +202,7 @@ jobs:
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Install native build and headless UI tools
-        run: sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb
+        run: sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb zsh
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -232,8 +232,15 @@ jobs:
         env:
           TEST_FILES_JSON: ${{ inputs.test_files }}
         run: |
-          mapfile -t TEST_FILES < <(jq -r '.[]' <<<"$TEST_FILES_JSON")
-          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 \
+          mapfile -t TEST_FILES < <(jq -r '.[] | select(
+            . != "tests/e2e/ssh-startup-exec-readiness.spec.ts" and
+            . != "tests/e2e/paired-startup-exec-readiness.spec.ts"
+          )' <<<"$TEST_FILES_JSON")
+          if [ "${#TEST_FILES[@]}" -eq 0 ]; then
+            echo "Changed startup-readiness specs are owned by the dedicated live lane."
+            exit 0
+          fi
+          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 \
             pnpm run test:e2e "${TEST_FILES[@]}" --workers=1
 
       - name: Upload Playwright traces
@@ -248,10 +255,13 @@ jobs:
   ssh-docker-watcher-isolation:
     name: ssh docker watcher isolation
     needs: build
-    if: inputs.test_files == ''
+    if: >-
+      inputs.test_files == '' ||
+      contains(inputs.test_files, 'tests/e2e/ssh-startup-exec-readiness.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/paired-startup-exec-readiness.spec.ts')
     runs-on: ubuntu-latest
-    # Why 35: the terminal parking + retention specs below add two more
-    # docker-rig tests capped at 240s each on top of the watcher isolation pair.
+    # Why 35: the parking, retention, startup-exec, and paired parity specs run
+    # serially on isolated Electron/SSH fixtures after watcher isolation.
     timeout-minutes: 35
 
     steps:
@@ -261,7 +271,7 @@ jobs:
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Install native build and headless UI tools
-        run: sudo apt-get update && sudo apt-get install -y build-essential openssh-client python3 xvfb
+        run: sudo apt-get update && sudo apt-get install -y build-essential openssh-client python3 xvfb zsh
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -295,10 +305,9 @@ jobs:
       - name: Run Docker SSH watcher isolation E2E
         run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation
 
-      # Why always(): these specs gate the C1 terminal parking/retention budget
-      # over a real SSH host and run in no other lane, so a watcher-isolation
-      # failure above must not silently skip them.
-      - name: Run Docker SSH terminal parking + retention E2E
+      # Why always(): this lane gates SSH parking/retention plus startup-exec
+      # readiness across live SSH, headed paired, and headless serve topologies.
+      - name: Run Docker SSH terminal parking + startup readiness E2E
         if: always()
         run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking
 
diff --git a/.github/workflows/golden-e2e-experiment.yml b/.github/workflows/golden-e2e-experiment.yml
index 89c1c86096f..5a2562bf2ba 100644
--- a/.github/workflows/golden-e2e-experiment.yml
+++ b/.github/workflows/golden-e2e-experiment.yml
@@ -23,10 +23,9 @@ jobs:
             platform: linux
           - os: macos-15
             platform: mac
-          # Why: Windows golden E2E is temporarily disabled on CI while its
-          # flaky runner-only failures are investigated.
-          # - os: windows-latest
-          #   platform: windows
+          # Match the release gate: Windows runs the fresh-startup golden only.
+          - os: windows-2022
+            platform: windows
 
     steps:
       - name: Checkout
@@ -67,12 +66,22 @@ jobs:
         run: |
           xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-core-flows.spec.ts
           xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
+          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:posix-profile-index-golden
 
       - name: Run golden E2E tests on macOS
         if: runner.os == 'macOS'
         run: |
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-core-flows.spec.ts
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
+          env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:posix-profile-index-golden
+
+      - name: Run golden E2E tests on Windows
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $env:SKIP_BUILD = '1'
+          $env:ORCA_E2E_FORWARD_APP_LOGS = '1'
+          pnpm run test:e2e:windows-fresh-startup-golden
 
       - name: Upload Playwright traces
         if: failure()
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index d10463173dd..0c1789bf3ea 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -176,6 +176,12 @@ jobs:
   shell_contracts:
     name: shell contracts
     runs-on: ubuntu-latest
+    env:
+      # Why: the suites below gate their live fish tests on the binary, which is
+      # right on a developer machine and wrong here — this job is a required check
+      # and its fish lane is the only end-to-end guard for #9993, so a skip would
+      # report green with nothing exercised. Turns those skips into failures.
+      ORCA_REQUIRE_FISH: '1'
 
     steps:
       - name: Checkout
@@ -186,8 +192,46 @@ jobs:
       # Why fish: shell-ready.test.ts gates its live fish test on the binary being
       # present, so without this the fish barrier is only covered by config-shape
       # assertions and never actually exercised.
+      # Why release-4: DECSET 2031 arming lives in the fish 4.0 Rust tty_handoff, and
+      # fish-color-scheme-child-stdin.node-pty.test.ts (#9993) needs it. Noble ships
+      # 3.7, so the PPA is what makes that lane real.
       - name: Install zsh and fish
-        run: sudo apt-get update && sudo apt-get install -y zsh fish
+        run: |
+          # Why the update/PPA/fish steps are tolerant: a repo the runner image already
+          # ships can lack a Release file for this suite, and a failed add-apt-repository
+          # still leaves its list entry behind — either makes `apt-get update` exit
+          # non-zero and would red this required check over something unrelated to the
+          # PR. Every fish outcome is judged by the version gate below instead, so only
+          # the zsh install (which has no such gate) stays fatal here.
+          sudo apt-get update || true
+          # Why retry only here: adding the PPA is the network-flaky step, and the
+          # version gate below is fatal, so a transient Launchpad blip would
+          # otherwise red a required check on PRs unrelated to shells.
+          for attempt in 1 2 3; do
+            sudo add-apt-repository -y ppa:fish-shell/release-4 && break
+            echo "add-apt-repository attempt ${attempt} failed; retrying" >&2
+            sudo add-apt-repository -y -r ppa:fish-shell/release-4 || true
+            sleep 5
+          done
+          sudo apt-get update || true
+          # Why both shells on one line: pr-workflow-parallelism.test.mjs parses only the
+          # first install command in this step to prove the lane really installs them.
+          sudo apt-get install -y zsh fish
+
+      # Separate from the install so the failure names the contract, not an apt error.
+      # ORCA_REQUIRE_FISH re-checks this at test time; this step just fails in seconds
+      # instead of after a full dependency install.
+      - name: Require fish 4+
+        run: |
+          version="$(fish --version 2>/dev/null || true)"
+          major="${version##*version }"
+          major="${major%%.*}"
+          case "$major" in '' | *[!0-9]*) major=0 ;; esac
+          echo "${version:-<fish not installed>}"
+          if [ "$major" -lt 4 ]; then
+            echo "::error::shell contracts needs fish 4+ (DECSET 2031 arming, #9993) but got '${version:-none}'. Fix the ppa:fish-shell/release-4 install rather than letting the fish lane skip." >&2
+            exit 1
+          fi
 
       - uses: ./.github/actions/install-node-dependencies
         with:
@@ -195,12 +239,14 @@ jobs:
 
       - name: Test real shell contracts
         run: |
-          pnpm exec vitest run --config config/vitest.config.ts \
+          pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
+            src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts \
             src/main/daemon/shell-ready.test.ts \
             src/main/daemon/node-pty-fd-leak.test.ts \
             src/main/providers/local-pty-shell-ready.test.ts \
             src/main/providers/__tests__/shell-ready-framework-example.test.ts \
             src/main/pty/omp-shell-wrapper.node-pty.test.ts \
+            src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts \
             src/shared/posix-command-path-lookup.test.ts
 
   test:
@@ -230,11 +276,13 @@ jobs:
       - name: Test shard
         run: |
           pnpm exec vitest run --config config/vitest.config.ts \
+            --exclude=src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts \
             --exclude=src/main/daemon/shell-ready.test.ts \
             --exclude=src/main/daemon/node-pty-fd-leak.test.ts \
             --exclude=src/main/providers/local-pty-shell-ready.test.ts \
             --exclude=src/main/providers/__tests__/shell-ready-framework-example.test.ts \
             --exclude=src/main/pty/omp-shell-wrapper.node-pty.test.ts \
+            --exclude=src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts \
             --exclude=src/shared/posix-command-path-lookup.test.ts \
             --exclude=tests/e2e/cross-version-wire/** \
             --shard=${{ matrix.shard }}/${{ matrix.shard_total }}
@@ -378,8 +426,12 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Test Windows PowerShell CLI boundary
-        run: pnpm exec vitest run --config config/vitest.config.ts src/main/cli/wsl-cli-powershell-boundary.test.ts
+      - name: Test Windows-specific boundaries
+        run: >-
+          pnpm exec vitest run --config config/vitest.config.ts
+          src/main/cli/wsl-cli-powershell-boundary.test.ts
+          src/main/orca-profiles/profile-index-store.test.ts
+          src/shared/secure-file-fsync-flags.test.ts
 
       - name: Build package inputs
         run: pnpm run build:release
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 6dba5ac1ff6..370fbcc0a32 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -783,7 +783,7 @@ jobs:
           {
             echo "## Release E2E Signal"
             echo ""
-            echo "- Terminal rendering golden is release-blocking."
+            echo "- Platform golden E2E is release-blocking: terminal rendering and restrictive-umask profile writes on Linux/macOS, plus fresh startup on Windows."
             echo "- Full E2E runs separately after publication and cannot change the release result."
             echo "- Terminal rendering release evidence is diagnostic/non-blocking."
             echo ""
@@ -817,7 +817,7 @@ jobs:
   terminal-rendering-golden:
     needs: cut
     if: needs.cut.outputs.should_release == 'true'
-    name: terminal rendering golden ${{ matrix.platform }}
+    name: golden e2e ${{ matrix.platform }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     env:
@@ -830,10 +830,10 @@ jobs:
             platform: linux
           - os: macos-15
             platform: mac
-          # Why: Windows terminal rendering golden is temporarily disabled on
-          # CI while its flaky runner-only failures are investigated.
-          # - os: windows-latest
-          #   platform: windows
+          # Windows terminal rendering remains flaky; keep its blocking signal
+          # scoped to the fresh-profile startup regression from #14130.
+          - os: windows-2022
+            platform: windows
 
     steps:
       - name: Checkout
@@ -866,22 +866,34 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Build Electron app for terminal rendering golden
+      - name: Build Electron app for platform golden
         run: npx electron-vite build --mode e2e
 
       - name: Run terminal rendering golden on Linux
         if: runner.os == 'Linux'
-        run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
+        run: |
+          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
+          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:posix-profile-index-golden
 
       - name: Run terminal rendering golden on macOS
         if: runner.os == 'macOS'
-        run: env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
+        run: |
+          env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
+          env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:posix-profile-index-golden
+
+      - name: Run fresh-startup golden on Windows
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $env:SKIP_BUILD = '1'
+          $env:ORCA_E2E_FORWARD_APP_LOGS = '1'
+          pnpm run test:e2e:windows-fresh-startup-golden
 
       - name: Upload Playwright traces
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: terminal-rendering-golden-${{ matrix.platform }}-playwright-traces
+          name: golden-e2e-${{ matrix.platform }}-playwright-traces
           path: test-results/
           retention-days: 7
           if-no-files-found: ignore
diff --git a/.gitignore b/.gitignore
index 17bb18529af..f5ffbfd5f3c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -102,7 +102,12 @@ docs/**
 !docs/reference/linux-glibc-compatibility.md
 !docs/reference/relay-grace-time-reconfiguration.md
 !docs/reference/remote-wire-compatibility.md
+!docs/reference/terminal-session-behavior-contract.md
+!docs/reference/terminal-session-correctness-handoff-2026-08-07/
+!docs/reference/terminal-session-correctness-handoff-2026-08-07/**
+!docs/reference/renderer-agent-status-performance.md
 !docs/reference/windows-setup-shell.md
+!docs/reference/worktree-scan-fingerprint.md
 
 # Stably CLI (only docs/ are tracked)
 .stably/*
@@ -125,6 +130,10 @@ playwright-report/
 /.agents/skills/
 /skills-lock.json
 
+# Generated Clawpatch state includes machine-local paths and review records.
+/.clawpatch/
+/mobile/.clawpatch/
+
 # Agent hook runtime endpoints (machine-local secrets)
 /agent-hooks/
 validation-screenshots/
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 0f679f17d52..97a2b68701a 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -56,6 +56,7 @@
     "react-hooks/rules-of-hooks": "error",
     "react-hooks/exhaustive-deps": "warn",
     "typescript/array-type": "error",
+    "typescript/consistent-generic-constructors": "error",
     "typescript/consistent-indexed-object-style": "error",
     "typescript/consistent-type-assertions": "error",
     "typescript/consistent-type-definitions": ["error", "type"],
@@ -68,12 +69,16 @@
     "typescript/prefer-function-type": "error",
     "typescript/prefer-includes": "error",
     "typescript/prefer-optional-chain": "error",
+    "typescript/prefer-ts-expect-error": "error",
     "typescript/switch-exhaustiveness-check": [
       "error",
       { "allowDefaultCaseForExhaustiveSwitch": false }
     ],
     "curly": "error",
     "no-unneeded-ternary": "error",
+    "no-else-return": "error",
+    "prefer-exponentiation-operator": "error",
+    "prefer-object-has-own": "error",
     "no-restricted-imports": [
       "error",
       {
@@ -90,11 +95,16 @@
     "no-useless-return": "error",
     "prefer-template": "error",
     "unicorn/consistent-empty-array-spread": "error",
+    "unicorn/consistent-existence-index-check": "error",
+    "unicorn/empty-brace-spaces": "error",
     "unicorn/error-message": "error",
     "unicorn/no-array-fill-with-reference-type": "warn",
     "unicorn/no-array-reverse": "error",
     "unicorn/no-instanceof-builtins": "error",
+    "unicorn/no-typeof-undefined": "error",
+    "unicorn/no-unnecessary-array-splice-count": "error",
     "unicorn/no-useless-promise-resolve-reject": "error",
+    "unicorn/no-zero-fractions": "error",
     "unicorn/prefer-array-find": "error",
     "unicorn/prefer-array-flat-map": "warn",
     "unicorn/prefer-array-index-of": "error",
diff --git a/config/electron-vite-target.config.ts b/config/electron-vite-target.config.ts
index 60651dd6590..490fa654f5b 100644
--- a/config/electron-vite-target.config.ts
+++ b/config/electron-vite-target.config.ts
@@ -8,7 +8,7 @@ const configByTarget = {
   renderer: { renderer: electronViteConfig.renderer }
 }
 
-if (!target || !Object.prototype.hasOwnProperty.call(configByTarget, target)) {
+if (!target || !Object.hasOwn(configByTarget, target)) {
   throw new Error(`Invalid ORCA_ELECTRON_VITE_TARGET: ${target ?? '<unset>'}`)
 }
 
diff --git a/config/max-lines-baseline.txt b/config/max-lines-baseline.txt
index 59368273624..a9c03d1b9d6 100644
--- a/config/max-lines-baseline.txt
+++ b/config/max-lines-baseline.txt
@@ -10,7 +10,6 @@ inline src/main/agent-hooks/server.test.ts
 inline src/main/agent-hooks/server.ts
 inline src/main/amp/hook-service.ts
 inline src/main/antigravity/hook-service.ts
-inline src/main/attribution/terminal-attribution.ts
 inline src/main/automations/external-manager.ts
 inline src/main/automations/hermes-cron-output.ts
 inline src/main/browser/agent-browser-bridge.test.ts
diff --git a/config/oxlint-code-quality-native-plugins.json b/config/oxlint-code-quality-native-plugins.json
index 5d9cd118e74..5f2fb031a51 100644
--- a/config/oxlint-code-quality-native-plugins.json
+++ b/config/oxlint-code-quality-native-plugins.json
@@ -16,6 +16,7 @@
     "import/namespace": "warn",
     "import/no-cycle": ["warn", { "maxDepth": 3 }],
     "import/no-duplicates": "warn",
+    "import/no-empty-named-blocks": "warn",
     "import/no-self-import": "warn"
   },
   "overrides": [
diff --git a/config/oxlint-code-quality-type-aware.json b/config/oxlint-code-quality-type-aware.json
index 4c0e01fa748..8ae3cbab60e 100644
--- a/config/oxlint-code-quality-type-aware.json
+++ b/config/oxlint-code-quality-type-aware.json
@@ -12,6 +12,7 @@
   },
   "rules": {
     "typescript/await-thenable": "warn",
+    "typescript/no-redundant-type-constituents": "warn",
     "typescript/restrict-plus-operands": "warn",
     "typescript/restrict-template-expressions": "warn",
     "typescript/switch-exhaustiveness-check": [
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index f5e5a39caeb..81f587046f0 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-08-10",
+  "updatedAt": "2026-08-12",
   "policy": {
     "maturityLevels": ["experimental", "soak", "blocking", "accepted-gap", "deprecated"],
     "blockingPromotion": {
@@ -10,6 +10,176 @@
     }
   },
   "gates": [
+    {
+      "id": "terminal-session.shell-ready-exec-prompt-fallback",
+      "title": "Startup exec falls back to the identified shell's line editor",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "terminal-session-readiness",
+      "layer": "posix-pty-and-shell-startup",
+      "surfaces": ["queued terminal startup commands", "zsh, bash, and Fish startup output"],
+      "platforms": ["macos", "linux"],
+      "providers": ["local", "local-daemon", "ssh-daemon", "ssh-relay", "paired-runtime"],
+      "coveredPlatforms": ["macos", "linux"],
+      "coveredProviders": ["local", "local-daemon", "ssh-relay", "paired-runtime"],
+      "coverageNotes": "Real macOS node-pty integration covers zsh 5.9 .zshenv/.zprofile and bash 3.2 profile replacement shells, including exec -a names, same-shell and child-process silent reads, a blocking zle-line-init hook, non-shell readline replacements, and a non-shell image renamed zsh. A real Fish PTY proves marker stripping is byte-exact and does not render bracketed-paste control text. An Ubuntu 20.04 container confirms compatible zsh/bash termios. Deterministic owner contracts cover local, daemon, and SSH relay identity/readiness composition plus provider-owned delivery; explicit terminal-paste remains renderer-owned. Live isolated journeys cover a macOS headed desktop owner with paired web client, headless orca serve with paired web client, and a Docker Linux OpenSSH/Bash target with one readiness-time reconnect. Linux desktop, WSL/Windows, live zsh-over-SSH, and physical remote hosts remain gaps.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/issues/13767",
+        "https://linear.app/stably/issue/STA-4067",
+        "https://linear.app/stably/issue/STA-4068",
+        "https://github.com/stablyai/orca/pull/14161"
+      ],
+      "invariant": "Shell startup scanning preserves every non-Orca output byte in order across arbitrary PTY chunk boundaries. Before user startup files run, the wrapper publishes its shell PID. If a later exec discards the ready marker, proof-based recovery releases queued startup input only after the launched shell's actual executable image with that exact PID owns the PTY foreground, emits its post-hook line-editor enable sequence, and exposes zle/readline termios; startup reads, line-init hooks, child foreground processes, and non-shell readline replacements cannot trigger that proof. The existing bounded compatibility timeout may enqueue input without proof, but must not publish readiness, lose or duplicate that input across reconnect, or execute it before the replacement shell can accept it.",
+      "oracle": "Split Fish output immediately after the ready marker and after the following ESC introducer; local and daemon owners must emit the exact ESC [ ? 2004 h bytes and headless xterm must not render literal control text. Run the real generated wrappers under node-pty with disposable zsh, bash, and Fish startup files. Plain and exec -a replacement shells must receive one queued command at their first completed line editor without waiting for the 15-second timeout. The identical oracle must time out without the startup identity and prompt fallback. Same-shell reads, child-process reads, a blocking zle-line-init hook, sqlite3, and sqlite3 renamed zsh must not trigger prompt fallback. Relay owner coverage must use the same lossless scanner composition and release through the same prompt contract.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/line-editor-ready-output-scanner.test.ts src/main/shell-startup-identity-scanner.test.ts src/main/shell-startup-output-scanner.test.ts src/main/shell-prompt-readiness-probe.test.ts src/shared/pty-slave-line-discipline-echo.test.ts src/shared/shell-process-readiness.test.ts src/main/daemon/session.test.ts src/main/daemon/shell-ready.test.ts src/main/providers/local-pty-shell-ready.test.ts src/main/providers/local-pty-provider.test.ts src/relay/pty-shell-launch.test.ts src/relay/pty-handler.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/daemon/shell-ready.test.ts src/main/shell-startup-output-scanner.test.ts",
+        "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
+        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headless --project electron-headful --workers=1"
+      ],
+      "testFiles": [
+        "src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts",
+        "src/main/line-editor-ready-output-scanner.test.ts",
+        "src/main/shell-startup-identity-scanner.test.ts",
+        "src/main/shell-startup-output-scanner.test.ts",
+        "src/main/shell-prompt-readiness-probe.test.ts",
+        "src/shared/pty-slave-line-discipline-echo.test.ts",
+        "src/shared/shell-process-readiness.test.ts",
+        "src/main/daemon/session.test.ts",
+        "src/main/daemon/shell-ready.test.ts",
+        "src/main/providers/local-pty-shell-ready.test.ts",
+        "src/main/providers/local-pty-provider.test.ts",
+        "src/relay/pty-shell-launch.test.ts",
+        "src/relay/pty-handler.test.ts",
+        "tests/e2e/ssh-startup-exec-readiness.spec.ts",
+        "tests/e2e/paired-startup-exec-readiness.spec.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/main/shell-startup-output-scanner.test.ts",
+          "assertions": [
+            "Fish bracketed-paste output stays byte-exact across marker and ESC chunk splits",
+            "every byte after readiness is preserved across every chunk boundary, even when it resembles an identity marker",
+            "pre-ready identity and readiness markers strip across every chunk boundary without reordering prompt output",
+            "incomplete scanner prefixes drain in byte order"
+          ]
+        },
+        {
+          "file": "src/main/daemon/session.test.ts",
+          "assertions": [
+            "daemon output is byte-exact for both Fish chunk splits",
+            "headless xterm never renders literal bracketed-paste control text"
+          ]
+        },
+        {
+          "file": "src/main/providers/local-pty-provider.test.ts",
+          "assertions": ["local PTY output is byte-exact for both Fish chunk splits"]
+        },
+        {
+          "file": "src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts",
+          "assertions": [
+            "real zsh .zshenv/.zprofile and bash profile replacement shells receive queued input exactly once",
+            "same-shell raw silent reads retain queued input",
+            "child-process raw silent reads retain queued input while the identified shell is not foreground",
+            "a blocking zle-line-init read retains queued input until the hook completes",
+            "sqlite3 and a sqlite3 image renamed zsh cannot impersonate the launched shell executable path",
+            "zsh configurations without a line-editor enable sequence retain the existing timeout backstop"
+          ]
+        },
+        {
+          "file": "src/relay/pty-handler.test.ts",
+          "assertions": [
+            "the SSH relay owner strips startup identity and releases provider-delivered input through prompt readiness",
+            "renderer-owned SSH delivery receives the existing ready marker after authoritative relay prompt readiness",
+            "normal renderer-owned ready markers pass through unchanged and retain no readiness state"
+          ]
+        },
+        {
+          "file": "tests/e2e/ssh-startup-exec-readiness.spec.ts",
+          "assertions": [
+            "a Docker Linux OpenSSH/Bash replacement shell retains one compatibility-fallback input across reconnect without executing it before the blocked replacement can accept it",
+            "the owning terminal handle and raw PTY identity remain singular and stable",
+            "painted output, authoritative terminal output, and the first interactive input each appear exactly once"
+          ]
+        },
+        {
+          "file": "tests/e2e/paired-startup-exec-readiness.spec.ts",
+          "assertions": [
+            "a headed desktop owner and paired client recover startup exec on one stable owning PTY",
+            "an isolated headless orca serve owner provides the same exact-once output and input contract"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "manual",
+          "platform": "linux",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/daemon/shell-ready.test.ts src/main/shell-startup-output-scanner.test.ts",
+          "result": "passed",
+          "durationSeconds": 7,
+          "summary": "A clean Debian 12 arm64 container with real Fish 3.6 and node-pty passed exact marker-stripped output plus headless-xterm rendering."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/line-editor-ready-output-scanner.test.ts src/main/shell-startup-identity-scanner.test.ts src/main/shell-startup-output-scanner.test.ts src/main/shell-prompt-readiness-probe.test.ts src/shared/pty-slave-line-discipline-echo.test.ts src/shared/shell-process-readiness.test.ts src/main/daemon/session.test.ts src/main/daemon/shell-ready.test.ts src/main/providers/local-pty-shell-ready.test.ts src/main/providers/local-pty-provider.test.ts src/relay/pty-shell-launch.test.ts src/relay/pty-handler.test.ts",
+          "result": "passed",
+          "durationSeconds": 6,
+          "summary": "473 tests passed with one local Fish skip, including every-boundary scanner composition, real exec, silent-read, line-init-hook, renamed-image, disabled-bracketed-paste, and relay-owner oracles."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "linux",
+          "command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
+          "result": "passed",
+          "durationSeconds": 17,
+          "summary": "The live OpenSSH/Bash relay journey crossed the bounded compatibility fallback while rc-file exec was blocked, proved one queued command echo with no command execution, then passed a disconnect/reconnect with exact-once startup output/input and stable pane plus owner PTY identities."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headless --project electron-headful --workers=1",
+          "result": "passed",
+          "durationSeconds": 14,
+          "summary": "The shared oracle passed a headed desktop owner plus paired web client and an isolated headless orca serve owner plus paired web client."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 120,
+        "scope": "focused local wrapper contracts plus isolated SSH and paired live journeys"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Fresh deterministic and isolated live runs pass locally; CI and soak history have not started."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Daemon oracle SHA-256 b13b08006a38b2adc2acb51ae9342909514e55ab4822fac4fbb76cd49b344cc6 was byte-identical across runs: affected baseline 09ec516ae5 failed 4 of 14, while pre-PR main bc2e30000b and this PR passed 14 of 14. The unchanged live SSH oracle failed on bc2e30000b and with the ownership change reverted because the ledger stayed pending after reconnect, then passed on this PR. Fish chunk oracle patch SHA-256 fd49a4d3d91bd5f0d10c1b1f44f4cfbd92cef9155a5505b415c8680184cdc765 was also byte-identical: scan target e4c278eb52, main 150cc6f50c, and candidate ae7f30318a with shared scanner integration disabled failed only the ESC-introducer split in local and daemon owners, while ae7f30318a passed all 163 cases plus headless-xterm rendering."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Two bounded linear scans partition identity ownership at the exact ready-marker boundary and retain only the existing bounded prefixes. The normal ready-marker path cancels before external probing. A missing marker triggers a debounced stty read only after a line-editor enable sequence, followed by narrow PID status and executable-image inspection only when termios matches. Slow ordinary startup output triggers zero probes; rejected protocol emissions are capped at four probes per startup. There is no per-command hook or steady-state polling."
+      },
+      "promotionCriteria": [
+        "Collect CI and soak history for the Docker SSH and paired live journeys.",
+        "Collect CI and soak history without unexplained flakes.",
+        "Keep same-shell, child-process, line-init-hook, and non-shell readline contracts green."
+      ],
+      "knownGaps": [
+        "The fallback requires a readable POSIX PTY slave; WSL through wsl.exe, ConPTY, and native Windows retain the existing timeout backstop.",
+        "The live SSH journey covers Docker Linux OpenSSH with Bash, not zsh, WSL, Windows SSH, a Linux desktop renderer, or a physical remote host.",
+        "An exec integration that forks a replacement shell instead of retaining the identified shell PID retains the existing timeout backstop.",
+        "A zsh configuration that disables bracketed-paste output emits no safe post-hook protocol signal and retains the existing timeout backstop.",
+        "The pre-existing timeout backstop can still deliver queued input to a non-shell replacement after it expires; this fallback prevents indefinite startup hangs and is unchanged by the prompt fallback.",
+        "The fallback restores safe startup-command delivery but cannot recreate OSC 133 hooks or overlay restores already discarded by exec.",
+        "Startup code running in the launched shell can deliberately spoof the public line-editor enable sequence after configuring matching termios; the existing timeout path already trusts a public OSC marker from the same startup code."
+      ],
+      "demotionRule": "Keep experimental or demote if prompt fallback enters a normal, child, or line-init read; a non-shell executable triggers prompt fallback; the identified shell PID is not foreground; delivery duplicates; ordinary startup output spawns probes; probe attempts exceed four; or the focused gate flakes without an identified harness defect."
+    },
     {
       "id": "editor.restored-sibling-owner-reparent",
       "title": "Restored sibling tabs migrate filesystem authority before becoming editable",
@@ -1361,6 +1531,442 @@
       ],
       "demotionRule": "Demote if a retired runtime transport can leave a renderer subscription without a close event, if a close is delivered more than once, if one failing teardown strands its sibling subscriptions, if payload frames from a retired transport reach the renderer, or if a revealed remote terminal can stay blank or reject input after a reconnect."
     },
+    {
+      "id": "browser-session.remote-terminal-link-ownership",
+      "title": "Paired terminal links open one browser on their owning runtime",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "browser-runtime",
+      "layer": "renderer-paired-runtime-routing",
+      "surfaces": [
+        "paired remote terminal HTTP links",
+        "terminal link action destinations",
+        "runtime-owned managed browser creation"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["remote-runtime", "ssh"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["remote-runtime", "ssh"],
+      "coverageNotes": "A headed macOS desktop host and separate paired Electron client exercise a real mirrored terminal link, owner-asserted host browser creation, exact host/client page identity, rendered DOM, explicit browser-tab activation, client external-browser suppression, exact host/client close convergence, and continued original-PTY liveness. Unit contracts cover OSC, WebLinksAddon, click fallback, explicit System Browser routing, failed creation, incapable runtimes, and unchanged direct SSH behavior.",
+      "motivatingLinks": [
+        "https://stablygroup.slack.com/archives/C0AK2T3JEF4/p1786567689897109",
+        "https://github.com/stablyai/orca/issues/12418"
+      ],
+      "invariant": "Selecting Orca Browser for an HTTP link in a runtime-owned terminal creates exactly one browser page on that owning runtime and exactly one mirrored client browser workspace, with matching remote page identity and no client external-browser call. Explicit System Browser remains client-owned, direct SSH remains system-browser-only, and unknown or mismatched owners fail closed.",
+      "oracle": "Use the focused routing contracts as the byte-identical baseline/candidate oracle. Require runtime OSC, WebLinksAddon, click fallback, action-menu, and modifier paths to target the exact owner without client fallback, while direct SSH and generic remote document links stay external. Separately run one byte-identical headed paired Electron journey on the candidate and with only runtime browser registration disabled. Require one new host browser tab, one new client mirror with exact page identity, rendered fixture DOM, explicit browser-tab activation, zero client shell.openExternal calls, exact close convergence, unchanged terminal counts, and continued output on the original PTY.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts src/renderer/src/lib/http-link-routing.test.ts src/renderer/src/lib/http-link-modifier-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
+      ],
+      "testFiles": [
+        "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts",
+        "src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts",
+        "src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts",
+        "src/renderer/src/lib/http-link-routing.test.ts",
+        "src/renderer/src/lib/http-link-modifier-routing.test.ts",
+        "src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+        "tests/e2e/paired-remote-terminal-browser-link.spec.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts",
+          "assertions": [
+            "OSC, WebLinksAddon, and click-fallback activations route through the exact runtime owner",
+            "direct SSH continues to use only the system browser"
+          ]
+        },
+        {
+          "file": "src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+          "assertions": [
+            "an asserted runtime cannot fall back to a client browser",
+            "mismatched and incapable runtime owners fail closed"
+          ]
+        },
+        {
+          "file": "tests/e2e/paired-remote-terminal-browser-link.spec.ts",
+          "assertions": [
+            "one terminal action produces one host page and one client mirror with exact identity",
+            "the host browser renders the fixture while client external navigation stays empty",
+            "an explicit browser-tab click reveals the exact mirror",
+            "closing the mirror returns host and client inventories to baseline",
+            "the original remote PTY accepts and renders fresh output after browser close"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+          "result": "failed",
+          "durationSeconds": 2.58,
+          "summary": "Latest main e4c278eb523 failed 6/25 owner-routing assertions: runtime terminal links called the viewing client's external browser and the managed-browser helper did not enforce an asserted runtime owner."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts src/renderer/src/lib/http-link-routing.test.ts src/renderer/src/lib/http-link-modifier-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+          "result": "passed",
+          "durationSeconds": 1.83,
+          "summary": "Candidate passed 84/84 across six focused routing, modifier, availability, owner assertion, failure, SSH, and system-browser contract files."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 32.9,
+          "summary": "Candidate created one host browser and one client mirror with matching page identity, rendered the fixture, activated on an explicit tab click, made zero client external-browser calls, converged both inventories after exact UI close, and delivered fresh output on the original remote PTY."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 60,
+          "summary": "The byte-identical final Electron oracle failed at its exact host/client identity barrier when the sole source delta replaced src/renderer/src/store/index.ts registration lines 110-113 with registerRuntimeHttpLinkBrowserOpener(null); no host-owned browser appeared within the deterministic 60-second bound."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 45,
+        "scope": "six focused renderer contract files plus one isolated headed paired-runtime journey"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "The focused contracts are deterministic and the headed paired-runtime journey passed locally after its PTY namespace oracle was corrected; longer CI and soak history is not yet available."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "The focused owner-routing oracle is red on latest main e4c278eb523 and green on the candidate. The byte-identical headed Electron oracle is green on the candidate and red when the sole source delta replaces the runtime browser opener registration with registerRuntimeHttpLinkBrowserOpener(null); candidate evidence proves exact host/client identity, rendered content, explicit activation, exact close convergence, original-PTY survival, and absence of client external navigation."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "The production change adds no timer, polling, retry, subprocess, stream opcode, RPC method, or host publication. Each link hover or activation performs bounded in-memory owner and capability lookups; an Orca Browser action issues the same single browser creation and snapshot reconciliation already used by the tab bar."
+      },
+      "promotionCriteria": [
+        "Collect Linux and physical Windows paired-server evidence.",
+        "Collect a live headless-serve terminal-link journey.",
+        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
+      ],
+      "knownGaps": [
+        "Live paired-server validation currently covers macOS only.",
+        "A live headless-serve journey and multiple simultaneous viewers are not exercised by the Electron journey.",
+        "Direct SSH intentionally retains its existing system-browser-only semantics.",
+        "Terminal-link activation does not change the existing asynchronous host/client focus policy."
+      ],
+      "demotionRule": "Demote if one runtime terminal link creates a client-owned or duplicate browser, targets a runtime other than the pane owner, invokes the client external browser for Orca Browser, or removes the source terminal."
+    },
+    {
+      "id": "browser-session.remote-html-preview-ownership",
+      "title": "Paired HTML previews keep one host page and one stable client split",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "browser-runtime",
+      "layer": "renderer-paired-runtime-reconciliation",
+      "surfaces": [
+        "paired remote HTML file preview",
+        "background preview creation and explicit browser activation",
+        "client-only split placement",
+        "capability-unknown and mixed-version preview rejection cleanup",
+        "post-create reconciliation failure and compensating rollback",
+        "remote browser close convergence"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["remote-runtime"],
+      "coverageNotes": "A headed macOS desktop host and separate paired client exercise the Explorer eye-button path with a real remote file URL, host browser DOM, renderer split layout, background preview creation, explicit browser activation, browser close, forced capability rejection after caller preflight, and a forced post-create reconciliation timeout. The same fault oracles pass against a live headless server. Unit contracts cover absent, unknown, and mixed-version capabilities, visible rejection, empty-split cleanup, owning-runtime routing, exact client materialization, confirmed rollback, ambiguous cleanup, and teardown. Linux and Windows live journeys remain gaps.",
+      "motivatingLinks": [
+        "https://linear.app/stably/issue/STA-3872/unable-to-open-html-files-in-remote-server",
+        "https://linear.app/stably/issue/STA-4025/p1-browser-create-reports-success-when-tab-reconcile-fails-after-pr",
+        "https://linear.app/stably/issue/STA-4063/p1-paired-html-preview-rejects-outside-cleanup-after-pr-13909",
+        "https://github.com/stablyai/orca/pull/13876"
+      ],
+      "invariant": "Opening one HTML preview from a paired client succeeds only after exactly one browser page on the worktree-owning runtime materializes as exactly one client browser workspace and unified tab in the requested group. Capability rejection before host mutation must preserve the original error, issue no RPC, surface a failure toast, and remove only a caller-declared newly-created empty split. Post-create reconciliation failure requires exact rollback; ambiguous rollback rejects without local fallback. Preview focus and close preserve the source editor and terminal.",
+      "oracle": "Run one unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host. Require the original unsupported error or visible toast, zero RPCs, and no retained new split. Run it on the scan target, latest main, candidate, and candidate with the cleanup boundary disabled. In headed paired Electron, arm capability rejection after the caller preflight, invoke the visible HTML side-preview action, require the failure toast, and compare exact host/client browser, editor, terminal, and group inventories to baseline. Repeat against headless serve. Retain the separate exact-page reconciliation rollback oracle.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-browser.test.ts src/main/runtime/rpc/methods/browser.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/runtime/web-session-browser-placement.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
+        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
+        "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+        "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
+        "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
+      ],
+      "testFiles": [
+        "src/main/runtime/orca-runtime-browser.test.ts",
+        "src/main/runtime/rpc/methods/browser.test.ts",
+        "src/renderer/src/lib/file-preview.test.ts",
+        "src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
+        "src/renderer/src/runtime/web-session-browser-placement.test.ts",
+        "src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
+        "src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts",
+        "src/renderer/src/runtime/web-runtime-session.test.ts",
+        "src/renderer/src/runtime/web-session-tabs-sync.test.ts",
+        "src/renderer/src/runtime/remote-server-parity.test.ts",
+        "tests/e2e/paired-remote-html-browser-focus.spec.ts",
+        "tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts",
+          "assertions": [
+            "absent status, unknown capabilities, and mixed-version hosts preserve the unsupported rejection",
+            "direct creation removes the caller-declared new split without issuing an RPC"
+          ]
+        },
+        {
+          "file": "src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
+          "assertions": [
+            "known unavailability reports visibly without creating a split",
+            "capability loss after caller preflight reports visibly without duplicating transaction cleanup"
+          ]
+        },
+        {
+          "file": "src/renderer/src/lib/file-preview.test.ts",
+          "assertions": [
+            "a failed side preview reports visibly without caller-owned split cleanup",
+            "overlapping side previews reuse the split without the first failure deleting it"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
+          "assertions": [
+            "success requires the exact environment and remote page handle plus a unified browser tab",
+            "a requested client group must contain the materialized browser tab"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/web-runtime-session.test.ts",
+          "assertions": [
+            "a post-create timeout returns false only after exact host close and a confirming snapshot",
+            "unconfirmed cleanup rejects so callers cannot create a competing local fallback",
+            "the canonical placement and a newly-created empty split are released on rollback",
+            "one failed preview cannot remove a shared split still reserved after an environment ownership change",
+            "if every overlapping creation fails, the last reservation closes the caller-created empty split"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/web-session-browser-placement.test.ts",
+          "assertions": [
+            "pending page placements are bounded and reserve worktree groups across environment ownership changes",
+            "caller-created cleanup transfers to the last failed overlapping reservation",
+            "capacity rejects a new placement without evicting an active reservation or its cleanup ownership",
+            "worktree and environment teardown clear only their own placement state"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/web-session-tabs-sync.test.ts",
+          "assertions": [
+            "a host browser page stays in its exact client-owned preview group",
+            "a reserved empty split survives a pre-publication host snapshot",
+            "later client moves supersede initial preview placement"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/remote-server-parity.test.ts",
+          "assertions": [
+            "a caller-created browser gains focus when the exact predecessor tab is still visible"
+          ]
+        },
+        {
+          "file": "tests/e2e/paired-remote-html-browser-focus.spec.ts",
+          "assertions": [
+            "one HTML open produces one client workspace, one client unified tab, and one host page",
+            "the source editor and remote frame remain visible in separate groups",
+            "preview creation leaves the editor active, an explicit browser click is authoritative, and close preserves the editor and terminal"
+          ]
+        },
+        {
+          "file": "tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts",
+          "assertions": [
+            "the exact created page exists on the host while publication is held and no browser tab materializes on the client",
+            "a forced post-create reconciliation timeout closes the exact host page and removes only the reserved empty split",
+            "a forced capability rejection after caller preflight shows a toast and restores exact host and client inventories",
+            "headed and headless hosts preserve the unrelated editor and terminal without local fallback"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
+          "result": "failed",
+          "durationSeconds": 0.72,
+          "summary": "The unchanged STA-4063 oracle failed 5/5 on scan e4c278eb52 and latest main bc2e30000b: direct create never closed the new split, and side-preview rejection produced neither cleanup nor a toast. Pre-fix PR #14100 passed the two caller cases but still failed all three direct transaction cases."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.7,
+          "summary": "Rebased candidate 14b5877a75 passed 5/5: absent, unknown, mixed-version, preflight-known, and post-preflight capability failures all reported failure and retained no new empty split."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
+          "result": "passed",
+          "durationSeconds": 18.3,
+          "summary": "The full headed spec passed 2/2. A visible desktop host and separate paired Electron client proved both reconciliation rollback and capability rejection with a failure toast and exact host/client browser, group, editor, and terminal inventory restoration."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
+          "result": "passed",
+          "durationSeconds": 9.1,
+          "summary": "The full isolated headless-serve journey passed 1/1, applying both reconciliation and capability faults to the same live host while preserving the visible-toast and exact inventory-restoration oracle."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.11,
+          "summary": "The exact environment, remote page, client workspace, unified browser tab, and requested group materialization contract passed 1/1 on the final rebased candidate."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
+          "result": "passed",
+          "durationSeconds": 24.3,
+          "summary": "A visible desktop host and separate paired Electron client held one exact host page before client materialization, forced the post-create timeout, then proved exact host rollback, empty-split removal, failure UI, no local fallback, and surviving editor and terminal."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
+          "result": "passed",
+          "durationSeconds": 18.5,
+          "summary": "The same exact-page hold, timeout, rollback, client cleanup, no-fallback, editor, and terminal oracle passed against isolated headless serve."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-browser.test.ts src/main/runtime/rpc/methods/browser.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/runtime/web-session-browser-placement.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
+          "result": "passed",
+          "durationSeconds": 3.48,
+          "summary": "Seven focused host and renderer contract files passed 183/183 tests, covering owning-runtime routing, focused and unfocused creation, placement, reconciliation, failure cleanup, and teardown."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
+          "result": "passed",
+          "durationSeconds": 16.1,
+          "summary": "The candidate passed exact host/client cardinality, split stability, rendered DOM, focus authority, close convergence, and surviving editor and terminal."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 11.6,
+          "summary": "Latest-main a90a18d43da333e1cc327779a3f9912a78308848 failed the byte-identical 5806b23f oracle because the HTML preview collapsed into the source editor group instead of retaining its requested split."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 6.5,
+          "summary": "Rebased candidate b7de9c0961a4edf389a29079b2b4d5250184b57e passed the byte-identical 5806b23f oracle: one host page, one client workspace, requested split, rendered DOM, stable focus, and browser-only close."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 10.9,
+          "summary": "Rebased candidate b7de9c0961a4edf389a29079b2b4d5250184b57e with only the side-preview owning-runtime routing seam disabled failed the byte-identical 5806b23f oracle with two client workspaces."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 7.6,
+          "summary": "Final candidate d5767481b982b736e7cc5b4653b2a32a61280638 on merge-base 36d45af062ec4022265aabac8fc6a9d36eecedf1 passed the byte-identical 5806b23f oracle after final review and rebase: one host page, one client workspace, requested split, rendered DOM, stable focus, and browser-only close."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 11.8,
+          "summary": "Latest-main 346e59c879 failed the byte-identical 2ec1dcf1 oracle with two client HTML browser workspaces instead of one."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 8.4,
+          "summary": "Candidate d05217c40d passed the byte-identical 2ec1dcf1 oracle: one host page, one client workspace, stable split, rendered DOM, editor focus after creation, explicit-click browser focus, and browser-only close."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 12.3,
+          "summary": "Candidate d05217c40d with only the side-preview focusOnCreate:false call disabled failed the byte-identical 2ec1dcf1 oracle because preview creation activated the browser instead of preserving editor focus."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 90,
+        "scope": "focused host/renderer contracts plus normal and faulted headed/headless paired-runtime journeys"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "The candidate passed isolated local macOS Electron runs before and after the final rebase; longer CI and soak history is not yet available."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "The unchanged STA-4063 five-assertion oracle is red 5/5 on scan e4c278eb52 and latest main bc2e30000b, partially green 2/5 on pre-fix PR #14100, green 5/5 on candidate 14b5877a75, and red 3/5 when only the new transaction cleanup boundary is disabled on final candidate a9e6fb7716. The earlier STA-4025 transaction oracle remains red on the post-#13909 base and green on this candidate. The byte-identical 2ec1dcf1 Electron oracle remains red on latest main 346e59c879, green on candidate d05217c40d, and red with only side-preview focus disabled; historical 5806b23f evidence separately proves owning-runtime routing."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "The transaction adds no timer, polling, retry, subprocess, RPC method, stream opcode, or host publication. Capability rejection performs zero RPCs and one bounded empty-group close. Successful creation adds one post-operation list; known-page failure adds one exact close and one confirming list. The E2E-only one-shot faults are build-gated, retain one promise/flag and a bounded page-id set, and reset after each run. Pending client placements remain capped at 128 and clear on adoption, failure, or teardown."
+      },
+      "promotionCriteria": [
+        "Collect Linux and physical Windows paired-server evidence.",
+        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
+      ],
+      "knownGaps": [
+        "Live paired-server validation currently covers macOS only.",
+        "Multiple simultaneous viewers are not exercised by the Electron journey.",
+        "Direct SSH remote file URLs remain intentionally unsupported and local file previews retain their existing path."
+      ],
+      "demotionRule": "Demote if one paired HTML action can create duplicate client or host browser identities, lose the requested split, steal editor focus before an explicit browser click, lose browser focus after that click, or remove unrelated editor or terminal state on close."
+    },
     {
       "id": "browser-stream.bounded-reconnect",
       "title": "Remote browser streams recover within a bounded retry budget",
@@ -2440,7 +3046,7 @@
           "platform": "macos",
           "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
           "result": "passed",
-          "durationSeconds": 0.4,
+          "durationSeconds": 0.34,
           "summary": "1 test file passed, 58 tests passed; covers cwdFallback forwarding only for local fresh spawns and metadata handoff."
         },
         {
@@ -2686,6 +3292,130 @@
       ],
       "demotionRule": "Demote or quarantine if identity-mismatched completion can retire newer work, cleanup retains compact authority, or the focused gate flakes without a product or harness bug."
     },
+    {
+      "id": "agent-launch.discovery-authority",
+      "title": "Agent discovery and launch use the same workspace authority",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "agent-session",
+      "layer": "renderer-store-contract",
+      "surfaces": ["Quick Launch agent inventory", "agent launch", "Floating Workspace"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "wsl", "ssh", "remote-runtime"],
+      "coveredPlatforms": ["macos", "windows"],
+      "coveredProviders": ["local", "wsl"],
+      "coverageNotes": "A deterministic Windows-mode renderer oracle keeps an active WSL project and explicit-local Floating Workspace mounted together with disjoint agent inventories, then independently asserts discovery and launch authority. A headed physical Windows 2 journey with real Ubuntu WSL2 independently verified the rendered inventory and native PowerShell launch; SSH and paired-runtime behavior retain their existing contract coverage.",
+      "motivatingLinks": [
+        "https://linear.app/stably/issue/STA-4027/p1-floating-workspace-agent-detection-still-uses-active-wsl-project",
+        "https://github.com/stablyai/orca/pull/13995"
+      ],
+      "invariant": "Every agent launch surface must advertise the provider set detected on its explicit execution authority and launch on that same authority; a local Floating Workspace must never inherit an unrelated active project's WSL, SSH, or paired-runtime context.",
+      "oracle": "Model an active WSL project and a native-Windows Floating Workspace with WSL-only Claude and host-only Codex. Keep both detection consumers mounted, require their advertised sets to stay disjoint through refresh, require the legacy active-project inventory to remain unchanged, then independently assert the Floating launch call and PTY transport select local IPC with no WSL project runtime.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/hooks/useAgentDetectionTarget.test.ts src/renderer/src/store/slices/detected-agents.test.ts src/renderer/src/store/slices/local-detected-agent-state.test.ts src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts src/renderer/src/lib/local-preflight-context.test.ts src/renderer/src/lib/launch-agent-in-new-tab.test.ts --reporter=verbose",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts --reporter=dot",
+        "Headed Electron/CDP STA-4027 journey on Orca environment windows 2 with a selected Ubuntu-24.04 WSL project and local Floating Workspace"
+      ],
+      "testFiles": [
+        "src/renderer/src/hooks/useDetectedAgents.test.tsx",
+        "src/renderer/src/hooks/useAgentDetectionTarget.test.ts",
+        "src/renderer/src/store/slices/detected-agents.test.ts",
+        "src/renderer/src/store/slices/local-detected-agent-state.test.ts",
+        "src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts",
+        "src/renderer/src/lib/local-preflight-context.test.ts",
+        "src/renderer/src/lib/launch-agent-in-new-tab.test.ts",
+        "src/renderer/src/components/terminal-pane/pty-connection.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/hooks/useDetectedAgents.test.tsx",
+          "assertions": [
+            "the active WSL project advertises only its WSL agent while Floating advertises only the native-host agent",
+            "Floating refresh preserves both scoped inventories and does not overwrite the legacy active-project inventory"
+          ]
+        },
+        {
+          "file": "src/renderer/src/store/slices/local-detected-agent-state.test.ts",
+          "assertions": [
+            "same-context callers deduplicate without cached broadcast fanout",
+            "refresh supersedes stale detection and failed cold refresh remains retryable",
+            "project removal evicts settled and in-flight context state"
+          ]
+        },
+        {
+          "file": "src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts",
+          "assertions": [
+            "removing one project evicts its authority-scoped agent inventory without disturbing another project"
+          ]
+        },
+        {
+          "file": "src/renderer/src/lib/launch-agent-in-new-tab.test.ts",
+          "assertions": [
+            "the advertised Floating agent launches in a Floating tab with null runtime ownership and no paired-runtime create call"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
+          "assertions": [
+            "the Floating agent's actual PTY selects local IPC, carries executionHostId local, and omits the active project's WSL runtime"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/hooks/useAgentDetectionTarget.test.ts src/renderer/src/store/slices/detected-agents.test.ts src/renderer/src/store/slices/local-detected-agent-state.test.ts src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts src/renderer/src/lib/local-preflight-context.test.ts src/renderer/src/lib/launch-agent-in-new-tab.test.ts --reporter=verbose",
+          "result": "passed",
+          "durationSeconds": 2,
+          "summary": "Seven focused files passed independent WSL/local inventory, refresh isolation, cache lifecycle, project eviction, and Floating launch-call assertions."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts --reporter=dot",
+          "result": "passed",
+          "durationSeconds": 20,
+          "summary": "The full PTY connection suite passed the independent Floating native-host transport oracle."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "manual",
+          "platform": "windows",
+          "command": "Headed Electron/CDP STA-4027 journey on Orca environment windows 2 with a selected Ubuntu-24.04 WSL project and local Floating Workspace",
+          "result": "passed",
+          "durationSeconds": 22.3,
+          "summary": "Environment abfee683-80eb-4ac3-ada0-da5d1b6303a6, runtime b3bea13e-f6b7-41e7-b850-0a118f7eda38: Floating advertised native Claude/Codex without WSL-only Gemini and launched Claude through native PowerShell with local host ownership while the WSL project remained active."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 40,
+        "scope": "eight focused renderer authority, cache, eviction, and launch test files"
+      },
+      "flakeHistory": {
+        "status": "soaking",
+        "evidence": "The deterministic oracle uses mocked provider results and React effect barriers. Exact-head PR run 31644438349 passed the full Node 24/26 matrix; an earlier patch-identical run's transient shard failures passed on rerun, but long-term soak history is not yet available."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "The byte-identical oracle fails on merged PR #13995 and the tested latest-main snapshot ebe5125476 because Floating receives the WSL-only Claude inventory while launch remains local. The candidate passes; disabling the scoped Floating target reproduces the mismatch."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Floating uses one stable host context key, retained tab bars do not rescan worktree indexes on store writes, concurrent probes deduplicate per context, and in-flight promise entries are deleted on settlement."
+      },
+      "promotionCriteria": [
+        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
+        "Keep the physical Windows/WSL inventory and launch journey green when authority routing changes.",
+        "Keep disjoint provider inventories, refresh isolation, launch authority, and bounded in-flight state green."
+      ],
+      "knownGaps": [
+        "Live SSH and paired-runtime launch journeys are covered by existing authority contracts rather than this focused oracle."
+      ],
+      "demotionRule": "Demote if discovery and launch can resolve different authorities, a scoped Floating probe overwrites the active-project inventory, or local context selection adds recurring scans or retained in-flight entries."
+    },
     {
       "id": "agent-session.provider-ownership",
       "title": "Provider sessions are resumed once per workspace ownership claim",
@@ -3226,16 +3956,22 @@
       "providers": ["local", "remote-runtime", "ssh", "wsl"],
       "coveredPlatforms": ["macos"],
       "coveredProviders": ["local", "remote-runtime", "ssh", "wsl"],
-      "coverageNotes": "Platform-neutral deterministic tests separate the durable Active Server preference from per-client connection, selected-workspace, browser-session, Add Project, and execution-host routing. The composed regression models Local desktop -> connect/navigate Windows 2 -> reveal a local terminal -> restart. Multi-client browser host overrides, multi-server profile caches, generic settings IPC rejection, local and remote workspace ownership, Add Project owner capture and stale-result fencing, host-qualified group/folder/worktree identity, and restart reset of transient routing are covered. A visible macOS Orca desktop server plus a separate paired Electron client proves real Git, plain-folder, Clone, Create, nested import, runtime-switch, disconnect, reconnect, concurrently visible same-ID local/runtime repo/worktree/group/folder rows, reversed catalog order, reversed refresh completion, local-after-runtime catalog refresh routing, and first paired-terminal activation without local fallback; hidden-window parity also passed. Live Linux, Windows, WSL, and SSH Add Project journeys remain uncollected.",
-      "motivatingLinks": ["https://github.com/stablyai/orca/pull/9687"],
-      "invariant": "Only an explicit user change in Settings > Remote Orca Servers > Advanced > Active Server may mutate activeRuntimeEnvironmentId. Connecting, pairing, disconnecting, selecting or revealing a workspace or terminal, browser/mobile handoff, remote navigation, and reconnect must use transient or target-owner routing and must never rewrite the durable preference. Every Add Project scan, add, import, catalog refresh, and worktree refresh must stay on the host selected when that operation began, even if the durable preference changes or the repo catalog is not hydrated. Generic settings mutation cannot bypass the dedicated preference IPC.",
-      "oracle": "Start with Active Server=Local desktop, connect and navigate Windows 2, then reveal a local terminal and assert it succeeds while the persisted preference remains local before and after restart. Repeat with multiple clients and servers, browser host switches, remote-owned and local-owned workspaces, pairing/connect/disconnect, and generic settings writes. In a separate paired Electron client, select a non-default headed runtime and add a real Git repo, plain folder, clone, created project, and nested repos while switching the preference and disconnecting/reconnecting. Before Git Add, plain-folder Add, Clone, and Create completion, insert a same-ID local repo/worktree decoy; require final activation to remain on the captured runtime. Merge same-ID local/runtime repo, worktree, group, and folder rows, reverse same-host refresh completions, overlap refresh with reconnect, issue ordinary unqualified local refreshes, then create the first paired runtime terminal while the same-ID local/runtime worktrees remain visible. Require only the selected server inventory to change, exact runtime ownership in the client store, preserved host-qualified catalogs, authoritative direct-SSH pruning without runtime sibling loss, visible projects, and zero direct SSH fallback. Assert only the dedicated validated preference method changes activeRuntimeEnvironmentId and stale host-operation completions cannot overwrite the newly selected transient host.",
+      "coverageNotes": "Platform-neutral deterministic tests separate the durable Active Server preference from per-client connection, selected-workspace, browser-session, Add Project, and execution-host routing. The composed regression models Local desktop -> connect/navigate Windows 2 -> reveal a local terminal -> restart. Multi-client browser host overrides, multi-server profile caches, generic settings IPC rejection, local and remote workspace ownership, Add Project eligibility/owner capture/stale-result fencing, host-qualified group/folder/worktree identity, and restart reset of transient routing are covered. A visible macOS Orca desktop server plus separate paired Electron and web clients prove selected-runtime Add Project operations and disabled creation when the only listed host is blocked or unavailable; headless-server parity also passed. Live Linux, Windows, WSL, and SSH Add Project journeys remain uncollected.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/pull/9687",
+        "https://linear.app/stably/issue/STA-4024/p1-paired-web-add-project-enables-unavailable-host-fallback-after-pr"
+      ],
+      "invariant": "Only an explicit user change in Settings > Remote Orca Servers > Advanced > Active Server may mutate activeRuntimeEnvironmentId. Connecting, pairing, disconnecting, selecting or revealing a workspace or terminal, browser/mobile handoff, remote navigation, and reconnect must use transient or target-owner routing and must never rewrite the durable preference. Every Add Project selected host must satisfy canSelectAddRepoHost; paired web has no local filesystem fallback, so no valid host means Browse, Clone, and Create remain disabled. Every operation stays on the host selected when it began, even if preference or catalog state changes. Generic settings mutation cannot bypass the dedicated preference IPC.",
+      "oracle": "Start with Active Server=Local desktop, connect and navigate Windows 2, then reveal a local terminal and assert it succeeds while the persisted preference remains local before and after restart. Repeat transient routing and selected-runtime Add Project operations with exact-ID host decoys and completion reordering. Separately pair the real web client to an isolated headed host, then make its sole still-listed runtime compatibility-blocked and unavailable. Require a null authoritative selection, a disabled host option, and disabled Browse, Clone, and Create actions with no local fallback. Repeat against headless serve. Run the byte-identical selector/action contract on latest main, candidate, and candidate with the eligibility seam disabled.",
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/settings.test.ts src/main/ipc/runtime-environments.test.ts src/renderer/src/store/slices/settings.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/components/settings/browser-session-host-selection.test.ts src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts src/renderer/src/components/status-bar/SshStatusSegment.test.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/hooks/useIpcEvents.test.ts src/renderer/src/web/web-preload-api.test.ts --maxWorkers=1",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list-host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees.test.ts --maxWorkers=1",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/runtime/runtime-server-directory-browser.test.ts src/renderer/src/store/slices/repos-paired-runtime-add.test.ts --maxWorkers=1",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list-host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees.test.ts src/renderer/src/runtime/web-runtime-session.test.ts --maxWorkers=1",
         "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
-        "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
+        "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
+        "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
+        "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
       ],
       "testFiles": [
         "src/main/ipc/settings.test.ts",
@@ -3246,11 +3982,14 @@
         "src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts",
         "src/renderer/src/components/status-bar/SshStatusSegment.test.ts",
         "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts",
+        "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts",
         "src/renderer/src/hooks/useIpcEvents.test.ts",
         "src/renderer/src/web/web-preload-api.test.ts",
         "src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx",
         "src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx",
         "src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts",
+        "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx",
+        "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx",
         "src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts",
         "src/renderer/src/components/sidebar/project-added-default-checkout.test.ts",
         "src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts",
@@ -3262,15 +4001,46 @@
         "src/renderer/src/lib/resolved-worktree-execution-host.test.ts",
         "src/renderer/src/lib/worktree-runtime-owner.test.ts",
         "src/renderer/src/store/selectors.test.ts",
+        "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts",
         "src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts",
         "src/renderer/src/store/slices/repos-project-groups.test.ts",
         "src/renderer/src/store/slices/repos-selected-owner-routing.test.ts",
         "src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts",
         "src/renderer/src/store/slices/worktrees.test.ts",
         "src/renderer/src/runtime/web-runtime-session.test.ts",
-        "tests/e2e/pr11346-selected-runtime-add.spec.ts"
+        "tests/e2e/pr11346-selected-runtime-add.spec.ts",
+        "tests/e2e/paired-web-add-project-unavailable-host.spec.ts"
       ],
       "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts",
+          "assertions": [
+            "paired web hides the viewing computer as an Add Project filesystem authority and selects only an eligible paired runtime",
+            "a sole blocked or errored runtime remains listed but produces no selected Add Project host"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts",
+          "assertions": [
+            "paired runtime browsing opens the host browser without invoking native pickFolders while desktop local and SSH routes remain intact"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx",
+          "assertions": ["paired runtime browsing renders the in-app host filesystem browser"]
+        },
+        {
+          "file": "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx",
+          "assertions": [
+            "host-scoped Add Project actions remain disabled until a paired runtime is selectable"
+          ]
+        },
+        {
+          "file": "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts",
+          "assertions": [
+            "an explicitly selected paired runtime submits repo.add to that runtime without native repo or folder-picker calls"
+          ]
+        },
         {
           "file": "src/main/ipc/settings.test.ts",
           "assertions": [
@@ -3378,9 +4148,35 @@
             "keeps every expanded selected-runtime Add Project path in hidden-window desktop parity",
             "creates the first paired runtime terminal while same-ID local/runtime worktrees remain visible without clearing the selected runtime owner"
           ]
+        },
+        {
+          "file": "tests/e2e/paired-web-add-project-unavailable-host.spec.ts",
+          "assertions": [
+            "a version-blocked sole host stays visible and non-selectable while Browse, Clone, and Create are disabled",
+            "an unavailable sole host has the same disabled action contract without a local fallback",
+            "the rendered contract passes against headed desktop and headless serve hosts"
+          ]
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
+          "result": "passed",
+          "durationSeconds": 12.3,
+          "summary": "A real paired web client against a visible desktop host kept the sole blocked and unavailable runtime listed but non-selectable, with Browse, Clone, and Create disabled and no local host fallback."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
+          "result": "passed",
+          "durationSeconds": 5.8,
+          "summary": "The same present-but-blocked and present-but-unavailable Add Project action oracle passed against isolated headless serve."
+        },
         {
           "date": "2026-07-22",
           "runner": "local",
@@ -3455,7 +4251,7 @@
       },
       "redGreenEvidence": {
         "status": "complete",
-        "evidence": "The byte-identical focused oracle (SHA-256 6de18c140a86801460e58f52287e27a58b97f1576f9f387fa82e1bd4eb378f7b) fails 2/3 on review baseline aa6f945001a5f78a07663c854fabb95c55d8b40b and on the r5-disabled parent e21f4ca58e: local-first lookup returns /local/repo and folder activation has no runtime host. It passes 3/3 on the candidate. Main later advanced to 94cf2f1422f30fc309cb47c5e864a831d516fa8b without changing any of the candidate's 68 files or the focused oracle production boundary; the rebased disabled parent f247d961cab15237bc7fcf0598fe76007f78ec7c has the same stable patch ID as e21f4ca58e. The final paired spec and fixture have SHA-256 bd6d9014d1bed2715397bcd2121d5d7e01792347b13ff14778ccf608bf98789c and d1d78a82f868e2f3152777550825c0ca2d4dc3cba5c6de548e066d2931751fc7. With the final runtime-session owner fix disabled, the focused session test fails 3/43 and the byte-identical hidden paired oracle deterministically creates the host terminal but reports null active client owner while same-ID local/runtime worktrees remain. The integrated candidate passes the same focused test and both headed/hidden paired oracles with exact runtime ownership, server inventory, local exclusion, preserved catalogs, visible rows, and zero direct SSH fallback. Earlier Active Server preference paths retain deterministic coverage but do not yet have a saved intentional-break artifact."
+        "evidence": "The Add Project selector file from fix-disabled overlay 17a612c819 and candidate 8abf0f5d20 is byte-identical (SHA-256 f34c3c69c8adba23811c3a3b6a0efb669f787666c5ada086df8a167e785eea20): its blocked and unavailable sole-host cases fail with the production fix disabled on latest main ebe5125476 after PR #13909 and pass on the candidate. The focused combined selector/transaction invocation was 3 failed with 69 skipped on the red overlay and 3 passed with 75 skipped on the candidate; the different totals come from supplemental browser-transaction cases, not this selector file. The originating/latest affected main 1136503c6a and its fix-disabled overlay were also red before the provider-gating rebase. The byte-identical focused oracle (SHA-256 6de18c140a86801460e58f52287e27a58b97f1576f9f387fa82e1bd4eb378f7b) fails 2/3 on review baseline aa6f945001a5f78a07663c854fabb95c55d8b40b and on the r5-disabled parent e21f4ca58e: local-first lookup returns /local/repo and folder activation has no runtime host. It passes 3/3 on the candidate. Main later advanced to 94cf2f1422f30fc309cb47c5e864a831d516fa8b without changing any of the candidate's 68 files or the focused oracle production boundary; the rebased disabled parent f247d961cab15237bc7fcf0598fe76007f78ec7c has the same stable patch ID as e21f4ca58e. The final paired spec and fixture have SHA-256 bd6d9014d1bed2715397bcd2121d5d7e01792347b13ff14778ccf608bf98789c and d1d78a82f868e2f3152777550825c0ca2d4dc3cba5c6de548e066d2931751fc7. With the final runtime-session owner fix disabled, the focused session test fails 3/43 and the byte-identical hidden paired oracle deterministically creates the host terminal but reports null active client owner while same-ID local/runtime worktrees remain. The integrated candidate passes the same focused test and both headed/hidden paired oracles with exact runtime ownership, server inventory, local exclusion, preserved catalogs, visible rows, and zero direct SSH fallback. Earlier Active Server preference paths retain deterministic coverage but do not yet have a saved intentional-break artifact."
       },
       "performanceBudget": {
         "required": true,
@@ -6005,7 +6801,7 @@
         "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/startup/ssh-startup-reconnect.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-session-terminal-handle-events.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
-        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/direct-ssh-host-hydration.test.ts src/renderer/src/hooks/direct-ssh-state-routing.test.ts src/renderer/src/hooks/remote-workspace-target-sync.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ipc/ssh.test.ts src/main/ipc/worktrees.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/ssh-connection-manager.test.ts src/main/ssh/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts src/shared/ssh-types.test.ts --reporter=dot",
         "pnpm exec electron-vite build --mode e2e",
@@ -6026,7 +6822,7 @@
         "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
         "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
         "src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts",
-        "src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx",
+        "src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx",
         "src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts",
         "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
         "src/renderer/src/runtime/web-session-terminal-handle-events.test.ts",
@@ -6108,7 +6904,7 @@
           ]
         },
         {
-          "file": "src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx",
+          "file": "src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx",
           "assertions": [
             "automatic recovery renders as a quiet bounded status without a button",
             "the disconnected state exposes one explicit Reconnect action"
@@ -6383,7 +7179,7 @@
           "date": "2026-07-21",
           "runner": "local",
           "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
           "result": "passed",
           "durationSeconds": 5,
           "summary": "Eleven fault-injection and recovery-UI files and 127 tests passed, covering suspended heartbeat clocks, stale socket, PTY, and create generations, canonical pre-ready close recovery with one replacement subscription, cold and repeated PTY reattachment, authoritative health, bounded PTY and terminal-create recovery, post-probe timeout clipping, manually retryable create cutoff, accurate capability-probe failures, same-PTY manual reconnect, pane-state cleanup, fatal error deduplication, stable create identity, cross-process PTY adoption, and fail-closed legacy inventory."
@@ -6701,7 +7497,7 @@
     },
     {
       "id": "terminal-input.ime-and-synthetic-forwarding",
-      "title": "IME, native text, and synthetic input commit exactly once and do not leak preedit bytes",
+      "title": "IME, native text, and synthetic input commit exactly once, do not leak preedit bytes, and pair every claimed press with one release",
       "maturity": "experimental",
       "protection": "partial",
       "owner": "terminal-input",
@@ -6718,18 +7514,19 @@
       "providers": ["local", "daemon", "ssh", "remote-runtime"],
       "coveredPlatforms": ["macos", "linux"],
       "coveredProviders": [],
-      "coverageNotes": "Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, and Electron/CDP live-PTY Sogou-style repros. Real Linux/Sogou OS IME automation, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps.",
+      "coverageNotes": "Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, Electron/CDP live-PTY Sogou-style repros, and a macOS renderer/main slice for Preview kitty commits: claimed press/release pairing in both keyup orderings, and snapshot flag provenance where a proven 0, a proven non-zero, and an absent field stay three distinct facts from daemon through the sequenced remote SnapshotStart frame. Real Linux/Sogou OS IME automation, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps.",
       "motivatingLinks": [
         "https://github.com/stablyai/orca/pull/6699",
         "https://github.com/stablyai/orca/pull/6682",
         "https://github.com/stablyai/orca/pull/6513",
         "https://github.com/stablyai/orca/pull/6999"
       ],
-      "invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY.",
-      "oracle": "The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and Linux/Sogou candidate Space/digit selectors do not leak keydown/keypress/keyup while ordinary and long-held letter-to-digit typing remains available. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text, while the legacy orphaned-letter-keyup sequence sends no selector byte to the PTY. Real legacy IME commit preservation and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
+      "invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY. When the snapshot source proves kitty state, macOS Preview commits must use the application's effective flags after the sequenced snapshot and every proven replay/live transition, and a claimed press delivered under report_event_types must produce exactly one matching release regardless of whether keyup arrives before or after insertText and regardless of xterm's defensive internal reset.",
+      "oracle": "Exact outbound bytes from the REAL native-text forwarder behind installPreviewImeBridge after initial snapshot restore, replacement resync, live transitions, and both keydown->insertText->keyup and keydown->keyup->insertText orderings; a wiring-only mock is supporting evidence, not the oracle. The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and Linux/Sogou candidate Space/digit selectors do not leak keydown/keypress/keyup while ordinary and long-held letter-to-digit typing remains available. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text, while the legacy orphaned-letter-keyup sequence sends no selector byte to the PTY. Real legacy IME commit preservation and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/shared/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
         "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts"
       ],
       "testFiles": [
@@ -6742,6 +7539,14 @@
         "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
         "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
         "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
+        "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts",
+        "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx",
+        "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts",
+        "src/main/ipc/terminal-preview.test.ts",
+        "src/main/ipc/terminal-preview-output-stream.test.ts",
+        "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts",
+        "src/main/daemon/daemon-pty-adapter.test.ts",
         "tests/e2e/chinese-ime-chat-input-repro.spec.ts"
       ],
       "assertionRefs": [
@@ -6806,6 +7611,65 @@
             "macOS standalone Process key behavior and composition-owned key suppression stay intact"
           ]
         },
+        {
+          "file": "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts",
+          "assertions": [
+            "the real forwarder behind the Preview bridge encodes the commit from the snapshot-proven flags before any live output",
+            "flags 0/1 commit raw text, flags 2 add one CSI-u release, flags 8 emit one CSI-u press, and flags 10 emit a CSI-u press followed by exactly one release",
+            "both keydown->insertText->keyup and keydown->keyup->insertText orderings produce the same bytes",
+            "the release is emitted by the forwarder while xterm's internal kitty flags stay 0",
+            "the mutable flags getter is read exactly once, at commit time, never on keydown or keyup",
+            "auto-repeat, two-key rollover, a swallowed commit, a retired claim, blur, and disposal each emit at most one release and never synthesize one"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts",
+          "assertions": [
+            "a Preview opened on a snapshot carrying flags 8 adopts 8 before any live output",
+            "a replacement snapshot whose ANSI carries no kitty bytes keeps its proven flags, and a proven 0 clears an earlier 8",
+            "a missing field leaves the mirror unproven at the raw-text fallback and a later live negotiation still upgrades it",
+            "restored flags land on the screen the snapshot scan selected",
+            "a proven post-snapshot suffix advances the stack while redelivered bytes apply idempotently"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx",
+          "assertions": [
+            "the Preview hands the forwarder the live kitty mirror seeded from the snapshot's proven flags"
+          ]
+        },
+        {
+          "file": "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts",
+          "assertions": [
+            "a fresh PTY's known 0 is distinguishable from a snapshot's unproven 0 fallback",
+            "restoreSnapshotFlags proves only the active screen and rejects non-safe-integer values",
+            "provenance survives absolute sets, screen switches, RIS and DECSTR, but a pop past omitted push history returns to unknown rather than a manufactured 0"
+          ]
+        },
+        {
+          "file": "src/main/ipc/terminal-preview.test.ts",
+          "assertions": [
+            "terminalPreview:connect returns image, sequence, and kitty flags from the same capture, including after an overflow retry"
+          ]
+        },
+        {
+          "file": "src/main/ipc/terminal-preview-output-stream.test.ts",
+          "assertions": [
+            "fully covered chunks are dropped, a sliced or strictly newer sequenced suffix gets live mode semantics, and an unsliceable or metadata-less overlap gets replay semantics"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts",
+          "assertions": [
+            "SnapshotStart decodes proven 0 and 8 with their seq into requested and host-pushed snapshot paths",
+            "negative, fractional, unsafe, and non-numeric values are treated as absent rather than clamped",
+            "an old host that omits the field stays usable and is never coerced to a proven 0"
+          ]
+        },
+        {
+          "file": "src/main/daemon/daemon-pty-adapter.test.ts",
+          "assertions": ["daemon provider snapshots publish proven kitty flags including a known 0"]
+        },
         {
           "file": "tests/e2e/chinese-ime-chat-input-repro.spec.ts",
           "assertions": [
@@ -6817,6 +7681,15 @@
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-11",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/shared/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
+          "result": "passed",
+          "durationSeconds": 9.84,
+          "summary": "8 test file(s) passed, 288 tests, covering the Preview kitty slice: real forwarder bytes at snapshot-proven flags, press/release pairing across both keyup/insertText orderings, and flag provenance where a proven 0, a proven non-zero, and an absent field stay three distinct facts — asserted on the daemon snapshot and on a host-pushed remote snapshot that carries the flags with their sequence. The emitter-side rule that a remote SnapshotStart withholds flags without a seq has no direct assertion yet; the client-side gate is what these files pin."
+        },
         {
           "date": "2026-08-09",
           "runner": "local",
@@ -6882,7 +7755,7 @@
       },
       "redGreenEvidence": {
         "status": "partial",
-        "evidence": "Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, and live-PTY Sogou-style candidate commits. Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
+        "evidence": "Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, live-PTY Sogou-style candidate commits, and the Preview kitty slice (press/release pairing in both keyup orderings, and snapshot flag provenance separating a proven 0 from an absent field). Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
       },
       "performanceBudget": {
         "required": true,
@@ -6895,7 +7768,9 @@
       ],
       "knownGaps": [
         "Current commands include renderer-unit coverage and a CDP-driven Electron repro; real OS IME automation may need manual or soak evidence.",
-        "Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage."
+        "Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage.",
+        "An older remote host omits the optional SnapshotStart kitty field, so a new client falls back to raw commits until live negotiation is observed.",
+        "Snapshot authorities expose only the active screen's effective flags, not kitty's complete two-screen push stacks; a pop that crosses the restored boundary degrades to unknown rather than a proven value."
       ],
       "demotionRule": "Cannot promote if success is based only on DOM text without PTY byte/cell evidence."
     },
@@ -7238,14 +8113,16 @@
       "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
       "coveredPlatforms": ["macos"],
       "coveredProviders": ["local", "daemon"],
-      "coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal on a shell conflict.",
+      "coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, verified managed-Claude launch identity, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal when no verified launch identity exists.",
       "motivatingLinks": ["https://github.com/stablyai/orca/issues/8303"],
-      "invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
-      "oracle": "Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
+      "invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; a generic busy title requires independent agent identity from the title, a verified managed launch bound to the current PTY incarnation, or the foreground process; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
+      "oracle": "A quarter-circle Claude task title authorizes without a provider lookup only on the exact PTY incarnation carrying verified managed-Claude launch identity; the same title in a bare pane, with an unverified launch hint, or after PTY incarnation replacement is refused while current Claude activity remains a working signal. Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
       "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send.test.ts src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
       ],
       "testFiles": [
+        "src/main/runtime/quarter-circle-title-send-authorization.test.ts",
         "src/main/runtime/orca-runtime.test.ts",
         "src/main/runtime/rpc/terminal-send.test.ts",
         "src/main/ipc/pty.test.ts",
@@ -7258,6 +8135,14 @@
         "src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
       ],
       "assertionRefs": [
+        {
+          "file": "src/main/runtime/quarter-circle-title-send-authorization.test.ts",
+          "assertions": [
+            "a verified managed-Claude launch authorizes a task-text quarter-circle title without foreground-process work",
+            "a bare pane, an unverified launch hint, and a replacement PTY incarnation remain refused",
+            "quarter circles remain working signals and braille authorization is unchanged"
+          ]
+        },
         {
           "file": "src/main/runtime/orca-runtime.test.ts",
           "assertions": [
@@ -7325,6 +8210,15 @@
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts",
+          "result": "passed",
+          "durationSeconds": 20.9,
+          "summary": "The focused file passed 9 tests, including current-incarnation managed-Claude authorization with zero foreground calls and fail-closed bare, unverified, and replacement-incarnation quarter-circle titles."
+        },
         {
           "date": "2026-07-11",
           "runner": "local",
@@ -7345,11 +8239,11 @@
       },
       "redGreenEvidence": {
         "status": "partial",
-        "evidence": "Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; saved intentional-break and physical Windows evidence remain missing."
+        "evidence": "Before the verified-launch fallback, the managed-Claude unavailable-foreground case failed with isRunningAgent false; the focused file passed 7 tests after the fix. Removing the launch-incarnation comparison makes the replacement-incarnation refusal fail. Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; physical Windows evidence remains missing."
       },
       "performanceBudget": {
         "required": true,
-        "evidence": "Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove permission/title blockers and ordinary recognized-agent evidence add zero confirmations; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
+        "evidence": "Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove verified managed-Claude launch identity, permission/title blockers, and ordinary recognized-agent evidence add zero provider calls; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
       },
       "promotionCriteria": [
         "Run the browser annotation existing-agent and repeat-send path in Electron on Windows ConPTY without a recognition refusal.",
@@ -7362,7 +8256,7 @@
         "SSH, WSL, legacy daemon, and remote-runtime providers without confirmation remain intentionally fail-closed on an ordinary-shell conflict; no live artifacts cover those degraded paths.",
         "No live Linux PTY, paired-web, mobile/relay, restore/replay, or multi-window artifact is attached; those surfaces receive no renderer, persistence, or protocol change."
       ],
-      "demotionRule": "Keep non-blocking or demote to protection none if provider confirmation becomes unconditional, exact-PTY mismatch can write bytes, unsupported providers fail open, or the focused gate flakes without an actionable product or harness defect."
+      "demotionRule": "Keep non-blocking or demote to protection none if a generic busy title authorizes without exact title, verified-launch, or foreground identity; provider confirmation becomes unconditional; exact-PTY mismatch can write bytes; unsupported providers fail open; or the focused gate flakes without an actionable product or harness defect."
     },
     {
       "id": "terminal-input.agent-prompt-injection",
@@ -7507,19 +8401,25 @@
       "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
       "coveredPlatforms": ["macos"],
       "coveredProviders": ["local", "daemon", "ssh"],
-      "coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, exact legacy worker identity planning, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, and federated non-reveal. Two isolated macOS Electron journeys launch fake Codex workers through the real RPC path and record append-only spawn/interruption ledgers. They assert immediate inactive presentation, one live agent PID, stable PTY/incarnation/tab/leaf/worktree/Task/Dispatch identity, and no interruption after workspace re-entry; the restart journey additionally removes renderer ownership, marks the Dispatch legacy, retains the daemon process across an app restart, and proves exact background adoption with readable ACK output and no resume replay. Distinct A/B artifacts plus live SSH, WSL, folder, remote-runtime, Linux, and Windows cutover journeys remain explicit gaps.",
-      "motivatingLinks": ["https://github.com/stablyai/orca/pull/11107#discussion_r3663321387"],
-      "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.",
+      "coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, exact legacy worker identity planning, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, exact legacy Task/Dispatch/report-receipt verification, JSON rejection envelopes, and capability-negotiated Run-home settlement with lost-ack replay. Three isolated macOS Electron journeys launch fake Codex workers through the real RPC path. The compiled-CLI journey spawns fresh out/cli processes for rejected and accepted worker_done plus worker-release, then independently verifies runtime and SQLite state. The presentation and restart journeys assert immediate inactive presentation, one live agent PID, stable PTY/incarnation/tab/leaf/worktree/Task/Dispatch identity, and no interruption after workspace re-entry; the restart journey additionally proves exact background adoption with readable ACK output and no resume replay. Distinct A/B artifacts plus live SSH, WSL, folder, remote-runtime, Linux, and Windows cutover journeys remain explicit gaps.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/pull/11107#discussion_r3663321387",
+        "https://github.com/stablyai/orca/issues/13858"
+      ],
+      "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. A worker_done caller may report success only after the owning runtime returns an explicit lifecycle verdict or authoritative reads prove that the exact Task, Dispatch, and worker report receipt settled the expected outcome. A federated worker may accept only the Run-home runtime's settlement verdict. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.",
       "oracle": "Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately remint a creator pane and process from Run A into Run B, require the nested Run A worker to fall back to its current coordinator, require indexed query plans, and bound 300 Task reads with 50,000 retained Runs. They also assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.",
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/ssh/ssh-remote-orca-cli.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/rpc/methods/orchestration-federation.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts",
         "pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1",
-        "pnpm run test:e2e -- tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts --workers=1"
+        "pnpm run test:e2e -- tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts --workers=1",
+        "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
       ],
       "testFiles": [
         "src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts",
@@ -7528,13 +8428,18 @@
         "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts",
         "src/main/runtime/orca-runtime.test.ts",
         "src/cli/handlers/orchestration.test.ts",
+        "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
+        "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
+        "src/cli/handlers/orchestration-migration.test.ts",
         "src/cli/handlers/orchestration-check-identity.test.ts",
         "src/cli/handlers/orchestration-worker-cli.test.ts",
         "src/main/runtime/rpc/methods/orchestration.test.ts",
         "src/main/runtime/rpc/methods/orchestration-federation.test.ts",
+        "src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts",
         "src/main/ssh/ssh-remote-orca-cli.test.ts",
         "tests/e2e/orchestration-worker-terminal-visibility.spec.ts",
-        "tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts"
+        "tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts",
+        "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
       ],
       "assertionRefs": [
         {
@@ -7577,6 +8482,27 @@
             "current formatting remains unchanged"
           ]
         },
+        {
+          "file": "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
+          "assertions": [
+            "an explicit current worker_done verdict completes without a compatibility read",
+            "a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt",
+            "legacy succeeded and failed reports require matching terminal Task and Dispatch state",
+            "stopped or stale Dispatches cannot impersonate report settlement",
+            "an idempotent retry accepts the first authoritative report from the same worker",
+            "a Run-home relay rejection reaches the CLI error boundary"
+          ]
+        },
+        {
+          "file": "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
+          "assertions": ["a rejected lifecycle verdict is emitted as a JSON ok=false envelope"]
+        },
+        {
+          "file": "src/cli/handlers/orchestration-migration.test.ts",
+          "assertions": [
+            "first and replayed legacy worker_done settlements are accepted from their authoritative runtime verdict"
+          ]
+        },
         {
           "file": "src/cli/handlers/orchestration-check-identity.test.ts",
           "assertions": [
@@ -7600,6 +8526,20 @@
             "a live handle cannot be retargeted by mismatched pane metadata"
           ]
         },
+        {
+          "file": "src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts",
+          "assertions": [
+            "a remote worker_done waits for Run-home settlement even when an older CLI omits the wait hint",
+            "older negotiated federation protocols reject before queueing",
+            "a committed settlement is replayed after an acknowledgment is lost",
+            "an aborted settlement wait returns operation_unknown instead of accepted success",
+            "an already-aborted signal registers no settlement waiter",
+            "a Run-home terminal verdict settles the remote attachment and revokes its capability",
+            "a terminal verdict cannot settle an unrelated relay item",
+            "a terminal verdict cannot contradict the exact queued worker report outcome",
+            "a rejected report replays its exact verdict without mutating durable rejection mail twice"
+          ]
+        },
         {
           "file": "src/main/runtime/rpc/methods/orchestration-federation.test.ts",
           "assertions": ["federated worker placement explicitly sets activate=false"]
@@ -7630,9 +8570,27 @@
             "sleeping-session, resume-claim, and pending-startup state are cleared after adoption",
             "no second spawn, resume argv, input, signal, interruption, or duplicate tab occurs after workspace re-entry"
           ]
+        },
+        {
+          "file": "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts",
+          "assertions": [
+            "a compiled CLI worker_done with the wrong identity exits nonzero with ok=false",
+            "the exact Task and Dispatch remain dispatched after rejection",
+            "the correct worker identity receives an explicit completed lifecycle verdict",
+            "an independent runtime read observes the Dispatch completed"
+          ]
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 20,
+          "summary": "The combined candidate passed one real Electron and compiled-CLI journey: wrong worker identity exited nonzero with ok=false while Dispatch stayed dispatched, the exact worker received an explicit completed verdict, and runtime state independently reached completed."
+        },
         {
           "date": "2026-08-03",
           "runner": "local",
@@ -7678,6 +8636,24 @@
           "durationSeconds": 5.27,
           "summary": "Five focused files passed with 216 tests, covering visible inactive local worker creation, reveal-failure warnings, stable-pane mailbox routing, live-handle precedence, and SSH fallback parity."
         },
+        {
+          "date": "2026-08-11",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.4,
+          "summary": "Three focused files passed 12 deterministic tests covering explicit current and Run-home verdicts, JSON failure output, exact report and terminal-state verification for stripped responses, stale/stopped rejection, idempotent retry, and first/replayed attested legacy settlements."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
+          "result": "passed",
+          "durationSeconds": 4.58,
+          "summary": "Nine deterministic tests passed for protocol negotiation, Run-home completion and rejection, already-aborted waits, authoritative remote-attachment settlement bound to the exact queued worker_done outcome, and exact verdict replay after lost acknowledgments without mutating durable rejection mail twice."
+        },
         {
           "date": "2026-07-28",
           "runner": "local",
@@ -7712,11 +8688,11 @@
       },
       "flakeHistory": {
         "status": "unknown",
-        "evidence": "The deterministic units and two isolated Electron journeys pass locally; CI and soak history are not yet available."
+        "evidence": "The deterministic units and three isolated Electron journeys pass locally; CI and soak history are not yet available."
       },
       "redGreenEvidence": {
-        "status": "partial",
-        "evidence": "The byte-identical 5f45c270f1 service oracle is red as the sole overlay 063340a8ba on origin/main@34291f07e9, green on candidate@2748b0b29b, red with current-authority propagation actually disabled in child 08a7db37bf, and green again after revert d2a4e2e024. The focused presentation and stale-handle tests failed against the earlier pre-fix implementation. The restart journey additionally failed first on empty retained output while the original PTY/PID remained live, then passed after the scoped recovered-worker snapshot fallback. The live incident and pre-fix Electron topology showed workspace re-entry replaying provider resume against a worker whose tab binding was missing. Distinct installed A/B and CI artifacts are still needed."
+        "status": "complete",
+        "evidence": "The byte-identical compiled-CLI Electron oracle failed on latest main 5ea7df1a5b because a wrong worker identity exited zero with ok=true while Dispatch stayed dispatched, passed on combined candidate d697666ce8 with a nonzero ok=false rejection and explicit completed verdict for the exact worker, and reproduced the main failure when the claimed production files were disabled at merge-base 64aec94cb2. The earlier byte-identical service oracle was also red on main, green on candidate, red with authority propagation disabled, and green after restore. Distinct installed A/B and CI artifacts are still needed."
       },
       "performanceBudget": {
         "required": true,
@@ -7877,24 +8853,42 @@
       "platforms": ["macos", "linux", "windows"],
       "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
       "coveredPlatforms": ["macos"],
-      "coveredProviders": ["local"],
-      "coverageNotes": "Deterministic service tests cover release-versus-reuse ordering, transactional retain and takeover cancellation, exact host/pane/process identity, conservative schema-v23 backfill, immutable transcript and bounded terminal archives, mutation restart, reset cleanup, replay idempotency, and 50-resource accounting. Live SSH, WSL, Windows, paired-runtime, and provider-close lost-ack journeys remain explicit gaps.",
-      "motivatingLinks": ["https://github.com/stablyai/orca/pull/12355", "STA-905"],
-      "invariant": "A settled Dispatch may close only its one coordinator-created terminal lease. Explicit reuse, real user input, retain, identity or host change, ambiguity, and another resource for the same exact host/pane/process must fence closure. Output preservation and the requested-to-releasing transition are atomic, archives remain readable without the provider file, retries resume idempotently, and orchestration reset removes archive and authority state.",
-      "oracle": "Record release intent for a settled owner, attempt exact reuse before close, and require worker-start to fail with terminal_release_in_progress while the terminal stays open; then release the original owner exactly once. Race retain and real user input against a controlled archive promise and require no committed archive or close. Change host or process identity and inject duplicate resource evidence to require retention. Freeze a structured transcript, delete its source file, and require archived worker-read to return the same bounded redacted messages. Restart a pending mutation, reset orchestration state, and create 50 resources while asserting replay convergence, zero orphan rows, two-query worker listing, and no unrelated close.",
+      "coveredProviders": ["local", "ssh"],
+      "coverageNotes": "Deterministic service tests cover release-versus-reuse ordering, transactional retain and takeover cancellation, exact host/pane/process identity, dead external/user-owned/transferred/stopped/abandoned reconciliation, conservative unknown provider and legacy metadata handling, immutable transcript and bounded terminal archives, mutation restart, reset cleanup, replay idempotency, and 50-resource accounting. A macOS Electron journey invokes the freshly compiled worker-release CLI after the worker process disappears, then independently checks released SQLite state and coordinator liveness. Injected inventories cover local and SSH provider routing; live SSH, WSL, Windows, paired-runtime, and provider-close lost-ack journeys remain explicit gaps.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/pull/12355",
+        "https://github.com/stablyai/orca/issues/13860",
+        "STA-905",
+        "STA-3932"
+      ],
+      "invariant": "A settled Dispatch may close only its one coordinator-created terminal lease. Explicit reuse, real user input, retain, identity or host change, ambiguity, and another resource for the same exact host/pane/process must fence closure. Once the authoritative owning provider positively excludes the resource's exact immutable process incarnation, even an external, user-owned, or transferred dead resource must converge to released without any process close. Unknown host scope, missing incarnation metadata, or unavailable inventory must remain retained. Output preservation and the requested-to-releasing transition are atomic, archives remain readable without the provider file, retries resume idempotently, and orchestration reset removes archive and authority state.",
+      "oracle": "Record release intent for a settled owner, attempt exact reuse before close, and require worker-start to fail with terminal_release_in_progress while the terminal stays open; then release the original owner exactly once. Race retain and real user input against a controlled archive promise and require no committed archive or close. For retained external, user-owned, transferred, stopped, and abandoned resources, run one fresh inventory against the exact local/WSL or SSH provider: an exact live incarnation and every unknown inventory shape stay retained, while positive absence atomically sets ownership_state and release_state to released with processAction none and zero closeTerminal calls. Change host or process identity and inject duplicate resource evidence to require retention. Freeze a structured transcript, delete its source file, and require archived worker-read to return the same bounded redacted messages. Restart a pending mutation, reset orchestration state, and create 50 resources while asserting replay convergence, zero orphan rows, two-query worker listing, and no unrelated close.",
       "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
-        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose"
+        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose",
+        "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
       ],
       "testFiles": [
+        "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts",
         "src/main/runtime/rpc/methods/orchestration-worker-release.test.ts",
         "src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts",
         "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts",
         "src/main/runtime/orchestration/worker-transcript-read.test.ts",
         "src/renderer/src/lib/worker-terminal-takeover-report.test.ts",
-        "tests/e2e/completed-worker-retirement-resume.unit.test.ts"
+        "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
+        "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
       ],
       "assertionRefs": [
+        {
+          "file": "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts",
+          "assertions": [
+            "classifies only an exact incarnation as live on its owning provider",
+            "keeps missing or malformed identity and unavailable inventory unknown",
+            "does not inspect an unproven host scope",
+            "uses the local provider inventory for local and WSL scopes"
+          ]
+        },
         {
           "file": "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
           "assertions": [
@@ -7904,6 +8898,10 @@
         {
           "file": "src/main/runtime/rpc/methods/orchestration-worker-release.test.ts",
           "assertions": [
+            "reconciles a dead external terminal without closing a process",
+            "reconciles a dead user-taken-over terminal without closing a process",
+            "reconciles a dead stopped or abandoned worker without closing a process",
+            "reconciles dead transferred ownership after the current owner settles",
             "rejects exact reuse after release intent instead of closing the new worker",
             "lets an explicit retain cancel a release while output capture is pending",
             "retains when the terminal host scope changed instead of closing",
@@ -7923,9 +8921,36 @@
             "coalesces overlapping reconciliation passes and closes each resource once",
             "keeps live terminals bounded across 50 settled workers while controls survive"
           ]
+        },
+        {
+          "file": "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts",
+          "assertions": [
+            "compiled worker-release reconciles a dead external retained resource to released",
+            "the CLI reports processAction none instead of closing a process",
+            "SQLite independently records released ownership and release state",
+            "the unrelated coordinator terminal remains live"
+          ]
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 20,
+          "summary": "The combined candidate's compiled worker-release returned released with processAction none after positive process absence; an independent SQLite read showed both states released and the coordinator terminal remained live."
+        },
+        {
+          "date": "2026-08-11",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
+          "result": "passed",
+          "durationSeconds": 4.98,
+          "summary": "Six focused files passed 67 tests on the rebased candidate, covering dead external, user-owned, stopped, abandoned, and transferred reconciliation; exact local/WSL/SSH provider routing; malformed, missing, and unavailable inventory retention; zero process closes; existing lease, archive, recovery, mutation, and renderer-input contracts."
+        },
         {
           "date": "2026-08-03",
           "runner": "local",
@@ -7937,20 +8962,20 @@
         }
       ],
       "runtimeBudget": {
-        "p95Seconds": 8,
-        "scope": "deterministic runtime, SQLite, transcript, renderer-input, and mutation contracts"
+        "p95Seconds": 45,
+        "scope": "deterministic runtime, SQLite, transcript, renderer-input, mutation contracts, and one compiled-CLI Electron journey"
       },
       "flakeHistory": {
         "status": "unknown",
-        "evidence": "First local deterministic run only; focused CI and soak history are not yet available."
+        "evidence": "Repeated local deterministic runs pass; focused CI and soak history are not yet available."
       },
       "redGreenEvidence": {
         "status": "complete",
-        "evidence": "The byte-identical 56-test oracle produced 12 deterministic failures and 44 passes with production restored to exact PR head 4aa66b62e3, including ready reuse during release, unsafe migration, stale archives, mutable transcript output, host/identity close gaps, and mutation replay loss. Candidate 457bc4edd1 passed all 56; restoring the same five production files to 4aa66b62e3 reproduced the same red state."
+        "evidence": "The byte-identical compiled-CLI Electron oracle left the dead resource external/retained on latest main 5ea7df1a5b, passed on combined candidate d697666ce8 with released/released SQLite state and processAction none, and reproduced external/retained after disabling the claimed production files at merge-base 64aec94cb2. The earlier unchanged three-case dead external/user-owned/transferred service oracle likewise failed 3/3 on main, passed 3/3 on candidate, and failed 3/3 with production restored; every run asserted durable state and zero terminal close calls."
       },
       "performanceBudget": {
         "required": true,
-        "evidence": "Release performs constant-count indexed resource and identity queries plus one bounded archive capture. Worker-list uses two set queries rather than one resource lookup per worker. Reconciliation remains serial and adds no polling, timers, subprocesses, renderer subscriptions, or provider-wide listing."
+        "evidence": "Normal owned release performs constant-count indexed resource and identity queries plus one bounded archive capture. A retained release performs exactly one bounded inventory against its authoritative local/WSL or specific SSH provider, with no retry, polling, timer, subprocess, renderer subscription, or per-session follow-up fanout. Worker-list uses two set queries rather than one resource lookup per worker."
       },
       "promotionCriteria": [
         "Collect 100 consecutive focused CI passes or 14 days of soak history.",
@@ -7961,7 +8986,7 @@
       "knownGaps": [
         "Provider close has no durable cross-process operation receipt, so a crash after host mutation but before SQLite settlement remains release_pending until exact inventory returns.",
         "Federated release remains explicitly unsupported and retained.",
-        "Mobile/direct remote input takeover and live Linux, Windows, WSL, SSH, headed, and headless paired-runtime release are not exercised."
+        "Mobile/direct remote input takeover and live Linux, Windows, WSL, SSH, headed, and headless paired-runtime release are not exercised; the current fix changes provider inventory classification and SQLite state only, not ConPTY, filesystem, update, sleep, firewall, or window lifecycle semantics."
       ],
       "demotionRule": "Keep experimental or demote if release can overlap exact reuse, close a conflicting lease, lose immutable output, retain reset archives, fan out per worker, or any focused ordering test flakes without a product or harness defect."
     },
diff --git a/config/scripts/build-notification-status-macos.mjs b/config/scripts/build-notification-status-macos.mjs
index e8150e32b6f..41d4c84a4af 100644
--- a/config/scripts/build-notification-status-macos.mjs
+++ b/config/scripts/build-notification-status-macos.mjs
@@ -79,7 +79,7 @@ try {
 
 function readArg(name) {
   const index = args.indexOf(name)
-  return index >= 0 ? args[index + 1] : undefined
+  return index !== -1 ? args[index + 1] : undefined
 }
 
 function embeddedInfoPlist(identifier) {
diff --git a/config/scripts/build-windows-cli-launcher.mjs b/config/scripts/build-windows-cli-launcher.mjs
index 6f9b86bdb4b..27c17b3d15c 100644
--- a/config/scripts/build-windows-cli-launcher.mjs
+++ b/config/scripts/build-windows-cli-launcher.mjs
@@ -56,5 +56,5 @@ function findFrameworkCompiler(env) {
 
 function readArg(name) {
   const index = process.argv.indexOf(name)
-  return index >= 0 ? process.argv[index + 1] : undefined
+  return index !== -1 ? process.argv[index + 1] : undefined
 }
diff --git a/config/scripts/computer-use-modifier-safety.test.mjs b/config/scripts/computer-use-modifier-safety.test.mjs
index 725f17fdf4c..2a3234d3d9c 100644
--- a/config/scripts/computer-use-modifier-safety.test.mjs
+++ b/config/scripts/computer-use-modifier-safety.test.mjs
@@ -11,7 +11,7 @@ function source(path) {
 function sourceBetween(contents, startMarker, endMarker) {
   const start = contents.indexOf(startMarker)
   const end = contents.indexOf(endMarker, start + startMarker.length)
-  if (start < 0 || end < 0) {
+  if (start === -1 || end === -1) {
     throw new Error(`Missing source boundary: ${startMarker} → ${endMarker}`)
   }
   return contents.slice(start, end)
diff --git a/config/scripts/electron-vite-output-contract.test.ts b/config/scripts/electron-vite-output-contract.test.ts
index f59f4a80f88..818b380fc2f 100644
--- a/config/scripts/electron-vite-output-contract.test.ts
+++ b/config/scripts/electron-vite-output-contract.test.ts
@@ -196,7 +196,8 @@ describe('Electron Vite output contract', () => {
   })
 
   it('rejects prototype properties as build targets', () => {
-    expect(targetConfig).toContain('Object.prototype.hasOwnProperty.call(configByTarget, target)')
+    // Own-property check only: an inherited key like `constructor` must not select a build target.
+    expect(targetConfig).toContain('Object.hasOwn(configByTarget, target)')
   })
 
   it('gives the dev terminal daemon helper the TCC identity watched by Orca', () => {
diff --git a/config/scripts/ensure-native-runtime.mjs b/config/scripts/ensure-native-runtime.mjs
index 98b064cd30d..44261e968a9 100644
--- a/config/scripts/ensure-native-runtime.mjs
+++ b/config/scripts/ensure-native-runtime.mjs
@@ -45,7 +45,7 @@ function readRuntimeArg() {
   }
 
   const runtimeIndex = process.argv.indexOf('--runtime')
-  if (runtimeIndex >= 0) {
+  if (runtimeIndex !== -1) {
     return process.argv[runtimeIndex + 1]
   }
 
diff --git a/config/scripts/generate-skill-bundle-manifest.mjs b/config/scripts/generate-skill-bundle-manifest.mjs
index 899cb6436df..226ea74c4fb 100644
--- a/config/scripts/generate-skill-bundle-manifest.mjs
+++ b/config/scripts/generate-skill-bundle-manifest.mjs
@@ -227,7 +227,7 @@ function readGitBlobs(objectShas) {
   let offset = 0
   for (const requestedSha of uniqueShas) {
     const headerEnd = output.indexOf(10, offset)
-    if (headerEnd < 0) {
+    if (headerEnd === -1) {
       throw new Error(`Missing git cat-file header for ${requestedSha}`)
     }
     const header = output.subarray(offset, headerEnd).toString('utf8')
@@ -648,8 +648,8 @@ async function main() {
   const argv = process.argv.slice(2)
   const rebuildFromTags = argv.includes('--rebuild-from-tags')
   const releaseIndex = argv.indexOf('--release')
-  const releaseVersion = releaseIndex >= 0 ? argv[releaseIndex + 1] : null
-  if (releaseIndex >= 0 && !releaseVersion) {
+  const releaseVersion = releaseIndex !== -1 ? argv[releaseIndex + 1] : null
+  if (releaseIndex !== -1 && !releaseVersion) {
     throw new Error('--release requires a version argument, e.g. --release 1.4.160')
   }
 
diff --git a/config/scripts/idle-cpu-process-sampling.mjs b/config/scripts/idle-cpu-process-sampling.mjs
new file mode 100644
index 00000000000..81f9218e5ad
--- /dev/null
+++ b/config/scripts/idle-cpu-process-sampling.mjs
@@ -0,0 +1,323 @@
+import { execFileSync, spawnSync } from 'node:child_process'
+
+function parseCpuTimeSeconds(value) {
+  const trimmed = String(value || '').trim()
+  if (!trimmed) {
+    return null
+  }
+  const [dayOrTime, maybeTime] = trimmed.includes('-') ? trimmed.split('-', 2) : [null, trimmed]
+  const days = dayOrTime === null ? 0 : Number(dayOrTime)
+  const parts = maybeTime.split(':').map(Number)
+  if (!Number.isFinite(days) || parts.some((part) => !Number.isFinite(part))) {
+    return null
+  }
+  if (parts.length === 3) {
+    return days * 86400 + parts[0] * 3600 + parts[1] * 60 + parts[2]
+  }
+  if (parts.length === 2) {
+    return days * 86400 + parts[0] * 60 + parts[1]
+  }
+  if (parts.length === 1) {
+    return days * 86400 + parts[0]
+  }
+  return null
+}
+
+function parseUnixProcesses(stdout) {
+  const rows = []
+  for (const raw of stdout.split('\n')) {
+    const line = raw.trim()
+    if (!line) {
+      continue
+    }
+    const match = line.match(/^(\d+)\s+(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)\s+(.+)$/)
+    if (!match) {
+      continue
+    }
+    rows.push({
+      pid: Number(match[1]),
+      ppid: Number(match[2]),
+      percentCpu: Number(match[3]),
+      rssBytes: Number(match[4]) * 1024,
+      cpuTimeSeconds: parseCpuTimeSeconds(match[5]),
+      command: match[6]
+    })
+  }
+  return rows
+}
+
+function readUnixProcesses() {
+  const stdout = execFileSync('ps', ['-axo', 'pid=,ppid=,pcpu=,rss=,cputime=,command='], {
+    encoding: 'utf8',
+    env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
+    maxBuffer: 20 * 1024 * 1024
+  })
+  return parseUnixProcesses(stdout)
+}
+
+function readWindowsProcesses() {
+  const script =
+    'Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,WorkingSetSize,CommandLine | ConvertTo-Json -Compress'
+  const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', script], {
+    encoding: 'utf8',
+    maxBuffer: 20 * 1024 * 1024
+  })
+  if (result.status !== 0) {
+    throw new Error(result.stderr || 'PowerShell process enumeration failed')
+  }
+  const parsed = JSON.parse(result.stdout || '[]')
+  const entries = Array.isArray(parsed) ? parsed : [parsed]
+  return entries.map((entry) => ({
+    pid: Number(entry.ProcessId),
+    ppid: Number(entry.ParentProcessId),
+    percentCpu: 0,
+    cpuTimeSeconds: null,
+    rssBytes: Number(entry.WorkingSetSize) || 0,
+    command: String(entry.CommandLine || '')
+  }))
+}
+
+export function readProcessRows() {
+  return process.platform === 'win32' ? readWindowsProcesses() : readUnixProcesses()
+}
+
+export function descendantsOf(rows, rootPid) {
+  const children = new Map()
+  for (const row of rows) {
+    const list = children.get(row.ppid) ?? []
+    list.push(row)
+    children.set(row.ppid, list)
+  }
+  const result = []
+  const stack = [rootPid]
+  const seen = new Set()
+  while (stack.length > 0) {
+    const pid = stack.pop()
+    if (seen.has(pid)) {
+      continue
+    }
+    seen.add(pid)
+    const row = rows.find((candidate) => candidate.pid === pid)
+    if (row) {
+      result.push(row)
+    }
+    for (const child of children.get(pid) ?? []) {
+      stack.push(child.pid)
+    }
+  }
+  return result
+}
+
+export function classify(row, rootPid) {
+  const command = row.command.toLowerCase()
+  if (row.pid === rootPid) {
+    return 'main'
+  }
+  if (command.includes('daemon-entry')) {
+    return 'daemon'
+  }
+  if (command.includes('--type=gpu-process')) {
+    return 'gpu'
+  }
+  if (command.includes('--type=renderer')) {
+    return 'renderer'
+  }
+  if (command.includes('--type=utility')) {
+    return 'utility'
+  }
+  if (command.includes('--type=')) {
+    return 'electron-other'
+  }
+  if (command.includes('node') || command.includes('/pi') || command.endsWith(' pi')) {
+    return 'agent-or-node'
+  }
+  return 'other-descendant'
+}
+
+const DEFAULT_WORKLOAD_OVERRUN_LIMIT_MS = 120_000
+
+export async function sampleProcessTreeUntilWorkloadsComplete({
+  rootPid,
+  requestedDurationMs,
+  intervalMs,
+  workloadPromise,
+  maxWorkloadOverrunMs = DEFAULT_WORKLOAD_OVERRUN_LIMIT_MS,
+  readRows = readProcessRows,
+  now = Date.now,
+  wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+}) {
+  const samplingStartedAt = now()
+  const requestedDeadline = samplingStartedAt + requestedDurationMs
+  const hardDeadline = requestedDeadline + maxWorkloadOverrunMs
+  let workloadSettled = false
+  let workloadResult
+  let workloadError
+  let workloadSettledAt = null
+  void workloadPromise.then(
+    (result) => {
+      workloadResult = result
+      workloadSettled = true
+      workloadSettledAt = now()
+    },
+    (error) => {
+      workloadError = error
+      workloadSettled = true
+      workloadSettledAt = now()
+    }
+  )
+  const samples = []
+  let previousSnapshot = null
+  const needsFinalWorkloadSample = () =>
+    workloadSettledAt !== null && (previousSnapshot?.at ?? -Infinity) < workloadSettledAt
+  while (
+    now() <= requestedDeadline ||
+    samples.length === 0 ||
+    !workloadSettled ||
+    needsFinalWorkloadSample()
+  ) {
+    const sampledAt = now()
+    if (workloadError) {
+      throw workloadError
+    }
+    if (
+      (!workloadSettled && sampledAt >= hardDeadline) ||
+      (workloadSettledAt !== null && workloadSettledAt > hardDeadline)
+    ) {
+      throw new Error(
+        `Benchmark workload exceeded the ${maxWorkloadOverrunMs}ms sampling overrun limit`
+      )
+    }
+    const processRows = descendantsOf(readRows(), rootPid)
+    const rawProcesses = processRows.map((row) => ({ ...row, kind: classify(row, rootPid) }))
+    if (previousSnapshot) {
+      const elapsedSeconds = Math.max(0.001, (sampledAt - previousSnapshot.at) / 1000)
+      const previousByPid = new Map(previousSnapshot.processes.map((proc) => [proc.pid, proc]))
+      const processes = rawProcesses.map((row) => {
+        const previous = previousByPid.get(row.pid)
+        const canComputeDelta =
+          typeof row.cpuTimeSeconds === 'number' && typeof previous?.cpuTimeSeconds === 'number'
+        const cpu = canComputeDelta
+          ? Math.max(0, ((row.cpuTimeSeconds - previous.cpuTimeSeconds) / elapsedSeconds) * 100)
+          : row.percentCpu
+        return { ...row, cpu }
+      })
+      samples.push({
+        at: sampledAt,
+        elapsedMs: sampledAt - previousSnapshot.at,
+        totalCpuPercent: processes.reduce((sum, proc) => sum + proc.cpu, 0),
+        totalRssBytes: processes.reduce((sum, proc) => sum + proc.rssBytes, 0),
+        processes
+      })
+    }
+    previousSnapshot = { at: sampledAt, processes: rawProcesses }
+    await wait(intervalMs)
+  }
+  if (workloadError) {
+    throw workloadError
+  }
+  const measuredDurationMs = Math.max(
+    0,
+    (previousSnapshot?.at ?? samplingStartedAt) - samplingStartedAt
+  )
+  return {
+    samples,
+    workloadResult,
+    samplingWindow: {
+      requestedDurationMs,
+      measuredDurationMs,
+      maxWorkloadOverrunMs,
+      extendedForWorkload: workloadSettledAt !== null && workloadSettledAt > requestedDeadline,
+      workloadSettledElapsedMs:
+        workloadSettledAt === null ? null : Math.max(0, workloadSettledAt - samplingStartedAt),
+      workloadSettledBeforeStop: workloadSettled
+    }
+  }
+}
+
+function mean(values) {
+  return values.length === 0 ? 0 : values.reduce((sum, value) => sum + value, 0) / values.length
+}
+
+function percentile(sorted, fraction) {
+  if (sorted.length === 0) {
+    return 0
+  }
+  const index = Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)
+  return sorted[index]
+}
+
+export function summarizeSamples(samples) {
+  const byKind = new Map()
+  for (const sample of samples) {
+    for (const proc of sample.processes) {
+      const bucket = byKind.get(proc.kind) ?? { cpuValues: [], rssValues: [], maxProcessCount: 0 }
+      bucket.cpuValues.push(proc.cpu)
+      bucket.rssValues.push(proc.rssBytes)
+      byKind.set(proc.kind, bucket)
+    }
+    const counts = new Map()
+    for (const proc of sample.processes) {
+      counts.set(proc.kind, (counts.get(proc.kind) ?? 0) + 1)
+    }
+    for (const [kind, count] of counts) {
+      byKind.get(kind).maxProcessCount = Math.max(byKind.get(kind).maxProcessCount, count)
+    }
+  }
+  const summary = {}
+  for (const [kind, values] of byKind) {
+    const cpuSorted = [...values.cpuValues].sort((a, b) => a - b)
+    const rssSumBySample = samples.map((sample) =>
+      sample.processes
+        .filter((proc) => proc.kind === kind)
+        .reduce((sum, proc) => sum + proc.rssBytes, 0)
+    )
+    summary[kind] = {
+      meanCpuPercent: mean(values.cpuValues),
+      p95CpuPercent: percentile(cpuSorted, 0.95),
+      maxCpuPercent: Math.max(0, ...values.cpuValues),
+      meanRssBytes: mean(rssSumBySample),
+      maxProcessCount: values.maxProcessCount
+    }
+  }
+  summary.total = {
+    meanCpuPercent: mean(samples.map((sample) => sample.totalCpuPercent)),
+    p95CpuPercent: percentile(
+      samples.map((sample) => sample.totalCpuPercent).sort((a, b) => a - b),
+      0.95
+    ),
+    meanRssBytes: mean(samples.map((sample) => sample.totalRssBytes))
+  }
+  return summary
+}
+
+export function summarizeProcessInventory(samples) {
+  const inventory = {}
+  for (const sample of samples) {
+    const counts = new Map()
+    for (const proc of sample.processes) {
+      counts.set(proc.kind, (counts.get(proc.kind) ?? 0) + 1)
+      const entry = inventory[proc.kind] ?? {
+        maxProcessCount: 0,
+        maxCpuPercent: 0,
+        commandSamples: []
+      }
+      entry.maxCpuPercent = Math.max(entry.maxCpuPercent, proc.cpu)
+      if (!entry.commandSamples.includes(proc.command) && entry.commandSamples.length < 6) {
+        entry.commandSamples.push(proc.command)
+      }
+      inventory[proc.kind] = entry
+    }
+    for (const [kind, count] of counts) {
+      inventory[kind].maxProcessCount = Math.max(inventory[kind].maxProcessCount, count)
+    }
+  }
+  return inventory
+}
+
+export function terminateProcesses(processes) {
+  for (const proc of processes) {
+    try {
+      process.kill(proc.pid)
+    } catch {}
+  }
+}
diff --git a/config/scripts/idle-cpu-process-sampling.test.mjs b/config/scripts/idle-cpu-process-sampling.test.mjs
new file mode 100644
index 00000000000..d452c6e3ce0
--- /dev/null
+++ b/config/scripts/idle-cpu-process-sampling.test.mjs
@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest'
+import { sampleProcessTreeUntilWorkloadsComplete } from './idle-cpu-process-sampling.mjs'
+
+function createClock(workloadCompletesAt) {
+  let currentMs = 0
+  let resolveWorkload
+  const workloadPromise = new Promise((resolve) => {
+    resolveWorkload = resolve
+  })
+  const wait = async (durationMs) => {
+    currentMs += durationMs
+    if (currentMs >= workloadCompletesAt) {
+      resolveWorkload('complete')
+    }
+    await Promise.resolve()
+  }
+  const readRows = () => [
+    {
+      pid: 10,
+      ppid: 0,
+      percentCpu: 0,
+      rssBytes: 1_024,
+      cpuTimeSeconds: currentMs / 2_000,
+      command: 'electron'
+    }
+  ]
+  return { now: () => currentMs, readRows, wait, workloadPromise }
+}
+
+describe('idle CPU process sampling window', () => {
+  it('extends through a slow workload and captures a final CPU delta', async () => {
+    const clock = createClock(40)
+    const result = await sampleProcessTreeUntilWorkloadsComplete({
+      rootPid: 10,
+      requestedDurationMs: 20,
+      intervalMs: 10,
+      maxWorkloadOverrunMs: 100,
+      ...clock
+    })
+
+    expect(result.workloadResult).toBe('complete')
+    expect(result.samples.map((sample) => sample.at)).toEqual([10, 20, 30, 40])
+    expect(result.samplingWindow).toEqual({
+      requestedDurationMs: 20,
+      measuredDurationMs: 40,
+      maxWorkloadOverrunMs: 100,
+      extendedForWorkload: true,
+      workloadSettledElapsedMs: 40,
+      workloadSettledBeforeStop: true
+    })
+  })
+
+  it('invalidates a run that reaches the workload overrun guard', async () => {
+    const clock = createClock(Infinity)
+    await expect(
+      sampleProcessTreeUntilWorkloadsComplete({
+        rootPid: 10,
+        requestedDurationMs: 20,
+        intervalMs: 10,
+        maxWorkloadOverrunMs: 20,
+        ...clock
+      })
+    ).rejects.toThrow('exceeded the 20ms sampling overrun limit')
+  })
+})
diff --git a/config/scripts/idle-cpu-renderer-scale-fixture.mjs b/config/scripts/idle-cpu-renderer-scale-fixture.mjs
new file mode 100644
index 00000000000..4759b768e27
--- /dev/null
+++ b/config/scripts/idle-cpu-renderer-scale-fixture.mjs
@@ -0,0 +1,202 @@
+export async function configureRendererScaleFixture(page, options, repoPath) {
+  return page.evaluate(
+    ({ agentsPerWorktree, lineageDepth, repoPath }) => {
+      const store = window.__store
+      if (!store) {
+        throw new Error('window.__store is not available')
+      }
+      const normalizePath = (value) =>
+        String(value ?? '')
+          .replaceAll('\\', '/')
+          .toLowerCase()
+      const primaryPath = normalizePath(repoPath)
+      const compare = (left, right) => (left < right ? -1 : left > right ? 1 : 0)
+      const state = store.getState()
+      const worktrees = Object.values(state.worktreesByRepo)
+        .flat()
+        .filter((worktree) => !worktree.isArchived)
+        .sort((left, right) => {
+          const primaryOrder =
+            Number(normalizePath(right.path) === primaryPath) -
+            Number(normalizePath(left.path) === primaryPath)
+          return (
+            primaryOrder ||
+            compare(normalizePath(left.path), normalizePath(right.path)) ||
+            compare(left.id, right.id)
+          )
+        })
+      const appliedLineageDepth = Math.min(lineageDepth, Math.max(0, worktrees.length - 1))
+      if (lineageDepth === 0 && agentsPerWorktree === 0) {
+        return {
+          applied: false,
+          requestedLineageDepth: lineageDepth,
+          appliedLineageDepth,
+          agentsPerWorktree,
+          seededAgentRows: 0
+        }
+      }
+
+      state.setActiveView('terminal')
+      state.setSidebarOpen(true)
+      state.setGroupBy('none')
+      state.setSortBy('recent')
+      state.setShowActiveOnly(false)
+      state.setShowSleepingWorkspaces(true)
+      state.setHideDefaultBranchWorkspace(false)
+      state.setFilterRepoIds([])
+
+      const lineageById = { ...store.getState().worktreeLineageById }
+      const lineageParentIds = new Set()
+      if (appliedLineageDepth > 0) {
+        for (const worktree of worktrees) {
+          delete lineageById[worktree.id]
+          if (!worktree.instanceId) {
+            throw new Error(`Worktree ${worktree.id} has no instanceId for lineage seeding`)
+          }
+        }
+        for (let index = 1; index < worktrees.length; index += 1) {
+          const child = worktrees[index]
+          const parent = worktrees[Math.min(index - 1, appliedLineageDepth - 1)]
+          lineageParentIds.add(parent.id)
+          lineageById[child.id] = {
+            worktreeId: child.id,
+            worktreeInstanceId: child.instanceId,
+            parentWorktreeId: parent.id,
+            parentWorktreeInstanceId: parent.instanceId,
+            origin: 'manual',
+            capture: { source: 'manual-action', confidence: 'explicit' },
+            createdAt: 1_700_000_000_000 + index
+          }
+        }
+      }
+      const collapsedGroups = new Set(store.getState().collapsedGroups)
+      for (const parentId of lineageParentIds) {
+        collapsedGroups.delete(`lineage:${parentId}`)
+      }
+      store.setState({ worktreeLineageById: lineageById, collapsedGroups })
+
+      let seededAgentRows = 0
+      if (agentsPerWorktree > 0) {
+        store.getState().setWorktreeCardMode('Default')
+        store.getState().setAgentActivityDisplayMode('full')
+        const fixtureNow = Date.now()
+        worktrees.forEach((worktree, worktreeIndex) => {
+          const next = store.getState()
+          const tab =
+            next.tabsByWorktree[worktree.id]?.[0] ??
+            next.createTab(worktree.id, undefined, undefined, {
+              activate: false,
+              id: `idle-cpu-tab-${worktreeIndex}`
+            })
+          for (let agentIndex = 0; agentIndex < agentsPerWorktree; agentIndex += 1) {
+            const agentType = agentIndex % 2 === 0 ? 'codex' : 'claude'
+            const leafSequence =
+              BigInt(worktreeIndex) * BigInt(agentsPerWorktree) + BigInt(agentIndex + 1)
+            const leafId = `00000000-0000-4000-8000-${leafSequence.toString(16).padStart(12, '0')}`
+            store.getState().setAgentStatus(
+              `${tab.id}:${leafId}`,
+              {
+                state: 'working',
+                prompt: `Idle CPU agent ${worktreeIndex + 1}.${agentIndex + 1}`,
+                agentType
+              },
+              agentType,
+              { updatedAt: fixtureNow, stateStartedAt: fixtureNow },
+              { tabId: tab.id, worktreeId: worktree.id }
+            )
+            seededAgentRows += 1
+          }
+        })
+      }
+      return {
+        applied: true,
+        requestedLineageDepth: lineageDepth,
+        appliedLineageDepth,
+        lineageEdges: appliedLineageDepth > 0 ? Math.max(0, worktrees.length - 1) : 0,
+        expandedLineageGroups: lineageParentIds.size,
+        agentsPerWorktree,
+        seededAgentRows,
+        orderedWorktreeIds: worktrees.map((worktree) => worktree.id)
+      }
+    },
+    { agentsPerWorktree: options.agentsPerWorktree, lineageDepth: options.lineageDepth, repoPath }
+  )
+}
+
+export async function collectRendererCensus(page, configuredLineageDepth) {
+  return page.evaluate((configuredDepth) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('window.__store is not available')
+    }
+    const worktrees = Object.values(state.worktreesByRepo).flat()
+    const worktreeIds = new Set(worktrees.map((worktree) => worktree.id))
+    const lineageDepthById = new Map()
+    const getDepth = (worktreeId, trail = new Set()) => {
+      if (lineageDepthById.has(worktreeId)) {
+        return lineageDepthById.get(worktreeId)
+      }
+      const lineage = state.worktreeLineageById[worktreeId]
+      if (!lineage || !worktreeIds.has(lineage.parentWorktreeId) || trail.has(worktreeId)) {
+        return 0
+      }
+      const nextTrail = new Set(trail)
+      nextTrail.add(worktreeId)
+      const depth = 1 + getDepth(lineage.parentWorktreeId, nextTrail)
+      lineageDepthById.set(worktreeId, depth)
+      return depth
+    }
+    const logicalDepths = worktrees.map((worktree) => getDepth(worktree.id))
+    const lineageParentIds = new Set(
+      Object.values(state.worktreeLineageById)
+        .filter((lineage) => worktreeIds.has(lineage.worktreeId))
+        .map((lineage) => lineage.parentWorktreeId)
+    )
+    const sidebar = document.querySelector('[data-worktree-sidebar]')
+    const mountedWorktreeIds = [
+      ...new Set(
+        [...(sidebar?.querySelectorAll('[data-worktree-id]') ?? [])]
+          .map((element) => element.getAttribute('data-worktree-id'))
+          .filter(Boolean)
+      )
+    ]
+    const mountedAgentRows = [...(sidebar?.querySelectorAll('*') ?? [])].filter(
+      (element) =>
+        element.classList.contains('group/agent-row') ||
+        element.classList.contains('compact-agent-row')
+    ).length
+    let diagnosticCensus = null
+    try {
+      diagnosticCensus = window.__orcaTypingDiagnostic?.report().census ?? null
+    } catch {}
+    const collapsedLineageGroups = [...lineageParentIds].filter((parentId) =>
+      state.collapsedGroups.has(`lineage:${parentId}`)
+    ).length
+    return {
+      capturedAt: new Date().toISOString(),
+      worktrees: {
+        store: worktrees.length,
+        mountedCards: sidebar?.querySelectorAll('[data-worktree-card-surface]').length ?? 0,
+        mountedUnique: mountedWorktreeIds.length,
+        mountedIds: mountedWorktreeIds.slice(0, 100),
+        mountedIdsTruncated: Math.max(0, mountedWorktreeIds.length - 100)
+      },
+      agentRows: {
+        storeLive: Object.keys(state.agentStatusByPaneKey ?? {}).length,
+        storeRetained: Object.keys(state.retainedAgentsByPaneKey ?? {}).length,
+        mounted: mountedAgentRows,
+        diagnosticMounted: diagnosticCensus?.agentRows.mountedDom ?? null
+      },
+      storeListeners: diagnosticCensus?.storeListeners ?? null,
+      lineage: {
+        configuredDepth,
+        measuredMaxDepth: Math.max(0, ...logicalDepths),
+        edges: logicalDepths.filter((depth) => depth > 0).length,
+        groups: lineageParentIds.size,
+        expandedGroups: lineageParentIds.size - collapsedLineageGroups,
+        collapsedGroups: collapsedLineageGroups
+      },
+      diagnostic: diagnosticCensus
+    }
+  }, configuredLineageDepth)
+}
diff --git a/config/scripts/idle-cpu-renderer-timing-probe.mjs b/config/scripts/idle-cpu-renderer-timing-probe.mjs
new file mode 100644
index 00000000000..b010bcb3433
--- /dev/null
+++ b/config/scripts/idle-cpu-renderer-timing-probe.mjs
@@ -0,0 +1,191 @@
+const RENDERER_TIMER_INTERVAL_MS = 100
+
+export async function startRendererTimingProbe(page) {
+  await page.evaluate((timerIntervalMs) => {
+    const maxSamples = 5_000
+    const maxEntries = 80
+    let phaseStartedAt = performance.now()
+    let phaseStartedAtIso = new Date().toISOString()
+    let timerId = null
+    let driftCount = 0
+    let driftSamples = []
+    let longTaskEntries = []
+    let observer = null
+    let longTaskSupported = false
+
+    const round = (value) => Math.round(value * 100) / 100
+    const summarize = (values, totalCount = values.length) => {
+      const sorted = [...values].sort((left, right) => left - right)
+      const percentile = (fraction) =>
+        sorted.length === 0
+          ? null
+          : sorted[Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)]
+      return {
+        count: totalCount,
+        retainedCount: sorted.length,
+        mean:
+          sorted.length === 0
+            ? null
+            : round(sorted.reduce((sum, value) => sum + value, 0) / sorted.length),
+        p50: sorted.length === 0 ? null : round(percentile(0.5)),
+        p95: sorted.length === 0 ? null : round(percentile(0.95)),
+        max: sorted.length === 0 ? null : round(sorted.at(-1))
+      }
+    }
+    const recordLongTasks = (entries) => {
+      for (const entry of entries) {
+        longTaskEntries.push({
+          startTime: entry.startTime,
+          duration: entry.duration,
+          name: entry.name
+        })
+        if (longTaskEntries.length > maxSamples) {
+          longTaskEntries.shift()
+        }
+      }
+    }
+    try {
+      longTaskSupported = PerformanceObserver.supportedEntryTypes?.includes('longtask') === true
+      if (longTaskSupported) {
+        observer = new PerformanceObserver((list) => recordLongTasks(list.getEntries()))
+        observer.observe({ type: 'longtask', buffered: true })
+      }
+    } catch {
+      observer = null
+      longTaskSupported = false
+    }
+    const scheduleTimer = () => {
+      const expectedAt = performance.now() + timerIntervalMs
+      timerId = setTimeout(() => {
+        driftCount += 1
+        driftSamples.push(Math.max(0, performance.now() - expectedAt))
+        if (driftSamples.length > maxSamples) {
+          driftSamples.shift()
+        }
+        scheduleTimer()
+      }, timerIntervalMs)
+    }
+    const snapshot = (reset) => {
+      if (observer) {
+        recordLongTasks(observer.takeRecords())
+      }
+      const capturedAt = performance.now()
+      const phaseLongTasks = longTaskEntries.filter((entry) => entry.startTime >= phaseStartedAt)
+      const durations = phaseLongTasks.map((entry) => entry.duration)
+      const result = {
+        startedAt: phaseStartedAtIso,
+        capturedAt: new Date().toISOString(),
+        durationMs: round(capturedAt - phaseStartedAt),
+        timerIntervalMs,
+        timerDriftMs: summarize(driftSamples, driftCount),
+        longTasks: {
+          supported: longTaskSupported,
+          ...summarize(durations),
+          totalDurationMs: round(durations.reduce((sum, value) => sum + value, 0)),
+          entries: phaseLongTasks.slice(-maxEntries).map((entry) => ({
+            startMs: round(entry.startTime - phaseStartedAt),
+            durationMs: round(entry.duration),
+            name: entry.name
+          })),
+          entriesTruncated: Math.max(0, phaseLongTasks.length - maxEntries)
+        }
+      }
+      if (reset) {
+        phaseStartedAt = capturedAt
+        phaseStartedAtIso = new Date().toISOString()
+        driftCount = 0
+        driftSamples = []
+        longTaskEntries = []
+      }
+      return result
+    }
+    scheduleTimer()
+    window.__orcaIdleCpuTimingProbe = {
+      snapshot: () => snapshot(true),
+      stop: () => {
+        if (timerId !== null) {
+          clearTimeout(timerId)
+        }
+        const result = snapshot(false)
+        observer?.disconnect()
+        return result
+      }
+    }
+  }, RENDERER_TIMER_INTERVAL_MS)
+}
+
+export async function snapshotRendererTimingProbe(page) {
+  return page.evaluate(() => window.__orcaIdleCpuTimingProbe?.snapshot() ?? null)
+}
+
+export async function stopRendererTimingProbe(page) {
+  return page.evaluate(() => window.__orcaIdleCpuTimingProbe?.stop() ?? null)
+}
+
+export async function runZustandPublications(page, count, intervalMs) {
+  return page.evaluate(
+    ({ count, intervalMs }) =>
+      new Promise((resolve, reject) => {
+        const store = window.__store
+        if (!store) {
+          reject(new Error('window.__store is not available'))
+          return
+        }
+        const maxSamples = 5_000
+        const startedAt = performance.now()
+        const startedAtIso = new Date().toISOString()
+        const schedulingDriftMs = []
+        let completed = 0
+        const finish = () => {
+          const sorted = [...schedulingDriftMs].sort((left, right) => left - right)
+          const percentile = (fraction) =>
+            sorted.length === 0
+              ? null
+              : sorted[Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)]
+          const round = (value) => Math.round(value * 100) / 100
+          resolve({
+            requested: count,
+            completed,
+            intervalMs,
+            startedAt: startedAtIso,
+            completedAt: new Date().toISOString(),
+            durationMs: round(performance.now() - startedAt),
+            schedulingDriftMs: {
+              retainedCount: sorted.length,
+              p50: sorted.length === 0 ? null : round(percentile(0.5)),
+              p95: sorted.length === 0 ? null : round(percentile(0.95)),
+              max: sorted.length === 0 ? null : round(sorted.at(-1))
+            }
+          })
+        }
+        const publish = () => {
+          const publishedAt = performance.now()
+          const scheduledAt = startedAt + completed * intervalMs
+          schedulingDriftMs.push(Math.max(0, publishedAt - scheduledAt))
+          if (schedulingDriftMs.length > maxSamples) {
+            schedulingDriftMs.shift()
+          }
+          try {
+            // Why: an empty partial notifies every subscriber without changing domain state.
+            store.setState({})
+          } catch (error) {
+            reject(error)
+            return
+          }
+          completed += 1
+          if (completed >= count) {
+            finish()
+            return
+          }
+          const nextAt = startedAt + completed * intervalMs
+          setTimeout(publish, Math.max(0, nextAt - performance.now()))
+        }
+        if (count === 0) {
+          finish()
+        } else {
+          setTimeout(publish, 0)
+        }
+      }),
+    { count, intervalMs }
+  )
+}
diff --git a/config/scripts/install-electron-package-binary.mjs b/config/scripts/install-electron-package-binary.mjs
index f75d1eae30a..314cd31710f 100644
--- a/config/scripts/install-electron-package-binary.mjs
+++ b/config/scripts/install-electron-package-binary.mjs
@@ -28,6 +28,8 @@ const transientDownloadErrorCodes = new Set([
   'EAI_AGAIN',
   'ECONNREFUSED',
   'ECONNRESET',
+  // GitHub release CDN can refuse HTTP/2 streams under load; retry like socket resets.
+  'ERR_HTTP2_STREAM_ERROR',
   'ENETDOWN',
   'ENETRESET',
   'ENETUNREACH',
@@ -185,7 +187,9 @@ async function downloadElectronArtifactWithRetry(downloadOptions) {
 function getDownloadRetryDelays() {
   const configured = process.env.ORCA_ELECTRON_PACKAGE_RETRY_DELAYS_MS
   if (!configured) {
-    return [1_000, 3_000]
+    // Why: GitHub release CDN returns intermittent 503 / HTTP2 stream refusals
+    // under CI fan-out; a few short attempts still exhaust during outages.
+    return [1_000, 3_000, 5_000, 10_000]
   }
 
   const delays = configured.split(',').map(Number)
@@ -200,7 +204,7 @@ function isTransientDownloadError(error) {
     if (transientDownloadErrorCodes.has(candidate?.code)) {
       return true
     }
-    const statusCode = candidate?.statusCode ?? candidate?.response?.statusCode
+    const statusCode = getDownloadErrorStatusCode(candidate)
     if (
       statusCode === 408 ||
       statusCode === 425 ||
@@ -213,6 +217,13 @@ function isTransientDownloadError(error) {
   return false
 }
 
+function getDownloadErrorStatusCode(error) {
+  // @electron/get FetchDownloader uses Fetch Response.status; older got uses statusCode.
+  return (
+    error?.statusCode ?? error?.status ?? error?.response?.statusCode ?? error?.response?.status
+  )
+}
+
 function getErrorChain(error) {
   const errors = []
   let candidate = error
@@ -225,7 +236,7 @@ function getErrorChain(error) {
 
 function formatDownloadError(error) {
   for (const candidate of getErrorChain(error)) {
-    const statusCode = candidate?.statusCode ?? candidate?.response?.statusCode
+    const statusCode = getDownloadErrorStatusCode(candidate)
     if (statusCode) {
       return `HTTP ${statusCode}`
     }
diff --git a/config/scripts/install-electron-package-binary.test.mjs b/config/scripts/install-electron-package-binary.test.mjs
index 2c37f95cfbe..ad04336e8e7 100644
--- a/config/scripts/install-electron-package-binary.test.mjs
+++ b/config/scripts/install-electron-package-binary.test.mjs
@@ -118,6 +118,58 @@ describe('install-electron-package-binary', () => {
     }
   })
 
+  it('retries HTTP/2 stream refusal Electron download failures', () => {
+    const projectDir = mkTempProject()
+
+    try {
+      writeFakeElectronPackage(projectDir)
+      writeFakeElectronGet(projectDir, {
+        downloadFailures: 1,
+        downloadErrorCode: 'ERR_HTTP2_STREAM_ERROR'
+      })
+      writeFakeExtractor(projectDir, { createExecutable: true })
+
+      const result = runInstallScript(projectDir, {
+        ORCA_ELECTRON_PACKAGE_RETRY_DELAYS_MS: '0,0'
+      })
+
+      expect(result.status, result.stderr).toBe(0)
+      expect(
+        readFileSync(join(projectDir, 'electron-get.log'), 'utf8').trim().split('\n')
+      ).toHaveLength(2)
+      expect(result.stderr).toContain(
+        'Transient Electron download failure (ERR_HTTP2_STREAM_ERROR)'
+      )
+    } finally {
+      rmSync(projectDir, { recursive: true, force: true })
+    }
+  })
+
+  it('retries Electron download HTTP 503 failures from Fetch Response.status', () => {
+    const projectDir = mkTempProject()
+
+    try {
+      writeFakeElectronPackage(projectDir)
+      writeFakeElectronGet(projectDir, {
+        downloadFailures: 1,
+        downloadHttpStatus: 503
+      })
+      writeFakeExtractor(projectDir, { createExecutable: true })
+
+      const result = runInstallScript(projectDir, {
+        ORCA_ELECTRON_PACKAGE_RETRY_DELAYS_MS: '0,0'
+      })
+
+      expect(result.status, result.stderr).toBe(0)
+      expect(
+        readFileSync(join(projectDir, 'electron-get.log'), 'utf8').trim().split('\n')
+      ).toHaveLength(2)
+      expect(result.stderr).toContain('Transient Electron download failure (HTTP 503)')
+    } finally {
+      rmSync(projectDir, { recursive: true, force: true })
+    }
+  })
+
   it('fails after exhausting transient Electron download retries', () => {
     const projectDir = mkTempProject()
 
@@ -279,7 +331,12 @@ module.exports = path.join(__dirname, 'dist', fs.readFileSync(pathFile, 'utf8'))
 
 function writeFakeElectronGet(
   projectDir,
-  { downloadNeverSettles = false, downloadFailures = 0, downloadErrorCode = 'ECONNRESET' } = {}
+  {
+    downloadNeverSettles = false,
+    downloadFailures = 0,
+    downloadErrorCode = 'ECONNRESET',
+    downloadHttpStatus = null
+  } = {}
 ) {
   const getDir = join(projectDir, 'node_modules', 'electron', 'node_modules', '@electron', 'get')
   mkdirSync(getDir, { recursive: true })
@@ -299,6 +356,11 @@ exports.downloadArtifact = async function downloadArtifact(details) {
     return new Promise(() => {})
   }
   if (downloadAttempt <= ${JSON.stringify(downloadFailures)}) {
+    if (${JSON.stringify(downloadHttpStatus)} != null) {
+      const error = new Error('Response code ' + ${JSON.stringify(downloadHttpStatus)})
+      error.response = { status: ${JSON.stringify(downloadHttpStatus)} }
+      throw error
+    }
     const cause = Object.assign(new Error('download failed'), {
       code: ${JSON.stringify(downloadErrorCode)}
     })
diff --git a/config/scripts/legacy-worker-recovery-persistence-benchmark.mjs b/config/scripts/legacy-worker-recovery-persistence-benchmark.mjs
index 5f4160600cc..76555d4e78e 100644
--- a/config/scripts/legacy-worker-recovery-persistence-benchmark.mjs
+++ b/config/scripts/legacy-worker-recovery-persistence-benchmark.mjs
@@ -30,8 +30,8 @@ const recoveryEnd = runtimeSource.indexOf(
 )
 const recoverySource = runtimeSource.slice(recoveryStart, recoveryEnd)
 if (
-  recoveryStart < 0 ||
-  recoveryEnd < 0 ||
+  recoveryStart === -1 ||
+  recoveryEnd === -1 ||
   !recoverySource.includes('await this.flushWorkspaceSessionOrThrowAsync()') ||
   recoverySource.includes('flushOrThrow()')
 ) {
diff --git a/config/scripts/locale-ko-key-overrides.json b/config/scripts/locale-ko-key-overrides.json
index bd0c3c15aee..aacf053926e 100644
--- a/config/scripts/locale-ko-key-overrides.json
+++ b/config/scripts/locale-ko-key-overrides.json
@@ -2273,12 +2273,6 @@
   "auto.components.settings.GitPane.976afc6b3e": {
     "ko": "워크스페이스를 만들면 Orca가 원격 기준 브랜치를 새로고침하고, 일치하는 로컬 브랜치를 안전하게 fast-forward합니다. 예:"
   },
-  "auto.components.settings.GitPane.b5f534717a": {
-    "ko": "공동 작성"
-  },
-  "auto.components.settings.GitPane.b9b5771bb1": {
-    "ko": "표기"
-  },
   "auto.components.settings.GitPane.b9c011fbc2": {
     "ko": "속도 제한"
   },
@@ -2288,9 +2282,6 @@
   "auto.components.settings.GitPane.db3a127eb1": {
     "ko": "이렇게 하면 다음과 같은 명령이 유지됩니다"
   },
-  "auto.components.settings.GitPane.e02ea23a32": {
-    "ko": "Orca 표기"
-  },
   "auto.components.settings.GitPane.f35007e6e8": {
     "ko": "git-username"
   },
diff --git a/config/scripts/locale-ko-value-overrides.mjs b/config/scripts/locale-ko-value-overrides.mjs
index 19db7c753ec..5dac8b29a0d 100644
--- a/config/scripts/locale-ko-value-overrides.mjs
+++ b/config/scripts/locale-ko-value-overrides.mjs
@@ -44,7 +44,6 @@ export const KO_VALUE_OVERRIDES = {
   'Issue #{{value0}}': '이슈 #{{value0}}',
   'Linked issue #{{value0}}': '연결된 이슈 #{{value0}}',
   'Issue # or GitHub URL': '이슈 # 또는 GitHub URL',
-  'Add Orca attribution to commits, PRs, and issues.': '커밋, PR 및 이슈에 Orca 속성을 추가합니다.',
   'Paste an issue URL, or enter a number. Leave blank to remove the link.':
     '이슈 URL을 붙여넣거나 숫자를 입력하세요. 링크를 제거하려면 비워두세요.',
   'Connect Linear in Settings to search issues.': '이슈를 검색하려면 설정에서 Linear를 연결하세요.',
@@ -157,8 +156,7 @@ export const KO_VALUE_OVERRIDES = {
     '저장되지 않은 Git AI Author 변경사항이 있습니다. 떠나면 폐기됩니다.',
   'Discard unsaved Git AI Author changes?':
     '저장되지 않은 Git AI Author 변경사항을 삭제하시겠습니까?',
-  'Branch naming, base refs, attribution, and Git AI Author.':
-    '브랜치 이름 지정, 기본 참조, 속성 및 Git AI Author.',
+  'Branch naming, base refs, and Git AI Author.': '브랜치 이름 지정, 기본 참조 및 Git AI Author.',
   'Used by repositories that inherit global hosted-review defaults.':
     '전역 호스팅 PR 기본값을 상속하는 저장소에서 사용됩니다.',
   'Defaults used when the hosted-review composer opens.':
diff --git a/config/scripts/locale-search-keyword-overrides.mjs b/config/scripts/locale-search-keyword-overrides.mjs
index 2a9d6266f5d..352199c1f7e 100644
--- a/config/scripts/locale-search-keyword-overrides.mjs
+++ b/config/scripts/locale-search-keyword-overrides.mjs
@@ -164,7 +164,6 @@ export const SEARCH_KEYWORD_OVERRIDES = {
     gitlab: 'GitLab',
     gitea: 'Gitea',
     oauth: 'OAuth',
-    attribution: '归因',
     skill: '技能',
     skills: '技能',
     phone: '手机',
diff --git a/config/scripts/locale-translation-policy.es-pr.test.mjs b/config/scripts/locale-translation-policy.es-pr.test.mjs
index a3c046ce895..389f914c86b 100644
--- a/config/scripts/locale-translation-policy.es-pr.test.mjs
+++ b/config/scripts/locale-translation-policy.es-pr.test.mjs
@@ -25,10 +25,10 @@ describe('locale-translation-policy es PR glossary', () => {
   it('rewrites PR inside longer sentences', () => {
     expect(
       repairEs(
-        'Add Orca attribution to commits, PRs, and issues.',
-        'Agregue la atribución de Orca a commits, relaciones públicas y problemas.'
+        'Split a large change into smaller PRs',
+        'Dividir un cambio grande en relaciones públicas más pequeños'
       )
-    ).toBe('Agregue la atribución de Orca a commits, PR y problemas.')
+    ).toBe('Dividir un cambio grande en PR más pequeños')
     expect(
       repairEs(
         'Open the PR details to view current reviewers.',
diff --git a/config/scripts/locale-translation-policy.zh-round5.test.mjs b/config/scripts/locale-translation-policy.zh-round5.test.mjs
index 28901fba8d4..622b3c5c31c 100644
--- a/config/scripts/locale-translation-policy.zh-round5.test.mjs
+++ b/config/scripts/locale-translation-policy.zh-round5.test.mjs
@@ -44,22 +44,14 @@ describe('locale-translation-policy zh round 5', () => {
         locale: 'zh'
       })
     ).toBe('显示 Orca Mobile 按钮')
-    expect(
-      repairTranslatedValue({
-        key: 'auto.components.settings.GitPane.e02ea23a32',
-        enValue: 'Orca Attribution',
-        localeValue: 'Orca归属',
-        locale: 'zh'
-      })
-    ).toBe('Orca 归因')
     expect(
       repairTranslatedValue({
         key: 'auto.hooks.useSettingsNavigationMetadata.ab4b21b58e',
-        enValue: 'Branch naming, base refs, attribution, and Git AI Author.',
-        localeValue: '分支命名、基本引用、归属和 Git AI 作者。',
+        enValue: 'Branch naming, base refs, and Git AI Author.',
+        localeValue: '分支命名、基本引用和 Git AI 作者。',
         locale: 'zh'
       })
-    ).toBe('分支命名、基础引用、归因和 Git AI Author。')
+    ).toBe('分支命名、基础引用和 Git AI Author。')
     expect(
       repairTranslatedValue({
         key: 'auto.components.workspace.cleanup.WorkspaceCleanupDialog.1b18868569',
diff --git a/config/scripts/locale-zh-phrase-fixes-round5.mjs b/config/scripts/locale-zh-phrase-fixes-round5.mjs
index 1aa117395e8..23fcc6d32a5 100644
--- a/config/scripts/locale-zh-phrase-fixes-round5.mjs
+++ b/config/scripts/locale-zh-phrase-fixes-round5.mjs
@@ -3,7 +3,6 @@ export const ZH_PHRASE_FIXES_ROUND5 = [
   { pattern: /Orca集成开发环境/g, replacement: 'Orca IDE', whenEnIncludes: 'Orca IDE' },
   { pattern: /Orca第一/g, replacement: 'Orca 优先', whenEnIncludes: 'Orca first' },
   { pattern: /Orca移动/g, replacement: 'Orca Mobile', whenEnIncludes: 'Orca Mobile' },
-  { pattern: /Orca归属/g, replacement: 'Orca 归因', whenEnIncludes: 'Orca Attribution' },
   { pattern: /Orca标志/g, replacement: 'Orca 标志', whenEnIncludes: 'Orca logo' },
   { pattern: /喜欢Orca/g, replacement: '喜欢 Orca', whenEnIncludes: 'Enjoying Orca' },
   { pattern: /认识Orca/g, replacement: '了解 Orca', whenEnIncludes: 'Get to know Orca' },
diff --git a/config/scripts/locale-zh-value-overrides.mjs b/config/scripts/locale-zh-value-overrides.mjs
index 087091a3f3e..b53fb1d2248 100644
--- a/config/scripts/locale-zh-value-overrides.mjs
+++ b/config/scripts/locale-zh-value-overrides.mjs
@@ -144,7 +144,6 @@ export const ZH_VALUE_OVERRIDES = {
   'Expand Orca': '展开 Orca',
   'Support Orca': '支持 Orca',
   'Restarting Orca…': '正在重启 Orca…',
-  'Orca Attribution': 'Orca 归因',
   'Show Orca Mobile Button': '显示 Orca Mobile 按钮',
   'Codex Accounts': 'Codex 账户',
   'Codex Account': 'Codex 账户',
@@ -186,8 +185,7 @@ export const ZH_VALUE_OVERRIDES = {
   "Give agents direct access to Orca's browser so they can test pages, capture screenshots, and act on what they see.":
     '让代理直接访问 Orca 的浏览器，以便测试页面、捕获屏幕截图并根据所见内容执行操作。',
   'X finishes, send it the review task.”': 'X 完成后，把评审任务发给它。”',
-  'Branch naming, base refs, attribution, and Git AI Author.':
-    '分支命名、基础引用、归因和 Git AI Author。',
+  'Branch naming, base refs, and Git AI Author.': '分支命名、基础引用和 Git AI Author。',
   'You have unsaved Git AI Author changes. Leaving will discard them.':
     '您有未保存的 Git AI Author 更改。离开将丢弃它们。',
   'Discard unsaved Git AI Author changes?': '放弃未保存的 Git AI Author 更改？',
diff --git a/config/scripts/macos-computer-helper-owner-loss-benchmark.mjs b/config/scripts/macos-computer-helper-owner-loss-benchmark.mjs
index 8724cf8faf4..b6f1d9571a5 100644
--- a/config/scripts/macos-computer-helper-owner-loss-benchmark.mjs
+++ b/config/scripts/macos-computer-helper-owner-loss-benchmark.mjs
@@ -210,7 +210,7 @@ function connectInvalidPeer(socketPath) {
     const onData = (chunk) => {
       buffer += chunk
       const newline = buffer.indexOf('\n')
-      if (newline < 0) {
+      if (newline === -1) {
         return
       }
       let response
diff --git a/config/scripts/mjpeg-frame-parser-alloc-benchmark.mjs b/config/scripts/mjpeg-frame-parser-alloc-benchmark.mjs
index 86791745c10..5e350bb24f8 100644
--- a/config/scripts/mjpeg-frame-parser-alloc-benchmark.mjs
+++ b/config/scripts/mjpeg-frame-parser-alloc-benchmark.mjs
@@ -54,7 +54,7 @@ function extractOld(pending, chunk, maxPendingBytes = 2 * 1024 * 1024) {
   const frames = []
   while (cursor.length > 0) {
     const frameStart = cursor.indexOf(JPEG_START)
-    if (frameStart < 0) {
+    if (frameStart === -1) {
       const keepLastByte = cursor.at(-1) === 0xff
       return { frames, pending: keepLastByte ? Buffer.from([0xff]) : Buffer.alloc(0) }
     }
@@ -62,7 +62,7 @@ function extractOld(pending, chunk, maxPendingBytes = 2 * 1024 * 1024) {
       cursor = cursor.subarray(frameStart)
     }
     const frameEnd = cursor.indexOf(JPEG_END, JPEG_START.length)
-    if (frameEnd < 0) {
+    if (frameEnd === -1) {
       const tail = cursor.length <= maxPendingBytes ? cursor : cursor.subarray(-maxPendingBytes)
       return { frames, pending: trackedCopy(tail) }
     }
@@ -79,7 +79,7 @@ function extractNew(pending, chunk, maxPendingBytes = 2 * 1024 * 1024) {
   const frames = []
   while (cursor.length > 0) {
     const frameStart = cursor.indexOf(JPEG_START)
-    if (frameStart < 0) {
+    if (frameStart === -1) {
       const keepLastByte = cursor.at(-1) === 0xff
       return { frames, pending: keepLastByte ? Buffer.from([0xff]) : Buffer.alloc(0) }
     }
@@ -87,7 +87,7 @@ function extractNew(pending, chunk, maxPendingBytes = 2 * 1024 * 1024) {
       cursor = cursor.subarray(frameStart)
     }
     const frameEnd = cursor.indexOf(JPEG_END, JPEG_START.length)
-    if (frameEnd < 0) {
+    if (frameEnd === -1) {
       const tail = cursor.length <= maxPendingBytes ? cursor : cursor.subarray(-maxPendingBytes)
       return { frames, pending: trackedCopy(tail) }
     }
diff --git a/config/scripts/orchestration-skill-guidance.test.mjs b/config/scripts/orchestration-skill-guidance.test.mjs
index 080cb4fa785..b9a88ae12ad 100644
--- a/config/scripts/orchestration-skill-guidance.test.mjs
+++ b/config/scripts/orchestration-skill-guidance.test.mjs
@@ -281,7 +281,7 @@ describe('orchestration skill guidance', () => {
     expect(workerLoop).toContain('opaque provider model id with `--model`')
     expect(workerLoop).toContain('`--effort` requires `--model`')
     expect(workerLoop).toContain('neither option can combine with `--terminal`')
-    expect(workerLoop).toContain('--agent claude --model aws-bedrock-opus-5 --effort high --json')
+    expect(workerLoop).toContain('--agent claude --model opus --effort high --json')
     expect(workerLoop).toContain('`launch.requested` and `launch.effective`')
   })
 
diff --git a/config/scripts/package-electron-runtime-contract.test.mjs b/config/scripts/package-electron-runtime-contract.test.mjs
index 1b695086808..c6e96c88b2c 100644
--- a/config/scripts/package-electron-runtime-contract.test.mjs
+++ b/config/scripts/package-electron-runtime-contract.test.mjs
@@ -80,6 +80,7 @@ describe('Electron runtime package contract', () => {
       'build:linux',
       'test:e2e',
       'test:e2e:terminal-rendering-golden',
+      'test:e2e:posix-profile-index-golden',
       'test:e2e:terminal-rendering-release-evidence',
       'test:e2e:headful'
     ]
@@ -492,7 +493,7 @@ describe('Electron runtime package contract', () => {
     expect(uploadStep.with.path).toBe('${{ env.ORCA_E2E_TERMINAL_PERF_REPORT_PATH }}')
   })
 
-  it('keeps terminal rendering regressions in the manual golden E2E workflow', () => {
+  it('keeps platform golden regressions in the manual and release workflows', () => {
     const packageScripts = packageJson.scripts
     const goldenWorkflow = parse(
       readFileSync(join(projectDir, '.github/workflows/golden-e2e-experiment.yml'), 'utf8')
@@ -506,17 +507,19 @@ describe('Electron runtime package contract', () => {
       ['mac', 'macOS'],
       ['windows', 'Windows']
     ])
-    const goldenPlatforms = goldenWorkflow.jobs['golden-e2e'].strategy.matrix.include
-      .map(({ platform }) => platform)
-      .sort()
-    const goldenRunSteps = goldenPlatforms.map((platform) => {
-      const label = goldenPlatformLabels.get(platform)
+    const goldenMatrix = goldenWorkflow.jobs['golden-e2e'].strategy.matrix.include
+    const goldenPlatforms = goldenMatrix.map(({ platform }) => platform).sort()
+    const goldenRunSteps = new Map(
+      goldenPlatforms.map((platform) => {
+        const label = goldenPlatformLabels.get(platform)
 
-      expect(label, platform).toBeDefined()
+        expect(label, platform).toBeDefined()
 
-      return steps.find((step) => step.name === `Run golden E2E tests on ${label}`)
-    })
+        return [platform, steps.find((step) => step.name === `Run golden E2E tests on ${label}`)]
+      })
+    )
     const releaseGoldenJob = releaseWorkflow.jobs['terminal-rendering-golden']
+    const releaseGoldenMatrix = releaseGoldenJob.strategy.matrix.include
     const releaseEvidenceJob = releaseWorkflow.jobs['terminal-rendering-release-evidence']
     const releaseBuildNeeds = releaseWorkflow.jobs.build.needs
     const publishReleaseNeeds = releaseWorkflow.jobs['publish-release'].needs
@@ -535,15 +538,47 @@ describe('Electron runtime package contract', () => {
     expect(packageScripts['test:e2e:terminal-rendering-golden']).not.toContain(
       'terminal-long-table-scroll-restore.spec.ts'
     )
+    expect(packageScripts['test:e2e:windows-fresh-startup-golden']).toContain(
+      'golden-windows-fresh-startup.spec.ts'
+    )
+    expect(packageScripts['test:e2e:windows-fresh-startup-golden']).toContain(
+      '@windows-fresh-startup-golden'
+    )
+    expect(packageScripts['test:e2e:posix-profile-index-golden']).toContain(
+      'golden-posix-profile-index-fsync.spec.ts'
+    )
+    expect(packageScripts['test:e2e:posix-profile-index-golden']).toContain(
+      'golden-posix-fresh-startup.spec.ts'
+    )
+    expect(packageScripts['test:e2e:posix-profile-index-golden']).toContain(
+      '@posix-profile-index-golden'
+    )
     expect(packageScripts['test:e2e:terminal-rendering-release-evidence']).toContain(
       'terminal-opencode-emoji-table-rendering.spec.ts'
     )
     expect(packageScripts['test:e2e:terminal-rendering-release-evidence']).toContain(
       'terminal-long-table-scroll-restore.spec.ts'
     )
-    for (const runStep of goldenRunSteps) {
-      expect(runStep?.run).toContain('pnpm run test:e2e:terminal-rendering-golden')
-    }
+    expect(goldenMatrix).toEqual([
+      { os: 'ubuntu-latest', platform: 'linux' },
+      { os: 'macos-15', platform: 'mac' },
+      { os: 'windows-2022', platform: 'windows' }
+    ])
+    expect(goldenRunSteps.get('linux')?.run).toContain(
+      'pnpm run test:e2e:terminal-rendering-golden'
+    )
+    expect(goldenRunSteps.get('linux')?.run).toContain(
+      'pnpm run test:e2e:posix-profile-index-golden'
+    )
+    expect(goldenRunSteps.get('mac')?.run).toContain('pnpm run test:e2e:terminal-rendering-golden')
+    expect(goldenRunSteps.get('mac')?.run).toContain('pnpm run test:e2e:posix-profile-index-golden')
+    expect(goldenRunSteps.get('windows')).toMatchObject({
+      if: "runner.os == 'Windows'",
+      shell: 'pwsh'
+    })
+    expect(goldenRunSteps.get('windows').run).toContain(
+      'pnpm run test:e2e:windows-fresh-startup-golden'
+    )
     expect(goldenWorkflow.on.pull_request).toBeUndefined()
     expect(goldenWorkflow.on.workflow_dispatch).toBeDefined()
     expect(releaseBuildNeeds).not.toContain('terminal-rendering-golden')
@@ -552,12 +587,25 @@ describe('Electron runtime package contract', () => {
     expect(publishReleaseNeeds).toContain('build')
     expect(publishReleaseNeeds).not.toContain('terminal-rendering-release-evidence')
     expect(releaseGoldenJob['continue-on-error']).toBeUndefined()
-    expect(releaseGoldenJob.strategy.matrix.include.map(({ platform }) => platform).sort()).toEqual(
-      goldenPlatforms
+    expect(releaseGoldenMatrix).toEqual(goldenMatrix)
+    const releaseLinuxRunStep = releaseGoldenJob.steps.find(
+      (step) => step.name === 'Run terminal rendering golden on Linux'
     )
-    expect(releaseGoldenJob.steps.map((step) => step.run ?? '')).toContain(
-      'xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden'
+    expect(releaseLinuxRunStep.run).toContain('pnpm run test:e2e:terminal-rendering-golden')
+    expect(releaseLinuxRunStep.run).toContain('pnpm run test:e2e:posix-profile-index-golden')
+    const releaseMacRunStep = releaseGoldenJob.steps.find(
+      (step) => step.name === 'Run terminal rendering golden on macOS'
     )
+    expect(releaseMacRunStep.run).toContain('pnpm run test:e2e:terminal-rendering-golden')
+    expect(releaseMacRunStep.run).toContain('pnpm run test:e2e:posix-profile-index-golden')
+    const releaseWindowsRunStep = releaseGoldenJob.steps.find(
+      (step) => step.name === 'Run fresh-startup golden on Windows'
+    )
+    expect(releaseWindowsRunStep).toMatchObject({
+      if: "runner.os == 'Windows'",
+      shell: 'pwsh'
+    })
+    expect(releaseWindowsRunStep.run).toContain('pnpm run test:e2e:windows-fresh-startup-golden')
     expect(releaseEvidenceJob['continue-on-error']).toBe(true)
     expect(
       releaseEvidenceJob.strategy.matrix.include.map(({ platform }) => platform).sort()
diff --git a/config/scripts/pr-e2e-gate-contract.test.mjs b/config/scripts/pr-e2e-gate-contract.test.mjs
index 860e70c892b..d44039a2ca8 100644
--- a/config/scripts/pr-e2e-gate-contract.test.mjs
+++ b/config/scripts/pr-e2e-gate-contract.test.mjs
@@ -6,6 +6,10 @@ import { parse } from 'yaml'
 const projectDir = resolve(import.meta.dirname, '../..')
 const prWorkflow = parse(readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
 const e2eWorkflow = parse(readFileSync(join(projectDir, '.github/workflows/e2e.yml'), 'utf8'))
+const sshDockerRunner = readFileSync(
+  join(projectDir, 'config/scripts/run-ssh-docker-terminal-parking-e2e.mjs'),
+  'utf8'
+)
 
 const filterStep = prWorkflow.jobs['e2e-paths'].steps.find(
   (step) => step.name === 'Filter changed E2E specs'
@@ -64,14 +68,36 @@ describe('PR E2E gate contract', () => {
     expect(e2eWorkflow.jobs.e2e.if).toBe("inputs.test_files == ''")
     expect(e2eWorkflow.jobs['changed-e2e'].if).toBe("inputs.test_files != ''")
     expect(e2eWorkflow.jobs['changed-e2e'].strategy).toBeUndefined()
-    expect(e2eWorkflow.jobs['ssh-docker-watcher-isolation'].if).toBe("inputs.test_files == ''")
     const changedRun = e2eWorkflow.jobs['changed-e2e'].steps.find(
       (step) => step.name === 'Run changed E2E specs'
     )
     expect(changedRun.env.TEST_FILES_JSON).toBe('${{ inputs.test_files }}')
+    expect(changedRun.run).toContain('. != "tests/e2e/ssh-startup-exec-readiness.spec.ts"')
+    expect(changedRun.run).toContain('. != "tests/e2e/paired-startup-exec-readiness.spec.ts"')
+    expect(changedRun.run).toContain('if [ "${#TEST_FILES[@]}" -eq 0 ]')
     expect(changedRun.run).toContain('pnpm run test:e2e "${TEST_FILES[@]}" --workers=1')
   })
 
+  it('keeps startup-exec live parity in the isolated SSH lane', () => {
+    const sshLaneCondition = e2eWorkflow.jobs['ssh-docker-watcher-isolation'].if
+    expect(sshLaneCondition).toContain("inputs.test_files == ''")
+    expect(sshLaneCondition).toContain('tests/e2e/ssh-startup-exec-readiness.spec.ts')
+    expect(sshLaneCondition).toContain('tests/e2e/paired-startup-exec-readiness.spec.ts')
+    expect(sshDockerRunner).toContain('tests/e2e/ssh-startup-exec-readiness.spec.ts')
+    expect(sshDockerRunner).toContain('tests/e2e/paired-startup-exec-readiness.spec.ts')
+    expect(sshDockerRunner).toContain("'electron-headless'")
+    expect(sshDockerRunner).toContain("'electron-headful'")
+  })
+
+  it('installs zsh in every Linux lane that can run paired startup readiness', () => {
+    for (const jobName of ['e2e', 'changed-e2e', 'ssh-docker-watcher-isolation']) {
+      const installStep = e2eWorkflow.jobs[jobName].steps.find((step) =>
+        step.name.startsWith('Install native build')
+      )
+      expect(installStep.run, jobName).toMatch(/\bzsh\b/)
+    }
+  })
+
   it('keeps dedicated E2E workflows out of pull request CI', () => {
     const dedicatedWorkflows = [
       'golden-e2e-experiment.yml',
diff --git a/config/scripts/pr-workflow-parallelism.test.mjs b/config/scripts/pr-workflow-parallelism.test.mjs
index 5b3b66dea3f..165931dbeb1 100644
--- a/config/scripts/pr-workflow-parallelism.test.mjs
+++ b/config/scripts/pr-workflow-parallelism.test.mjs
@@ -8,6 +8,7 @@ const dependencyAction = parse(
 )
 const packageJson = JSON.parse(readFileSync('package.json', 'utf8'))
 const shellContractFiles = [
+  'src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts',
   'src/main/daemon/shell-ready.test.ts',
   'src/main/providers/local-pty-shell-ready.test.ts',
   'src/main/providers/__tests__/shell-ready-framework-example.test.ts',
@@ -75,6 +76,7 @@ describe('PR workflow parallelism', () => {
 
     expect(shellStep).toBeDefined()
     expect(shellInstall).toBeDefined()
+    expect(shellStep.run.split(/\s+/)).toContain('--maxWorkers=1')
     // Why the whole workflow, not just the general shards: any other lane installing
     // these shells would silently start running the real-shell tests twice.
     expect(jobsInstallingPackages).toEqual(['shell_contracts'])
diff --git a/config/scripts/relay-watcher-fault-harness.mjs b/config/scripts/relay-watcher-fault-harness.mjs
index b27a1f945d9..784abfc4850 100644
--- a/config/scripts/relay-watcher-fault-harness.mjs
+++ b/config/scripts/relay-watcher-fault-harness.mjs
@@ -94,7 +94,7 @@ function waitForStdoutSentinel(proc, protocol, stderr) {
         stdoutBuffer = Buffer.concat([stdoutBuffer, chunk])
         const sentinel = Buffer.from(protocol.RELAY_SENTINEL)
         const index = stdoutBuffer.indexOf(sentinel)
-        if (index < 0) {
+        if (index === -1) {
           return
         }
         settled = true
@@ -148,7 +148,7 @@ function createRelayClient(entryPath, args, env, protocol) {
     stdoutBuffer = Buffer.concat([stdoutBuffer, chunk])
     const sentinel = Buffer.from(protocol.RELAY_SENTINEL)
     const index = stdoutBuffer.indexOf(sentinel)
-    if (index < 0) {
+    if (index === -1) {
       return
     }
     ready = true
diff --git a/config/scripts/remote-shared-control-retirement-probe.ts b/config/scripts/remote-shared-control-retirement-probe.ts
index 63abd01e376..30edeb9802a 100644
--- a/config/scripts/remote-shared-control-retirement-probe.ts
+++ b/config/scripts/remote-shared-control-retirement-probe.ts
@@ -5,7 +5,8 @@ import {
   resolveEnvironment,
   resolveEnvironmentPairingOffer
 } from '../../src/shared/runtime-environment-store'
-import type { MemorySnapshot, RuntimeStatus } from '../../src/shared/types'
+import type { MemorySnapshot } from '../../src/shared/types'
+import type { RuntimeStatus } from '../../src/shared/runtime-types'
 
 async function main(): Promise<void> {
   const environmentName = process.env.ORCA_PROBE_ENVIRONMENT_NAME
diff --git a/config/scripts/run-idle-cpu-benchmark.mjs b/config/scripts/run-idle-cpu-benchmark.mjs
index 53cabd3380b..3892de8845d 100644
--- a/config/scripts/run-idle-cpu-benchmark.mjs
+++ b/config/scripts/run-idle-cpu-benchmark.mjs
@@ -1,15 +1,34 @@
 #!/usr/bin/env node
 import { _electron as electron } from '@stablyai/playwright-test'
-import { execFileSync, spawnSync } from 'node:child_process'
+import { execFileSync } from 'node:child_process'
 import { existsSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import {
+  descendantsOf,
+  readProcessRows,
+  sampleProcessTreeUntilWorkloadsComplete,
+  summarizeProcessInventory,
+  summarizeSamples,
+  terminateProcesses
+} from './idle-cpu-process-sampling.mjs'
+import {
+  collectRendererCensus,
+  configureRendererScaleFixture
+} from './idle-cpu-renderer-scale-fixture.mjs'
+import {
+  runZustandPublications,
+  snapshotRendererTimingProbe,
+  startRendererTimingProbe,
+  stopRendererTimingProbe
+} from './idle-cpu-renderer-timing-probe.mjs'
 import { installSyntheticVisibleSpinners } from './idle-cpu-synthetic-spinners.mjs'
 
 const DEFAULT_WARMUP_MS = 15_000
 const DEFAULT_SAMPLE_MS = 30_000
 const DEFAULT_INTERVAL_MS = 1_000
 const DEFAULT_WORKTREE_COUNT = 1
+const DEFAULT_ZUSTAND_PUBLICATION_INTERVAL_MS = 100
 const ONBOARDING_FINAL_STEP = 3
 const ONBOARDING_FLOW_VERSION = 2
 
@@ -19,6 +38,10 @@ function parseArgs(argv) {
     sampleMs: DEFAULT_SAMPLE_MS,
     intervalMs: DEFAULT_INTERVAL_MS,
     worktrees: DEFAULT_WORKTREE_COUNT,
+    lineageDepth: 0,
+    agentsPerWorktree: 0,
+    zustandPublications: 0,
+    zustandPublicationIntervalMs: DEFAULT_ZUSTAND_PUBLICATION_INTERVAL_MS,
     skipBuild: false,
     headful: false,
     output: null,
@@ -47,6 +70,14 @@ function parseArgs(argv) {
       options.intervalMs = Number(readValue())
     } else if (arg === '--worktrees') {
       options.worktrees = Number(readValue())
+    } else if (arg === '--lineage-depth') {
+      options.lineageDepth = Number(readValue())
+    } else if (arg === '--agents-per-worktree') {
+      options.agentsPerWorktree = Number(readValue())
+    } else if (arg === '--zustand-publications') {
+      options.zustandPublications = Number(readValue())
+    } else if (arg === '--zustand-publication-interval-ms') {
+      options.zustandPublicationIntervalMs = Number(readValue())
     } else if (arg === '--output') {
       options.output = readValue()
     } else if (arg === '--skip-build') {
@@ -73,6 +104,10 @@ function parseArgs(argv) {
     'sampleMs',
     'intervalMs',
     'worktrees',
+    'lineageDepth',
+    'agentsPerWorktree',
+    'zustandPublications',
+    'zustandPublicationIntervalMs',
     'syntheticVisibleSpinners',
     'syntheticSpinnerSteps'
   ]) {
@@ -82,16 +117,33 @@ function parseArgs(argv) {
   }
   options.worktrees = Math.max(1, Math.floor(options.worktrees))
   options.intervalMs = Math.max(250, Math.floor(options.intervalMs))
+  options.lineageDepth = Math.floor(options.lineageDepth)
+  options.agentsPerWorktree = Math.floor(options.agentsPerWorktree)
+  options.zustandPublications = Math.floor(options.zustandPublications)
+  options.zustandPublicationIntervalMs = Math.max(
+    1,
+    Math.floor(options.zustandPublicationIntervalMs)
+  )
   options.syntheticVisibleSpinners = Math.max(0, Math.floor(options.syntheticVisibleSpinners))
   options.syntheticSpinnerSteps = Math.max(1, Math.floor(options.syntheticSpinnerSteps))
   if (!['smooth', 'steps'].includes(options.syntheticSpinnerAnimation)) {
     throw new Error(`Invalid --synthetic-spinner-animation: ${options.syntheticSpinnerAnimation}`)
   }
+  if (options.lineageDepth > 0 && options.worktrees < 2) {
+    throw new Error('--lineage-depth requires at least two --worktrees')
+  }
+  const publicationSpanMs =
+    Math.max(0, options.zustandPublications - 1) * options.zustandPublicationIntervalMs
+  if (publicationSpanMs > options.sampleMs) {
+    throw new Error(
+      `Zustand publication span ${publicationSpanMs}ms exceeds --sample-ms ${options.sampleMs}`
+    )
+  }
   return options
 }
 function printUsage() {
   console.log(
-    `Usage: node config/scripts/run-idle-cpu-benchmark.mjs [options]\n\nOptions:\n  --warmup-ms <n>    Time to wait after app readiness before sampling (default ${DEFAULT_WARMUP_MS})\n  --sample-ms <n>    Sampling window duration (default ${DEFAULT_SAMPLE_MS})\n  --interval-ms <n>  Sampling cadence (default ${DEFAULT_INTERVAL_MS})\n  --worktrees <n>    Seed repo worktree count, including primary (default ${DEFAULT_WORKTREE_COUNT})\n  --headful          Show the Electron window while measuring\n  --skip-build       Reuse out/main/index.js instead of building first\n  --output <path>    Write JSON report to this path\n  --disable-renderer-animations  Inject measurement-only CSS that disables animations/transitions\n  --synthetic-visible-spinners <n>  Measurement-only: add visible working spinners\n  --synthetic-spinner-animation <smooth|steps>  Spinner animation style (default smooth)\n  --synthetic-spinner-steps <n>  Step count for --synthetic-spinner-animation steps (default 12)\n`
+    `Usage: node config/scripts/run-idle-cpu-benchmark.mjs [options]\n\nOptions:\n  --warmup-ms <n>    Time to wait after app readiness before sampling (default ${DEFAULT_WARMUP_MS})\n  --sample-ms <n>    Sampling window duration (default ${DEFAULT_SAMPLE_MS})\n  --interval-ms <n>  Sampling cadence (default ${DEFAULT_INTERVAL_MS})\n  --worktrees <n>    Seed repo worktree count, including primary (default ${DEFAULT_WORKTREE_COUNT})\n  --lineage-depth <n>  Nest all worktrees under one expanded lineage, up to this depth\n  --agents-per-worktree <n>  Seed this many visible inline agent rows per worktree\n  --zustand-publications <n>  Publish exactly this many store updates during sampling\n  --zustand-publication-interval-ms <n>  Publication cadence (default ${DEFAULT_ZUSTAND_PUBLICATION_INTERVAL_MS})\n  --headful          Show the Electron window while measuring\n  --skip-build       Reuse out/main/index.js instead of building first\n  --output <path>    Write JSON report to this path\n  --disable-renderer-animations  Inject measurement-only CSS that disables animations/transitions\n  --synthetic-visible-spinners <n>  Measurement-only: add visible working spinners\n  --synthetic-spinner-animation <smooth|steps>  Spinner animation style (default smooth)\n  --synthetic-spinner-steps <n>  Step count for --synthetic-spinner-animation steps (default 12)\n`
   )
 }
 function run(command, args, options = {}) {
@@ -188,140 +240,6 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms))
 }
 
-function parseCpuTimeSeconds(value) {
-  const trimmed = String(value || '').trim()
-  if (!trimmed) {
-    return null
-  }
-  const [dayOrTime, maybeTime] = trimmed.includes('-') ? trimmed.split('-', 2) : [null, trimmed]
-  const days = dayOrTime === null ? 0 : Number(dayOrTime)
-  const parts = maybeTime.split(':').map(Number)
-  if (!Number.isFinite(days) || parts.some((part) => !Number.isFinite(part))) {
-    return null
-  }
-  if (parts.length === 3) {
-    return days * 86400 + parts[0] * 3600 + parts[1] * 60 + parts[2]
-  }
-  if (parts.length === 2) {
-    return days * 86400 + parts[0] * 60 + parts[1]
-  }
-  if (parts.length === 1) {
-    return days * 86400 + parts[0]
-  }
-  return null
-}
-
-function parseUnixProcesses(stdout) {
-  const rows = []
-  for (const raw of stdout.split('\n')) {
-    const line = raw.trim()
-    if (!line) {
-      continue
-    }
-    const match = line.match(/^(\d+)\s+(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)\s+(.+)$/)
-    if (!match) {
-      continue
-    }
-    rows.push({
-      pid: Number(match[1]),
-      ppid: Number(match[2]),
-      percentCpu: Number(match[3]),
-      rssBytes: Number(match[4]) * 1024,
-      cpuTimeSeconds: parseCpuTimeSeconds(match[5]),
-      command: match[6]
-    })
-  }
-  return rows
-}
-
-function readUnixProcesses() {
-  const stdout = execFileSync('ps', ['-axo', 'pid=,ppid=,pcpu=,rss=,cputime=,command='], {
-    encoding: 'utf8',
-    env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
-    maxBuffer: 20 * 1024 * 1024
-  })
-  return parseUnixProcesses(stdout)
-}
-
-function readWindowsProcesses() {
-  const script =
-    'Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,WorkingSetSize,CommandLine | ConvertTo-Json -Compress'
-  const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', script], {
-    encoding: 'utf8',
-    maxBuffer: 20 * 1024 * 1024
-  })
-  if (result.status !== 0) {
-    throw new Error(result.stderr || 'PowerShell process enumeration failed')
-  }
-  const parsed = JSON.parse(result.stdout || '[]')
-  const entries = Array.isArray(parsed) ? parsed : [parsed]
-  return entries.map((entry) => ({
-    pid: Number(entry.ProcessId),
-    ppid: Number(entry.ParentProcessId),
-    percentCpu: 0,
-    cpuTimeSeconds: null,
-    rssBytes: Number(entry.WorkingSetSize) || 0,
-    command: String(entry.CommandLine || '')
-  }))
-}
-
-function readProcessRows() {
-  return process.platform === 'win32' ? readWindowsProcesses() : readUnixProcesses()
-}
-
-function descendantsOf(rows, rootPid) {
-  const children = new Map()
-  for (const row of rows) {
-    const list = children.get(row.ppid) ?? []
-    list.push(row)
-    children.set(row.ppid, list)
-  }
-  const result = []
-  const stack = [rootPid]
-  const seen = new Set()
-  while (stack.length > 0) {
-    const pid = stack.pop()
-    if (seen.has(pid)) {
-      continue
-    }
-    seen.add(pid)
-    const row = rows.find((candidate) => candidate.pid === pid)
-    if (row) {
-      result.push(row)
-    }
-    for (const child of children.get(pid) ?? []) {
-      stack.push(child.pid)
-    }
-  }
-  return result
-}
-
-function classify(row, rootPid) {
-  const command = row.command.toLowerCase()
-  if (row.pid === rootPid) {
-    return 'main'
-  }
-  if (command.includes('daemon-entry')) {
-    return 'daemon'
-  }
-  if (command.includes('--type=gpu-process')) {
-    return 'gpu'
-  }
-  if (command.includes('--type=renderer')) {
-    return 'renderer'
-  }
-  if (command.includes('--type=utility')) {
-    return 'utility'
-  }
-  if (command.includes('--type=')) {
-    return 'electron-other'
-  }
-  if (command.includes('node') || command.includes('/pi') || command.endsWith(' pi')) {
-    return 'agent-or-node'
-  }
-  return 'other-descendant'
-}
-
 async function collectRendererIdleState(page) {
   return page.evaluate(() => {
     const describeElement = (element) => {
@@ -364,93 +282,6 @@ async function collectRendererIdleState(page) {
   })
 }
 
-function summarizeSamples(samples) {
-  const byKind = new Map()
-  for (const sample of samples) {
-    for (const proc of sample.processes) {
-      const bucket = byKind.get(proc.kind) ?? { cpuValues: [], rssValues: [], maxProcessCount: 0 }
-      bucket.cpuValues.push(proc.cpu)
-      bucket.rssValues.push(proc.rssBytes)
-      byKind.set(proc.kind, bucket)
-    }
-    const counts = new Map()
-    for (const proc of sample.processes) {
-      counts.set(proc.kind, (counts.get(proc.kind) ?? 0) + 1)
-    }
-    for (const [kind, count] of counts) {
-      byKind.get(kind).maxProcessCount = Math.max(byKind.get(kind).maxProcessCount, count)
-    }
-  }
-  const summary = {}
-  for (const [kind, values] of byKind) {
-    const cpuSorted = [...values.cpuValues].sort((a, b) => a - b)
-    const rssSumBySample = samples.map((sample) =>
-      sample.processes
-        .filter((proc) => proc.kind === kind)
-        .reduce((sum, proc) => sum + proc.rssBytes, 0)
-    )
-    summary[kind] = {
-      meanCpuPercent: mean(values.cpuValues),
-      p95CpuPercent: percentile(cpuSorted, 0.95),
-      maxCpuPercent: Math.max(0, ...values.cpuValues),
-      meanRssBytes: mean(rssSumBySample),
-      maxProcessCount: values.maxProcessCount
-    }
-  }
-  summary.total = {
-    meanCpuPercent: mean(samples.map((sample) => sample.totalCpuPercent)),
-    p95CpuPercent: percentile(
-      samples.map((sample) => sample.totalCpuPercent).sort((a, b) => a - b),
-      0.95
-    ),
-    meanRssBytes: mean(samples.map((sample) => sample.totalRssBytes))
-  }
-  return summary
-}
-
-function summarizeProcessInventory(samples) {
-  const inventory = {}
-  for (const sample of samples) {
-    const counts = new Map()
-    for (const proc of sample.processes) {
-      counts.set(proc.kind, (counts.get(proc.kind) ?? 0) + 1)
-      const entry = inventory[proc.kind] ?? {
-        maxProcessCount: 0,
-        maxCpuPercent: 0,
-        commandSamples: []
-      }
-      entry.maxCpuPercent = Math.max(entry.maxCpuPercent, proc.cpu)
-      if (!entry.commandSamples.includes(proc.command) && entry.commandSamples.length < 6) {
-        entry.commandSamples.push(proc.command)
-      }
-      inventory[proc.kind] = entry
-    }
-    for (const [kind, count] of counts) {
-      inventory[kind].maxProcessCount = Math.max(inventory[kind].maxProcessCount, count)
-    }
-  }
-  return inventory
-}
-function mean(values) {
-  return values.length === 0 ? 0 : values.reduce((sum, value) => sum + value, 0) / values.length
-}
-
-function percentile(sorted, fraction) {
-  if (sorted.length === 0) {
-    return 0
-  }
-  const index = Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)
-  return sorted[index]
-}
-
-function terminateProcesses(processes) {
-  for (const proc of processes) {
-    try {
-      process.kill(proc.pid)
-    } catch {}
-  }
-}
-
 async function main() {
   const options = parseArgs(process.argv.slice(2))
   const root = path.resolve(import.meta.dirname, '..', '..')
@@ -491,6 +322,11 @@ async function main() {
     const page = await app.firstWindow({ timeout: 120_000 })
     await page.waitForLoadState('domcontentloaded')
     await page.waitForFunction(() => Boolean(window.__store), null, { timeout: 30_000 })
+    await page.waitForFunction(
+      () => window.__store?.getState().workspaceSessionReady === true,
+      null,
+      { timeout: 60_000 }
+    )
     const measurementCss = []
     if (options.disableRendererAnimations) {
       measurementCss.push(
@@ -506,63 +342,111 @@ async function main() {
       options.syntheticSpinnerAnimation,
       options.syntheticSpinnerSteps
     )
-    await page.evaluate(async (repoPath) => {
-      await window.api.repos.add({ path: repoPath })
+    const fixtureState = await page.evaluate(async (repoPath) => {
+      const added = await window.api.repos.add({ path: repoPath })
+      if ('error' in added) {
+        return { error: added.error }
+      }
       const store = window.__store
       await store?.getState().fetchRepos()
-      const repo = store?.getState().repos.find((candidate) => candidate.path === repoPath)
+      const repo = store?.getState().repos.find((candidate) => candidate.id === added.repo.id)
       if (repo) {
-        await store.getState().updateRepo(repo.id, { externalWorktreeVisibility: 'show' })
-        await store.getState().fetchWorktrees(repo.id)
+        const detected = await store
+          .getState()
+          .fetchWorktrees(repo.id, { requireAuthoritative: true })
+        const importedWorktreePaths = (
+          store.getState().detectedWorktreesByRepo[repo.id]?.worktrees ?? []
+        )
+          .filter((worktree) => !worktree.selectedCheckout)
+          .map((worktree) => worktree.path)
+        const updated = await store.getState().updateRepo(repo.id, {
+          externalWorktreeVisibility: 'show',
+          importedExternalWorktreePaths: importedWorktreePaths,
+          externalWorktreeInboxBaselinePaths: importedWorktreePaths
+        })
+        const refreshed = await store
+          .getState()
+          .fetchWorktrees(repo.id, { requireAuthoritative: true })
+        return {
+          detected,
+          updated,
+          refreshed,
+          detectedCount: store.getState().detectedWorktreesByRepo[repo.id]?.worktrees.length ?? 0,
+          importedCount: importedWorktreePaths.length,
+          visibleCount: store.getState().worktreesByRepo[repo.id]?.length ?? 0
+        }
       }
+      return { error: 'repo-not-found' }
     }, repoDir)
+    console.log(`[idle-cpu] fixture ${JSON.stringify(fixtureState)}`)
     await page.waitForFunction(
-      () => window.__store?.getState().workspaceSessionReady === true,
+      (expectedWorktrees) => {
+        const state = window.__store?.getState()
+        return (
+          state?.workspaceSessionReady === true &&
+          Object.values(state.worktreesByRepo).flat().length === expectedWorktrees
+        )
+      },
+      options.worktrees,
+      { timeout: 180_000 }
+    )
+    const scaleFixtureState = await configureRendererScaleFixture(page, options, repoDir)
+    if (scaleFixtureState.applied) {
+      console.log(`[idle-cpu] scale fixture ${JSON.stringify(scaleFixtureState)}`)
+    }
+    await page.waitForFunction(
+      (expectedAgentRows) => {
+        const state = window.__store?.getState()
+        return (
+          state !== undefined &&
+          Object.keys(state.agentStatusByPaneKey ?? {}).length >= expectedAgentRows
+        )
+      },
+      scaleFixtureState.seededAgentRows,
+      { timeout: 30_000 }
+    )
+    await page.waitForFunction(
+      () => Boolean(document.querySelector('[data-worktree-sidebar] [data-worktree-id]')),
       null,
-      { timeout: 60_000 }
+      { timeout: 30_000 }
     )
     console.log(
-      `[idle-cpu] root pid=${rootPid}; warmup=${options.warmupMs}ms sample=${options.sampleMs}ms interval=${options.intervalMs}ms worktrees=${options.worktrees}`
+      `[idle-cpu] root pid=${rootPid}; warmup=${options.warmupMs}ms sample=${options.sampleMs}ms interval=${options.intervalMs}ms worktrees=${options.worktrees} lineage-depth=${options.lineageDepth} agents/worktree=${options.agentsPerWorktree} publications=${options.zustandPublications}`
     )
+    await startRendererTimingProbe(page)
     await sleep(options.warmupMs)
     const rendererIdleState = await collectRendererIdleState(page)
-    const deadline = Date.now() + options.sampleMs
-    const samples = []
-    let previousSnapshot = null
-    while (Date.now() <= deadline || samples.length === 0) {
-      const sampledAt = Date.now()
-      const processRows = descendantsOf(readProcessRows(), rootPid)
-      const rawProcesses = processRows.map((row) => ({ ...row, kind: classify(row, rootPid) }))
-      if (previousSnapshot) {
-        const elapsedSeconds = Math.max(0.001, (sampledAt - previousSnapshot.at) / 1000)
-        const previousByPid = new Map(previousSnapshot.processes.map((proc) => [proc.pid, proc]))
-        const processes = rawProcesses.map((row) => {
-          const previous = previousByPid.get(row.pid)
-          const canComputeDelta =
-            typeof row.cpuTimeSeconds === 'number' && typeof previous?.cpuTimeSeconds === 'number'
-          const cpu = canComputeDelta
-            ? Math.max(0, ((row.cpuTimeSeconds - previous.cpuTimeSeconds) / elapsedSeconds) * 100)
-            : row.percentCpu
-          return { ...row, cpu }
-        })
-        samples.push({
-          at: sampledAt,
-          elapsedMs: sampledAt - previousSnapshot.at,
-          totalCpuPercent: processes.reduce((sum, proc) => sum + proc.cpu, 0),
-          totalRssBytes: processes.reduce((sum, proc) => sum + proc.rssBytes, 0),
-          processes
-        })
-      }
-      previousSnapshot = { at: sampledAt, processes: rawProcesses }
-      await sleep(options.intervalMs)
-    }
+    const rendererCensusBefore = await collectRendererCensus(page, options.lineageDepth)
+    const rendererTimingBefore = await snapshotRendererTimingProbe(page)
+    const publicationPromise = runZustandPublications(
+      page,
+      options.zustandPublications,
+      options.zustandPublicationIntervalMs
+    )
+    const sampled = await sampleProcessTreeUntilWorkloadsComplete({
+      rootPid,
+      requestedDurationMs: options.sampleMs,
+      intervalMs: options.intervalMs,
+      workloadPromise: publicationPromise
+    })
+    const samples = sampled.samples
+    const zustandPublications = sampled.workloadResult
+    const rendererTimingAfter = await stopRendererTimingProbe(page)
+    const rendererCensusAfter = await collectRendererCensus(page, options.lineageDepth)
     const report = {
       benchmark: 'orca-idle-cpu',
       createdAt: new Date().toISOString(),
       options,
       rootPid,
       platform: { platform: process.platform, arch: process.arch, cpus: os.cpus().length },
+      fixtureState,
+      scaleFixtureState,
       rendererIdleState,
+      rendererCensusBefore,
+      rendererCensusAfter,
+      rendererTiming: { before: rendererTimingBefore, after: rendererTimingAfter },
+      zustandPublications,
+      samplingWindow: sampled.samplingWindow,
       sampleCount: samples.length,
       summary: summarizeSamples(samples),
       processInventory: summarizeProcessInventory(samples),
@@ -578,7 +462,13 @@ async function main() {
         {
           summary: report.summary,
           processInventory: report.processInventory,
-          sampleCount: report.sampleCount
+          sampleCount: report.sampleCount,
+          scaleFixtureState: report.scaleFixtureState,
+          rendererCensusBefore: report.rendererCensusBefore,
+          rendererCensusAfter: report.rendererCensusAfter,
+          rendererTiming: report.rendererTiming,
+          zustandPublications: report.zustandPublications,
+          samplingWindow: report.samplingWindow
         },
         null,
         2
diff --git a/config/scripts/run-ssh-docker-maxsessions-identity-e2e.mjs b/config/scripts/run-ssh-docker-maxsessions-identity-e2e.mjs
new file mode 100644
index 00000000000..2f232420531
--- /dev/null
+++ b/config/scripts/run-ssh-docker-maxsessions-identity-e2e.mjs
@@ -0,0 +1,41 @@
+import { spawnSync } from 'node:child_process'
+
+const rawExtraArgs = process.argv.slice(2)
+const extraArgs = rawExtraArgs[0] === '--' ? rawExtraArgs.slice(1) : rawExtraArgs
+const pnpm = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm'
+const env = {
+  ...process.env,
+  ORCA_E2E_SSH_DOCKER: '1'
+}
+
+// Why: Node's CVE-2024-27980 hardening rejects .cmd spawns without shell on Windows.
+const spawnOptions = {
+  stdio: 'inherit',
+  env,
+  shell: process.platform === 'win32'
+}
+
+const runtime = spawnSync(pnpm, ['run', 'ensure:electron-runtime'], spawnOptions)
+
+if (runtime.status !== 0) {
+  process.exit(runtime.status ?? 1)
+}
+
+const result = spawnSync(
+  pnpm,
+  [
+    'exec',
+    'playwright',
+    'test',
+    'tests/e2e/ssh-maxsessions-remote-pid-binding-identity.spec.ts',
+    '--config',
+    'tests/playwright.config.ts',
+    '--project',
+    'electron-headless',
+    '--workers=1',
+    ...extraArgs
+  ],
+  spawnOptions
+)
+
+process.exit(result.status ?? 1)
diff --git a/config/scripts/run-ssh-docker-reconnect-pane-cardinality-e2e.mjs b/config/scripts/run-ssh-docker-reconnect-pane-cardinality-e2e.mjs
new file mode 100644
index 00000000000..cde82379c1f
--- /dev/null
+++ b/config/scripts/run-ssh-docker-reconnect-pane-cardinality-e2e.mjs
@@ -0,0 +1,41 @@
+import { spawnSync } from 'node:child_process'
+
+const rawExtraArgs = process.argv.slice(2)
+const extraArgs = rawExtraArgs[0] === '--' ? rawExtraArgs.slice(1) : rawExtraArgs
+const pnpm = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm'
+const env = {
+  ...process.env,
+  ORCA_E2E_SSH_DOCKER: '1'
+}
+
+// Why: Node's CVE-2024-27980 hardening rejects .cmd spawns without shell on Windows.
+const spawnOptions = {
+  stdio: 'inherit',
+  env,
+  shell: process.platform === 'win32'
+}
+
+const runtime = spawnSync(pnpm, ['run', 'ensure:electron-runtime'], spawnOptions)
+
+if (runtime.status !== 0) {
+  process.exit(runtime.status ?? 1)
+}
+
+const result = spawnSync(
+  pnpm,
+  [
+    'exec',
+    'playwright',
+    'test',
+    'tests/e2e/ssh-reconnect-pane-cardinality.spec.ts',
+    '--config',
+    'tests/playwright.config.ts',
+    '--project',
+    'electron-headless',
+    '--workers=1',
+    ...extraArgs
+  ],
+  spawnOptions
+)
+
+process.exit(result.status ?? 1)
diff --git a/config/scripts/run-ssh-docker-terminal-parking-e2e.mjs b/config/scripts/run-ssh-docker-terminal-parking-e2e.mjs
index 8d4183b4515..b894ac15217 100644
--- a/config/scripts/run-ssh-docker-terminal-parking-e2e.mjs
+++ b/config/scripts/run-ssh-docker-terminal-parking-e2e.mjs
@@ -5,7 +5,8 @@ const extraArgs = rawExtraArgs[0] === '--' ? rawExtraArgs.slice(1) : rawExtraArg
 const pnpm = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm'
 const env = {
   ...process.env,
-  ORCA_E2E_SSH_DOCKER: '1'
+  ORCA_E2E_SSH_DOCKER: '1',
+  ORCA_E2E_WEB_CLIENT: '1'
 }
 
 // Why: Node's CVE-2024-27980 hardening rejects .cmd spawns without shell on Windows.
@@ -21,9 +22,8 @@ if (runtime.status !== 0) {
   process.exit(runtime.status ?? 1)
 }
 
-// Why both specs in one runner: they share the docker SSH rig and the same
-// ORCA_E2E_SSH_DOCKER gate — the SSH parking spec proves SSH panes park and
-// restore, the retention spec proves the C1 budget bounds what they retain.
+// Why one runner: these specs share the Docker SSH rig; startup-exec also joins
+// the paired desktop/headless parity proof under the same isolated CI lane.
 const result = spawnSync(
   pnpm,
   [
@@ -32,10 +32,14 @@ const result = spawnSync(
     'test',
     'tests/e2e/ssh-terminal-parking.spec.ts',
     'tests/e2e/terminal-retention-budget.spec.ts',
+    'tests/e2e/ssh-startup-exec-readiness.spec.ts',
+    'tests/e2e/paired-startup-exec-readiness.spec.ts',
     '--config',
     'tests/playwright.config.ts',
     '--project',
     'electron-headless',
+    '--project',
+    'electron-headful',
     '--workers=1',
     ...extraArgs
   ],
diff --git a/config/scripts/run-ssh-docker-two-hosts-isolation-e2e.mjs b/config/scripts/run-ssh-docker-two-hosts-isolation-e2e.mjs
new file mode 100644
index 00000000000..45c3911a3b8
--- /dev/null
+++ b/config/scripts/run-ssh-docker-two-hosts-isolation-e2e.mjs
@@ -0,0 +1,41 @@
+import { spawnSync } from 'node:child_process'
+
+const rawExtraArgs = process.argv.slice(2)
+const extraArgs = rawExtraArgs[0] === '--' ? rawExtraArgs.slice(1) : rawExtraArgs
+const pnpm = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm'
+const env = {
+  ...process.env,
+  ORCA_E2E_SSH_DOCKER: '1'
+}
+
+// Why: Node's CVE-2024-27980 hardening rejects .cmd spawns without shell on Windows.
+const spawnOptions = {
+  stdio: 'inherit',
+  env,
+  shell: process.platform === 'win32'
+}
+
+const runtime = spawnSync(pnpm, ['run', 'ensure:electron-runtime'], spawnOptions)
+
+if (runtime.status !== 0) {
+  process.exit(runtime.status ?? 1)
+}
+
+const result = spawnSync(
+  pnpm,
+  [
+    'exec',
+    'playwright',
+    'test',
+    'tests/e2e/ssh-two-hosts-isolation.spec.ts',
+    '--config',
+    'tests/playwright.config.ts',
+    '--project',
+    'electron-headless',
+    '--workers=1',
+    ...extraArgs
+  ],
+  spawnOptions
+)
+
+process.exit(result.status ?? 1)
diff --git a/config/scripts/run-ssh-staged-upload-reliability.mjs b/config/scripts/run-ssh-staged-upload-reliability.mjs
index 4fadf6f3001..fb3d0040350 100644
--- a/config/scripts/run-ssh-staged-upload-reliability.mjs
+++ b/config/scripts/run-ssh-staged-upload-reliability.mjs
@@ -17,8 +17,8 @@ const defaultFiles = [
 const cliArguments = process.argv.slice(2)
 const powerShellFlag = cliArguments.indexOf('--powershell')
 const configuredPowerShell =
-  powerShellFlag >= 0 ? cliArguments[powerShellFlag + 1] : process.env.ORCA_POWERSHELL_EXECUTABLE
-if (powerShellFlag >= 0 && !configuredPowerShell) {
+  powerShellFlag !== -1 ? cliArguments[powerShellFlag + 1] : process.env.ORCA_POWERSHELL_EXECUTABLE
+if (powerShellFlag !== -1 && !configuredPowerShell) {
   console.error('--powershell requires an executable path')
   process.exit(2)
 }
diff --git a/config/scripts/terminal-e2e-helpers.mjs b/config/scripts/terminal-e2e-helpers.mjs
index 2f89f1a7f90..8b698416326 100644
--- a/config/scripts/terminal-e2e-helpers.mjs
+++ b/config/scripts/terminal-e2e-helpers.mjs
@@ -222,8 +222,8 @@ if (process.argv[1]?.endsWith('terminal-e2e-helpers.mjs')) {
   const args = process.argv.slice(2)
   const portIdx = args.indexOf('--port')
   const cmdIdx = args.indexOf('--command')
-  const port = portIdx >= 0 ? Number(args[portIdx + 1]) : 9444
-  const command = cmdIdx >= 0 ? args[cmdIdx + 1] : null
+  const port = portIdx !== -1 ? Number(args[portIdx + 1]) : 9444
+  const command = cmdIdx !== -1 ? args[cmdIdx + 1] : null
 
   const term = new OrcaTerminal(port)
   console.log('Connecting to Orca on CDP port', port, '...')
diff --git a/config/scripts/verify-agent-hook-stdin-lifecycle.mjs b/config/scripts/verify-agent-hook-stdin-lifecycle.mjs
index 079735c41ec..187b5aa3fc2 100644
--- a/config/scripts/verify-agent-hook-stdin-lifecycle.mjs
+++ b/config/scripts/verify-agent-hook-stdin-lifecycle.mjs
@@ -142,7 +142,7 @@ function readGeneratedScripts(home, minMtime) {
     const body = readFileSync(path, 'utf8')
     const captureIndex = body.indexOf('payload=$(cat)')
     const firstExitIndex = body.indexOf('exit 0')
-    if (captureIndex < 0 || firstExitIndex <= captureIndex) {
+    if (captureIndex === -1 || firstExitIndex <= captureIndex) {
       throw new Error([fileName, ' can exit before capturing stdin'].join(''))
     }
     return { body, fileName, path, source }
diff --git a/config/scripts/verify-computer-native.mjs b/config/scripts/verify-computer-native.mjs
index ba23a49cdd0..56efeb33521 100644
--- a/config/scripts/verify-computer-native.mjs
+++ b/config/scripts/verify-computer-native.mjs
@@ -489,11 +489,11 @@ function verifyNativeArgumentGuardrails() {
 
 function powerShellFunctionBody(source, name) {
   const start = source.indexOf(`function ${name}`)
-  if (start < 0) {
+  if (start === -1) {
     return null
   }
   const bodyStart = source.indexOf('{', start)
-  if (bodyStart < 0) {
+  if (bodyStart === -1) {
     return null
   }
   let depth = 0
@@ -513,11 +513,11 @@ function powerShellFunctionBody(source, name) {
 
 function swiftFunctionBody(source, name) {
   const start = source.indexOf(`func ${name}`)
-  if (start < 0) {
+  if (start === -1) {
     return null
   }
   const bodyStart = source.indexOf('{', start)
-  if (bodyStart < 0) {
+  if (bodyStart === -1) {
     return null
   }
   let depth = 0
diff --git a/config/scripts/wsl-git-shell-benchmark.mjs b/config/scripts/wsl-git-shell-benchmark.mjs
index 00ea47ded0a..d29aaea2824 100644
--- a/config/scripts/wsl-git-shell-benchmark.mjs
+++ b/config/scripts/wsl-git-shell-benchmark.mjs
@@ -175,7 +175,7 @@ async function main() {
         wslShellArgs(distro, ['/bin/sh', '-lc', escapeWslShCommandForWindows(script)])
       )
       const markerOffset = result.stdout.indexOf(outputMarker)
-      if (markerOffset < 0) {
+      if (markerOffset === -1) {
         throw new Error('Login shell did not emit the Git output marker')
       }
       result.stdout = result.stdout.subarray(markerOffset + Buffer.byteLength(outputMarker))
diff --git a/docs/assets/readme-downloads.svg b/docs/assets/readme-downloads.svg
index a3074230367..610bdb8b92e 100644
--- a/docs/assets/readme-downloads.svg
+++ b/docs/assets/readme-downloads.svg
@@ -1,5 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 18m">
-  <title>downloads: 18m</title>
+<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 19m">
+  <title>downloads: 19m</title>
   <linearGradient id="s" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
@@ -15,7 +15,7 @@
   <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
     <text x="37" y="15" fill="#010101" fill-opacity=".3">downloads</text>
     <text x="37" y="14">downloads</text>
-    <text x="90" y="15" fill="#010101" fill-opacity=".3">18m</text>
-    <text x="90" y="14">18m</text>
+    <text x="90" y="15" fill="#010101" fill-opacity=".3">19m</text>
+    <text x="90" y="14">19m</text>
   </g>
 </svg>
diff --git a/docs/readme/README.ko.md b/docs/readme/README.ko.md
index e247ace7d7c..d02a025cb5f 100644
--- a/docs/readme/README.ko.md
+++ b/docs/readme/README.ko.md
@@ -36,7 +36,7 @@
 
 휴대폰에서 에이전트를 모니터링하고 조종하세요 — 에이전트가 완료되면 알림을 받고 어디서든 후속 지시를 보낼 수 있습니다.
 
-[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [Android APK](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.37/app-release.apk) · [문서 →](https://www.onorca.dev/docs/mobile)
+[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [TestFlight](https://testflight.apple.com/join/YjeGMQBA) · [Android APK 0.0.42](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.42/app-release.apk) · [문서 →](https://www.onorca.dev/docs/mobile)
 
 </td>
 <td width="50%">
@@ -179,12 +179,14 @@ diff의 어느 줄에든 코멘트를 남기고 에이전트에게 바로 보내
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
+  <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="MiMo Code logo" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
   <a href="https://ampcode.com/manual#install"><kbd><img src="https://www.google.com/s2/favicons?domain=ampcode.com&sz=64" alt="Amp logo" width="16" valign="middle" /> Amp</kbd></a> &nbsp;
   <a href="https://openclaude.gitlawb.com/"><kbd><img src="../../resources/openclaude-logo.png" alt="OpenClaude logo" width="16" valign="middle" /> OpenClaude</kbd></a> &nbsp;
   <a href="https://antigravity.google/docs/cli-overview"><kbd><img src="https://www.google.com/s2/favicons?domain=antigravity.google&sz=64" alt="Antigravity logo" width="16" valign="middle" /> Antigravity</kbd></a> &nbsp;
   <a href="https://pi.dev"><kbd><img src="https://pi.dev/favicon.svg" alt="Pi logo" width="16" valign="middle" /> Pi</kbd></a> &nbsp;
   <a href="https://omp.sh"><kbd><img src="https://omp.sh/favicon.svg" alt="oh-my-pi logo" width="16" valign="middle" /> oh-my-pi</kbd></a> &nbsp;
   <a href="https://hermes-agent.nousresearch.com/docs/"><kbd><img src="https://www.google.com/s2/favicons?domain=nousresearch.com&sz=64" alt="Hermes Agent logo" width="16" valign="middle" /> Hermes Agent</kbd></a> &nbsp;
+  <a href="https://devin.ai/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=devin.ai&sz=64" alt="Devin logo" width="16" valign="middle" /> Devin</kbd></a> &nbsp;
   <a href="https://block.github.io/goose/docs/quickstart/"><kbd><img src="https://www.google.com/s2/favicons?domain=goose-docs.ai&sz=64" alt="Goose logo" width="16" valign="middle" /> Goose</kbd></a> &nbsp;
   <a href="https://docs.augmentcode.com/cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=augmentcode.com&sz=64" alt="Auggie logo" width="16" valign="middle" /> Auggie</kbd></a> &nbsp;
   <a href="https://github.com/autohandai/code-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=autohand.ai&sz=64" alt="Autohand Code logo" width="16" valign="middle" /> Autohand Code</kbd></a> &nbsp;
@@ -211,6 +213,7 @@ diff의 어느 줄에든 코멘트를 남기고 에이전트에게 바로 보내
 
 - **[onOrca.dev에서 다운로드](https://onorca.dev/download)**
 - 또는 빌드를 직접 받기: [macOS Apple Silicon](https://github.com/stablyai/orca/releases/latest/download/orca-macos-arm64.dmg) · [macOS Intel](https://github.com/stablyai/orca/releases/latest/download/orca-macos-x64.dmg) · [Windows (.exe)](https://github.com/stablyai/orca/releases/latest/download/orca-windows-setup.exe) · [Linux AppImage](https://github.com/stablyai/orca/releases/latest/download/orca-linux.AppImage) · [전체 빌드](https://github.com/stablyai/orca/releases/latest)
+- headless Linux 서버에서 `orca serve`를 실행하시나요? [Headless Linux 서버 가이드](../reference/headless-linux-server.md)를 확인하세요.
 
 _또는 패키지 매니저로 설치:_
 
@@ -226,8 +229,8 @@ yay -S stably-orca-bin
 
 데스크톱 앱과 페어링해 휴대폰에서 에이전트를 모니터링하고 조종하세요.
 
-- **iOS:** [App Store에서 다운로드](https://apps.apple.com/us/app/orca-ide/id6766130217)
-- **Android:** [APK 다운로드](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.37/app-release.apk)
+- **iOS:** [App Store에서 다운로드](https://apps.apple.com/us/app/orca-ide/id6766130217) 또는 [TestFlight 참여](https://testflight.apple.com/join/YjeGMQBA)
+- **Android:** [APK 0.0.42 다운로드](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.42/app-release.apk)
 
 ---
 
@@ -235,6 +238,10 @@ yay -S stably-orca-bin
 
 - **Discord:** **[Discord](https://discord.gg/fzjDKHxv8Q)** 커뮤니티에 참여하세요.
 - **Twitter / X:** 업데이트와 공지는 **[@orca_build](https://x.com/orca_build)** 를 팔로우하세요.
+- **WeChat:** QR 코드를 스캔해 Orca 커뮤니티 WeChat 그룹 7에 참여하세요.
+
+  <img src="../assets/wechat-qr-group7.jpg" alt="Orca 커뮤니티 WeChat 그룹 7 QR 코드" width="160" />
+
 - **피드백과 아이디어:** 우리는 빠르게 출시합니다. 필요한 기능이 있나요? [새 기능을 요청](https://github.com/stablyai/orca/issues)하세요.
 - **개인정보 보호:** Orca가 수집하는 익명 사용 데이터와 수집 거부 방법은 [개인정보 및 텔레메트리 문서](https://www.onorca.dev/docs/telemetry)를 참고하세요.
 - **응원하기:** 이 리포지토리에 [Star](https://github.com/stablyai/orca)를 눌러 매일 공개되는 릴리스 소식을 확인해 주세요.
@@ -249,6 +256,14 @@ yay -S stably-orca-bin
   <img src="https://contrib.rocks/image?repo=stablyai/orca" alt="Orca 기여자" />
 </a>
 
+<p align="center">
+  <img src="../assets/star-history.png" alt="stablyai/orca GitHub Star 히스토리 차트" width="880" />
+</p>
+
+## 서명된 빌드
+
+Windows 코드 서명은 [SignPath.io](https://signpath.io)가 후원·제공하며, 인증서는 [SignPath Foundation](https://signpath.org)에서 제공합니다.
+
 ## 라이선스
 
 Orca는 [MIT 라이선스](../../LICENSE)에 따라 자유롭게 사용할 수 있는 오픈 소스입니다.
diff --git a/docs/reference/renderer-agent-status-performance.md b/docs/reference/renderer-agent-status-performance.md
new file mode 100644
index 00000000000..8ed43d868ce
--- /dev/null
+++ b/docs/reference/renderer-agent-status-performance.md
@@ -0,0 +1,328 @@
+# Renderer agent-status performance
+
+## Status
+
+This design is adopted for the renderer's high-frequency agent-status path. It
+keeps the existing event semantics while bounding the amount of synchronous
+store fanout performed for one IPC burst.
+
+It lands in slices. This document and the `bench:idle-cpu` harness land first so
+the store changes can be reviewed against a baseline someone else measured. Until
+the store slice lands, the `setAgentStatuses` / `transactAgentStatuses` actions
+and the agent-status write workload described below are not yet on `main`; the
+harness measures scale, listener census, and raw publication fanout only.
+
+## Context
+
+Orca can display a large expanded worktree lineage inside one virtualized list
+row. Virtualizing the root row does not virtualize its descendants, so a
+100-worktree lineage can mount 100 `WorktreeCard` instances at once.
+
+Agent-status IPC events are bursty. The renderer already groups live events into
+a 33 ms window, but the original flush applied every queued event with a
+separate Zustand write. Zustand synchronously visits every listener for every
+publication. The resulting work therefore grew with both the number of status
+events and the number of mounted subscriptions:
+
+```text
+burst work ~= status events x store listeners x selector work
+```
+
+A production trace captured the renderer repeatedly entering
+`flushLiveAgentStatusBurst -> applyAgentStatus -> setAgentStatus -> setState`
+through `Set.forEach`. A deterministic 100-worktree fixture reproduces the
+structural multiplier; see "Baseline on `main`" below for the currently measured
+listener count and publication cost.
+
+The production app later recovered substantially when all configured remote
+hosts were removed. Host removal can stop relay/reconnect traffic, remove
+mounted remote worktrees, or both, depending on host type and removal options.
+That observation identifies remote presence as the production trigger but does
+not by itself distinguish traffic volume from mounted-listener fanout.
+
+A read-only reconnect audit ruled out systematic double status emission from a
+full PTY replay: replay bytes bypass OSC status parsing. Reconnect still causes
+a full terminal-buffer repaint for every attached remote pane, which is a
+separate source of renderer work and remains a follow-up investigation.
+
+## Goals
+
+- Keep a large expanded lineage responsive during dense agent-status traffic.
+- Preserve every ordered status transition, including repeated updates for one
+  pane inside the same burst.
+- Publish agent-status state once for a deferred live burst.
+- Preserve selector identity and child render isolation.
+- Make the regression reproducible without relying on a user's production data.
+
+## Non-goals
+
+- Changing the client/server status payload or remote protocol.
+- Deduplicating status events by pane.
+- Changing agent freshness, retention, history, title, completion, or provider
+  session behavior.
+- Changing remote reconnect, PTY replay, or terminal repaint behavior.
+- Redesigning lineage presentation or collapsing worktrees automatically.
+
+## Design
+
+### Bound mounted subscription fanout
+
+Sidebar components select cohesive state bundles with shallow equality instead
+of registering one listener per field. Derived arrays and maps retain their
+existing shallow identity behavior so unrelated store writes do not rerender a
+card. Full agent-list mode keeps its child-level subscription boundary; compact
+mode passes the already selected rows to avoid selecting the same inputs twice.
+
+The deterministic 100-worktree fixture pins the resulting listener budget:
+
+| Surface                        | Listener budget |
+| ------------------------------ | --------------: |
+| Worktree card state and caches |               2 |
+| Agent-row inputs               |               1 |
+| Worktree activity status       |               1 |
+| Closed context menu            |               1 |
+
+Unmount tests require the listener count to return to its prior baseline. In the
+bundled prototype, the fixture without seeded agents fell from 8,518 listeners
+to 1,218; with 100 visible agent rows the candidate mounted 1,618. Compare
+against the census in "Baseline on `main`", which the harness reports directly.
+
+### Share working-spinner phase without per-element animation queries
+
+Working rows keep the existing compositor-driven CSS animation and shared
+visual phase. Each mount derives one negative animation delay from the document
+timeline instead of querying `getAnimations()` and mutating the animation start
+time. This removes per-row Web Animations setup from dense status transitions
+without adding a JavaScript animation clock.
+
+### Fold a burst in event order
+
+The store exposes the single-update action and two batch forms:
+
+- `setAgentStatus(paneKey, payload, ...)` retains the positional single-update
+  API for the immediate live path.
+- `setAgentStatuses(updates)` applies a prebuilt ordered list, while
+  `transactAgentStatuses(operation)` lets IPC derive each update against the
+  exact staged state before the single commit.
+
+Both entry points reuse the same single-update state transition. The batch
+reducer passes each resulting state into the next update, so a sequence such as
+`working -> waiting -> done` retains the same history and timestamps as three
+sequential calls. Updates are never keyed or deduplicated before the fold.
+
+The live IPC queue is spliced before it is processed. This preserves the
+existing reentrancy guarantee: a synchronous subscriber can enqueue another
+event without causing the current queue to be drained recursively. The first
+event outside an active burst remains immediate; events accumulated within the
+33 ms window are applied as one ordered transaction. Startup snapshots and
+bounded pending-hydration retries use the same transaction path instead of
+publishing once per restored pane.
+
+Each transaction builds pane-routing ownership once with the same first-match
+semantics as the standalone resolver. Split-layout leaf membership is indexed
+once per layout root, so a large snapshot performs linear tab and leaf work
+instead of rescanning every mounted worktree for every pane.
+
+### Run effects after the transaction
+
+Generated-title work that requires committed state is deferred until after the
+transaction. Accepted updates also request freshness scheduling; the outer batch
+coalesces those requests and schedules the shared freshness timer once after its
+single commit. Generated-title requests are folded in event order and published
+together, including first-write and forced-replacement semantics. Resolved tab
+titles are projected while the transaction folds, then final title changes are
+published together. Completion-triggered review refreshes remain deferred
+microtasks.
+
+Bulk title application preserves event order and duplicate-tab behavior while
+indexing owners once, cloning each changed owner array once, and replacing each
+top-level map once. This keeps the post-commit title phase linear in mounted
+tabs plus changed titles.
+
+This separation is important: invoking store actions from inside a Zustand
+updater would re-enter the store, while running an effect before the commit
+would let it observe stale state.
+
+## Semantic invariants
+
+Sequential and batched application must agree on:
+
+- live and retained agent maps;
+- state history, `updatedAt`, and `stateStartedAt`;
+- agent identity, model, prompt, tools, assistant messages, and subagents;
+- orchestration and provider-session continuity;
+- sleeping-session and launch-config recovery records;
+- retired/closed-pane rejection and inherited-status suppression;
+- retention cleanup and live-map eviction;
+- `agentStatusEpoch` and `sortEpoch`;
+- automation completion observation across intermediate transitions;
+- generated-title inputs, freshness scheduling, and completion refreshes.
+
+Equivalence tests use fixed timestamps and include repeated same-pane
+transitions. A publication-count test subscribes to the real store and requires
+one notification for a non-empty batch and none for an empty batch.
+
+## Benchmark contract
+
+The benchmark launches an E2E-mode Electron build with the store exposed only
+for instrumentation. It creates 100 worktrees in one expanded lineage, verifies
+100 mounted cards, captures the store listener census, and then applies seeded
+ordered agent-status traffic through the real store action.
+
+The benchmark measures the synchronous store action, not the live IPC leading
+edge or post-commit notification path. A real-store snapshot test covers the
+end-to-end budget for 100 panes with auto-generated titles enabled: one status,
+one bulk generated-title, and one bulk resolved-title publication. Disabling
+generated titles removes that middle publication, independent of pane count.
+
+The artifact records only fixed diagnostic fields needed for comparison:
+
+- requested and completed batches and updates;
+- store action calls and observed publications;
+- elapsed time, throughput, and scheduling drift;
+- final-state verification;
+- renderer mean, p95, and maximum CPU;
+- renderer timer drift and long tasks;
+- mounted-card and listener counts.
+
+Raw process inventories, temporary paths, pane identifiers, and DOM text are
+diagnostic-only and must not be embedded in the shareable report.
+
+Run baseline and candidate on the same machine and OS with the same Electron
+build mode. CPU samples from macOS and Linux are comparable within that
+constraint; Windows process CPU collection currently cannot support this
+comparison.
+
+## Harness
+
+`pnpm run bench:idle-cpu` drives `config/scripts/run-idle-cpu-benchmark.mjs`,
+which composes four modules:
+
+| Module                                | Responsibility                                                                                    |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------- |
+| `idle-cpu-renderer-scale-fixture.mjs` | Seeds the lineage, agent rows, and sidebar view state; takes the mounted-card and listener census |
+| `idle-cpu-renderer-timing-probe.mjs`  | In-page timer drift and long-task probe; runs the no-op publication workload                      |
+| `idle-cpu-process-sampling.mjs`       | Classifies the Electron process tree and samples per-role CPU/RSS                                 |
+| `idle-cpu-synthetic-spinners.mjs`     | Measurement-only visible spinners                                                                 |
+
+The sampling window extends past `--sample-ms` until the workload settles, and
+fails the run rather than reporting a truncated window if the workload overruns
+the guard. That is why a 2,000-publication run reports a measured window longer
+than the requested one.
+
+`--zustand-publications` publishes an empty partial through the real store, so
+each publication costs exactly one full subscriber visit and nothing else. It
+isolates the `listeners x selector work` half of the burst-cost model from
+agent-status payload work, and it is store-API independent — it measures the
+same thing before and after the batching slice.
+
+The agent-status write workload (`--agent-status-batches`,
+`--agent-status-write-mode`) is not in this harness yet. It depends on
+`setAgentStatuses`, so it lands with the store slice.
+
+## Baseline on `main`
+
+Measured on `main` at `077f5a11cd4` (macOS, arm64, 16 CPUs), Electron built with
+`electron-vite --mode e2e`, headless, 100 worktrees at lineage depth 99 with 100
+seeded agent rows, 10 s warmup and a 30 s sampling window.
+
+Fixture scale is confirmed by the census rather than assumed: 100 store
+worktrees, 100 mounted cards, 100 mounted agent rows, and **9,279 store
+listeners**. That listener count is the multiplier the design targets.
+
+2,000 no-op store publications at a 1 ms cadence, three repetitions. The
+listener census was 9,279 in every run.
+
+| Measure                  |      Median | Runs                           |
+| ------------------------ | ----------: | ------------------------------ |
+| Wall time to complete    | 12,325.7 ms | 13,148.6 / 12,325.7 / 11,870.5 |
+| p50 scheduling drift     |  5,150.3 ms | 5,432.3 / 5,150.3 / 4,945.2    |
+| p95 scheduling drift     |  9,802.9 ms | 10,570.4 / 9,802.9 / 9,390.0   |
+| Renderer mean CPU        |      18.25% | 20.25 / 18.25 / 15.88          |
+| Renderer p95 CPU         |      32.59% | 40.07 / 32.59 / 31.28          |
+| Renderer timer drift p95 |      7.0 ms | 7.3 / 5.3 / 7.0                |
+
+2,000 publications requested over 2 s take about 12 s, so the renderer sustains
+roughly 160 publications per second at this scale. Each publication is
+individually short - the long-task observer recorded zero entries in all three
+runs - so the cost surfaces as scheduling drift and sustained CPU rather than as
+discrete long tasks. Compare drift and CPU here, not long-task counts.
+
+The idle control at the same scale with `--zustand-publications 0` reports 6.63%
+renderer mean CPU, 17.11% p95, and 1.6 ms p95 timer drift. Roughly 11.6 points
+of mean renderer CPU are therefore attributable to publication fanout rather than
+to the mounted fixture itself. 200 spinner animations run in both cases, so the
+control also bounds the animation cost out of the comparison.
+
+Reproduce with:
+
+```bash
+pnpm run bench:idle-cpu -- --worktrees 100 --lineage-depth 99 \
+  --agents-per-worktree 1 --warmup-ms 10000 --sample-ms 30000 \
+  --zustand-publications 2000 --zustand-publication-interval-ms 1 \
+  --output /tmp/idle-cpu-baseline.json
+```
+
+## Results
+
+Three repetitions used 100 mounted worktrees, lineage depth 99, 100 seeded
+agent rows, and verified final state. Medians from the regenerated evidence set
+are:
+
+| Single 2,000-update burst | Sequential |    Batched |
+| ------------------------- | ---------: | ---------: |
+| Status-state publications |      2,000 |          1 |
+| Store action time         | 3,692.0 ms |   188.7 ms |
+| Update throughput         |    541.7/s | 10,598.8/s |
+| Renderer mean CPU         |      36.2% |       2.9% |
+| Renderer p95 CPU          |     107.3% |       8.2% |
+| p95 long task             |   4,653 ms |     216 ms |
+
+The direct store transaction performs 99.95% fewer status-state publications,
+spends 94.9% less time in the store action, and processes updates 19.6 times
+faster. Renderer mean CPU falls 92.0%, renderer p95 CPU falls 92.4%, and the p95
+long task falls 95.4%.
+
+The 60-burst × 32-update case at 33 ms is a sustained saturation stress, not a
+real-time production SLO. Publications fall from 1,920 to 60 and median store
+action time falls from 2,791.9 ms to 323.3 ms. Median completion time falls from
+5,298.2 ms to 2,710.6 ms, p95 scheduling drift falls from 3,073.0 ms to 664.9
+ms, and long-task count falls from 57 to 1. Renderer p95 CPU remains saturated
+and noisy in this cadence, so it is not used as the discriminating measure.
+
+The 20-pane artificial OpenCode regression passes with 12.4 ms median key echo,
+25.2 ms worst key echo, 19.4 ms maximum timer drift, and zero dropped renderer
+backlogs.
+
+These figures come from the bundled prototype and are restated here as the
+target. They are re-measured with the harness when the store slice lands.
+
+## Acceptance criteria
+
+- The 100-worktree fixture stays at or below the pinned listener budgets.
+- A deferred transaction performs one status-state publication while preserving
+  ordered final state, including live-map eviction at the 500-row cap.
+- A 100-pane startup snapshot performs one status and one bulk resolved-title
+  publication with generated titles disabled; enabling generated titles adds at
+  most one ordered bulk publication while preserving final statuses and titles.
+- Sequential-versus-batch equivalence tests pass across same-pane transitions
+  and side-effect-bearing updates.
+- Renderer CPU tails and scheduling drift improve in repeated candidate runs.
+- The 20-pane artificial terminal test reports no dropped output backlog and no
+  material typing-latency regression.
+- Web typecheck, focused unit tests, lint, max-lines ratchet, and E2E build pass.
+
+## Compatibility
+
+This is renderer-local. It adds no RPC field, stream opcode, persisted data, Git
+command, or provider-specific contract. Native, WSL, SSH, relay, folder
+workspace, and git-worktree status events enter the same renderer action. Mixed
+client/server versions therefore need no capability negotiation.
+
+## Failure containment
+
+The first live event remains immediate. Startup replay and bounded pending
+retries fold synchronously without waiting for the 33 ms live-burst window, but
+publish their accepted updates together. Empty batches are no-ops. If an update
+is stale or targets retired authority, the reducer skips only that update and
+continues folding later events in order.
diff --git a/docs/reference/terminal-session-behavior-contract.md b/docs/reference/terminal-session-behavior-contract.md
new file mode 100644
index 00000000000..e345f36c8c2
--- /dev/null
+++ b/docs/reference/terminal-session-behavior-contract.md
@@ -0,0 +1,146 @@
+# Terminal session behavior contract
+
+Properties every terminal-session change must preserve. They describe
+observable behavior, not mechanism, so a test written against them stays valid
+under any implementation.
+
+Oracles for the STA-3077 properties live in
+`src/main/ssh-reattach-pane-cardinality.test.ts`.
+
+## Why this exists
+
+Reconnecting an SSH-backed workspace used to add panes the user never opened,
+and the remote host accumulated shells nobody was using — one report went from
+2 to 19 to 20 relay PTYs across three reconnects. The failures in this class
+share one shape: **something absent was treated as something dead**, or a
+reattach was allowed to create what it should only have bound.
+
+## A. Unknown is not dead
+
+A disconnect, timeout, absent inventory entry, or failed inspection means
+_unresolved_. None of them may terminate a PTY, release a binding, or authorize
+cleanup.
+
+**A5** — a timer may never be the _sole cause_ of a destructive action. A timer
+that bounds a wait or triggers re-verification is fine; a timer that kills is
+not. Retry count never decides identity or liveness.
+
+This is deliberately weaker than "no timers". Recovery budgets and scratch-file
+age-gates are correct code and must stay.
+
+Two patterns make a retention bound safe, and both beat shortening it:
+
+- measure **process time**, not wall clock, so a suspended laptop does not
+  burn the budget;
+- gate aggressive reclamation on an **independent observation** — a second
+  consecutive scan, or another client completing a handshake — so the clock
+  bounds a wait while evidence authorizes the act.
+
+**B** — respawn requires proof. A failure that does not prove the session is
+gone is unresolved: leave the shell running and keep the binding. An
+unrecognized failure must never become a respawn, because a duplicated shell
+is worse than a stalled one.
+
+## B. Attach binds; it never creates
+
+An ambiguous, unavailable, or rejected attach does not spawn a shell and does
+not grow topology — no minted tab, no minted leaf, no split root, no minted
+layout. Only an explicit create for a fresh pane may spawn.
+
+Corollary: after a recovery, keystrokes cannot land on a different shell than
+the one that was visible before it.
+
+## C. Exact-binding fencing
+
+Mutating operations name the binding captured before the first await and are
+rejected when any component no longer matches. A stale operation cannot reach a
+later pane generation, a later PTY incarnation reusing the same id, or a
+restarted owner. Output and exit arriving under a stale binding are dropped.
+
+The store already enforces this via `persistPtyBinding`'s `expectedBinding`
+compare-and-swap and the per-repo topology revision fence.
+
+## D. Cardinality
+
+One pane owns at most one live PTY binding, and one PTY incarnation belongs to
+at most one pane. Lease identity must therefore include the pane, not just the
+transport id — keying on `(targetId, ptyId)` alone is what let predecessors
+accumulate.
+
+Superseding a lease marks it expired; it does not kill the remote process,
+because losing a lease is not proof the shell died.
+
+## E. Ordering and loss
+
+Output is delivered in PTY order. A gap is resolved by resnapshot, never by
+silently continuing. A correctness-bearing effect (exit, command completion,
+review link, bell) is neither lost while the renderer is unmounted nor applied
+twice after a replay.
+
+Bounded replay plus idempotent application by event key satisfies this. A
+durable per-consumer delivery cursor is not required, and is not currently
+used.
+
+**Lifecycle is state, not an event.** An exit that happens while nothing is
+attached is not recovered from a delivery channel — it is read during the
+attach handshake. The attach reply should carry whether the session is alive
+or exited, its exit code, and the resume offset. That is what removes the need
+to guarantee delivery of an exit _event_, and it is why no journal is required
+here.
+
+Where a resume offset cannot be served, advance the offset explicitly by the
+size of the gap and persist the running total, so "output was lost here" stays
+a queryable fact rather than a silent discontinuity.
+
+## F. Isolation
+
+A failure on one host cannot affect another host; a failure in one workspace
+cannot affect another on the same connection. There is no process-wide failure
+fence.
+
+## G. Liveness
+
+Every fail-closed path needs a bounded, user-reachable recovery. A workspace
+must never reach a state that permanently refuses terminal operations with no
+operator escape — in particular, backpressure from a consumer that is gone
+forever must be releasable without that consumer's cooperation.
+
+Unavailable transports retry with bounded backoff and bounded memory.
+
+## H. Compatibility
+
+Clients and hosts update independently. A capability is negotiated or the newer
+side degrades; a required operation is never silently dropped. New stream
+opcodes must be capability-negotiated, because decoders drop unknown opcodes
+silently. Nothing is gated on an app build id.
+
+See [`remote-wire-compatibility.md`](./remote-wire-compatibility.md).
+
+## I. Cost
+
+No new work on the input hot path and none per output frame. Pane create and
+close latency must not regress, including over a high-latency SSH link. No
+startup-blocking probe of a host nothing has asked for.
+
+---
+
+## Test the call site, not the capability
+
+A guard that exists and is never passed is indistinguishable from no guard.
+`mayCreate` was added to `persistPtyBinding`, was correct, and had no
+production caller for several commits — every store-level test passed the whole
+time, because they called the store directly.
+
+So for anything that refuses a destructive action, pin the **caller**: assert
+that the reattach path passes the refusal, not merely that the store honours it
+when asked. The same applies to a classifier — assert the branch that consumes
+its verdict is reachable, since a guard behind an unreachable `catch` is dead.
+
+## Deliberately not required
+
+A durable event journal, per-consumer cumulative delivery cursors, and
+cryptographic device principals are **not** required by any property above.
+Each would need to earn its place by being the only way to satisfy one of them.
+
+Principals, in particular, exist only to key cursors: without cursors there is
+nothing for them to key.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/PR-13326-REPLACEMENT-DESIGN-2026-08-13.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/PR-13326-REPLACEMENT-DESIGN-2026-08-13.md
new file mode 100644
index 00000000000..0e5eae53bc4
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/PR-13326-REPLACEMENT-DESIGN-2026-08-13.md
@@ -0,0 +1,192 @@
+# Design: make "Start a new terminal" a replacement, not a spawn
+
+Supersedes the mechanism in `PR-13326-SESSION-HANDOFF-2026-08-12.md` §"Approved bounded redesign".
+Keeps its **properties**; replaces several of its **mechanisms** with smaller ones, and adds the
+thing it was missing — a way to actually run the decisive test.
+
+## 1. The defect, stated once
+
+"Start a new terminal" is routed through a path whose job is *"resolve this pane's owner and attach
+it; spawn only if there is none."* Creation is that path's fallback, not its purpose. The pane's
+durable binding still names the old shell at click time, so the path resolves it and adopts it.
+
+I confirmed this first-hand earlier in the branch: commit `ab6ce176f3f` detects adoption after the
+fact (`freshPtyId === sessionId`) and stops the callback from unbinding the live shell. Its own
+message records that suppressing the adoption itself was left undone. So the adoption is real, and
+the current code only contains its worst consequence.
+
+## 2. Why every previous fix leaked
+
+Each attempt expressed "do not adopt" as **another condition inside the adopting path**. Conditions
+are forgettable and order-dependent, and this branch has three shipped proofs of that failure mode:
+
+- a guard centralised into a publisher that returned `void`, so four callers paired a conditional
+  publish with an unconditional `return`;
+- the same rule applied to the tombstone branch and missed on the liveness branch beside it;
+- the incarnation fence sent on the pane-driven route and not on the reconnect route.
+
+Every one was "the rule exists, but this path does not ask it." A fourth condition in the same path
+is the same bet again.
+
+## 3. The design, and why it removes the defect
+
+### P1 — Replacement is a separate operation that cannot adopt
+
+Add a main-owned entry that performs replacement only. It contains **no owner-resolution call**: it
+does not read a stable-pane owner, does not accept `sessionId`/`attachOnly`, and constructs provider
+options from a narrow main-owned allowlist (dimensions + validated pane/workspace identity).
+
+*Why this fixes it:* adoption stops being a branch that must be avoided and becomes code that is not
+present. A function with no owner-resolution cannot adopt for the same reason a function with no
+socket cannot make a network call. This converts "remember to skip adoption" (liveness) into "there
+is nothing here to adopt with" (structure).
+
+*Falsifiable by:* route the action back through generic spawn — the oracle in P0 must redden.
+
+### P2 — Ownership moves in one durable commit, keyed on exact incarnation
+
+One Store method mutates and flushes once: exact-CAS the old binding and the old active lease,
+install the new binding + incarnation + attached lease, expire the exact old lease **without
+touching its process**, bump the topology/lease versions, flush.
+
+*Why:* ownership lives in the durable binding and the lease. Moved separately, there is a window
+where a racing reconnect sees a half-moved pane and restores the predecessor. One commit means the
+window does not exist rather than being narrow.
+
+*Why exact incarnation:* the relay reissues `pty-N` from 1 after a reset, so any CAS keyed on ptyId
+alone can match a different process. This branch already proved that and already carries the
+primitive: host-attested `SshRemotePtyLease.incarnationId`, the relay-side `expectedIncarnationId`
+fence, and `isRelayAttestedPtyIncarnationId` filtering synthesised values.
+
+*Falsifiable by:* split the commit in two flushes and drive a reconnect between them.
+
+### P3 — Ambiguity leaks, never kills
+
+Provider/relay shutdown identifies a PTY by id only. After a dispatched spawn whose outcome is
+ambiguous, we cannot prove which incarnation a shutdown would reach. So: clean up a failed new shell
+only when its exact incarnation is provable; otherwise leave it running and unbound for the existing
+cleanup surface to reap.
+
+*Why:* the costs are asymmetric. Leaking costs an orphan shell that a user can already list and
+terminate. Killing the wrong incarnation destroys a live agent session — the exact harm this whole
+program exists to prevent.
+
+*Falsifiable by:* make the ambiguous path call shutdown; the oracle asserting zero kill RPCs on an
+unprovable outcome must redden.
+
+### P4 — The successor is invisible until it is the owner
+
+Spawn the replacement hidden and install its output handlers only after P2 commits.
+
+*Why:* a new shell reusing the old raw id could otherwise deliver bytes into the predecessor's
+model. Ordering removes the window without a new quarantine subsystem.
+
+### P5 — Stale renderer work does nothing
+
+Guard every completion on: not disposed, current transport identity, current action generation. A
+stale callback must not clear a binding, republish the card, or kill a result. Main owns the durable
+transition, so the renderer never clears the old binding on success.
+
+## 4. What I am deliberately NOT building, and the risk of each
+
+The handoff prescribes more machinery. I judge these unnecessary for this defect; each is a
+reversible decision if an oracle shows otherwise.
+
+| Prescribed | Decision | Reasoning | Risk if I am wrong |
+|---|---|---|---|
+| Opaque ticket bound to ~11 fields (sender, both generations, worktree, tab, leaf, pane key, both ids, both incarnations, expiry, 5-state machine) | **Replace** with an operation id + expected-owner `{ptyId, incarnationId}` CAS | The renderer is not a trust boundary — it can already open terminals. The ticket's real jobs are staleness and idempotency, which the CAS and op id give directly. Eleven bindings add eleven invalidation paths, and invalidation bugs are the same class we are trying to leave | A forged/stale request creates one blank shell for a pane the user owns — recoverable, and the CAS still refuses to move ownership off an unexpected incumbent |
+| A new shared owner mutex | **Reuse** `paneSpawnReservationsByOwnerKey` (already per-pane) and the runtime pane-create claim | Serialisation already exists at exactly this granularity; a second lock invites lock-order bugs | Two operations interleave on one pane; the P2 CAS still refuses the loser |
+| A quarantine subsystem for provider output | **Reuse** hidden spawn + install-after-commit ordering | Achieves the same property with existing options | Bytes reach the wrong model; caught by the P4 oracle |
+
+## 5. The part the previous session was missing: the decisive test can now run
+
+`tests/e2e/ssh-disconnected-pane-affordance.spec.ts` holds the decisive case at `test.fixme` because
+**the state was not inducible**: it needs the SSH target CONNECTED while exactly one pane's
+`pty.attach` fails with an error that does not prove the shell gone. Host faults tried (SIGSTOP the
+relay) take the whole connection down and produce the connection overlay instead.
+
+That state is now inducible, by a mechanism this branch added for another reason. The relay refuses
+an attach whose `expectedIncarnationId` names a different shell, with
+`PTY "<id>" identity mismatch` — per-pty, connection healthy, and explicitly not proof of death
+(`SSH_PTY_IDENTITY_MISMATCH` never grounds a respawn).
+
+So the test can seed the pane's lease with an incarnation that is not the host's, reconnect, and get
+exactly the state the banner needs — deterministically, with no timing fault.
+
+**This is the highest-value item in the plan and it comes first.** The previous session looped
+because every claim was adjudicated by reading code; with the oracle running, the design is
+*demonstrated* instead of argued, and a regression reddens instead of being found in review.
+
+## 6. Goalposts
+
+Each is a behaviour with a stated mutation that must redden it. G1 is a prerequisite for believing
+any of the others.
+
+| # | Goalpost | Mutation that must redden it |
+|---|---|---|
+| **G1** | The decisive E2E runs unskipped: with the target connected, one pane unreachable, clicking "Start a new terminal" yields exactly one new remote shell, the pane count is unchanged, and the host transcript shows no second agent launch | Remove the induction; the test can no longer reach the banner |
+| **G2** | The action never adopts: the pane's shell id/incarnation after the click differs from before, and the new shell has no command, resume metadata, launch token, agent, or startup delivery | Route the action back through generic `pty:spawn` |
+| **G3** | Ownership moves atomically: a reconnect racing the replacement cannot restore the predecessor; binding and lease agree at every observable point | Split the durable commit into two flushes |
+| **G4** | Ambiguity never kills: on an unprovable spawn outcome, zero shutdown RPCs are issued and neither process dies | Call ID-only shutdown on the ambiguous path |
+| **G5** | The successor is silent until it owns the pane: no provider bytes reach the predecessor's model, including when the raw id is reused | Install output handlers before the commit |
+| **G6** | Stale renderer work is inert: a disposed or superseded callback clears no binding, republishes no card, kills no result | Drop the generation guard on the completion path |
+
+## 7. Sequence
+
+0. Remove the rejected six-file WIP (targeted edits, not a broad restore — the worktree is dirty).
+1. **G1** — induction + un-`fixme`. Nothing else is believable until this runs.
+2. **G2** — the separate replacement operation.
+3. **G3** — the single durable commit.
+4. **G4/G5/G6** — ambiguity, ordering, staleness.
+5. Adversarial review on both models, then push.
+
+## 8. Stop conditions
+
+- If G1 cannot be made to run, stop and report. Building 2–6 without it repeats the previous loop.
+- If exact cleanup cannot be achieved within existing local/provider contracts, take the leak (P3).
+  Do **not** add `expectedIncarnationId` to remote shutdown — that is a separate, capability-
+  negotiated wire change with its own review.
+
+---
+
+## 9. Findings from running the gate (2026-08-13)
+
+The oracle in §5 works: the state is inducible and the card appears reliably. Running it found
+three things that reading had not.
+
+**Fixed — the card's buttons were unclickable.** `TerminalErrorToast` renders at `z-50` in the same
+bottom strip and was suppressed only for the connection overlay, not for the pane's own card. In
+the one state this affordance exists for, both actions were covered. `TerminalPane.tsx` now also
+suppresses it while the active pane shows the card.
+
+**Fixed — a session id is the instruction to attach.** "Start a new terminal" was still sending the
+pane's recorded `sessionId`, which routes straight to reattach before any pane-owner logic runs, so
+the action attached the very shell it could not reach and created nothing. Skipping owner
+resolution in main was NOT enough on its own; the id had to be dropped at the last gate before the
+IPC (`admittedSessionId` in `pty-transport.ts`).
+
+**OPEN — the action produces no spawn at all.** With both fixes in, the measured result after
+clicking is still `visible=true launches=1 shells=1`: the card clears briefly, no shell is created,
+and the card returns. The main log over the same window shows only the pane's own restore retries
+(three `spawn() called with sessionId=…` → `identity mismatch`), never a fresh spawn.
+
+The evidence points at the action closure rather than the spawn path: the pane retries its restore
+while the card is up, each retry republishes the card, and the button the test clicks appears to
+belong to a superseded connection whose `startFreshSpawn` no longer does anything. That is the
+"stale renderer work" hazard from the original handoff, showing up as a dead button rather than as
+a wrong write.
+
+**RESOLVED.** Instrumenting handler, transport and main in one correlated run disproved the
+closure hypothesis: the handler ran, the connection was live, and the renderer half was already
+correct — it sent no session id and asked for adoption to be refused. Main re-derived the id anyway.
+
+The rule had been applied at the two places an owner is PRODUCED and missed at the one place it is
+CONSUMED: `spawnForStablePane` turns an owner into `sessionId` for the provider, which is what makes
+an attach an attach. Gating there — `if (args.owner && !args.refuseAdoption)` — closes it for every
+producer at once, present and future.
+
+The gate now passes, and reverting that single condition reddens it.
+
+Lesson worth keeping: this rule leaked at three sites in a row (early owner resolution, the
+transport's session id, the owner consumption). Each fix was necessary and none was sufficient. The
+one that finally held was the one placed where the value is USED rather than where it is derived.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/PR-13326-SESSION-HANDOFF-2026-08-12.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/PR-13326-SESSION-HANDOFF-2026-08-12.md
new file mode 100644
index 00000000000..bd4900ddf52
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/PR-13326-SESSION-HANDOFF-2026-08-12.md
@@ -0,0 +1,823 @@
+# STA-3077 / PR #13326 session handoff
+
+> **Status:** paused at an approved bounded redesign; not release-ready.
+>
+> **Review/fix round:** 6.
+>
+> **Do not continue the current six-file implementation.** It is a rejected,
+> uncommitted grant-map approach. Remove it with `apply_patch`, then implement
+> the dedicated main-owned replacement transaction described below.
+
+This is the continuation entrypoint for the current PR. It records the whole
+session at the point the user asked to pause, including what shipped to the PR
+branch, what failed review, the agreed design boundary, and the next safe work.
+
+## Executive summary
+
+The session started with STA-3077's SSH reconnect failure class: reconnects
+could graft panes the user never created, accumulate remote shells, fabricate
+process death from an attach failure, or let stale identities affect a
+successor. The branch now contains extensive fixes, tests, design records, and
+two user-visible recovery actions for an unreachable pane.
+
+The pushed candidate is still incorrect in one important action. “Start a new
+terminal” invokes generic `pty:spawn` while the old durable pane binding remains.
+Main can adopt that old owner, so the action can reopen the old shell instead of
+creating the one blank shell the user requested.
+
+An attempted six-file fix added `freshSpawnForUnreachablePtyId` to generic spawn
+and a process-global grant map. Three independent read-only audits rejected it.
+The common verdict was that replacement must be a dedicated local transaction
+owned by Electron main, with exact incarnation identity, one durable Store
+commit, runtime ownership transfer, output quarantine, reconnect fencing, and
+renderer generation guards.
+
+The user approved this bounded redesign. It applies only to the broken
+unreachable-pane replacement operation. It is not authority to restart the
+earlier whole-system architecture effort.
+
+## Repository checkpoint
+
+Verified before this handoff was written:
+
+| Item                                | Value                                                |
+| ----------------------------------- | ---------------------------------------------------- |
+| Worktree                            | `/Users/nwparker/orca/workspaces/orca/eye-React-185` |
+| Local branch                        | `nwparker/sta-3077-reattach-pane-cardinality`        |
+| HEAD                                | `df6edfcebd2ea401a6feda1fccf31189e57eceda`           |
+| HEAD subject                        | `fix(ui): center narrow terminal recovery actions`   |
+| Actual PR                           | `stablyai/orca#13326`                                |
+| Actual PR ref                       | `origin/nwparker/sta-3077-d-affordance-and-review`   |
+| Actual PR ref SHA                   | exactly `df6edfcebd2ea401a6feda1fccf31189e57eceda`   |
+| Configured upstream                 | `origin/nwparker/sta-3077-reattach-pane-cardinality` |
+| Configured upstream SHA             | `518dac34415e0f67883461c3f58e5586209c7f24`           |
+| Local `origin/main`                 | `889dd4c7d2fe255aac552e4dcc91204279dc022c`           |
+| Merge base with local `origin/main` | `58a926170cd99baf8920a83a86799bfbd307d735`           |
+| Local `origin/main...HEAD`          | 10 commits on main / 109 commits on HEAD             |
+
+The configured upstream is stale. Its `[ahead 387]` status is not the PR's
+push state. The PR ref is exactly at HEAD. When the work is genuinely ready,
+push explicitly:
+
+```bash
+git push origin HEAD:nwparker/sta-3077-d-affordance-and-review
+```
+
+Before this document, the worktree had six modified tracked files, no untracked
+files, and a `+163/-11` uncommitted diff. `git diff --check` was clean. No
+product test, typecheck, lint, build, Electron, or E2E command was run against
+that dirty state.
+
+## The intended outcome
+
+For a pane whose old SSH terminal cannot currently be reached, the UI offers:
+
+- **Try again:** attempt to reattach the exact existing shell without claiming
+  it exited or spawning a replacement.
+- **Start a new terminal:** keep the same pane and leaf, create exactly one
+  genuinely blank shell, move durable and runtime pane ownership to it, and
+  leave the unproven old process alive but unbound.
+
+The second action must never:
+
+- silently adopt or resume the old shell;
+- resume an agent, command, launch token, startup sequence, or saved telemetry;
+- create another pane or tab;
+- kill a process whose exact incarnation is not proven;
+- let a reconnect restore the predecessor after replacement wins;
+- let stale renderer work clear, kill, or republish the successor;
+- expose provider output before the replacement commits; or
+- add replacement intent to SSH, relay, provider, paired-runtime, or stream
+  wire contracts.
+
+## What was done during the session
+
+The branch has 109 first-parent commits over its current merge base, including
+two large updates from `origin/main`. The useful progression is below; use the
+git history for the complete commit-by-commit record.
+
+### 1. Reconnect and persistence containment
+
+The early work stopped SSH reconnect from treating persisted rows as permission
+to create UI, made pane binding authoritative during duplicate arbitration,
+and added rollback around durable lease retirement.
+
+Representative commits:
+
+- `5d8bb18fd3f` — stop reconnect from grafting panes and stacking leases.
+- `ae134995c13` — heal duplicate pane leases from older state.
+- `ccb082740fc` — let the durable pane binding outrank recency.
+- `8d9aeb55e03` — roll back lease retirement when durable writing fails.
+- `03d794a0f90` — pass `mayCreate: false` from the production reattach writer.
+- `a7558a837ca`, `13ca7630116`, and `8ec025e4e46` — add and strengthen pane,
+  process, binding, and lease census oracles.
+
+### 2. Unknown is not death
+
+The session removed several paths that inferred a dead process from missing,
+unavailable, timed-out, or disconnected state.
+
+Representative commits:
+
+- `eec807d7594` — stop respawning a shell that may still be running.
+- `356d6b52b24` — apply positive-proof requirements to both reattach paths.
+- `b9d58423121` and `7589df8b348` — let PTY liveness remain unknown.
+- `7cd7fef927f` — a reattach not-found is not itself proof of shell death.
+- `e39514e9ab2` and `41613b5c84c` — distinguish bare not-found from a relay-
+  proven exit and retire a lease only in the latter case.
+
+This work also stopped one exhausted delivery recovery from tearing down every
+session on an SSH host (`07e382ec196`) and made parked delivery recoveries
+expire/re-enter correctly (`124e00e8a83`, `601604d17b1`).
+
+### 3. Exact operation and incarnation fencing
+
+The branch added or strengthened stale-operation refusal, host-attested shell
+identity, remembered-exit identity, and reconnect fences.
+
+Representative commits:
+
+- `0de5994be91` and `980e5d846b5` — fence stale writes, resize, and signals.
+- `235e45ad0f2` — record host-attested shell identity on a lease.
+- `30441f1ebbb` — fence recycled relay PTY IDs by shell identity.
+- `8f0c8e3ed35`, `42cbe34523f`, `c14ba64d9dc`, and `0cb187f6035` — require an
+  exit proof to name the shell for which it grants replacement authority.
+- `5793f186e96`, `be02c4e7f5c`, and `901dd06b8d1` — apply incarnation and pane
+  fences on reconnect, including clients unable to name a shell.
+- `c8d08e1b215` — strengthen the incarnation write-fence regression oracle.
+
+These improvements are valuable, but the round-6 review found that raw PTY ID
+is still used as identity in important lease/runtime/cleanup paths. The new
+replacement transaction must finish that exact-incarnation work for its own
+surface rather than assuming the existing fencing is complete.
+
+### 4. Pane arbitration and rollback hardening
+
+Lease arbitration moved from tab-level assumptions toward the actual pane leaf,
+and rollback was hardened so an already-expired duplicate cannot be revived.
+
+Representative commits:
+
+- `b92498468a5` — arbitrate on the pane, not the tab.
+- `1697b3be163` — supersede on the leaf.
+- `7724a950ecd` — mutate only the plane that supplied the supersession proof.
+- `21ad47c0bc5` — fence duplicate-lease rollback and add a regression oracle.
+
+The existing `upsertSshRemotePtyLease` key remains `(targetId, ptyId)`. That is
+insufficient when an old and a new process reuse the same raw ID but have
+different incarnations. Replacement requires exact lease identity.
+
+### 5. Unreachable-pane product behavior
+
+The renderer now presents a provider-neutral disconnected card with two
+explicit actions and copy that does not claim an unobserved exit.
+
+Representative commits:
+
+- `5e1b57bb2f9` — add the two-action disconnected pane affordance.
+- `d27927b84b5` — remove a remote-host-only assumption from its copy.
+- `037ee535b8a` — centralize unreachable-pane guards.
+- `f7eb6f26656` — suppress the entire saved startup set for a fresh shell.
+- `b46a1f8773e` — avoid stranding a local pane after restore failure.
+- `ab6ce176f3f` — do not unbind a live shell that generic spawn adopted.
+- `df6edfcebd2` — center the recovery actions in narrow panes.
+
+The last item in that list makes the pushed behavior internally safer but also
+exposes the unresolved product bug: generic spawn can adopt the incumbent, so
+“Start a new terminal” is not guaranteed to start anything new.
+
+### 6. Tests, design records, and platform evidence
+
+The session added substantial focused and E2E coverage for local restart,
+daemon/WSL survival, SSH pane cardinality, two-host isolation, `MaxSessions=1`,
+mixed-version decoding, lease termination, relay exit proof, and renderer
+recovery behavior. The main records are:
+
+- `docs/reference/terminal-session-behavior-contract.md`
+- this folder's `goalposts.md`, `design-final-detail.md`, and `resume-plan.md`
+- `src/main/ipc/pty.test.ts`
+- `src/main/ipc/pty-superseded-operation-fence.test.ts`
+- `src/main/persistence.test.ts`
+- `src/main/persistence-ssh-lease-termination.test.ts`
+- `src/main/runtime/orca-runtime.test.ts`
+- `src/main/ssh-reattach-pane-cardinality.test.ts`
+- `src/main/ssh/ssh-relay-reattach-exit-proof.test.ts`
+- `src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts`
+- `src/renderer/src/components/terminal-pane/pty-connection.test.ts`
+- `src/renderer/src/components/terminal-pane/pty-transport.test.ts`
+- `src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx`
+- `tests/e2e/ssh-disconnected-pane-affordance.spec.ts`
+
+Historical receipts in `goalposts.md` include discriminating native macOS,
+Linux, Windows, physical WSL, daemon, and Docker work at earlier candidate
+SHAs. They are historical evidence, not a current-HEAD validation receipt.
+
+Important proof corrections were also recorded during the session:
+
+- a guard tested only through a direct Store call can still have no production
+  caller;
+- a green E2E that also passes without the fix is a forward guard, not proof;
+- the disconnected-pane state is not currently inducible with the existing
+  Docker host faults; and
+- the first recovery grant and a later pane-binding fold were deleted after
+  review showed their premises were false or their path was unreachable.
+
+## The proven current bug
+
+At pushed HEAD, the renderer's disconnected action calls `startFreshSpawn`,
+which calls the normal transport `connect`, which invokes generic `pty:spawn`.
+The old durable binding is still present. Generic spawn resolves stable pane
+ownership and may attach/adopt that incumbent rather than create a blank shell.
+
+Consequences:
+
+- “Start a new terminal” can reopen the old terminal.
+- A same-ID/new-incarnation result is not representable in the current renderer
+  result contract.
+- The action's success path may compare or clear ownership by raw PTY ID.
+- The full product oracle is not running.
+
+The decisive E2E is
+`tests/e2e/ssh-disconnected-pane-affordance.spec.ts`, test “starting a new
+terminal adds exactly one shell and leaves the panes alone,” beginning near line 314. It is still unconditionally held by
+`test.fixme(true, UNREACHABLE_PANE_INDUCTION_UNAVAILABLE)` near line 318.
+
+## Dirty WIP that must be removed
+
+The six uncommitted files implement the rejected
+`freshSpawnForUnreachablePtyId`/grant-map design:
+
+| File                                                               | Uncommitted behavior                                                                                                                                                                                 |
+| ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `src/main/ipc/pty.ts`                                              | Adds a max-256 process-global grant map, records a raw `StablePaneOwner` after attach failure, accepts replacement intent on generic spawn, skips adoption, and performs best-effort raw-ID cleanup. |
+| `src/preload/api-types.ts`                                         | Adds `freshSpawnForUnreachablePtyId` to generic spawn.                                                                                                                                               |
+| `src/preload/index.ts`                                             | Forwards that generic spawn option.                                                                                                                                                                  |
+| `src/renderer/src/components/terminal-pane/pty-connection.ts`      | Passes the old `sessionId` as replacement authority.                                                                                                                                                 |
+| `src/renderer/src/components/terminal-pane/pty-transport-types.ts` | Adds the option to the generic transport contract.                                                                                                                                                   |
+| `src/renderer/src/components/terminal-pane/pty-transport.ts`       | Forwards it to generic spawn and suppresses telemetry with saved startup.                                                                                                                            |
+
+Why it was rejected:
+
+1. Raw PTY ID is not process identity; same-ID/different-incarnation leases and
+   runtime owners collapse.
+2. Renderer input becomes replacement authority on a broad generic IPC.
+3. Grants have no TTL, sender binding, one-shot operation state, reload
+   invalidation, or post-spawn revalidation.
+4. Concurrent pane reservations can return another operation's result rather
+   than re-resolving the caller's intent.
+5. Binding and lease changes flush separately, so no atomic replacement exists.
+6. Provider output can reach the old model before persistence/runtime commit.
+7. Generic spawn still accepts renderer-derived environment and other startup
+   data, so it is not a guaranteed blank shell.
+8. Runtime pane ownership is registered, not exactly transferred; lookup can
+   continue returning the old record.
+9. Renderer callbacks remain authoritative after dispose or a newer attempt.
+10. Failure cleanup calls ID-only shutdown and can kill the wrong incarnation.
+11. The grant is minted on only one attach-failure path, while the UI action can
+    be published from other paths, leaving a visible dead action.
+12. Replacement intent leaks into `PtySpawnOptions`-adjacent contracts, making
+    remote-wire and mixed-version reasoning unnecessarily dangerous.
+
+No uncommitted tests cover this WIP, and no test was run against it.
+
+Remove only these WIP edits with `apply_patch`. Do not use `git reset`,
+`git checkout --`, or another broad restoration command in this dirty worktree.
+
+## Round-6 independent review result
+
+Three read-only reviews converged:
+
+- **Relay/wire review:** request changes. It identified raw-ID identity,
+  ambiguous cleanup, missing atomic Store commit, precommit output publication,
+  broad IPC authority, incomplete blank-shell enforcement, and wire-
+  compatibility blockers.
+- **Targeted transaction review:** recommended a dedicated IPC, owner-keyed
+  mutex, token-keyed idempotency, combined Store transaction, reconnect CAS,
+  post-image inspection on flush error, and deterministic race tests.
+- **Final readiness audit:** request changes. It independently found the same
+  persistence/runtime/grant/incarnation/renderer/cleanup defects and one hard
+  feasibility boundary: existing SSH shutdown is raw-ID-only.
+
+All three reviews were read-only. They ran no tests or builds and changed no
+files.
+
+## Approved bounded redesign
+
+### 1. Main-issued replacement ticket
+
+When main classifies an attach as unreachable but not proven dead, return a
+typed local result containing an opaque ticket. The ticket is authority, not a
+renderer-supplied PTY ID.
+
+Bind it to:
+
+- the issuing `webContents`/sender;
+- connection and provider generation;
+- worktree or folder-workspace identity;
+- tab, leaf, and pane key;
+- exact old application PTY ID and provider-native ID;
+- persisted and runtime incarnation IDs;
+- exact active lease identity;
+- issuance generation and short expiry;
+- a random operation ID; and
+- state `issued | running | committed | rejected | unresolved` plus the
+  idempotent result where applicable.
+
+Invalidate tickets on renderer reload/destruction, provider replacement,
+connection re-registration, expiry, or exact-owner change. A consumed or
+rejected ticket must not become valid again after any request was dispatched.
+
+### 2. Dedicated local IPC
+
+Add a local-only API such as:
+
+```ts
+pty.replaceUnreachablePane({ ticketId, cols, rows })
+```
+
+It should return a structured result such as:
+
+```ts
+{
+  ;(ptyId, incarnationId, operationId)
+}
+```
+
+It must not route through generic `pty:spawn` or `PtyTransport.connect`, and it
+must not add fields to provider, SSH, relay, paired-runtime, or stream payloads.
+Authenticate the sender as the main renderer window before ticket lookup.
+
+### 3. Shared owner lock and idempotency
+
+Use one host/worktree/pane owner mutex for:
+
+- ordinary pane spawn/adoption;
+- unreachable-pane replacement; and
+- relay reconnect's final owner activation.
+
+Each waiter must re-resolve its own intent after acquiring the lock. It may not
+return another operation's result merely because it waited on the same lock.
+
+Use the ticket's operation ID for idempotency. A double-click, lost response,
+or retry while running awaits the same operation and returns the same result.
+It must create at most one shell.
+
+### 4. Main-constructed blank spawn
+
+Under the owner lock, re-read the workspace and re-derive CWD. Repeat folder-
+workspace path validation at that moment; do not trust the path captured when
+the ticket was issued.
+
+Construct provider spawn options from a narrow main-owned allowlist. Exclude:
+
+- command and command delivery;
+- `sessionId`, `attachOnly`, or resume metadata;
+- launch config, token, agent, or telemetry;
+- arbitrary renderer environment or environment deletion;
+- shell override;
+- startup command delivery; and
+- sequenced-startup environment.
+
+Only the validated pane/workspace identity, dimensions, and provider-required
+blank-shell metadata may cross the provider boundary.
+
+### 5. Exact incarnation lease identity
+
+Lease identity for this transaction must include incarnation, not only
+`(targetId, ptyId)`. Old `pty-1/inc-A` and new `pty-1/inc-B` must coexist as:
+
+- old exact lease: expired/unbound; and
+- new exact lease: attached/bound.
+
+Every mark, remove, attach, rollback, and reconnect CAS touched by replacement
+must name the exact lease incarnation. Preserve compatibility with persisted
+legacy rows that lack optional incarnation data; unknown identity may not
+authorize destructive cleanup.
+
+### 6. One Store transaction
+
+Add one Store method, for example `replaceUnreachableSshPaneOwner`, that under
+one mutation and one flush:
+
+1. exact-CASes the old durable pane binding;
+2. exact-CASes the old active lease;
+3. installs the new binding and incarnation;
+4. installs the new exact attached lease;
+5. expires the exact old lease without shutting down its process;
+6. advances topology and lease mutation versions, including affected already-
+   expired siblings; and
+7. flushes once.
+
+Snapshot every mutated in-memory field before starting.
+
+Because durable-file replacement renames the new image before directory fsync,
+a thrown flush is not proof that disk stayed old. Inspect the persisted post-
+image before deciding what happened:
+
+- **Old image:** restore memory and clean only a provably exact new process.
+- **New image:** treat the transaction as committed.
+- **Mixed or unreadable:** kill neither process; mark the operation unresolved,
+  quarantine publication, and reconcile from disk/provider evidence.
+
+### 7. Runtime ownership replacement
+
+Add a non-exit runtime primitive along these lines:
+
+```ts
+runtime.replaceTerminalPaneOwner({
+  paneKey,
+  worktreeId,
+  expected: { ptyId, incarnationId },
+  replacement: { ptyId, incarnationId }
+})
+```
+
+It must:
+
+- exact-CAS the current owner;
+- clear the old record's pane ownership without `onPtyExit`;
+- leave the old process live and unbound;
+- move the pane/leaf/handle lookup to the replacement;
+- invalidate old handles so they cannot silently target the successor; and
+- correctly reset ID-keyed state when raw PTY ID is reused with a new
+  incarnation.
+
+Prepare and validate runtime replacement before the Store commit. Make the
+final in-memory step synchronous and designed not to fail. If an unexpected
+post-durable failure still occurs, never roll durable ownership back to the old
+process and never kill either shell; quarantine and retry publication/
+reconciliation idempotently.
+
+### 8. Quarantine provider output
+
+Capture the provider object and generation before spawn and recheck them after
+every await. Quarantine output for the exact
+`{ provider generation, ptyId, incarnationId }` until durable and runtime
+replacement commit.
+
+Only then activate source delivery and publish the new runtime owner. A new
+shell reusing the old raw ID must never send bytes into the predecessor model.
+
+### 9. Fence relay reconnect
+
+Relay reconnect must acquire the same owner lock after network attach and,
+before changing ownership or delivery, exact-CAS:
+
+- the current pane binding;
+- the lease incarnation; and
+- the provider/connection generation.
+
+Only a winning reconnect may set ownership, restore incarnation, activate
+source delivery, or register runtime state. A reconnect for the predecessor
+must be unable to publish it after replacement commits.
+
+### 10. Renderer adoption rules
+
+The renderer calls only the dedicated API. Guard every completion/failure by:
+
+- connection object not disposed;
+- current transport identity;
+- current action generation; and
+- matching ticket/operation generation.
+
+Accept same-raw-ID/new-incarnation as a real successor. Adopt only the exact
+structured committed result. A stale or disposed callback does nothing: it does
+not clear a binding, republish the card, or kill a result. Main owns the durable
+transition, so the renderer must never clear the old durable binding after
+success.
+
+## Hard cleanup boundary and selected policy
+
+Current provider and SSH relay shutdown APIs identify only a PTY ID. If spawn
+returns `pty-1/inc-B`, then reconnect races and `pty-1` may refer to a different
+incarnation by the time rollback runs. Calling `shutdown('pty-1')` is not exact
+cleanup.
+
+The safe policy for this PR is:
+
+- do not add replacement intent to the remote wire;
+- use existing capability-gated create-operation replay and host-attested
+  incarnation when they provide conclusive identity;
+- clean a failed new shell only when its exact incarnation is provable through
+  a provider-owned rollback handle or equivalent existing evidence;
+- otherwise park/quarantine the ambiguous shell for reconciliation;
+- never blind-retry an ambiguous legacy spawn; and
+- never risk killing the incumbent merely to avoid a leak.
+
+Legacy relays without create-operation replay or host-attested incarnation must
+fail closed or leave the outcome unresolved. If implementation cannot satisfy
+this with current local/provider contracts, stop at the design gate. Do not
+silently add `expectedIncarnationId` to remote shutdown; that is a separate,
+capability-negotiated wire design and review.
+
+## Transaction outcome table
+
+| Outcome                                      | Durable owner     | Process action                                    | Publication                           |
+| -------------------------------------------- | ----------------- | ------------------------------------------------- | ------------------------------------- |
+| Ticket/pre-spawn validation or fence failure | Old               | None                                              | Reject                                |
+| Spawn failure before dispatch                | Old               | None                                              | Reject; ticket may be safely terminal |
+| Spawn response ambiguous after dispatch      | Old or unresolved | No blind retry or ID-only shutdown                | Park/reconcile                        |
+| Known new shell, post-spawn CAS loss         | Winner or old     | Stop only the exact new incarnation when provable | Publish nothing                       |
+| Store commit succeeds                        | New               | Leave old process alive; expire exact old lease   | Publish new                           |
+| Flush throws; disk has old image             | Old               | Clean exact new only when provable                | Reject                                |
+| Flush throws; disk has new image             | New               | Leave both processes                              | Publish new                           |
+| Flush throws; disk mixed/unreadable          | Unresolved        | Kill neither                                      | Quarantine/reconcile                  |
+| Post-commit runtime/publication failure      | New               | Never roll back or kill                           | Retry publication idempotently        |
+
+## Required deterministic oracles
+
+These are completion requirements, not optional follow-ups.
+
+### Main transaction
+
+- Seed an exact failed owner, ticket, binding, and lease.
+- One explicit replacement call makes exactly one provider fresh spawn.
+- Provider options contain no session, attach, command, startup, resume,
+  renderer env, launch metadata, or telemetry.
+- The same pane remains; the old shell receives no shutdown or synthetic exit.
+- Exactly one combined Store handoff occurs and runtime lookup resolves the new
+  owner.
+
+### Authorization and lifecycle
+
+- Missing, expired, replayed, wrong-sender, wrong-host, wrong-worktree,
+  wrong-pane, and renderer-reload tickets reject before provider spawn.
+- Changed/missing binding, persisted/runtime incarnation, lease, provider, or
+  generation rejects before mutation.
+- Folder-workspace path changes after ticket issuance are revalidated under the
+  lock.
+
+### Identity and races
+
+- Old and new may both be raw `pty-1` with distinct incarnations.
+- Double-click and lost-response retry create one operation and one shell.
+- Ordinary spawn racing replacement does not inherit the replacement result.
+- Reconnect before spawn yields no spawn.
+- Reconnect after spawn cannot republish the predecessor.
+- Provider replacement during every await prevents an unsafe commit.
+- A delayed old-incarnation exit cannot affect the new incarnation.
+
+### Persistence and durability
+
+- Success survives save/reload with exactly one flush.
+- Old exact lease is expired, new exact lease attached, and new binding exact.
+- Pre-rename failure restores old memory/disk state.
+- Post-rename failure recognizes the new image as committed.
+- Mixed/unreadable post-image kills neither process.
+- Duplicate-retirement rollback cannot revive an already-expired sibling.
+- Same raw PTY ID with different incarnations remains representable.
+
+### Runtime and renderer
+
+- Exact non-exit runtime rebind moves pane/leaf/handle lookup to the successor.
+- The old owner remains live but unbound and receives no exit.
+- Disposed, stale-generation, late-success, and late-failure callbacks cannot
+  spawn, clear, kill, or republish over newer state.
+- Same-ID/new-incarnation structured results are adopted.
+- A disposed transport never kills a main-committed replacement.
+
+### Compatibility and E2E
+
+- No replacement field appears in provider, SSH, relay, runtime RPC, paired
+  RPC, or stream payloads.
+- Legacy relay degradation is fail-closed/unresolved, never destructive.
+- Current-to-release and release-to-current terminal compatibility suites stay
+  green.
+- Unfix the decisive Docker test and add a deterministic production seam that
+  leaves the target connected while one pane attach is unreachable.
+- The E2E must prove old PID plus start ticks stay alive, exactly one blank
+  shell is added, pane/leaf count is unchanged, new durable `(id,
+incarnation)` is bound, new lease is attached, old exact lease is expired,
+  and no agent/resume/startup transcript is duplicated.
+
+## Remaining work, in dependency order
+
+### Phase 0 — resume safely and freeze the invariants
+
+1. Read this document and the repository `AGENTS.md` instructions.
+2. Run the checkpoint commands below.
+3. Confirm the PR ref remains at the recorded SHA and inspect any newly arrived
+   changes before editing.
+4. Treat ambiguous cleanup as unresolved rather than adding a remote wire field.
+5. If that constraint becomes infeasible, stop and return to the user instead
+   of widening scope.
+
+### Phase 1 — remove the rejected WIP
+
+Use `apply_patch` to remove only the current six-file
+`freshSpawnForUnreachablePtyId` and grant-map edits. Preserve every committed
+change and any unrelated user work. Run `git diff --check` and verify the only
+remaining change is this handoff document before beginning the replacement.
+
+### Phase 2 — build the identity and persistence foundation
+
+1. Add incarnation-aware exact lease identity with legacy-row compatibility.
+2. Add exact lease lookup/mark/remove APIs required by replacement and
+   reconnect.
+3. Add the single Store replacement transaction and one-flush rollback state.
+4. Add post-image inspection for pre-rename, post-rename, and mixed/unreadable
+   outcomes.
+5. Write persistence tests first and demonstrate the intended failure on the
+   current implementation.
+
+### Phase 3 — build runtime and coordination primitives
+
+1. Add the exact non-exit runtime pane-owner replacement primitive.
+2. Add the host/worktree/pane owner mutex shared by normal spawn,
+   replacement, and reconnect final activation.
+3. Add operation-token idempotency independent from that lock.
+4. Update reconnect to revalidate exact binding, lease incarnation, and
+   provider generation after it acquires the lock.
+5. Add same-ID/new-incarnation and delayed-old-exit tests.
+
+### Phase 4 — implement the main replacement transaction
+
+1. Issue typed, sender-bound, expiring, one-shot tickets from every renderer
+   path that can publish the unreachable action.
+2. Add the dedicated preload/main IPC and main-window sender check.
+3. Re-derive CWD and validate folder workspaces under the lock.
+4. Construct the blank provider spawn from the main allowlist.
+5. Capture provider generation and quarantine exact new output.
+6. Revalidate after every await; prepare runtime; execute the Store commit;
+   finish runtime activation; publish output/result.
+7. Implement all transition-table outcomes without ID-only cleanup.
+
+### Phase 5 — adopt through the renderer
+
+1. Remove replacement from generic transport/spawn types.
+2. Thread the typed ticket and structured committed result through the
+   disconnected action only.
+3. Add disposed/current-transport/action-generation guards.
+4. Remove renderer-side binding clearing or committed-result killing.
+5. Verify UI layout, copy, and behavior through Electron Playwright CDP as
+   required by repository instructions.
+
+### Phase 6 — validate and review once
+
+1. Run the focused deterministic suite.
+2. Make the Docker E2E inducible, remove its unconditional `fixme`, and prove
+   it fails for the intended reason on the unfixed candidate before claiming
+   it as evidence.
+3. Run typecheck, lint, full unit tests, build, reliability gates, and relevant
+   SSH/daemon/cross-version regressions.
+4. Run independent repository and release-readiness reviews, including
+   security, performance, mobile/backcompat, Windows, Linux/glibc, SSH, folder
+   workspace, and provider-neutrality coverage.
+5. Resolve every P0/P1 and relevant P2. If another architectural invariant
+   fails, pause instead of entering an unbounded seventh patch loop.
+
+### Phase 7 — deliver
+
+Only after the implementation and reviews are clean:
+
+1. Commit the replacement work.
+2. Push explicitly to
+   `origin/nwparker/sta-3077-d-affordance-and-review`.
+3. Update PR #13326's body with the transaction, compatibility behavior, and
+   exact validation receipts.
+4. Resolve the seven saved review threads only when their findings are actually
+   addressed.
+5. Request `@coderabbitai review` and monitor CI to completion.
+6. Use the `orca-linear` workflow to post one concise STA-3077 completion
+   update and attach the PR if needed.
+
+## First safe resume commands
+
+Run from the primary worktree before editing:
+
+```bash
+git status --short --branch --untracked-files=all
+git rev-parse HEAD
+git rev-parse origin/nwparker/sta-3077-d-affordance-and-review
+git rev-parse origin/main
+git rev-list --left-right --count origin/main...HEAD
+git diff --stat
+git diff --check
+```
+
+Expected before any external state changes:
+
+- HEAD and the PR ref are both `df6edfcebd2ea401a6feda1fccf31189e57eceda`;
+- the six rejected production-file edits are present;
+- this handoff file is the only additional local artifact; and
+- `git diff --check` exits 0.
+
+Do not use the configured upstream to infer PR state.
+
+## Suggested validation commands after implementation
+
+Adjust the focused file list only when the final implementation clearly moves
+the covered behavior. Record exact commands and outcomes in the PR.
+
+```bash
+pnpm exec vitest run --config config/vitest.config.ts \
+  src/main/ipc/pty.test.ts \
+  src/main/persistence.test.ts \
+  src/main/persistence-ssh-lease-termination.test.ts \
+  src/main/runtime/orca-runtime.test.ts \
+  src/main/ssh-reattach-pane-cardinality.test.ts \
+  src/main/ssh/ssh-relay-session.test.ts \
+  src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts \
+  src/main/ssh/ssh-relay-session-reattach-pane-fence.test.ts \
+  src/renderer/src/components/terminal-pane/pty-connection.test.ts \
+  src/renderer/src/components/terminal-pane/pty-transport.test.ts \
+  src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx \
+  --reporter=dot
+
+pnpm typecheck
+pnpm lint
+pnpm test
+pnpm build
+```
+
+For the Docker product oracle, use the repo's Electron Playwright configuration
+with `ORCA_E2E_SSH_DOCKER=1` after adding the deterministic induction seam and
+removing the test's unconditional `fixme`. Keep the run POSIX-only as the
+existing Docker fault harness requires.
+
+Run the current↔release cross-version terminal suite and the relevant Docker
+SSH cardinality, `MaxSessions=1`, and two-host scripts as part of broad
+regression coverage.
+
+## Validation record at pause
+
+### Current redesign/WIP
+
+No product validation was run after the rejected six-file WIP was introduced.
+No product validation was run during the three final read-only audits or while
+writing this handoff. Therefore this document claims no current test, typecheck,
+lint, build, Electron, Docker, cross-version, or packaging pass.
+
+### Read-only checkpoint commands run for this handoff
+
+The following repository inspections completed successfully:
+
+```bash
+git status --short --branch
+git status --short --branch --untracked-files=all
+git rev-parse HEAD
+git branch --show-current
+git rev-parse --abbrev-ref --symbolic-full-name '@{upstream}'
+git rev-parse origin/nwparker/sta-3077-d-affordance-and-review
+git rev-parse origin/nwparker/sta-3077-reattach-pane-cardinality
+git rev-parse origin/main
+git rev-list --left-right --count origin/main...HEAD
+git merge-base origin/main HEAD
+git log --oneline --decorate -12
+git reflog --date=iso
+git diff --stat
+git diff --name-status
+git diff --check
+```
+
+Observed results are recorded in the repository checkpoint above. In
+particular, `git diff --check` exited 0.
+
+Historical validation details are preserved in `goalposts.md` and
+`resume-plan.md`. Those receipts belong to their recorded SHAs and must not be
+reported as validation of the final replacement candidate without rerunning
+them.
+
+## Security, compatibility, migration, and release risks
+
+- **IPC authority:** a renderer-supplied PTY ID is forgeable/piggybackable;
+  tickets must be opaque, sender-bound, short-lived, one-shot, and revalidated.
+- **Same-ID reuse:** raw PTY ID cannot distinguish an incumbent from a
+  successor. Every destructive or ownership operation needs exact incarnation.
+- **Durability:** a thrown fsync after rename can leave the new image on disk.
+  Blind in-memory rollback can diverge from restart state.
+- **Remote ambiguity:** ID-only shutdown cannot safely clean same-ID reuse.
+  Prefer a visible/reconcilable leak to killing an unproven process.
+- **Output isolation:** precommit bytes from a successor can corrupt the old
+  pane model unless quarantined by provider generation plus incarnation.
+- **Mixed versions:** clients and hosts update independently. Keep replacement
+  local; any future exact-shutdown wire field needs capability negotiation and
+  both-direction live skew tests.
+- **Legacy persisted rows:** missing incarnation is unknown, not permission to
+  mutate or delete. Migration must be additive and old-reader-safe.
+- **Folder and SSH workspaces:** re-resolve current paths and host generation
+  under the lock; neither git worktree presence nor local filesystem access may
+  be assumed.
+- **Cross-platform:** preserve macOS, Linux/glibc floor, Windows, WSL, path, and
+  shortcut rules even though the Docker fault harness is POSIX-only.
+- **Performance:** avoid global scans, unbounded ticket/operation maps,
+  repeated fsyncs, or hot-path lock contention. Bound retention and measure
+  affected reconnect/spawn paths.
+- **Release evidence:** the key E2E remains held. The change is not release-
+  ready until that product path is deterministic and discriminating.
+
+## Stop conditions
+
+Pause and return to the user if any of these occurs:
+
+- exact cleanup appears to require an unreviewed remote-wire change;
+- the Store/runtime transaction cannot distinguish old, new, and mixed durable
+  post-images;
+- replacement requires treating unknown identity as proof;
+- the deterministic E2E still cannot enter the actual production state;
+- the shared lock introduces a new global serialization or deadlock risk; or
+- the next independent review finds another architectural invariant failure.
+
+The point of this handoff is to prevent another opaque loop: one bounded
+redesign, deterministic evidence, one adversarial review, then either delivery
+or a principled stop.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/README.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/README.md
new file mode 100644
index 00000000000..2dab127658c
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/README.md
@@ -0,0 +1,265 @@
+# Terminal session correctness and authority handoff
+
+> **Status: preserved and paused, not complete, not release-ready.**
+>
+> The comprehensive program is at **0/8 proven goalposts** and
+> **2/13 proven journeys**. No agent may narrow, replace, or mark a goalpost
+> complete without the user's explicit approval and the proof named in this
+> folder.
+
+This folder is the sole continuation entrypoint for the work previously called
+“React 185” or “terminal session authority.” That shorthand is too narrow: the
+program covers terminal identity, ownership, exact operations, reconnect,
+delivery, migration, daemon and SSH lifecycle, paired and remote runtimes,
+cross-platform compatibility, performance, and removal of superseded code.
+
+## Read in this order
+
+1. Read all three preserved source documents with the exact `git show` commands
+   under [Repository checkpoint](#repository-checkpoint). The normative design,
+   delivery ledger, and original pause handoff are mandatory, not optional
+   implementation detail.
+2. [`goalposts.md`](./goalposts.md) — the current completion contract, amendable
+   only by an explicit user decision.
+3. [`related-open-work.md`](./related-open-work.md) — live PR/issue overlap and
+   conflicts.
+4. [`resume-plan.md`](./resume-plan.md) — safe continuation order and required
+   validation receipts.
+
+The older `terminal-session-authority-handoff-2.md` is useful as an adversarial
+report, but it is not authoritative. In particular, its “descoped,” “shipped,”
+identity-equivalence, timer, and LOC claims must not be copied as settled facts.
+
+## Non-negotiable user objective
+
+Deliver one coherent long-term terminal-session correctness model that:
+
+- removes the root causes instead of leaving quarantine, retry-window,
+  sliding-window, optional-metadata repair, or other reconciliation as the
+  final correctness mechanism;
+- never treats missing, unavailable, timed-out, disconnected, or unknown state
+  as proof that a process is dead or that replacement/destruction is safe;
+- works for local terminals, daemon, WSL, direct and nested SSH, paired runtime,
+  remote server, folder workspaces, floating workspaces, and git worktrees;
+- remains correct when clients and hosts update independently;
+- works on macOS, Linux at the supported glibc floor, Windows, WSL, and Docker
+  OpenSSH;
+- has no correctness, security, latency, throughput, memory, restore, startup,
+  backpressure, or large-pane regression;
+- finishes with **strictly less aggregate production code than the frozen
+  pre-program baseline** after all superseded implementations are deleted; and
+- is proven through real production paths and discriminating end-to-end
+  journeys, not inferred from test counts or green CI.
+
+Correctness and performance cannot be weakened to reach the code-size target.
+The code-size target also cannot be waived because a replacement architecture
+was added beside the old one.
+
+## Authority and scope rules
+
+- Direct user instructions govern scope.
+- The original normative design remains the contract except where a later,
+  explicit user decision changes a named requirement.
+- This handoff tightens G6 to **strictly net-negative production LOC** because
+  the user explicitly asked to end with less production code than the original
+  baseline.
+- The default frozen accounting baseline is
+  `5ed45739e94bdf6460364e033bfcec9b32c0b42a`, the base recorded by GitHub for
+  PR #12600. This program subsumes that containment PR. Every later
+  program-attributable merged prerequisite and every stack layer must be counted
+  in aggregate; rebasing may not roll the accounting baseline forward and hide
+  earlier additions. Changing this baseline requires an explicit user decision.
+- Focused tests, green CI, a review comment, a behavior-contract document, an
+  open PR, or a construction milestone cannot amend the design or promote a
+  release goalpost.
+- A replacement design is allowed, but it must map every original invariant,
+  risk, and journey to an equal or stronger mechanism, close the known liveness
+  gap, and receive explicit user approval before the ledger changes.
+- Only `not started`, `partial`, and `proven` are valid gate statuses.
+  “Descoped,” “superseded,” and “met for what shipped” are not valid statuses
+  for G0–G7 under the current objective.
+- A narrow incident PR may be independently useful or mergeable. It does not
+  reduce the comprehensive denominator of eight goalposts and thirteen
+  journeys.
+
+## Settled status
+
+| Scope                      | Status                                        | Meaning                                                                                                                                                         |
+| -------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Construction preservation  | **Complete locally; not remotely durable**    | The 814-path construction tree and the original three authority documents are preserved at local branch `nwparker/react185-authority-snapshot` / `fddb19f6977`. |
+| Comprehensive goalposts    | **0/8 proven**                                | G0–G4 and G6 are partial. G5 and G7 are not started.                                                                                                            |
+| Required journeys          | **2/13 proven**                               | Journeys 1 and 2 have clause-selective discriminating oracles run on every environment they name. The other eleven remain unproven.                             |
+| Current branch / PR #13111 | **Implemented, open, unapproved, incomplete** | Useful narrow SSH containment; not a long-term completion and not merged.                                                                                       |
+| PR #13110                  | **Open, independent, unapproved**             | Useful preload artifact guard; not shipped and has an unresolved major review thread.                                                                           |
+| Less-code gate             | **Failed on current candidate**               | PR #13111 is net positive; the preserved construction snapshot is net `+60,903` production LOC.                                                                 |
+
+The numeric release checkpoint is therefore:
+
+- **G0:** partial
+- **G1:** partial
+- **G2:** partial
+- **G3:** partial
+- **G4:** partial
+- **G5:** not started
+- **G6:** partial and currently failing its final LOC condition
+- **G7:** not started
+- **Total:** **0/8 proven, 6/8 partial, 2/8 not started**
+- **Journeys:** **2/13 proven** (Journey 1 natively on macOS/Linux/Windows; Journey 2 on macOS/Linux/physical WSL)
+
+This is the **program artifact ledger**. Its partial G0, G1, G3, and G4 evidence
+exists only in the preserved construction snapshot and historical receipts. It
+does not mean those implementations exist on the current #13111 branch. The
+current candidate contributes credible partial G2 evidence and limited
+compatibility/review evidence, but it proves **zero** complete release gates.
+
+## Repository checkpoint
+
+Verified before creating this documentation folder:
+
+- Worktree:
+  `/Users/nwparker/orca/workspaces/orca/eye-React-185`
+- Current branch: `nwparker/sta-3077-reattach-pane-cardinality`
+- Current HEAD: `5369479be2953f45cea9ab5cfcde756dd9660548`
+- HEAD subject: `fix(pty): let liveness say unknown instead of forcing it to say dead`
+- Local `origin/main`: `0d29497f8279e2d4c2d26ffc8f3fb68cee2756a7`
+- Merge base: `e6e197feeddd1adda066c5cd22f7ee056a12c8c1`
+- Distance from local `origin/main`: 15 commits ahead, 19 behind
+- The worktree was clean before this handoff. The expected handoff-only changes
+  are this folder and its `.gitignore` allow-list entry.
+- Preserved construction branch:
+  `nwparker/react185-authority-snapshot`
+- Preserved construction commit:
+  `fddb19f6977ae4ba4764c32afc9fe104c1ed2549`
+- Preservation location: local ref only; the branch has no upstream, tag, or
+  remote branch containing this commit
+- Snapshot status: **unshippable salvage/reference only**
+
+The exact commit ID is the preservation anchor. Do not checkout, switch, reset,
+rebase, commit, or push from the snapshot branch in the primary worktree. Read
+its authority documents without switching branches:
+
+```bash
+git show fddb19f6977:docs/reference/terminal-session-authority.md
+git show fddb19f6977:docs/reference/terminal-session-authority-delivery.md
+git show fddb19f6977:docs/reference/terminal-session-authority-handoff.md
+```
+
+Mine tests, design arguments, or narrow implementations only through `git show`
+or a disposable isolated worktree, and only after verifying that they address a
+reachable production path on the current base. A local tag protects against
+branch movement and ordinary GC only; it does not survive loss of this machine.
+Cross-machine/crash preservation requires a copy-verified off-machine bundle or
+an explicitly authorized remote ref. Do not infer permission to push it.
+
+## Current narrow candidate: what is real
+
+At current HEAD / PR
+[#13111](https://github.com/stablyai/orca/pull/13111):
+
+- SSH relay reattach passes `mayCreate: false` to stop that call site from
+  creating durable pane/layout state.
+- Duplicate complete pane leases are superseded and excluded from reattach.
+- Existing duplicate complete leases are reconciled during reconnect.
+- Reattach failure paths require positive evidence before cold respawn.
+- PTY inventory can report `unknown` rather than collapsing an unavailable
+  provider into `false`/dead.
+- Focused tests and GitHub checks are green at HEAD.
+
+These are credible partial G2 improvements. They do **not** establish the
+comprehensive design or release gates.
+
+## Current narrow candidate: what remains unproved or wrong
+
+- Lease row identity is still `(targetId, ptyId)`. Pane fields remain optional.
+  Active-pane cardinality is enforced by sibling expiration and a healing scan,
+  so the end state remains reconciliation-based rather than structurally
+  pane-keyed.
+- Incomplete legacy leases bypass pane arbitration.
+- Superseded remote shells are deliberately left running and unreachable. The
+  PR body acknowledges that the “accumulates unused shells” half of the incident
+  remains unresolved.
+- The repeated-reconnect Docker test still passes with and without the fix: it
+  is a forward guard, not causal proof. Its sibling in the same spec — 'leaves a
+  lease whose durable pane is gone unbound…' — was reported as discriminating,
+  but that DID NOT REPRODUCE on a second machine: with `mayCreate: false`
+  removed from the reattach call site and the app rebuilt, both tests still
+  passed. Its induction races `pty:kill` against a severed transport, so when
+  the kill lands the lease is cleaned up and there is nothing to graft. Treat
+  both tests as forward guards. No journey is proven.
+- The final Docker settle assertion has an unresolved major review thread: a
+  late pane or shell can appear after the polling assertion has already passed.
+- The production-call-site wiring oracle reads source text. It does not execute
+  the full production reattach path.
+- `mayCreate: false` is wired at one production binding call site, not proven
+  across every recovery/reattach runtime. `removeSshRemotePtyLease` still has one
+  production caller, the spawn-persistence rollback.
+- `WEDGED_DAEMON_GRACE_RETRIES = 11` remains reachable and still permits retry
+  count to drive daemon replacement after unknown inventory.
+- `terminal-input-quarantine.ts` remains reachable.
+- No current-tree proof covers physical Windows, WSL, the Linux glibc floor,
+  paired runtime, remote server, two independent SSH hosts, live mixed-version
+  peers, or production-scale performance.
+- There is no candidate-versus-baseline performance result for the new
+  per-upsert sibling scan or reconnect healing pass.
+- PR #13111 is open, has no approval decision, and is not shipped.
+
+Current HEAD census against its merge base, before this documentation change:
+
+| Category                                            | Additions | Deletions |      Net |
+| --------------------------------------------------- | --------: | --------: | -------: |
+| Production source, including a fixture under `src/` |       374 |        65 | **+309** |
+| Tests and end-to-end tests                          |       944 |        30 |     +914 |
+| Documentation                                       |       146 |         0 |     +146 |
+| CI/configuration                                    |        43 |         0 |      +43 |
+| Total GitHub diff                                   |     1,507 |        95 |   +1,412 |
+
+The production source plus Docker runner is net `+350`. Whichever taxonomy is
+used, the categories must remain separate and G6 is not proven.
+
+## Corrections to the previous handoff
+
+- PRs #13110 and #13111 are **open and green**, not shipped.
+- #13110 is implementation-independent from #13111, but emitted-preload safety
+  remains inside G0/G5/G7 and any retained #13110 production/build logic counts
+  in the aggregate G6 census.
+- The snapshot genuinely failed to wire `mayCreate`, pane-cardinality
+  arbitration, or a complete shell-lifecycle fix into the affected legacy SSH
+  path.
+- Pane key, PTY ID, incarnation ID, a narrow CAS, and a three-valued daemon
+  resolver pre-existed and should be reused where their semantics match.
+- Existing `connectionId` and `worktreeId` do **not** establish equivalence to a
+  final-host-minted authority identity and canonical host-local namespace.
+- The normative design never banned all timers. It permits bounded waits and
+  backoff; it forbids elapsed time or retry count **alone** from deciding
+  identity, liveness, takeover, replacement, or destruction.
+- The design does have a liveness gap: a permanently lost retained consumer can
+  hold compaction at capacity without a sufficiently explicit bounded operator
+  recovery path. G0 and G3 cannot become proven until that is resolved.
+- The claimed approximately 6,500-line comparison implementation has no
+  reproducible census and cannot justify deleting requirements.
+
+## Definition of done
+
+The comprehensive work is done only when all of the following are true on one
+rebased, converged candidate SHA:
+
+- every G0–G7 section in [`goalposts.md`](./goalposts.md) has its named
+  production implementation and current proof;
+- all thirteen required journeys pass with their full oracles;
+- each new causal oracle is red on the unfixed baseline and green on the final
+  candidate; formal verification may supplement but never replace a required
+  live journey;
+- every open incident bound to the mandatory issue-to-journey matrix in
+  [`related-open-work.md`](./related-open-work.md) passes its discriminating
+  oracle or is ruled unrelated with explicit evidence and user acceptance;
+- correctness, security, wire, migration, platform, packaging, performance,
+  restore, and scale reviews have no unresolved P0–P2 findings;
+- the aggregate production source census is strictly net-negative against the
+  frozen pre-program baseline, including all program-attributable prerequisite
+  PRs and stack layers;
+- no superseded reconciliation, quarantine, duplicate state machine, legacy
+  writer, or test fixture remains reachable in production; and
+- the user explicitly accepts any deliberate change to the normative design.
+
+Anything less must be reported as partial, regardless of test count or PR
+state.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/RESUME-PROMPT.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/RESUME-PROMPT.md
new file mode 100644
index 00000000000..88cff53f68b
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/RESUME-PROMPT.md
@@ -0,0 +1,111 @@
+# Resume prompt — terminal session ownership
+
+Paste the block below into a fresh session. Everything it needs is in the repo.
+
+---
+
+You are taking over an in-flight implementation in this repo. Read these, in
+order, before doing anything:
+
+1. `docs/reference/terminal-session-correctness-handoff-2026-08-07/new-design-goalposts.md`
+   — the tracked goalposts. This is the contract. Report progress against it.
+2. `docs/reference/terminal-session-correctness-handoff-2026-08-07/design-explained.html`
+   — the design in plain English (open it; it has diagrams).
+3. `docs/reference/terminal-session-correctness-handoff-2026-08-07/design-final-detail.md`
+   — the full detail: record shape, death rule, reattach algorithm, migration
+   order, and the oracle list.
+4. `docs/reference/terminal-session-correctness-handoff-2026-08-07/counsel-design.html`
+   — how the design was reviewed, and the defects the review found in earlier
+   shipped work. Read at least the "What I got wrong" section.
+
+## The problem being fixed
+
+Reconnecting to an SSH host multiplied a user's terminals (2 → 19 → 20), and a
+coding agent could be resumed twice into one transcript. Root cause is not one
+bug: it is that ownership bookkeeping is filed under the wrong key and written to
+two places, and that the client infers "the program died" from things that do not
+prove it.
+
+The design in one line: **keep our own notes about which terminal is whose, and
+never guess whether a program died.**
+
+## State
+
+Branch `nwparker/sta-3077-reattach-pane-cardinality`. Landed and committed:
+
+- `e2524b0472f` — an identity mismatch is no longer read as death (goalpost S1)
+- `c51be8072ba` — pane identity is no longer sent on reattach (S2)
+- Goalposts, design docs (S6 verdict recorded)
+
+**3 of 7 step goalposts proven. Net production lines: −24.**
+
+Two older PRs (#13110, #13111) are **held, unmerged, deliberately**. The owner
+decided: no stopgap, get the design right. Do not merge them without being asked.
+
+## What to do next
+
+Three goalposts have **failing oracles already written**, each with the exact
+production change identified. This is implementation against a fixed target.
+
+**S3 — a failed reattach must never fabricate an exit.**
+Oracle: `src/main/ssh/ssh-relay-reattach-exit-proof.test.ts` (6 red, 2 green).
+In `handlePtyReattachFailure` (`src/main/ssh/ssh-relay-session.ts`), the
+not-found case currently sends the pane a synthetic `pty:exit { code: -1 }`,
+clears provider state, deletes ownership and expires the lease — all claims about
+a process we know nothing about. Collapse it into the non-destructive branch that
+already exists a few lines above (`restoreRequired = 'reattachAttemptsExhausted'`
++ `wakeRecovery`). This is a branch collapse, not a new mechanism.
+Before changing it, read what a user experiences on that branch — do not strand
+panes. This step ships with the disconnected-pane affordance below.
+
+**S4 — one partition per (target, pane).** *Highest value: this is the 2 → 19 → 20
+mechanism.* Oracle: `src/main/ssh-pane-binding-partition.test.ts` (6 red).
+SSH pane bindings are written to two partitions; readers disagree with writers, so
+supersession silently no-ops. Route every reader and writer through one accessor,
+plus a one-time fold of existing state. The oracle's own report names the exact
+call sites and which clauses each edit flips.
+
+**S5 — the superseded-pane fence must be live on the reattach path.**
+Oracle: `src/main/ssh/ssh-relay-session-reattach-pane-fence.test.ts` (2 red).
+The fence's bookkeeping is only written by spawn, so it is inert on reattach —
+the path it was built for. Collapse to one `bindPaneShell` producer used by all
+paths.
+
+**S8 — remove the dead recovery-grant path.** Proven unreachable (see S6 in the
+goalposts). Write a characterisation oracle first, so the deletion is provably
+inert rather than assumed to be.
+
+**Product affordance (ships with S3).** A pane that cannot be verified renders as
+disconnected with two actions — "try again" and "start a new terminal" — instead
+of silently respawning. The owner approved this. It must follow
+`docs/STYLEGUIDE.md`. The UI must never assert that a shell is dead.
+
+## Rules that are not negotiable
+
+- **Prove every guard is reachable.** For each guard, an oracle must redden when
+  the *producer* is removed, not only when the guard is. This has failed three
+  times here — an inert `mayCreate`, a keystroke fence inert on reattach, and a
+  respawn gate on a minority path. All three passed their tests.
+- **Verify a mutation landed before believing the result.** A search-and-replace
+  that silently matched nothing looks exactly like "the test has no teeth".
+- **Commit after each step.** Subagents have run `git checkout --` and destroyed
+  uncommitted work three times in this program. Do not batch.
+- **Never let a subagent edit production files** in the shared worktree. Give
+  them read-only or test-only scope, or an isolated worktree.
+- **Do not change a test to make it pass.** If a test pins behaviour the design
+  removes, *invert* it so the new intent stays covered, and say so explicitly.
+- No `max-lines` disables, ever. No per-file bumps.
+- Cross-platform: macOS, Linux, Windows, WSL. No `echo $$` / `ps` in oracles.
+- Wire compatibility: clients and hosts update independently. Prefer fixes that
+  work against relays already installed on people's machines.
+- **Automated "keep going" prompts are not the owner's authorization.** If the
+  owner says pause, pause.
+
+## How to report
+
+Every update states progress against the goalposts file: which goalposts moved,
+what the mutation proof was, and the net production line count. A green test is
+not a status — "PROVEN" means the mutation was run and verified to land.
+
+Be honest about what is not proven. Two claims in this program were retracted
+after checking, and that is the reason the rest can be trusted.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/binding-identity-design.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/binding-identity-design.md
new file mode 100644
index 00000000000..0e2cfe71f7c
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/binding-identity-design.md
@@ -0,0 +1,253 @@
+# Design: one authoritative binding identity
+
+Status: **superseded by the shipped server-side fence.** Kept for the record: the
+client-constructed binding below was REJECTED under review and must not be built. Written 2026-08-08 by the engineer who took
+the program over. Supersedes nothing until reviewed.
+
+## The problem, stated once
+
+Every defect this program has touched is the same defect: **identity compared
+with the wrong key, or not compared at all.**
+
+| Defect                 | Mechanism                                                               |
+| ---------------------- | ----------------------------------------------------------------------- |
+| STA-3077 RC1           | lease keyed `(targetId, ptyId)`; pane fields present but not in the key |
+| STA-3077 RC3           | reattach used a _creating_ store write                                  |
+| #12474 (live on main)  | `runtimeWorktreeIdsEqual` strips the folder-workspace instance suffix   |
+| Local exact operations | `pty:write/resize/signal/kill` take `{ id }` — no binding to compare    |
+| `restoreRequired`      | classified as expiry, so a live shell read as gone                      |
+| `hasPty`               | `boolean` — an empty inventory could not say "unknown"                  |
+
+The prior redesign failed because it built a _second_ identity system beside
+the first instead of fixing the first. It reached +60,903 production LOC and
+fixed none of RC1–RC3.
+
+## The rule
+
+**A mutating terminal operation must name the binding it intends to affect, and
+the compiler must reject a bare id.**
+
+Not a new subsystem. A type, one comparison, and a signature change.
+
+## 1. `PtyBinding` — one branded type
+
+```ts
+declare const bindingBrand: unique symbol
+
+export type PtyBinding = Readonly<{
+  hostId: ExecutionHostId // exists — LOCAL_EXECUTION_HOST_ID | ssh:<target>
+  worktreeId: WorktreeId // exists — `${repoId}::${path}[::workspace:<uuid>]`
+  paneKey: PaneKey // exists — `${tabId}:${leafId}`, already branded
+  ptyId: string // exists
+  incarnationId: PtyIncarnationId // exists — already branded
+}> & { readonly [bindingBrand]: true }
+```
+
+Every field already exists and is already persisted. Nothing is invented.
+
+Construction is the whole point: `PtyBinding` is producible **only** by
+`bindingFromAuthority()` — reading the durable store, a spawn result, or an
+attach reply. There is no public constructor from loose strings, so a caller
+cannot fabricate one, and `as PtyBinding` is banned by lint.
+
+## 2. Mutating IPC carries the binding
+
+Today, on the local path:
+
+```ts
+pty: write({ id, data })
+pty: resize({ id, cols, rows })
+pty: signal({ id, signal })
+pty: kill({ id })
+```
+
+There is no fence to test because there is nothing to compare. That is a
+production gap, not a test gap.
+
+After:
+
+```ts
+pty: write({ binding, data })
+pty: resize({ binding, cols, rows })
+pty: signal({ binding, signal })
+pty: kill({ binding })
+```
+
+The handler resolves the binding against the authoritative record and rejects a
+mismatch — the same compare-and-swap `persistPtyBinding` already performs for
+`expectedBinding`. A stale renderer cannot reach a successor pane or a reused
+PTY id, which is invariants 1–4 of the original design, enforced rather than
+asserted.
+
+**Compatibility:** the ID-only channels stay for one release behind the existing
+capability negotiation, since clients and hosts update independently. They are
+marked deprecated, are not reachable from authoritative paths, and are deleted
+in the release after — that deletion is where the LOC comes back.
+
+## 3. One comparison, not twenty-six
+
+```ts
+export function bindingsEqual(a: PtyBinding, b: PtyBinding): boolean
+export function sameNamespace(a: PtyBinding, b: PtyBinding): boolean
+```
+
+Delete the hand-rolled comparisons. `runtimeWorktreeIdsEqual` — the #12474 bug —
+is one of them; ~26 repeat a host-id/namespace-id comparison inline. Each
+hand-rolled copy is a future drift, and #12474 proves drift already happened.
+
+## 4. Three-valued liveness
+
+Landed (`5369479be29`). `hasPty: boolean | null`, `null` never authorizes
+destruction.
+
+## What this deletes
+
+| Target                                                            | Est. LOC |
+| ----------------------------------------------------------------- | -------: |
+| ID-only IPC channels + handlers (release after next)              |     ~250 |
+| Hand-rolled identity comparisons (~26 sites)                      |     ~180 |
+| `pty-source-replay-index.ts` (done)                               |      201 |
+| Inference sites that exist only because a binding was unavailable |     ~200 |
+
+Net direction is negative once the deprecated channels go. It is net-positive in
+the release that adds the type, and the recorded G6 decision permits that when
+justified.
+
+## What this deliberately does not build
+
+No durable journal, no per-consumer cumulative cursors, no cryptographic device
+principals, no parallel authority service. Verified against mature prior art:
+bounded replay plus lifecycle-in-the-attach-reply is what shipping systems use,
+and their entire persistent-terminal subsystem is ~6,500 LOC.
+
+If a reviewer can name a concrete event sequence where bounded replay loses or
+double-applies an outcome, that conclusion changes. Nobody has yet.
+
+## How each claim gets falsified
+
+| Claim                                    | Oracle                                                                 |
+| ---------------------------------------- | ---------------------------------------------------------------------- |
+| A stale op cannot reach a successor pane | Send a captured binding after the pane is recreated; must be refused   |
+| A stale op cannot reach a reused pty id  | Same, after incarnation change                                         |
+| Same-path workspaces do not collide      | The 5 skipped tests in `workspace-namespace-terminal-identity.test.ts` |
+| Reattach never creates                   | Proven, discriminating (`ed10a467883`)                                 |
+| Unknown never destroys                   | Revert three-valued `hasPty`; daemon spec reddens                      |
+
+Every row must fail with its guard removed, verified under an isolated
+`TMPDIR` — the e2e harness keys its seeded-repo pointer on a machine-global
+tmpdir path, so a shared machine can both fabricate and mask a red.
+
+---
+
+# Post-review record (2026-08-08)
+
+## The proposal above was rejected, correctly
+
+Verified against the code, three load-bearing claims in it were false: there is
+no `WorktreeId` type; `PtyIncarnationId` is a bare `string` alias, not branded;
+and `incarnationId` is optional in the store and never reaches the renderer, so
+the side asked to construct the binding cannot. It was also a _second_ identity
+comparison beside `resolveStablePaneOwner` (`src/main/ipc/pty.ts:647`), which
+already resolves pane ownership against runtime and store and already throws
+`terminal_pane_owner_conflict` — with 9 call sites, all on spawn/adopt, none on
+a mutating handler. The fence existed; it was not being called.
+
+## What shipped instead
+
+`isSupersededPtyId` in `src/main/ipc/pty.ts`, consulted by `pty:write`,
+`pty:writeAccepted`, `pty:resize` and `pty:signal`. Main keeps `ptyPaneKey` and
+`paneKeyPtyId` in lock-step, so their disagreement is proof the caller's id was
+superseded. No wire change, no renderer change, nothing added to the input
+payload. `pty:kill` is deliberately exempt: a superseded PTY is orphaned and
+reclaiming it is the point.
+
+## Peer review of that shape
+
+Four comparable agent IDEs were studied. The verdict was to keep this shape.
+None sends a composite identity per keystroke; the one that fences keystrokes
+sends a single opaque server-minted scalar. The best peer formulation is _keep
+the id as the sole lookup key and make the second field a rejection predicate,
+never a key component_ — which is what this does, with the owner read from
+authority rather than accepted from the caller.
+
+## Known gap, stated precisely
+
+**The fence compares a binding, not an incarnation.** If a pane respawns under
+the _same_ ptyId, `paneKeyPtyId.get(paneKey) === ptyId` still holds and a write
+composed for the dead shell passes.
+
+The obvious remedy — mint a fresh ptyId on every spawn — is wrong here.
+`ptySessionIdForAgentCreateOperation` (`src/main/daemon/pty-session-id.ts:26`)
+is deterministic _by design_ so a replayed agent-create is idempotent rather
+than spawning a second shell. Randomising it would trade this narrow gap for a
+duplicate-spawn bug, which is worse.
+
+So the residual exposure is one path: an agent-create PTY dies, the same
+operation is replayed, the id is reproduced, and a caller holding a pre-death
+reference writes into the successor. Closing it needs the caller to carry the
+incarnation — the rejected proposal — or a per-attachment token, which is a wire
+change. Neither is justified by evidence today. Recorded rather than hidden.
+
+## Adopted from the peer review
+
+- The "no binding recorded" branch is an explicit, commented decision (permit),
+  not an accident — an omitted guard on an optional field is exactly how one
+  peer reintroduced this defect class.
+- A classifier's default must be non-destructive: unknown resolves to reattach,
+  and only a positive "session not found" authorises a respawn.
+
+## Not yet adopted, ranked
+
+1. Typed end-reason recorded at end time (`detached` vs `terminal-exited`), so a
+   user quit is not a resume candidate. Aimed squarely at duplicate resume.
+2. Compare-and-swap before any _delayed_ destructive write. Three-valued probes
+   stop us acting on unknown; CAS stops us acting on stale-known.
+3. Derive the pane inventory from the authority snapshot rather than merging into
+   a local store. A projection cannot grow; an accumulator can — which is what
+   2 -> 19 -> 20 was.
+4. Durable intent-to-kill, since kill is the reclamation path for orphaned leases
+   and a one-shot renderer broadcast should not be its only chance.
+
+---
+
+# Duplicate agent resume: why I did not add the fix I recommended
+
+Adoption item 1 was a typed end-reason recorded at end time — `detached` (the
+user quit; not a resume candidate) versus `terminal-exited` (it died under the
+agent; resumable) — on the grounds that a boolean `ended` cannot express the
+difference, which is why systems keep resuming things they should not.
+
+I went to implement it and stopped, because the codebase already contains that
+idea three times over.
+
+`SleepingAgentSessionRecord` (`src/shared/agent-session-resume.ts`) carries:
+
+- `origin?: 'worktree-sleep' | 'quit' | 'live'` — added so worktree activation
+  would not launch a tab that a warm reattach had already restored (#5232);
+- `restoreOnTabOpenOnly?: boolean` — added so a mobile wake would not background
+  mount every slept tab and respawn the workspace the user just slept (#11598);
+- `automaticResumeBlockedBy?: 'legacy-orchestration-worker'` — added so a
+  relaunch could not race a durable orchestration assignment.
+
+Three fields, three incidents, one defect: something resumed that should not
+have. They are consulted at 22 non-test sites. A fourth flag — however well
+typed — is the fifth containment cycle, which is the failure pattern this
+program exists to break.
+
+The peer designs that do not have this bug do not have a better flag. They have
+a different shape:
+
+1. **Nothing resumes automatically.** Resume is a button. On click it resumes
+   into a _brand-new terminal id_, re-points the pane, then kills the old
+   terminal — so two live agents for one pane never exist even transiently.
+2. **Two-agents-in-one-terminal is unrepresentable.** The terminal id is the
+   agent binding's primary key with a cascade to the session row, and live reads
+   inner-join on the session being active — so a dead terminal's agent cannot
+   appear in a read no matter how the terminal died.
+
+Neither is a 30-line change here, and (1) is a product decision about whether
+automatic resume stays a feature. That belongs to the user, not to me.
+
+What is safe to say: the next duplicate-resume incident should not be answered
+with a fourth predicate on this record. The record already proves that approach
+does not converge.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/counsel-design.html b/docs/reference/terminal-session-correctness-handoff-2026-08-07/counsel-design.html
new file mode 100644
index 00000000000..34c224c6352
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/counsel-design.html
@@ -0,0 +1,278 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Design Counsel — Terminal Session Ownership</title>
+    <style>
+      :root {
+        --bg: #0f1115; --panel: #161920; --panel-2: #1c2029; --ink: #e6e8ee; --ink-dim: #9aa3b2;
+        --line: #262b36; --good: #3fb950; --bad: #f85149; --warn: #d29922; --info: #58a6ff;
+        --accent: #7c8cff; --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, monospace;
+      }
+      @media (prefers-color-scheme: light) {
+        :root {
+          --bg: #fbfbfd; --panel: #fff; --panel-2: #f4f5f8; --ink: #14161a; --ink-dim: #5b6472;
+          --line: #e2e5ea; --good: #1a7f37; --bad: #cf222e; --warn: #9a6700; --info: #0969da; --accent: #4d5bd9;
+        }
+      }
+      * { box-sizing: border-box; }
+      body { margin: 0; background: var(--bg); color: var(--ink);
+        font: 16px/1.65 -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, system-ui, sans-serif; -webkit-font-smoothing: antialiased; }
+      .wrap { max-width: 1080px; margin: 0 auto; padding: 48px 28px 120px; }
+      header.hero { border-bottom: 1px solid var(--line); padding-bottom: 28px; }
+      h1 { font-size: 34px; line-height: 1.2; margin: 0 0 8px; letter-spacing: -0.02em; }
+      .sub { color: var(--ink-dim); font-size: 15px; margin: 0; }
+      h2 { font-size: 24px; margin: 56px 0 6px; letter-spacing: -0.01em; padding-top: 20px; border-top: 1px solid var(--line); }
+      h3 { font-size: 18px; margin: 30px 0 6px; }
+      .lede { color: var(--ink-dim); margin-top: 0; }
+      code { font-family: var(--mono); font-size: 0.9em; background: var(--panel-2); padding: 1px 5px; border-radius: 4px; }
+      .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 12px; margin: 22px 0; }
+      .stat { background: var(--panel); border: 1px solid var(--line); border-radius: 10px; padding: 16px 18px; }
+      .stat .n { font-size: 28px; font-weight: 650; letter-spacing: -0.02em; line-height: 1.1; }
+      .stat .l { color: var(--ink-dim); font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.05em; margin-top: 4px; }
+      .n.good { color: var(--good); } .n.bad { color: var(--bad); } .n.warn { color: var(--warn); } .n.info { color: var(--info); }
+      figure { margin: 22px 0; background: var(--panel); border: 1px solid var(--line); border-radius: 12px; padding: 10px; }
+      figure .bar { display: flex; justify-content: space-between; align-items: center; padding: 4px 8px 10px; color: var(--ink-dim); font-size: 12.5px; }
+      figure .zoom { color: var(--accent); cursor: pointer; user-select: none; font-weight: 600; }
+      .mermaid { text-align: center; overflow: auto; }
+      .dia { text-align: center; padding: 4px 6px 10px; cursor: zoom-in; }
+      .dia svg { width: 100%; height: auto; max-width: 900px; }
+      .d-light { display: none; }
+      @media (prefers-color-scheme: light) { .d-dark { display: none; } .d-light { display: block; } }
+      table { border-collapse: collapse; width: 100%; margin: 18px 0; font-size: 14.5px; }
+      th, td { text-align: left; padding: 9px 12px; border-bottom: 1px solid var(--line); vertical-align: top; }
+      th { color: var(--ink-dim); font-weight: 600; font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.04em; }
+      tbody tr:hover { background: var(--panel-2); }
+      .pill { display: inline-block; padding: 1px 9px; border-radius: 999px; font-size: 12px; font-weight: 650; white-space: nowrap; }
+      .pill.ok { background: color-mix(in srgb, var(--good) 18%, transparent); color: var(--good); }
+      .pill.no { background: color-mix(in srgb, var(--bad) 18%, transparent); color: var(--bad); }
+      .pill.mid { background: color-mix(in srgb, var(--warn) 20%, transparent); color: var(--warn); }
+      .pill.inf { background: color-mix(in srgb, var(--info) 18%, transparent); color: var(--info); }
+      .callout { border-left: 3px solid var(--accent); background: var(--panel); padding: 14px 18px; border-radius: 0 10px 10px 0; margin: 22px 0; }
+      .callout.bad { border-left-color: var(--bad); } .callout.good { border-left-color: var(--good); } .callout.warn { border-left-color: var(--warn); }
+      .callout p:first-child { margin-top: 0; } .callout p:last-child { margin-bottom: 0; }
+      .k { font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.06em; color: var(--ink-dim); font-weight: 650; }
+      pre.term { background: #0b0d12; color: #d7dbe4; border: 1px solid var(--line); border-radius: 10px;
+        padding: 14px 16px; overflow-x: auto; font-family: var(--mono); font-size: 13px; line-height: 1.55; }
+      pre.term .r { color: #ff7b72; } pre.term .g { color: #7ee787; } pre.term .d { color: #8b949e; } pre.term .y { color: #e3b341; }
+      #ov { position: fixed; inset: 0; background: var(--bg); display: none; z-index: 99; cursor: grab; overflow: hidden; }
+      #ov.on { display: block; }
+      #ov .inner { transform-origin: 0 0; position: absolute; top: 0; left: 0;
+        background: var(--panel); border: 1px solid var(--line); border-radius: 14px; padding: 22px; }
+      #ov .inner svg { display: block; }
+      #ov .hint { position: fixed; bottom: 18px; left: 50%; transform: translateX(-50%);
+        color: var(--ink-dim); background: var(--panel-2); border: 1px solid var(--line); border-radius: 999px; padding: 7px 16px; font-size: 13px; }
+      #ov .x { position: fixed; top: 14px; right: 20px; color: var(--ink); font-size: 26px; cursor: pointer; line-height: 1;
+        z-index: 2; background: var(--panel-2); border: 1px solid var(--line); border-radius: 8px; padding: 2px 10px 5px; }
+      .foot { margin-top: 60px; padding-top: 20px; border-top: 1px solid var(--line); color: var(--ink-dim); font-size: 13.5px; }
+    </style>
+  </head>
+  <body>
+    <div class="wrap">
+      <header class="hero">
+        <h1>Design Counsel — Terminal Session Ownership</h1>
+        <p class="sub">Three review rounds across two models, an adversarial fact-check, and a close-out · the design that emerged is not the one I proposed</p>
+      </header>
+
+      <div class="grid">
+        <div class="stat"><div class="n bad">1</div><div class="l">Live bug found</div></div>
+        <div class="stat"><div class="n good">2 → 1</div><div class="l">Durable records</div></div>
+        <div class="stat"><div class="n info">3</div><div class="l">Review rounds</div></div>
+        <div class="stat"><div class="n">78 / 12</div><div class="l">Facts right / wrong</div></div>
+        <div class="stat"><div class="n warn">4</div><div class="l">Unresolved conflicts</div></div>
+        <div class="stat"><div class="n good">~900–1250</div><div class="l">Lines deleted</div></div>
+      </div>
+
+      <div class="callout bad">
+        <p><span class="k">The headline</span></p>
+        <p>The counsel found a <strong>live duplicate-agent bug reachable from a shipped gesture</strong>, and then something worse: <strong>respawn is reachable down at least five paths, and the proof gate I shipped sits on only one of them</strong> — not the primary one. Detaching a pane into a new tab makes a healthy remote shell report as dead, and the client starts a second one <em>with agent resume</em> while the original keeps running.</p>
+      </div>
+
+      <h2>1 · How the counsel ran</h2>
+      <figure>
+        <div class="bar"><span>Process and convergence</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark0" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 273.390625 1194" role="graphics-document document" aria-roledescription="d0-flowchart-v2"><style>#gdark0{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark0 .error-icon{fill:#a44141;}#gdark0 .error-text{fill:#ddd;stroke:#ddd;}#gdark0 .edge-thickness-normal{stroke-width:1px;}#gdark0 .edge-thickness-thick{stroke-width:3.5px;}#gdark0 .edge-pattern-solid{stroke-dasharray:0;}#gdark0 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark0 .edge-pattern-dashed{stroke-dasharray:3;}#gdark0 .edge-pattern-dotted{stroke-dasharray:2;}#gdark0 .marker{fill:lightgrey;stroke:lightgrey;}#gdark0 .marker.cross{stroke:lightgrey;}#gdark0 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark0 p{margin:0;}#gdark0 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark0 .cluster-label text{fill:#F9FFFE;}#gdark0 .cluster-label span{color:#F9FFFE;}#gdark0 .cluster-label span p{background-color:transparent;}#gdark0 .label text,#gdark0 span{fill:#ccc;color:#ccc;}#gdark0 .node rect,#gdark0 .node circle,#gdark0 .node ellipse,#gdark0 .node polygon,#gdark0 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark0 .rough-node .label text,#gdark0 .node .label text,#gdark0 .image-shape .label,#gdark0 .icon-shape .label{text-anchor:middle;}#gdark0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark0 .rough-node .label,#gdark0 .node .label,#gdark0 .image-shape .label,#gdark0 .icon-shape .label{text-align:center;}#gdark0 .node.clickable{cursor:pointer;}#gdark0 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark0 .arrowheadPath{fill:lightgrey;}#gdark0 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark0 .d0-flowchart-link{stroke:lightgrey;fill:none;}#gdark0 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark0 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark0 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark0 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark0 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark0 .cluster text{fill:#F9FFFE;}#gdark0 .cluster span{color:#F9FFFE;}#gdark0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark0 rect.text{fill:none;stroke-width:0;}#gdark0 .icon-shape,#gdark0 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark0 .icon-shape p,#gdark0 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark0 .icon-shape .label rect,#gdark0 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark0 .node .neo-node{stroke:#ccc;}#gdark0 [data-look="neo"].node rect,#gdark0 [data-look="neo"].cluster rect,#gdark0 [data-look="neo"].node polygon{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark0 [data-look="neo"].node path{stroke:url(#gdark0-gradient);stroke-width:1px;}#gdark0 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark0 [data-look="neo"].node circle{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark0 [data-look="neo"].icon-shape .icon{fill:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark0_d0-flowchart-v2-pointEnd" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointStart" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointEnd-margin" class="marker d0-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointStart-margin" class="marker d0-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark0_d0-flowchart-v2-circleEnd" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleStart" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleEnd-margin" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleStart-margin" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-crossEnd" class="marker cross d0-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossStart" class="marker cross d0-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossEnd-margin" class="marker cross d0-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossStart-margin" class="marker cross d0-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M136.695,658L136.695,662.167C136.695,666.333,136.695,674.667,136.695,682.333C136.695,690,136.695,697,136.695,700.5L136.695,704" id="gdark0-L_S1_R2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S1_R2_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjY1OH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6NjgzfSx7IngiOjEzNi42OTUzMTI1LCJ5Ijo3MDh9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M136.695,808L136.695,812.167C136.695,816.333,136.695,824.667,136.695,832.333C136.695,840,136.695,847,136.695,850.5L136.695,854" id="gdark0-L_R2_R3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R2_R3_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjgwOH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6ODMzfSx7IngiOjEzNi42OTUzMTI1LCJ5Ijo4NTh9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M136.695,958L136.695,962.167C136.695,966.333,136.695,974.667,136.695,982.333C136.695,990,136.695,997,136.695,1000.5L136.695,1004" id="gdark0-L_R3_CC_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R3_CC_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjk1OH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6OTgzfSx7IngiOjEzNi42OTUzMTI1LCJ5IjoxMDA4fV0=" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M136.695,1060L136.695,1064.167C136.695,1068.333,136.695,1076.667,136.695,1084.333C136.695,1092,136.695,1099,136.695,1102.5L136.695,1106" id="gdark0-L_CC_CO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_CC_CO_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjEwNjB9LHsieCI6MTM2LjY5NTMxMjUsInkiOjEwODV9LHsieCI6MTM2LjY5NTMxMjUsInkiOjExMTB9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M136.695,108L136.695,112.167C136.695,116.333,136.695,124.667,136.695,132.333C136.695,140,136.695,147,136.695,150.5L136.695,154" id="gdark0-L_B_R1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_R1_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjEwOH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6MTMzfSx7IngiOjEzNi42OTUzMTI1LCJ5IjoxNTh9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M136.695,484L136.695,488.167C136.695,492.333,136.695,500.667,136.695,508.333C136.695,516,136.695,523,136.695,526.5L136.695,530" id="gdark0-L_R1_S1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R1_S1_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjQ4NH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6NTA5fSx7IngiOjEzNi42OTUzMTI1LCJ5Ijo1MzR9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_S1_R2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R2_R3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R3_CC_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_CC_CO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_R1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R1_S1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(0, 150)"><g class="clusters"><g class="cluster " id="gdark0-R1" data-look="classic"><rect style="" x="8" y="8" width="257.390625" height="326"></rect><g class="cluster-label " transform="translate(107.7421875, 8)"><foreignObject width="57.90625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>Round 1</p></span></div></foreignObject></g></g></g><g class="edgePaths"></g><g class="edgeLabels"></g><g class="nodes"><g class="node default  " id="gdark0-d0-flowchart-G1-2" data-look="classic" transform="translate(136.6953125, 69)"><rect class="basic label-container" style="" x="-91.1953125" y="-26" width="182.390625" height="52"></rect><g class="label" style="" transform="translate(-63.1953125, -12)"><rect></rect><foreignObject width="126.390625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Grok · 10 findings</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-O1-3" data-look="classic" transform="translate(136.6953125, 171)"><rect class="basic label-container" style="" x="-89.6484375" y="-26" width="179.296875" height="52"></rect><g class="label" style="" transform="translate(-61.6484375, -12)"><rect></rect><foreignObject width="123.296875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Opus · 8 findings</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-X1-4" data-look="classic" transform="translate(136.6953125, 273)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-90.4921875" y="-26" width="180.984375" height="52"></rect><g class="label" style="color:#fff !important" transform="translate(-62.4921875, -12)"><rect></rect><foreignObject width="124.984375" height="24"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>GPT seat · empty</p></span></div></foreignObject></g></g></g></g><g class="node default  " id="gdark0-d0-flowchart-B-0" data-look="classic" transform="translate(136.6953125, 58)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>shared brief<br/><i>verified facts vs unverified leads</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-S1-6" data-look="classic" transform="translate(136.6953125, 596)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>synthesis<br/>both models independently say:<br/><b>one record, not two</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-R2-8" data-look="classic" transform="translate(136.6953125, 758)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>Round 2 · Grok 6 · Opus 7<br/>→ key by leafId, not paneKey</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-R3-10" data-look="classic" transform="translate(136.6953125, 908)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>Round 3 · Grok 5 · Opus 5<br/>→ delete attach identity entirely</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-CC-12" data-look="classic" transform="translate(136.6953125, 1034)"><rect class="basic label-container" style="" x="-121.1328125" y="-26" width="242.265625" height="52"></rect><g class="label" style="" transform="translate(-93.1328125, -12)"><rect></rect><foreignObject width="186.265625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>clean-check + fact-check</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-CO-14" data-look="classic" transform="translate(136.6953125, 1148)"><rect class="basic label-container" style="" x="-62.65625" y="-38" width="125.3125" height="76"></rect><g class="label" style="" transform="translate(-34.65625, -24)"><rect></rect><foreignObject width="69.3125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>close-out<br/>C1–C5</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark0-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark0-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark0-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault0" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 273.390625 1194" role="graphics-document document" aria-roledescription="l0-flowchart-v2"><style>#gdefault0{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault0 .error-icon{fill:#552222;}#gdefault0 .error-text{fill:#552222;stroke:#552222;}#gdefault0 .edge-thickness-normal{stroke-width:1px;}#gdefault0 .edge-thickness-thick{stroke-width:3.5px;}#gdefault0 .edge-pattern-solid{stroke-dasharray:0;}#gdefault0 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault0 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault0 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault0 .marker{fill:#333333;stroke:#333333;}#gdefault0 .marker.cross{stroke:#333333;}#gdefault0 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault0 p{margin:0;}#gdefault0 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault0 .cluster-label text{fill:#333;}#gdefault0 .cluster-label span{color:#333;}#gdefault0 .cluster-label span p{background-color:transparent;}#gdefault0 .label text,#gdefault0 span{fill:#333;color:#333;}#gdefault0 .node rect,#gdefault0 .node circle,#gdefault0 .node ellipse,#gdefault0 .node polygon,#gdefault0 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault0 .rough-node .label text,#gdefault0 .node .label text,#gdefault0 .image-shape .label,#gdefault0 .icon-shape .label{text-anchor:middle;}#gdefault0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault0 .rough-node .label,#gdefault0 .node .label,#gdefault0 .image-shape .label,#gdefault0 .icon-shape .label{text-align:center;}#gdefault0 .node.clickable{cursor:pointer;}#gdefault0 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault0 .arrowheadPath{fill:#333333;}#gdefault0 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault0 .l0-flowchart-link{stroke:#333333;fill:none;}#gdefault0 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault0 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault0 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault0 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault0 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault0 .cluster text{fill:#333;}#gdefault0 .cluster span{color:#333;}#gdefault0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault0 rect.text{fill:none;stroke-width:0;}#gdefault0 .icon-shape,#gdefault0 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault0 .icon-shape p,#gdefault0 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault0 .icon-shape .label rect,#gdefault0 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault0 .node .neo-node{stroke:#9370DB;}#gdefault0 [data-look="neo"].node rect,#gdefault0 [data-look="neo"].cluster rect,#gdefault0 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault0 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault0 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault0 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault0 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault0_l0-flowchart-v2-pointEnd" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointStart" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointEnd-margin" class="marker l0-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointStart-margin" class="marker l0-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault0_l0-flowchart-v2-circleEnd" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleStart" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleEnd-margin" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleStart-margin" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-crossEnd" class="marker cross l0-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossStart" class="marker cross l0-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossEnd-margin" class="marker cross l0-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossStart-margin" class="marker cross l0-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M136.695,658L136.695,662.167C136.695,666.333,136.695,674.667,136.695,682.333C136.695,690,136.695,697,136.695,700.5L136.695,704" id="gdefault0-L_S1_R2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S1_R2_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjY1OH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6NjgzfSx7IngiOjEzNi42OTUzMTI1LCJ5Ijo3MDh9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M136.695,808L136.695,812.167C136.695,816.333,136.695,824.667,136.695,832.333C136.695,840,136.695,847,136.695,850.5L136.695,854" id="gdefault0-L_R2_R3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R2_R3_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjgwOH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6ODMzfSx7IngiOjEzNi42OTUzMTI1LCJ5Ijo4NTh9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M136.695,958L136.695,962.167C136.695,966.333,136.695,974.667,136.695,982.333C136.695,990,136.695,997,136.695,1000.5L136.695,1004" id="gdefault0-L_R3_CC_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R3_CC_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjk1OH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6OTgzfSx7IngiOjEzNi42OTUzMTI1LCJ5IjoxMDA4fV0=" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M136.695,1060L136.695,1064.167C136.695,1068.333,136.695,1076.667,136.695,1084.333C136.695,1092,136.695,1099,136.695,1102.5L136.695,1106" id="gdefault0-L_CC_CO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_CC_CO_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjEwNjB9LHsieCI6MTM2LjY5NTMxMjUsInkiOjEwODV9LHsieCI6MTM2LjY5NTMxMjUsInkiOjExMTB9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M136.695,108L136.695,112.167C136.695,116.333,136.695,124.667,136.695,132.333C136.695,140,136.695,147,136.695,150.5L136.695,154" id="gdefault0-L_B_R1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_R1_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjEwOH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6MTMzfSx7IngiOjEzNi42OTUzMTI1LCJ5IjoxNTh9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M136.695,484L136.695,488.167C136.695,492.333,136.695,500.667,136.695,508.333C136.695,516,136.695,523,136.695,526.5L136.695,530" id="gdefault0-L_R1_S1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R1_S1_0" data-points="W3sieCI6MTM2LjY5NTMxMjUsInkiOjQ4NH0seyJ4IjoxMzYuNjk1MzEyNSwieSI6NTA5fSx7IngiOjEzNi42OTUzMTI1LCJ5Ijo1MzR9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_S1_R2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R2_R3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R3_CC_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_CC_CO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_R1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R1_S1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(0, 150)"><g class="clusters"><g class="cluster " id="gdefault0-R1" data-look="classic"><rect style="" x="8" y="8" width="257.390625" height="326"></rect><g class="cluster-label " transform="translate(107.7421875, 8)"><foreignObject width="57.90625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>Round 1</p></span></div></foreignObject></g></g></g><g class="edgePaths"></g><g class="edgeLabels"></g><g class="nodes"><g class="node default  " id="gdefault0-l0-flowchart-G1-2" data-look="classic" transform="translate(136.6953125, 69)"><rect class="basic label-container" style="" x="-91.1953125" y="-26" width="182.390625" height="52"></rect><g class="label" style="" transform="translate(-63.1953125, -12)"><rect></rect><foreignObject width="126.390625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Grok · 10 findings</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-O1-3" data-look="classic" transform="translate(136.6953125, 171)"><rect class="basic label-container" style="" x="-89.6484375" y="-26" width="179.296875" height="52"></rect><g class="label" style="" transform="translate(-61.6484375, -12)"><rect></rect><foreignObject width="123.296875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Opus · 8 findings</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-X1-4" data-look="classic" transform="translate(136.6953125, 273)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-90.4921875" y="-26" width="180.984375" height="52"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-62.4921875, -12)"><rect></rect><foreignObject width="124.984375" height="24"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>GPT seat · empty</p></span></div></foreignObject></g></g></g></g><g class="node default  " id="gdefault0-l0-flowchart-B-0" data-look="classic" transform="translate(136.6953125, 58)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>shared brief<br/><i>verified facts vs unverified leads</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-S1-6" data-look="classic" transform="translate(136.6953125, 596)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>synthesis<br/>both models independently say:<br/><b>one record, not two</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-R2-8" data-look="classic" transform="translate(136.6953125, 758)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>Round 2 · Grok 6 · Opus 7<br/>→ key by leafId, not paneKey</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-R3-10" data-look="classic" transform="translate(136.6953125, 908)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>Round 3 · Grok 5 · Opus 5<br/>→ delete attach identity entirely</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-CC-12" data-look="classic" transform="translate(136.6953125, 1034)"><rect class="basic label-container" style="" x="-121.1328125" y="-26" width="242.265625" height="52"></rect><g class="label" style="" transform="translate(-93.1328125, -12)"><rect></rect><foreignObject width="186.265625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>clean-check + fact-check</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-CO-14" data-look="classic" transform="translate(136.6953125, 1148)"><rect class="basic label-container" style="" x="-62.65625" y="-38" width="125.3125" height="76"></rect><g class="label" style="" transform="translate(-34.65625, -24)"><rect></rect><foreignObject width="69.3125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>close-out<br/>C1–C5</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault0-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault0-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The GPT seat returned nothing in all three rounds and was dropped. Grok ran through its CLI; the wrapper was instructed to report a failure rather than author findings, so its participation is real rather than assumed. Findings fell 10 → 6 → 5 and 8 → 7 → 5 across rounds — converging, not exhausted.</p>
+
+      <h2>2 · The live bug</h2>
+      <p class="lede">Four independently reasonable decisions compose into a shell-killer.</p>
+      <figure>
+        <div class="bar"><span>Detach a pane → duplicate agent</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark1" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 335.703125 1118" role="graphics-document document" aria-roledescription="d1-flowchart-v2"><style>#gdark1{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark1 .error-icon{fill:#a44141;}#gdark1 .error-text{fill:#ddd;stroke:#ddd;}#gdark1 .edge-thickness-normal{stroke-width:1px;}#gdark1 .edge-thickness-thick{stroke-width:3.5px;}#gdark1 .edge-pattern-solid{stroke-dasharray:0;}#gdark1 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark1 .edge-pattern-dashed{stroke-dasharray:3;}#gdark1 .edge-pattern-dotted{stroke-dasharray:2;}#gdark1 .marker{fill:lightgrey;stroke:lightgrey;}#gdark1 .marker.cross{stroke:lightgrey;}#gdark1 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark1 p{margin:0;}#gdark1 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark1 .cluster-label text{fill:#F9FFFE;}#gdark1 .cluster-label span{color:#F9FFFE;}#gdark1 .cluster-label span p{background-color:transparent;}#gdark1 .label text,#gdark1 span{fill:#ccc;color:#ccc;}#gdark1 .node rect,#gdark1 .node circle,#gdark1 .node ellipse,#gdark1 .node polygon,#gdark1 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark1 .rough-node .label text,#gdark1 .node .label text,#gdark1 .image-shape .label,#gdark1 .icon-shape .label{text-anchor:middle;}#gdark1 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark1 .rough-node .label,#gdark1 .node .label,#gdark1 .image-shape .label,#gdark1 .icon-shape .label{text-align:center;}#gdark1 .node.clickable{cursor:pointer;}#gdark1 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark1 .arrowheadPath{fill:lightgrey;}#gdark1 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark1 .d1-flowchart-link{stroke:lightgrey;fill:none;}#gdark1 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark1 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark1 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark1 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark1 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark1 .cluster text{fill:#F9FFFE;}#gdark1 .cluster span{color:#F9FFFE;}#gdark1 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark1 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark1 rect.text{fill:none;stroke-width:0;}#gdark1 .icon-shape,#gdark1 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark1 .icon-shape p,#gdark1 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark1 .icon-shape .label rect,#gdark1 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark1 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark1 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark1 .node .neo-node{stroke:#ccc;}#gdark1 [data-look="neo"].node rect,#gdark1 [data-look="neo"].cluster rect,#gdark1 [data-look="neo"].node polygon{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark1 [data-look="neo"].node path{stroke:url(#gdark1-gradient);stroke-width:1px;}#gdark1 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark1 [data-look="neo"].node circle{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark1 [data-look="neo"].icon-shape .icon{fill:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark1_d1-flowchart-v2-pointEnd" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointStart" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointEnd-margin" class="marker d1-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointStart-margin" class="marker d1-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark1_d1-flowchart-v2-circleEnd" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleStart" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleEnd-margin" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleStart-margin" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-crossEnd" class="marker cross d1-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossStart" class="marker cross d1-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossEnd-margin" class="marker cross d1-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossStart-margin" class="marker cross d1-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M167.852,108L167.852,112.167C167.852,116.333,167.852,124.667,167.852,132.333C167.852,140,167.852,147,167.852,150.5L167.852,154" id="gdark1-L_A_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_B_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjEwOH0seyJ4IjoxNjcuODUxNTYyNSwieSI6MTMzfSx7IngiOjE2Ny44NTE1NjI1LCJ5IjoxNTh9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M167.852,258L167.852,262.167C167.852,266.333,167.852,274.667,167.852,282.333C167.852,290,167.852,297,167.852,300.5L167.852,304" id="gdark1-L_B_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_C_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjI1OH0seyJ4IjoxNjcuODUxNTYyNSwieSI6MjgzfSx7IngiOjE2Ny44NTE1NjI1LCJ5IjozMDh9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M167.852,432L167.852,436.167C167.852,440.333,167.852,448.667,167.852,456.333C167.852,464,167.852,471,167.852,474.5L167.852,478" id="gdark1-L_C_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_D_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjQzMn0seyJ4IjoxNjcuODUxNTYyNSwieSI6NDU3fSx7IngiOjE2Ny44NTE1NjI1LCJ5Ijo0ODJ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M167.852,582L167.852,586.167C167.852,590.333,167.852,598.667,167.852,606.333C167.852,614,167.852,621,167.852,624.5L167.852,628" id="gdark1-L_D_E_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_E_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjU4Mn0seyJ4IjoxNjcuODUxNTYyNSwieSI6NjA3fSx7IngiOjE2Ny44NTE1NjI1LCJ5Ijo2MzJ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M167.852,708L167.852,712.167C167.852,716.333,167.852,724.667,167.852,732.333C167.852,740,167.852,747,167.852,750.5L167.852,754" id="gdark1-L_E_F_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_E_F_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjcwOH0seyJ4IjoxNjcuODUxNTYyNSwieSI6NzMzfSx7IngiOjE2Ny44NTE1NjI1LCJ5Ijo3NTh9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M167.852,834L167.852,838.167C167.852,842.333,167.852,850.667,167.852,858.333C167.852,866,167.852,873,167.852,876.5L167.852,880" id="gdark1-L_F_G_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_F_G_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjgzNH0seyJ4IjoxNjcuODUxNTYyNSwieSI6ODU5fSx7IngiOjE2Ny44NTE1NjI1LCJ5Ijo4ODR9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M167.852,960L167.852,964.167C167.852,968.333,167.852,976.667,167.852,984.333C167.852,992,167.852,999,167.852,1002.5L167.852,1006" id="gdark1-L_G_H_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_G_H_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjk2MH0seyJ4IjoxNjcuODUxNTYyNSwieSI6OTg1fSx7IngiOjE2Ny44NTE1NjI1LCJ5IjoxMDEwfV0=" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C_D_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D_E_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_E_F_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_F_G_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_G_H_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark1-d1-flowchart-A-0" data-look="classic" transform="translate(167.8515625, 58)"><rect class="basic label-container" style="" x="-105.796875" y="-50" width="211.59375" height="100"></rect><g class="label" style="" transform="translate(-77.796875, -36)"><rect></rect><foreignObject width="155.59375" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>user detaches a pane<br/>into a new tab<br/><i>shipped gesture</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-B-1" data-look="classic" transform="translate(167.8515625, 208)"><rect class="basic label-container" style="" x="-124.296875" y="-50" width="248.59375" height="100"></rect><g class="label" style="" transform="translate(-96.296875, -36)"><rect></rect><foreignObject width="192.59375" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>tabId changes;<br/>relay still holds the old one<br/><i>frozen at spawn</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-C-3" data-look="classic" transform="translate(167.8515625, 370)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>reattach → relay compares<br/>and throws<br/><b>PTY "x" not found (identity mismatch)</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-D-5" data-look="classic" transform="translate(167.8515625, 532)"><rect class="basic label-container" style="" x="-122.5" y="-50" width="245" height="100"></rect><g class="label" style="" transform="translate(-94.5, -36)"><rect></rect><foreignObject width="189" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>isSshPtyNotFoundError<br/>regex /PTY ".+" not found/<br/><b>matches</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-E-7" data-look="classic" transform="translate(167.8515625, 670)"><rect class="basic label-container" style="" x="-118.03125" y="-38" width="236.0625" height="76"></rect><g class="label" style="" transform="translate(-90.03125, -24)"><rect></rect><foreignObject width="180.0625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>re-emitted as<br/>SSH_SESSION_EXPIRED</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-F-9" data-look="classic" transform="translate(167.8515625, 796)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-137.8046875" y="-38" width="275.609375" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-109.8046875, -24)"><rect></rect><foreignObject width="219.609375" height="48"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>isProvenSshSessionGoneError<br/>returns <b>true</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-G-11" data-look="classic" transform="translate(167.8515625, 922)"><rect class="basic label-container" style="" x="-159.8515625" y="-38" width="319.703125" height="76"></rect><g class="label" style="" transform="translate(-131.8515625, -24)"><rect></rect><foreignObject width="263.703125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>clear binding →<br/>startFreshColdRestoreAgentResume</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-H-13" data-look="classic" transform="translate(167.8515625, 1060)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>second shell + SECOND AGENT RESUME<br/>original shell still running</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark1-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark1-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark1-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault1" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 335.703125 1118" role="graphics-document document" aria-roledescription="l1-flowchart-v2"><style>#gdefault1{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault1 .error-icon{fill:#552222;}#gdefault1 .error-text{fill:#552222;stroke:#552222;}#gdefault1 .edge-thickness-normal{stroke-width:1px;}#gdefault1 .edge-thickness-thick{stroke-width:3.5px;}#gdefault1 .edge-pattern-solid{stroke-dasharray:0;}#gdefault1 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault1 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault1 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault1 .marker{fill:#333333;stroke:#333333;}#gdefault1 .marker.cross{stroke:#333333;}#gdefault1 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault1 p{margin:0;}#gdefault1 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault1 .cluster-label text{fill:#333;}#gdefault1 .cluster-label span{color:#333;}#gdefault1 .cluster-label span p{background-color:transparent;}#gdefault1 .label text,#gdefault1 span{fill:#333;color:#333;}#gdefault1 .node rect,#gdefault1 .node circle,#gdefault1 .node ellipse,#gdefault1 .node polygon,#gdefault1 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault1 .rough-node .label text,#gdefault1 .node .label text,#gdefault1 .image-shape .label,#gdefault1 .icon-shape .label{text-anchor:middle;}#gdefault1 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault1 .rough-node .label,#gdefault1 .node .label,#gdefault1 .image-shape .label,#gdefault1 .icon-shape .label{text-align:center;}#gdefault1 .node.clickable{cursor:pointer;}#gdefault1 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault1 .arrowheadPath{fill:#333333;}#gdefault1 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault1 .l1-flowchart-link{stroke:#333333;fill:none;}#gdefault1 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault1 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault1 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault1 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault1 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault1 .cluster text{fill:#333;}#gdefault1 .cluster span{color:#333;}#gdefault1 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault1 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault1 rect.text{fill:none;stroke-width:0;}#gdefault1 .icon-shape,#gdefault1 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault1 .icon-shape p,#gdefault1 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault1 .icon-shape .label rect,#gdefault1 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault1 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault1 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault1 .node .neo-node{stroke:#9370DB;}#gdefault1 [data-look="neo"].node rect,#gdefault1 [data-look="neo"].cluster rect,#gdefault1 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault1 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault1 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault1 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault1 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault1_l1-flowchart-v2-pointEnd" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointStart" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointEnd-margin" class="marker l1-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointStart-margin" class="marker l1-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault1_l1-flowchart-v2-circleEnd" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleStart" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleEnd-margin" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleStart-margin" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-crossEnd" class="marker cross l1-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossStart" class="marker cross l1-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossEnd-margin" class="marker cross l1-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossStart-margin" class="marker cross l1-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M167.852,108L167.852,112.167C167.852,116.333,167.852,124.667,167.852,132.333C167.852,140,167.852,147,167.852,150.5L167.852,154" id="gdefault1-L_A_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_B_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjEwOH0seyJ4IjoxNjcuODUxNTYyNSwieSI6MTMzfSx7IngiOjE2Ny44NTE1NjI1LCJ5IjoxNTh9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M167.852,258L167.852,262.167C167.852,266.333,167.852,274.667,167.852,282.333C167.852,290,167.852,297,167.852,300.5L167.852,304" id="gdefault1-L_B_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_C_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjI1OH0seyJ4IjoxNjcuODUxNTYyNSwieSI6MjgzfSx7IngiOjE2Ny44NTE1NjI1LCJ5IjozMDh9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M167.852,432L167.852,436.167C167.852,440.333,167.852,448.667,167.852,456.333C167.852,464,167.852,471,167.852,474.5L167.852,478" id="gdefault1-L_C_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_D_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjQzMn0seyJ4IjoxNjcuODUxNTYyNSwieSI6NDU3fSx7IngiOjE2Ny44NTE1NjI1LCJ5Ijo0ODJ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M167.852,582L167.852,586.167C167.852,590.333,167.852,598.667,167.852,606.333C167.852,614,167.852,621,167.852,624.5L167.852,628" id="gdefault1-L_D_E_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_E_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjU4Mn0seyJ4IjoxNjcuODUxNTYyNSwieSI6NjA3fSx7IngiOjE2Ny44NTE1NjI1LCJ5Ijo2MzJ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M167.852,708L167.852,712.167C167.852,716.333,167.852,724.667,167.852,732.333C167.852,740,167.852,747,167.852,750.5L167.852,754" id="gdefault1-L_E_F_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_E_F_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjcwOH0seyJ4IjoxNjcuODUxNTYyNSwieSI6NzMzfSx7IngiOjE2Ny44NTE1NjI1LCJ5Ijo3NTh9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M167.852,834L167.852,838.167C167.852,842.333,167.852,850.667,167.852,858.333C167.852,866,167.852,873,167.852,876.5L167.852,880" id="gdefault1-L_F_G_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_F_G_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjgzNH0seyJ4IjoxNjcuODUxNTYyNSwieSI6ODU5fSx7IngiOjE2Ny44NTE1NjI1LCJ5Ijo4ODR9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M167.852,960L167.852,964.167C167.852,968.333,167.852,976.667,167.852,984.333C167.852,992,167.852,999,167.852,1002.5L167.852,1006" id="gdefault1-L_G_H_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_G_H_0" data-points="W3sieCI6MTY3Ljg1MTU2MjUsInkiOjk2MH0seyJ4IjoxNjcuODUxNTYyNSwieSI6OTg1fSx7IngiOjE2Ny44NTE1NjI1LCJ5IjoxMDEwfV0=" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C_D_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D_E_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_E_F_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_F_G_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_G_H_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault1-l1-flowchart-A-0" data-look="classic" transform="translate(167.8515625, 58)"><rect class="basic label-container" style="" x="-105.796875" y="-50" width="211.59375" height="100"></rect><g class="label" style="" transform="translate(-77.796875, -36)"><rect></rect><foreignObject width="155.59375" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>user detaches a pane<br/>into a new tab<br/><i>shipped gesture</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-B-1" data-look="classic" transform="translate(167.8515625, 208)"><rect class="basic label-container" style="" x="-124.296875" y="-50" width="248.59375" height="100"></rect><g class="label" style="" transform="translate(-96.296875, -36)"><rect></rect><foreignObject width="192.59375" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>tabId changes;<br/>relay still holds the old one<br/><i>frozen at spawn</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-C-3" data-look="classic" transform="translate(167.8515625, 370)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>reattach → relay compares<br/>and throws<br/><b>PTY "x" not found (identity mismatch)</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-D-5" data-look="classic" transform="translate(167.8515625, 532)"><rect class="basic label-container" style="" x="-122.5" y="-50" width="245" height="100"></rect><g class="label" style="" transform="translate(-94.5, -36)"><rect></rect><foreignObject width="189" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>isSshPtyNotFoundError<br/>regex /PTY ".+" not found/<br/><b>matches</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-E-7" data-look="classic" transform="translate(167.8515625, 670)"><rect class="basic label-container" style="" x="-118.03125" y="-38" width="236.0625" height="76"></rect><g class="label" style="" transform="translate(-90.03125, -24)"><rect></rect><foreignObject width="180.0625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>re-emitted as<br/>SSH_SESSION_EXPIRED</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-F-9" data-look="classic" transform="translate(167.8515625, 796)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-137.8046875" y="-38" width="275.609375" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-109.8046875, -24)"><rect></rect><foreignObject width="219.609375" height="48"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>isProvenSshSessionGoneError<br/>returns <b>true</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-G-11" data-look="classic" transform="translate(167.8515625, 922)"><rect class="basic label-container" style="" x="-159.8515625" y="-38" width="319.703125" height="76"></rect><g class="label" style="" transform="translate(-131.8515625, -24)"><rect></rect><foreignObject width="263.703125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>clear binding →<br/>startFreshColdRestoreAgentResume</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-H-13" data-look="classic" transform="translate(167.8515625, 1060)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>second shell + SECOND AGENT RESUME<br/>original shell still running</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault1-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault1-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The error string says the PTY was <em>not found</em>. It was found — that is how its identity got compared. The word “not found” is doing double duty for “absent” and “present but mismatched”, and a regex cannot tell them apart.</p>
+      <pre class="term"><span class="d">// my classifier — the last link</span>
+export function isProvenSshSessionGoneError(error: unknown): boolean {
+  if (message.includes(SSH_SOURCE_RESTORE_REQUIRED_ERROR)) return false
+  return message.includes(SSH_SESSION_EXPIRED_ERROR) || <span class="r">/PTY ".+" not found/i.test(message)</span>
+}
+<span class="d">// two functions away, unused by me:</span>
+<span class="y">export function isSshPtyIdentityMismatchError(error: unknown): boolean</span></pre>
+      <div class="callout bad">
+        <p><span class="k">Why I missed it</span></p>
+        <p>I wrote this file to enforce “unknown is not dead,” and its doc-comment says <em>“True only when the failure proves the session no longer exists.”</em> I treated a <strong>message shape</strong> as proof. The discriminator I needed already existed in the same file. A test asserting “not-found ⇒ gone” passes happily, because the wrongness is in what the string <em>means</em>, not in what the code does with it.</p>
+      </div>
+
+      <h3>The gate is on the wrong path</h3>
+      <p>I shipped “respawn requires positive proof” and pinned it with a test. Grok traced every respawn path and found the proof check is bypassed on the main one, because the error never reaches a classifier — it is converted into a boolean first:</p>
+      <pre class="term"><span class="d">// pty-transport.ts — catches the error and RESOLVES</span>
+return { id: options.sessionId, <span class="r">sessionExpired: true</span> }
+
+<span class="d">// pty-connection.ts — respawns on the flag alone, no proof check</span>
+if (connectResult?.<span class="r">sessionExpired</span>) { <span class="d">/* clear binding */</span>
+  <span class="r">startFreshColdRestoreAgentResume</span>(...) }</pre>
+      <figure>
+        <div class="bar"><span>Respawn paths vs the proof gate</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark2" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1342.484375 465.359375" role="graphics-document document" aria-roledescription="d2-flowchart-v2"><style>#gdark2{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark2 .error-icon{fill:#a44141;}#gdark2 .error-text{fill:#ddd;stroke:#ddd;}#gdark2 .edge-thickness-normal{stroke-width:1px;}#gdark2 .edge-thickness-thick{stroke-width:3.5px;}#gdark2 .edge-pattern-solid{stroke-dasharray:0;}#gdark2 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark2 .edge-pattern-dashed{stroke-dasharray:3;}#gdark2 .edge-pattern-dotted{stroke-dasharray:2;}#gdark2 .marker{fill:lightgrey;stroke:lightgrey;}#gdark2 .marker.cross{stroke:lightgrey;}#gdark2 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark2 p{margin:0;}#gdark2 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark2 .cluster-label text{fill:#F9FFFE;}#gdark2 .cluster-label span{color:#F9FFFE;}#gdark2 .cluster-label span p{background-color:transparent;}#gdark2 .label text,#gdark2 span{fill:#ccc;color:#ccc;}#gdark2 .node rect,#gdark2 .node circle,#gdark2 .node ellipse,#gdark2 .node polygon,#gdark2 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark2 .rough-node .label text,#gdark2 .node .label text,#gdark2 .image-shape .label,#gdark2 .icon-shape .label{text-anchor:middle;}#gdark2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark2 .rough-node .label,#gdark2 .node .label,#gdark2 .image-shape .label,#gdark2 .icon-shape .label{text-align:center;}#gdark2 .node.clickable{cursor:pointer;}#gdark2 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark2 .arrowheadPath{fill:lightgrey;}#gdark2 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark2 .d2-flowchart-link{stroke:lightgrey;fill:none;}#gdark2 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark2 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark2 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark2 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark2 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark2 .cluster text{fill:#F9FFFE;}#gdark2 .cluster span{color:#F9FFFE;}#gdark2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark2 rect.text{fill:none;stroke-width:0;}#gdark2 .icon-shape,#gdark2 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark2 .icon-shape p,#gdark2 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark2 .icon-shape .label rect,#gdark2 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark2 .node .neo-node{stroke:#ccc;}#gdark2 [data-look="neo"].node rect,#gdark2 [data-look="neo"].cluster rect,#gdark2 [data-look="neo"].node polygon{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark2 [data-look="neo"].node path{stroke:url(#gdark2-gradient);stroke-width:1px;}#gdark2 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark2 [data-look="neo"].node circle{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark2 [data-look="neo"].icon-shape .icon{fill:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark2_d2-flowchart-v2-pointEnd" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointStart" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointEnd-margin" class="marker d2-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointStart-margin" class="marker d2-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark2_d2-flowchart-v2-circleEnd" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleStart" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleEnd-margin" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleStart-margin" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-crossEnd" class="marker cross d2-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossStart" class="marker cross d2-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossEnd-margin" class="marker cross d2-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossStart-margin" class="marker cross d2-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M642.625,60L642.625,64.167C642.625,68.333,642.625,76.667,642.625,84.333C642.625,92,642.625,99,642.625,102.5L642.625,106" id="gdark2-L_F_T_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_F_T_0" data-points="W3sieCI6NjQyLjYyNSwieSI6NjB9LHsieCI6NjQyLjYyNSwieSI6ODV9LHsieCI6NjQyLjYyNSwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M572.264,212.998L495.112,230.892C417.96,248.785,263.656,284.572,186.504,307.966C109.352,331.359,109.352,342.359,109.352,347.859L109.352,353.359" id="gdark2-L_T_P1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P1_0" data-points="W3sieCI6NTcyLjI2Mzg1MzczOTI5NzEsInkiOjIxMi45OTgyMjg3MzkyOTcyfSx7IngiOjEwOS4zNTE1NjI1LCJ5IjozMjAuMzU5Mzc1fSx7IngiOjEwOS4zNTE1NjI1LCJ5IjozNTcuMzU5Mzc1fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M583.789,224.523L550.036,240.496C516.284,256.468,448.778,288.414,415.026,311.887C381.273,335.359,381.273,350.359,381.273,357.859L381.273,365.359" id="gdark2-L_T_P2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P2_0" data-points="W3sieCI6NTgzLjc4ODU1MDMyMTg1OSwieSI6MjI0LjUyMjkyNTMyMTg1OTAyfSx7IngiOjM4MS4yNzM0Mzc1LCJ5IjozMjAuMzU5Mzc1fSx7IngiOjM4MS4yNzM0Mzc1LCJ5IjozNjkuMzU5Mzc1fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M642.625,283.359L642.625,289.526C642.625,295.693,642.625,308.026,642.625,321.693C642.625,335.359,642.625,350.359,642.625,357.859L642.625,365.359" id="gdark2-L_T_P4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P4_0" data-points="W3sieCI6NjQyLjYyNSwieSI6MjgzLjM1OTM3NX0seyJ4Ijo2NDIuNjI1LCJ5IjozMjAuMzU5Mzc1fSx7IngiOjY0Mi42MjUsInkiOjM2OS4zNTkzNzV9XQ==" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M700.883,225.101L733.426,240.978C765.969,256.854,831.055,288.607,863.598,311.983C896.141,335.359,896.141,350.359,896.141,357.859L896.141,365.359" id="gdark2-L_T_P8_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P8_0" data-points="W3sieCI6NzAwLjg4MzAyODE5NjkwOTgsInkiOjIyNS4xMDEzNDY4MDMwOTAyNX0seyJ4Ijo4OTYuMTQwNjI1LCJ5IjozMjAuMzU5Mzc1fSx7IngiOjg5Ni4xNDA2MjUsInkiOjM2OS4zNTkzNzV9XQ==" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M713.487,212.498L794.019,230.475C874.551,248.452,1035.615,284.406,1116.147,309.882C1196.68,335.359,1196.68,350.359,1196.68,357.859L1196.68,365.359" id="gdark2-L_T_P3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P3_0" data-points="W3sieCI6NzEzLjQ4NjUxODgyMjA0NjIsInkiOjIxMi40OTc4NTYxNzc5NTM4OH0seyJ4IjoxMTk2LjY3OTY4NzUsInkiOjMyMC4zNTkzNzV9LHsieCI6MTE5Ni42Nzk2ODc1LCJ5IjozNjkuMzU5Mzc1fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_F_T_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(109.3515625, 320.359375)"><g class="label" data-id="L_T_P1_0" transform="translate(-63.265625, -12)"><foreignObject width="126.53125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>resolved as a flag</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(381.2734375, 320.359375)"><g class="label" data-id="L_T_P2_0" transform="translate(-38.4765625, -12)"><foreignObject width="76.953125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>bare token</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(642.625, 320.359375)"><g class="label" data-id="L_T_P4_0" transform="translate(-45.328125, -12)"><foreignObject width="90.65625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>empty result</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(896.140625, 320.359375)"><g class="label" data-id="L_T_P8_0" transform="translate(-48.28125, -12)"><foreignObject width="96.5625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>main process</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(1196.6796875, 320.359375)"><g class="label" data-id="L_T_P3_0" transform="translate(-25.0390625, -12)"><foreignObject width="50.078125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>thrown</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark2-d2-flowchart-F-0" data-look="classic" transform="translate(642.625, 34)"><rect class="basic label-container" style="" x="-74.765625" y="-26" width="149.53125" height="52"></rect><g class="label" style="" transform="translate(-46.765625, -12)"><rect></rect><foreignObject width="93.53125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reattach fails</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-T-1" data-look="classic" transform="translate(642.625, 196.6796875)"><polygon points="86.6796875,0 173.359375,-86.6796875 86.6796875,-173.359375 0,-86.6796875" class="label-container" transform="translate(-86.1796875, 86.6796875)"></polygon><g class="label" style="" transform="translate(-48.6796875, -24)"><rect></rect><foreignObject width="97.359375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>how does the<br/>failure travel?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-P1-3" data-look="classic" transform="translate(109.3515625, 407.359375)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-101.3515625" y="-50" width="202.703125" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-73.3515625, -36)"><rect></rect><foreignObject width="146.703125" height="72"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>sessionExpired: true<br/>→ respawn<br/><b>no proof check</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-P2-5" data-look="classic" transform="translate(381.2734375, 407.359375)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-120.5703125" y="-38" width="241.140625" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-92.5703125, -24)"><rect></rect><foreignObject width="185.140625" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>isSshSessionExpiredError<br/>→ respawn</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-P4-7" data-look="classic" transform="translate(642.625, 407.359375)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-90.78125" y="-38" width="181.5625" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-62.78125, -24)"><rect></rect><foreignObject width="125.5625" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>no ptyId returned<br/>→ respawn</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-P8-9" data-look="classic" transform="translate(896.140625, 407.359375)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-112.734375" y="-38" width="225.46875" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-84.734375, -24)"><rect></rect><foreignObject width="169.46875" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>lease marked expired<br/>→ recoverTerminalPane</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-P3-11" data-look="classic" transform="translate(1196.6796875, 407.359375)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-137.8046875" y="-38" width="275.609375" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-109.8046875, -24)"><rect></rect><foreignObject width="219.609375" height="48"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>isProvenSshSessionGoneError<br/><b>the gate I shipped</b></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark2-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark2-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark2-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault2" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1342.484375 465.359375" role="graphics-document document" aria-roledescription="l2-flowchart-v2"><style>#gdefault2{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault2 .error-icon{fill:#552222;}#gdefault2 .error-text{fill:#552222;stroke:#552222;}#gdefault2 .edge-thickness-normal{stroke-width:1px;}#gdefault2 .edge-thickness-thick{stroke-width:3.5px;}#gdefault2 .edge-pattern-solid{stroke-dasharray:0;}#gdefault2 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault2 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault2 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault2 .marker{fill:#333333;stroke:#333333;}#gdefault2 .marker.cross{stroke:#333333;}#gdefault2 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault2 p{margin:0;}#gdefault2 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault2 .cluster-label text{fill:#333;}#gdefault2 .cluster-label span{color:#333;}#gdefault2 .cluster-label span p{background-color:transparent;}#gdefault2 .label text,#gdefault2 span{fill:#333;color:#333;}#gdefault2 .node rect,#gdefault2 .node circle,#gdefault2 .node ellipse,#gdefault2 .node polygon,#gdefault2 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault2 .rough-node .label text,#gdefault2 .node .label text,#gdefault2 .image-shape .label,#gdefault2 .icon-shape .label{text-anchor:middle;}#gdefault2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault2 .rough-node .label,#gdefault2 .node .label,#gdefault2 .image-shape .label,#gdefault2 .icon-shape .label{text-align:center;}#gdefault2 .node.clickable{cursor:pointer;}#gdefault2 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault2 .arrowheadPath{fill:#333333;}#gdefault2 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault2 .l2-flowchart-link{stroke:#333333;fill:none;}#gdefault2 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault2 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault2 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault2 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault2 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault2 .cluster text{fill:#333;}#gdefault2 .cluster span{color:#333;}#gdefault2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault2 rect.text{fill:none;stroke-width:0;}#gdefault2 .icon-shape,#gdefault2 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault2 .icon-shape p,#gdefault2 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault2 .icon-shape .label rect,#gdefault2 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault2 .node .neo-node{stroke:#9370DB;}#gdefault2 [data-look="neo"].node rect,#gdefault2 [data-look="neo"].cluster rect,#gdefault2 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault2 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault2 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault2 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault2 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault2_l2-flowchart-v2-pointEnd" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointStart" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointEnd-margin" class="marker l2-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointStart-margin" class="marker l2-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault2_l2-flowchart-v2-circleEnd" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleStart" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleEnd-margin" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleStart-margin" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-crossEnd" class="marker cross l2-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossStart" class="marker cross l2-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossEnd-margin" class="marker cross l2-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossStart-margin" class="marker cross l2-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M642.625,60L642.625,64.167C642.625,68.333,642.625,76.667,642.625,84.333C642.625,92,642.625,99,642.625,102.5L642.625,106" id="gdefault2-L_F_T_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_F_T_0" data-points="W3sieCI6NjQyLjYyNSwieSI6NjB9LHsieCI6NjQyLjYyNSwieSI6ODV9LHsieCI6NjQyLjYyNSwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M572.264,212.998L495.112,230.892C417.96,248.785,263.656,284.572,186.504,307.966C109.352,331.359,109.352,342.359,109.352,347.859L109.352,353.359" id="gdefault2-L_T_P1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P1_0" data-points="W3sieCI6NTcyLjI2Mzg1MzczOTI5NzEsInkiOjIxMi45OTgyMjg3MzkyOTcyfSx7IngiOjEwOS4zNTE1NjI1LCJ5IjozMjAuMzU5Mzc1fSx7IngiOjEwOS4zNTE1NjI1LCJ5IjozNTcuMzU5Mzc1fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M583.789,224.523L550.036,240.496C516.284,256.468,448.778,288.414,415.026,311.887C381.273,335.359,381.273,350.359,381.273,357.859L381.273,365.359" id="gdefault2-L_T_P2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P2_0" data-points="W3sieCI6NTgzLjc4ODU1MDMyMTg1OSwieSI6MjI0LjUyMjkyNTMyMTg1OTAyfSx7IngiOjM4MS4yNzM0Mzc1LCJ5IjozMjAuMzU5Mzc1fSx7IngiOjM4MS4yNzM0Mzc1LCJ5IjozNjkuMzU5Mzc1fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M642.625,283.359L642.625,289.526C642.625,295.693,642.625,308.026,642.625,321.693C642.625,335.359,642.625,350.359,642.625,357.859L642.625,365.359" id="gdefault2-L_T_P4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P4_0" data-points="W3sieCI6NjQyLjYyNSwieSI6MjgzLjM1OTM3NX0seyJ4Ijo2NDIuNjI1LCJ5IjozMjAuMzU5Mzc1fSx7IngiOjY0Mi42MjUsInkiOjM2OS4zNTkzNzV9XQ==" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M700.883,225.101L733.426,240.978C765.969,256.854,831.055,288.607,863.598,311.983C896.141,335.359,896.141,350.359,896.141,357.859L896.141,365.359" id="gdefault2-L_T_P8_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P8_0" data-points="W3sieCI6NzAwLjg4MzAyODE5NjkwOTgsInkiOjIyNS4xMDEzNDY4MDMwOTAyNX0seyJ4Ijo4OTYuMTQwNjI1LCJ5IjozMjAuMzU5Mzc1fSx7IngiOjg5Ni4xNDA2MjUsInkiOjM2OS4zNTkzNzV9XQ==" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M713.487,212.498L794.019,230.475C874.551,248.452,1035.615,284.406,1116.147,309.882C1196.68,335.359,1196.68,350.359,1196.68,357.859L1196.68,365.359" id="gdefault2-L_T_P3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_P3_0" data-points="W3sieCI6NzEzLjQ4NjUxODgyMjA0NjIsInkiOjIxMi40OTc4NTYxNzc5NTM4OH0seyJ4IjoxMTk2LjY3OTY4NzUsInkiOjMyMC4zNTkzNzV9LHsieCI6MTE5Ni42Nzk2ODc1LCJ5IjozNjkuMzU5Mzc1fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_F_T_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(109.3515625, 320.359375)"><g class="label" data-id="L_T_P1_0" transform="translate(-63.265625, -12)"><foreignObject width="126.53125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>resolved as a flag</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(381.2734375, 320.359375)"><g class="label" data-id="L_T_P2_0" transform="translate(-38.4765625, -12)"><foreignObject width="76.953125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>bare token</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(642.625, 320.359375)"><g class="label" data-id="L_T_P4_0" transform="translate(-45.328125, -12)"><foreignObject width="90.65625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>empty result</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(896.140625, 320.359375)"><g class="label" data-id="L_T_P8_0" transform="translate(-48.28125, -12)"><foreignObject width="96.5625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>main process</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(1196.6796875, 320.359375)"><g class="label" data-id="L_T_P3_0" transform="translate(-25.0390625, -12)"><foreignObject width="50.078125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>thrown</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault2-l2-flowchart-F-0" data-look="classic" transform="translate(642.625, 34)"><rect class="basic label-container" style="" x="-74.765625" y="-26" width="149.53125" height="52"></rect><g class="label" style="" transform="translate(-46.765625, -12)"><rect></rect><foreignObject width="93.53125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reattach fails</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-T-1" data-look="classic" transform="translate(642.625, 196.6796875)"><polygon points="86.6796875,0 173.359375,-86.6796875 86.6796875,-173.359375 0,-86.6796875" class="label-container" transform="translate(-86.1796875, 86.6796875)"></polygon><g class="label" style="" transform="translate(-48.6796875, -24)"><rect></rect><foreignObject width="97.359375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>how does the<br/>failure travel?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-P1-3" data-look="classic" transform="translate(109.3515625, 407.359375)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-101.3515625" y="-50" width="202.703125" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-73.3515625, -36)"><rect></rect><foreignObject width="146.703125" height="72"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>sessionExpired: true<br/>→ respawn<br/><b>no proof check</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-P2-5" data-look="classic" transform="translate(381.2734375, 407.359375)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-120.5703125" y="-38" width="241.140625" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-92.5703125, -24)"><rect></rect><foreignObject width="185.140625" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>isSshSessionExpiredError<br/>→ respawn</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-P4-7" data-look="classic" transform="translate(642.625, 407.359375)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-90.78125" y="-38" width="181.5625" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-62.78125, -24)"><rect></rect><foreignObject width="125.5625" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>no ptyId returned<br/>→ respawn</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-P8-9" data-look="classic" transform="translate(896.140625, 407.359375)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-112.734375" y="-38" width="225.46875" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-84.734375, -24)"><rect></rect><foreignObject width="169.46875" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>lease marked expired<br/>→ recoverTerminalPane</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-P3-11" data-look="classic" transform="translate(1196.6796875, 407.359375)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-137.8046875" y="-38" width="275.609375" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-109.8046875, -24)"><rect></rect><foreignObject width="219.609375" height="48"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>isProvenSshSessionGoneError<br/><b>the gate I shipped</b></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault2-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault2-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <div class="callout bad">
+        <p><span class="k">What this means for the shipped work</span></p>
+        <p>Two of my six changes are now known to be narrower than claimed. The keystroke fence is <strong>inert on the reattach path</strong>, and the respawn gate <strong>guards a minority of respawn routes</strong>. Both passed their tests because each test asserted the guard behaves correctly <em>when reached</em> — neither could observe that the guarded route is not the route production takes.</p>
+      </div>
+
+      <h2>3 · What the counsel changed about my design</h2>
+      <table>
+        <thead><tr><th>My proposal</th><th>Counsel’s design</th><th>Why theirs is better</th></tr></thead>
+        <tbody>
+          <tr><td>Two records: ownership + orphan inventory</td><td><strong>One record.</strong> Orphans become a connect-time projection with no durable rows</td><td>A durable orphan row goes stale across exactly the disconnect during which the truth changed — and an orphan is only actionable while connected. Also deletes the two-record transaction my split needed.</td></tr>
+          <tr><td>Key by <code>paneKey = tabId:leafId</code></td><td>Key by <strong><code>leafId</code></strong>; tab derived from the live layout, never stored</td><td>A stored tabId is either frozen (names a tab the leaf left) or updated (desyncs from the relay’s copy). Both are live failures. Keying by the leaf deletes the transfer problem instead of managing it.</td></tr>
+          <tr><td>Keep attach-time pane identity</td><td><strong>Delete it</strong> — compare returned incarnation instead</td><td>The apparatus is over-strict and under-strict at once: it rejects a live renamed pane, and accepts a different shell after a relay restart recycles the id. It fails at its own stated job.</td></tr>
+          <tr><td>“Unknown is not dead” as a principle</td><td>Same rule, made <strong>structural</strong>: fate must be <em>reported by the host</em>, never inferred from timing, absence, or error-string shape</td><td>Every defect found across three rounds is one violation of that clause. Mine was a slogan; theirs is a rule with an enforcement point.</td></tr>
+        </tbody>
+      </table>
+      <p>Both models proposed the single-record collapse <strong>independently</strong>, which is the strongest signal available in a counsel and why it outweighed my version.</p>
+
+      <h2>4 · The rule everything follows from</h2>
+      <figure>
+        <div class="bar"><span>Ownership vs fate</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark3" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 632.890625 924" role="graphics-document document" aria-roledescription="d3-flowchart-v2"><style>#gdark3{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark3 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark3 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark3 .error-icon{fill:#a44141;}#gdark3 .error-text{fill:#ddd;stroke:#ddd;}#gdark3 .edge-thickness-normal{stroke-width:1px;}#gdark3 .edge-thickness-thick{stroke-width:3.5px;}#gdark3 .edge-pattern-solid{stroke-dasharray:0;}#gdark3 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark3 .edge-pattern-dashed{stroke-dasharray:3;}#gdark3 .edge-pattern-dotted{stroke-dasharray:2;}#gdark3 .marker{fill:lightgrey;stroke:lightgrey;}#gdark3 .marker.cross{stroke:lightgrey;}#gdark3 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark3 p{margin:0;}#gdark3 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark3 .cluster-label text{fill:#F9FFFE;}#gdark3 .cluster-label span{color:#F9FFFE;}#gdark3 .cluster-label span p{background-color:transparent;}#gdark3 .label text,#gdark3 span{fill:#ccc;color:#ccc;}#gdark3 .node rect,#gdark3 .node circle,#gdark3 .node ellipse,#gdark3 .node polygon,#gdark3 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark3 .rough-node .label text,#gdark3 .node .label text,#gdark3 .image-shape .label,#gdark3 .icon-shape .label{text-anchor:middle;}#gdark3 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark3 .rough-node .label,#gdark3 .node .label,#gdark3 .image-shape .label,#gdark3 .icon-shape .label{text-align:center;}#gdark3 .node.clickable{cursor:pointer;}#gdark3 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark3 .arrowheadPath{fill:lightgrey;}#gdark3 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark3 .d3-flowchart-link{stroke:lightgrey;fill:none;}#gdark3 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark3 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark3 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark3 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark3 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark3 .cluster text{fill:#F9FFFE;}#gdark3 .cluster span{color:#F9FFFE;}#gdark3 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark3 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark3 rect.text{fill:none;stroke-width:0;}#gdark3 .icon-shape,#gdark3 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark3 .icon-shape p,#gdark3 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark3 .icon-shape .label rect,#gdark3 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark3 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark3 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark3 .node .neo-node{stroke:#ccc;}#gdark3 [data-look="neo"].node rect,#gdark3 [data-look="neo"].cluster rect,#gdark3 [data-look="neo"].node polygon{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark3 [data-look="neo"].node path{stroke:url(#gdark3-gradient);stroke-width:1px;}#gdark3 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark3 [data-look="neo"].node circle{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark3 [data-look="neo"].icon-shape .icon{fill:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark3_d3-flowchart-v2-pointEnd" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointStart" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointEnd-margin" class="marker d3-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointStart-margin" class="marker d3-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark3_d3-flowchart-v2-circleEnd" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleStart" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleEnd-margin" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleStart-margin" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-crossEnd" class="marker cross d3-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossStart" class="marker cross d3-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossEnd-margin" class="marker cross d3-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossStart-margin" class="marker cross d3-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M337.063,234.5L341.74,234.5C346.417,234.5,355.771,234.5,363.948,234.5C372.125,234.5,379.125,234.5,382.625,234.5L386.125,234.5" id="gdark3-L_FATE_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_FATE_N_0" data-points="W3sieCI6MzM3LjA2MjUsInkiOjIzNC41fSx7IngiOjM2NS4xMjUsInkiOjIzNC41fSx7IngiOjM5MC4xMjUsInkiOjIzNC41fV0=" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_FATE_N_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(3.0625, 0)"><g class="clusters"><g class="cluster " id="gdark3-FATE" data-look="classic"><rect style="" x="8" y="8" width="326" height="453"></rect><g class="cluster-label " transform="translate(84.7734375, 8)"><foreignObject width="172.453125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>FATE — is the shell alive</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M171,97.5L171,103.75C171,110,171,122.5,171,134.333C171,146.167,171,157.333,171,162.917L171,168.5" id="gdark3-L_F1_F2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_F1_F2_0" data-points="W3sieCI6MTcxLCJ5Ijo5Ny41fSx7IngiOjE3MSwieSI6MTM1fSx7IngiOjE3MSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M171,224.5L171,230.75C171,237,171,249.5,171,261.333C171,273.167,171,284.333,171,289.917L171,295.5" id="gdark3-L_F2_F3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_F2_F3_0" data-points="W3sieCI6MTcxLCJ5IjoyMjQuNX0seyJ4IjoxNzEsInkiOjI2Mn0seyJ4IjoxNzEsInkiOjI5OS41fV0=" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_F1_F2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_F2_F3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark3-d3-flowchart-F1-3" data-look="classic" transform="translate(171, 71.5)"><rect class="basic label-container" style="" x="-72.671875" y="-26" width="145.34375" height="52"></rect><g class="label" style="" transform="translate(-44.671875, -12)"><rect></rect><foreignObject width="89.34375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>non-durable</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-F2-4" data-look="classic" transform="translate(171, 198.5)"><rect class="basic label-container" style="" x="-64.2109375" y="-26" width="128.421875" height="52"></rect><g class="label" style="" transform="translate(-36.2109375, -12)"><rect></rect><foreignObject width="72.421875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>host-local</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-F3-5" data-look="classic" transform="translate(171, 361.5)"><rect class="basic label-container" style="" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>must be REPORTED by the host<br/>never INFERRED by the client</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(23.7421875, 503)"><g class="clusters"><g class="cluster " id="gdark3-OWN" data-look="classic"><rect style="" x="-15.7421875" y="8" width="332.125" height="405"></rect><g class="cluster-label " transform="translate(-11.7421875, 8)"><foreignObject width="324.125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>OWNERSHIP — which pane owns which shell</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M150.32,97.5L150.32,103.75C150.32,110,150.32,122.5,150.32,134.333C150.32,146.167,150.32,157.333,150.32,162.917L150.32,168.5" id="gdark3-L_O1_O2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_O1_O2_0" data-points="W3sieCI6MTUwLjMyMDMxMjUsInkiOjk3LjV9LHsieCI6MTUwLjMyMDMxMjUsInkiOjEzNX0seyJ4IjoxNTAuMzIwMzEyNSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M150.32,224.5L150.32,230.75C150.32,237,150.32,249.5,150.32,261.333C150.32,273.167,150.32,284.333,150.32,289.917L150.32,295.5" id="gdark3-L_O2_O3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_O2_O3_0" data-points="W3sieCI6MTUwLjMyMDMxMjUsInkiOjIyNC41fSx7IngiOjE1MC4zMjAzMTI1LCJ5IjoyNjJ9LHsieCI6MTUwLjMyMDMxMjUsInkiOjI5OS41fV0=" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_O1_O2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_O2_O3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark3-d3-flowchart-O1-0" data-look="classic" transform="translate(150.3203125, 71.5)"><rect class="basic label-container" style="" x="-55.4609375" y="-26" width="110.921875" height="52"></rect><g class="label" style="" transform="translate(-27.4609375, -12)"><rect></rect><foreignObject width="54.921875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>durable</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-O2-1" data-look="classic" transform="translate(150.3203125, 198.5)"><rect class="basic label-container" style="" x="-68.03125" y="-26" width="136.0625" height="52"></rect><g class="label" style="" transform="translate(-40.03125, -12)"><rect></rect><foreignObject width="80.0625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>client-local</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-O3-2" data-look="classic" transform="translate(150.3203125, 337.5)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-107.3203125" y="-38" width="214.640625" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-79.3203125, -24)"><rect></rect><foreignObject width="158.640625" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>read synchronously<br/>from disk while offline</p></span></div></foreignObject></g></g></g></g><g class="node default  " id="gdark3-d3-flowchart-N-7" data-look="classic" transform="translate(507.5078125, 234.5)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-117.3828125" y="-50" width="234.765625" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-89.3828125, -36)"><rect></rect><foreignObject width="178.765625" height="72"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>not from timing<br/>not from an absent entry<br/>not from an error string</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark3-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark3-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark3-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault3" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 632.890625 924" role="graphics-document document" aria-roledescription="l3-flowchart-v2"><style>#gdefault3{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault3 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault3 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault3 .error-icon{fill:#552222;}#gdefault3 .error-text{fill:#552222;stroke:#552222;}#gdefault3 .edge-thickness-normal{stroke-width:1px;}#gdefault3 .edge-thickness-thick{stroke-width:3.5px;}#gdefault3 .edge-pattern-solid{stroke-dasharray:0;}#gdefault3 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault3 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault3 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault3 .marker{fill:#333333;stroke:#333333;}#gdefault3 .marker.cross{stroke:#333333;}#gdefault3 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault3 p{margin:0;}#gdefault3 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault3 .cluster-label text{fill:#333;}#gdefault3 .cluster-label span{color:#333;}#gdefault3 .cluster-label span p{background-color:transparent;}#gdefault3 .label text,#gdefault3 span{fill:#333;color:#333;}#gdefault3 .node rect,#gdefault3 .node circle,#gdefault3 .node ellipse,#gdefault3 .node polygon,#gdefault3 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault3 .rough-node .label text,#gdefault3 .node .label text,#gdefault3 .image-shape .label,#gdefault3 .icon-shape .label{text-anchor:middle;}#gdefault3 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault3 .rough-node .label,#gdefault3 .node .label,#gdefault3 .image-shape .label,#gdefault3 .icon-shape .label{text-align:center;}#gdefault3 .node.clickable{cursor:pointer;}#gdefault3 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault3 .arrowheadPath{fill:#333333;}#gdefault3 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault3 .l3-flowchart-link{stroke:#333333;fill:none;}#gdefault3 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault3 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault3 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault3 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault3 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault3 .cluster text{fill:#333;}#gdefault3 .cluster span{color:#333;}#gdefault3 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault3 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault3 rect.text{fill:none;stroke-width:0;}#gdefault3 .icon-shape,#gdefault3 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault3 .icon-shape p,#gdefault3 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault3 .icon-shape .label rect,#gdefault3 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault3 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault3 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault3 .node .neo-node{stroke:#9370DB;}#gdefault3 [data-look="neo"].node rect,#gdefault3 [data-look="neo"].cluster rect,#gdefault3 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault3 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault3 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault3 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault3 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault3_l3-flowchart-v2-pointEnd" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointStart" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointEnd-margin" class="marker l3-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointStart-margin" class="marker l3-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault3_l3-flowchart-v2-circleEnd" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleStart" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleEnd-margin" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleStart-margin" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-crossEnd" class="marker cross l3-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossStart" class="marker cross l3-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossEnd-margin" class="marker cross l3-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossStart-margin" class="marker cross l3-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M337.063,234.5L341.74,234.5C346.417,234.5,355.771,234.5,363.948,234.5C372.125,234.5,379.125,234.5,382.625,234.5L386.125,234.5" id="gdefault3-L_FATE_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_FATE_N_0" data-points="W3sieCI6MzM3LjA2MjUsInkiOjIzNC41fSx7IngiOjM2NS4xMjUsInkiOjIzNC41fSx7IngiOjM5MC4xMjUsInkiOjIzNC41fV0=" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_FATE_N_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(3.0625, 0)"><g class="clusters"><g class="cluster " id="gdefault3-FATE" data-look="classic"><rect style="" x="8" y="8" width="326" height="453"></rect><g class="cluster-label " transform="translate(84.7734375, 8)"><foreignObject width="172.453125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>FATE — is the shell alive</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M171,97.5L171,103.75C171,110,171,122.5,171,134.333C171,146.167,171,157.333,171,162.917L171,168.5" id="gdefault3-L_F1_F2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_F1_F2_0" data-points="W3sieCI6MTcxLCJ5Ijo5Ny41fSx7IngiOjE3MSwieSI6MTM1fSx7IngiOjE3MSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M171,224.5L171,230.75C171,237,171,249.5,171,261.333C171,273.167,171,284.333,171,289.917L171,295.5" id="gdefault3-L_F2_F3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_F2_F3_0" data-points="W3sieCI6MTcxLCJ5IjoyMjQuNX0seyJ4IjoxNzEsInkiOjI2Mn0seyJ4IjoxNzEsInkiOjI5OS41fV0=" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_F1_F2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_F2_F3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault3-l3-flowchart-F1-3" data-look="classic" transform="translate(171, 71.5)"><rect class="basic label-container" style="" x="-72.671875" y="-26" width="145.34375" height="52"></rect><g class="label" style="" transform="translate(-44.671875, -12)"><rect></rect><foreignObject width="89.34375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>non-durable</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-F2-4" data-look="classic" transform="translate(171, 198.5)"><rect class="basic label-container" style="" x="-64.2109375" y="-26" width="128.421875" height="52"></rect><g class="label" style="" transform="translate(-36.2109375, -12)"><rect></rect><foreignObject width="72.421875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>host-local</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-F3-5" data-look="classic" transform="translate(171, 361.5)"><rect class="basic label-container" style="" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>must be REPORTED by the host<br/>never INFERRED by the client</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(23.7421875, 503)"><g class="clusters"><g class="cluster " id="gdefault3-OWN" data-look="classic"><rect style="" x="-15.7421875" y="8" width="332.125" height="405"></rect><g class="cluster-label " transform="translate(-11.7421875, 8)"><foreignObject width="324.125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>OWNERSHIP — which pane owns which shell</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M150.32,97.5L150.32,103.75C150.32,110,150.32,122.5,150.32,134.333C150.32,146.167,150.32,157.333,150.32,162.917L150.32,168.5" id="gdefault3-L_O1_O2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_O1_O2_0" data-points="W3sieCI6MTUwLjMyMDMxMjUsInkiOjk3LjV9LHsieCI6MTUwLjMyMDMxMjUsInkiOjEzNX0seyJ4IjoxNTAuMzIwMzEyNSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M150.32,224.5L150.32,230.75C150.32,237,150.32,249.5,150.32,261.333C150.32,273.167,150.32,284.333,150.32,289.917L150.32,295.5" id="gdefault3-L_O2_O3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_O2_O3_0" data-points="W3sieCI6MTUwLjMyMDMxMjUsInkiOjIyNC41fSx7IngiOjE1MC4zMjAzMTI1LCJ5IjoyNjJ9LHsieCI6MTUwLjMyMDMxMjUsInkiOjI5OS41fV0=" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_O1_O2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_O2_O3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault3-l3-flowchart-O1-0" data-look="classic" transform="translate(150.3203125, 71.5)"><rect class="basic label-container" style="" x="-55.4609375" y="-26" width="110.921875" height="52"></rect><g class="label" style="" transform="translate(-27.4609375, -12)"><rect></rect><foreignObject width="54.921875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>durable</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-O2-1" data-look="classic" transform="translate(150.3203125, 198.5)"><rect class="basic label-container" style="" x="-68.03125" y="-26" width="136.0625" height="52"></rect><g class="label" style="" transform="translate(-40.03125, -12)"><rect></rect><foreignObject width="80.0625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>client-local</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-O3-2" data-look="classic" transform="translate(150.3203125, 337.5)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-107.3203125" y="-38" width="214.640625" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-79.3203125, -24)"><rect></rect><foreignObject width="158.640625" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>read synchronously<br/>from disk while offline</p></span></div></foreignObject></g></g></g></g><g class="node default  " id="gdefault3-l3-flowchart-N-7" data-look="classic" transform="translate(507.5078125, 234.5)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-117.3828125" y="-50" width="234.765625" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-89.3828125, -36)"><rect></rect><foreignObject width="178.765625" height="72"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>not from timing<br/>not from an absent entry<br/>not from an error string</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault3-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault3-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>This is what makes the offline case work without an authority layer. Ownership is answerable with the network down, because it never depended on the network. Fate is never answered by the client at all.</p>
+
+      <h2>5 · The record</h2>
+      <pre class="term"><span class="d">/** Main-owned. TOP-LEVEL in PersistedState — never inside WorkspaceSessionState. */</span>
+type PaneShellOwnership = {
+  <span class="g">leafId: string</span>          <span class="d">// PRIMARY KEY — layout leaf UUID</span>
+  hostId: ExecutionHostId <span class="d">// FIELD: 'local' | 'ssh:&lt;target&gt;' | 'runtime:&lt;id&gt;'</span>
+  worktreeId: string
+  ptyId: string           <span class="d">// relay-native form for SSH — one namespace, always</span>
+  incarnationId: string   <span class="d">// REQUIRED</span>
+  relayInstanceId?: string
+  state: 'attached' | 'detached' | 'terminated'
+  createdAt / updatedAt / lastAttachedAt? / lastDetachedAt?
+}
+<span class="d">// Absent on purpose: no tabId, no paneKey, no hostEpoch, no second record.</span></pre>
+      <p>Uniqueness is enforced on <code>(hostId, ptyId, incarnationId)</code>, not <code>ptyId</code> alone — because relay ids are minted <code>pty-1, pty-2…</code> per relay <em>process</em>, so <code>pty-1</code> recurs on every host after every relay restart. Round 1 had rejected a collision here as impossible; round 3 showed it is <strong>guaranteed</strong>, and the rejection was withdrawn.</p>
+
+      <h2>6 · Orphans are a projection, not an authority</h2>
+      <figure>
+        <div class="bar"><span>Why no durable orphan rows</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark4" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 578 692" role="graphics-document document" aria-roledescription="d4-flowchart-v2"><style>#gdark4{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark4 .error-icon{fill:#a44141;}#gdark4 .error-text{fill:#ddd;stroke:#ddd;}#gdark4 .edge-thickness-normal{stroke-width:1px;}#gdark4 .edge-thickness-thick{stroke-width:3.5px;}#gdark4 .edge-pattern-solid{stroke-dasharray:0;}#gdark4 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark4 .edge-pattern-dashed{stroke-dasharray:3;}#gdark4 .edge-pattern-dotted{stroke-dasharray:2;}#gdark4 .marker{fill:lightgrey;stroke:lightgrey;}#gdark4 .marker.cross{stroke:lightgrey;}#gdark4 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark4 p{margin:0;}#gdark4 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark4 .cluster-label text{fill:#F9FFFE;}#gdark4 .cluster-label span{color:#F9FFFE;}#gdark4 .cluster-label span p{background-color:transparent;}#gdark4 .label text,#gdark4 span{fill:#ccc;color:#ccc;}#gdark4 .node rect,#gdark4 .node circle,#gdark4 .node ellipse,#gdark4 .node polygon,#gdark4 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark4 .rough-node .label text,#gdark4 .node .label text,#gdark4 .image-shape .label,#gdark4 .icon-shape .label{text-anchor:middle;}#gdark4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark4 .rough-node .label,#gdark4 .node .label,#gdark4 .image-shape .label,#gdark4 .icon-shape .label{text-align:center;}#gdark4 .node.clickable{cursor:pointer;}#gdark4 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark4 .arrowheadPath{fill:lightgrey;}#gdark4 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark4 .d4-flowchart-link{stroke:lightgrey;fill:none;}#gdark4 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark4 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark4 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark4 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark4 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark4 .cluster text{fill:#F9FFFE;}#gdark4 .cluster span{color:#F9FFFE;}#gdark4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark4 rect.text{fill:none;stroke-width:0;}#gdark4 .icon-shape,#gdark4 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark4 .icon-shape p,#gdark4 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark4 .icon-shape .label rect,#gdark4 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark4 .node .neo-node{stroke:#ccc;}#gdark4 [data-look="neo"].node rect,#gdark4 [data-look="neo"].cluster rect,#gdark4 [data-look="neo"].node polygon{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark4 [data-look="neo"].node path{stroke:url(#gdark4-gradient);stroke-width:1px;}#gdark4 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark4 [data-look="neo"].node circle{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark4 [data-look="neo"].icon-shape .icon{fill:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark4_d4-flowchart-v2-pointEnd" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointStart" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointEnd-margin" class="marker d4-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointStart-margin" class="marker d4-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark4_d4-flowchart-v2-circleEnd" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleStart" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleEnd-margin" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleStart-margin" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-crossEnd" class="marker cross d4-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossStart" class="marker cross d4-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossEnd-margin" class="marker cross d4-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossStart-margin" class="marker cross d4-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M136,60L136,64.167C136,68.333,136,76.667,136,84.333C136,92,136,99,136,102.5L136,106" id="gdark4-L_C_L_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_L_0" data-points="W3sieCI6MTM2LCJ5Ijo2MH0seyJ4IjoxMzYsInkiOjg1fSx7IngiOjEzNiwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M136,162L136,166.167C136,170.333,136,178.667,136,192.333C136,206,136,225,136,234.5L136,244" id="gdark4-L_L_S_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_L_S_0" data-points="W3sieCI6MTM2LCJ5IjoxNjJ9LHsieCI6MTM2LCJ5IjoxODd9LHsieCI6MTM2LCJ5IjoyNDh9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M136,348L136,360.167C136,372.333,136,396.667,147.981,414.707C159.963,432.746,183.926,444.493,195.907,450.366L207.888,456.239" id="gdark4-L_S_P_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S_P_0" data-points="W3sieCI6MTM2LCJ5IjozNDh9LHsieCI6MTM2LCJ5Ijo0MjF9LHsieCI6MjExLjQ4MDAwMDAwMDAwMDAyLCJ5Ijo0NTh9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M289,534L289,538.167C289,542.333,289,550.667,289,558.333C289,566,289,573,289,576.5L289,580" id="gdark4-L_P_U_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_U_0" data-points="W3sieCI6Mjg5LCJ5Ijo1MzR9LHsieCI6Mjg5LCJ5Ijo1NTl9LHsieCI6Mjg5LCJ5Ijo1ODR9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M442,384L442,390.167C442,396.333,442,408.667,430.019,420.707C418.037,432.746,394.074,444.493,382.093,450.366L370.112,456.239" id="gdark4-L_D_P_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_P_0" data-points="W3sieCI6NDQyLCJ5IjozODR9LHsieCI6NDQyLCJ5Ijo0MjF9LHsieCI6MzY2LjUyLCJ5Ijo0NTh9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_C_L_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_L_S_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_S_P_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_P_U_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(442, 421)"><g class="label" data-id="L_D_P_0" transform="translate(-29.6796875, -12)"><foreignObject width="59.359375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>rejected</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark4-d4-flowchart-C-0" data-look="classic" transform="translate(136, 34)"><rect class="basic label-container" style="" x="-68.65625" y="-26" width="137.3125" height="52"></rect><g class="label" style="" transform="translate(-40.65625, -12)"><rect></rect><foreignObject width="81.3125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>on connect</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-L-1" data-look="classic" transform="translate(136, 136)"><rect class="basic label-container" style="" x="-113.53125" y="-26" width="227.0625" height="52"></rect><g class="label" style="" transform="translate(-85.53125, -12)"><rect></rect><foreignObject width="171.0625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>ask the host what it has</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-S-3" data-look="classic" transform="translate(136, 298)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>subtract what our records claim<br/><i>incarnation-scoped</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-P-5" data-look="classic" transform="translate(289, 496)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-120.703125" y="-38" width="241.40625" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-92.703125, -24)"><rect></rect><foreignObject width="185.40625" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>remainder = orphans<br/><b>computed, never stored</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-U-7" data-look="classic" transform="translate(289, 634)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>feeds the existing cleanup affordance<br/>never auto-killed</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-D-8" data-look="classic" transform="translate(442, 298)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-128" y="-86" width="256" height="172"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -72)"><rect></rect><foreignObject width="200" height="144"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>a durable orphan row would<br/>go stale across the very disconnect<br/>during which the truth changed</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark4-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark4-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark4-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault4" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 578 692" role="graphics-document document" aria-roledescription="l4-flowchart-v2"><style>#gdefault4{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault4 .error-icon{fill:#552222;}#gdefault4 .error-text{fill:#552222;stroke:#552222;}#gdefault4 .edge-thickness-normal{stroke-width:1px;}#gdefault4 .edge-thickness-thick{stroke-width:3.5px;}#gdefault4 .edge-pattern-solid{stroke-dasharray:0;}#gdefault4 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault4 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault4 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault4 .marker{fill:#333333;stroke:#333333;}#gdefault4 .marker.cross{stroke:#333333;}#gdefault4 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault4 p{margin:0;}#gdefault4 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault4 .cluster-label text{fill:#333;}#gdefault4 .cluster-label span{color:#333;}#gdefault4 .cluster-label span p{background-color:transparent;}#gdefault4 .label text,#gdefault4 span{fill:#333;color:#333;}#gdefault4 .node rect,#gdefault4 .node circle,#gdefault4 .node ellipse,#gdefault4 .node polygon,#gdefault4 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault4 .rough-node .label text,#gdefault4 .node .label text,#gdefault4 .image-shape .label,#gdefault4 .icon-shape .label{text-anchor:middle;}#gdefault4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault4 .rough-node .label,#gdefault4 .node .label,#gdefault4 .image-shape .label,#gdefault4 .icon-shape .label{text-align:center;}#gdefault4 .node.clickable{cursor:pointer;}#gdefault4 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault4 .arrowheadPath{fill:#333333;}#gdefault4 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault4 .l4-flowchart-link{stroke:#333333;fill:none;}#gdefault4 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault4 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault4 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault4 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault4 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault4 .cluster text{fill:#333;}#gdefault4 .cluster span{color:#333;}#gdefault4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault4 rect.text{fill:none;stroke-width:0;}#gdefault4 .icon-shape,#gdefault4 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault4 .icon-shape p,#gdefault4 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault4 .icon-shape .label rect,#gdefault4 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault4 .node .neo-node{stroke:#9370DB;}#gdefault4 [data-look="neo"].node rect,#gdefault4 [data-look="neo"].cluster rect,#gdefault4 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault4 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault4 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault4 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault4 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault4_l4-flowchart-v2-pointEnd" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointStart" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointEnd-margin" class="marker l4-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointStart-margin" class="marker l4-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault4_l4-flowchart-v2-circleEnd" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleStart" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleEnd-margin" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleStart-margin" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-crossEnd" class="marker cross l4-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossStart" class="marker cross l4-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossEnd-margin" class="marker cross l4-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossStart-margin" class="marker cross l4-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M136,60L136,64.167C136,68.333,136,76.667,136,84.333C136,92,136,99,136,102.5L136,106" id="gdefault4-L_C_L_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_L_0" data-points="W3sieCI6MTM2LCJ5Ijo2MH0seyJ4IjoxMzYsInkiOjg1fSx7IngiOjEzNiwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M136,162L136,166.167C136,170.333,136,178.667,136,192.333C136,206,136,225,136,234.5L136,244" id="gdefault4-L_L_S_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_L_S_0" data-points="W3sieCI6MTM2LCJ5IjoxNjJ9LHsieCI6MTM2LCJ5IjoxODd9LHsieCI6MTM2LCJ5IjoyNDh9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M136,348L136,360.167C136,372.333,136,396.667,147.981,414.707C159.963,432.746,183.926,444.493,195.907,450.366L207.888,456.239" id="gdefault4-L_S_P_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S_P_0" data-points="W3sieCI6MTM2LCJ5IjozNDh9LHsieCI6MTM2LCJ5Ijo0MjF9LHsieCI6MjExLjQ4MDAwMDAwMDAwMDAyLCJ5Ijo0NTh9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M289,534L289,538.167C289,542.333,289,550.667,289,558.333C289,566,289,573,289,576.5L289,580" id="gdefault4-L_P_U_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_U_0" data-points="W3sieCI6Mjg5LCJ5Ijo1MzR9LHsieCI6Mjg5LCJ5Ijo1NTl9LHsieCI6Mjg5LCJ5Ijo1ODR9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M442,384L442,390.167C442,396.333,442,408.667,430.019,420.707C418.037,432.746,394.074,444.493,382.093,450.366L370.112,456.239" id="gdefault4-L_D_P_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_P_0" data-points="W3sieCI6NDQyLCJ5IjozODR9LHsieCI6NDQyLCJ5Ijo0MjF9LHsieCI6MzY2LjUyLCJ5Ijo0NTh9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_C_L_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_L_S_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_S_P_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_P_U_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(442, 421)"><g class="label" data-id="L_D_P_0" transform="translate(-29.6796875, -12)"><foreignObject width="59.359375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>rejected</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault4-l4-flowchart-C-0" data-look="classic" transform="translate(136, 34)"><rect class="basic label-container" style="" x="-68.65625" y="-26" width="137.3125" height="52"></rect><g class="label" style="" transform="translate(-40.65625, -12)"><rect></rect><foreignObject width="81.3125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>on connect</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-L-1" data-look="classic" transform="translate(136, 136)"><rect class="basic label-container" style="" x="-113.53125" y="-26" width="227.0625" height="52"></rect><g class="label" style="" transform="translate(-85.53125, -12)"><rect></rect><foreignObject width="171.0625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>ask the host what it has</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-S-3" data-look="classic" transform="translate(136, 298)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>subtract what our records claim<br/><i>incarnation-scoped</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-P-5" data-look="classic" transform="translate(289, 496)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-120.703125" y="-38" width="241.40625" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-92.703125, -24)"><rect></rect><foreignObject width="185.40625" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>remainder = orphans<br/><b>computed, never stored</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-U-7" data-look="classic" transform="translate(289, 634)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>feeds the existing cleanup affordance<br/>never auto-killed</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-D-8" data-look="classic" transform="translate(442, 298)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-128" y="-86" width="256" height="172"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -72)"><rect></rect><foreignObject width="200" height="144"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>a durable orphan row would<br/>go stale across the very disconnect<br/>during which the truth changed</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault4-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault4-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+
+      <h2>7 · What gets deleted</h2>
+      <table>
+        <thead><tr><th>Deleted</th><th>Where</th></tr></thead>
+        <tbody>
+          <tr><td>Attach-identity apparatus</td><td>relay comparison + throw, the error constants, the expected-identity derivation on both reattach paths, the renderer branch that treats a mismatch as proof</td></tr>
+          <tr><td>Lease↔binding reconciliation</td><td>supersession, ranking, deferral, rollback, dual matchers — the ~209 lines I added, plus the ~374 that preceded them</td></tr>
+          <tr><td>The restorable fork</td><td>the two contradictory predicates where absence of a lease meant opposite things depending on a sibling leaf</td></tr>
+          <tr><td>The 30-second grant arithmetic</td><td>replaced by an explicit record state</td></tr>
+          <tr><td>Never built at all</td><td><code>hostEpoch</code> and its clock arithmetic; a five-row evidence matrix; a <code>resumed</code> flag — all proposed in earlier rounds and killed before implementation</td></tr>
+        </tbody>
+      </table>
+      <div class="callout">
+        <p><span class="k">Net lines, honestly</span></p>
+        <p>Removed ≈900–1,250. Added ≈450–700. <strong>Net ≈ −300 to −700</strong> — but only after a one-release legacy projection is dropped; during that release it is ≈ −100 to −450. Tests go up ≈900–1,500 for 25 oracles, several needing SSH + detach + relay-restart harnesses that do not exist. The synthesizer stated plainly it could not narrow the range further without doing the call-site rewiring.</p>
+      </div>
+
+      <h2>8 · Verification</h2>
+      <p class="lede">Models assert plausible file contents confidently, so every claim about existing code was checked.</p>
+      <div class="grid">
+        <div class="stat"><div class="n good">78</div><div class="l">Confirmed</div></div>
+        <div class="stat"><div class="n bad">12</div><div class="l">Wrong</div></div>
+        <div class="stat"><div class="n warn">1</div><div class="l">Unverifiable</div></div>
+      </div>
+      <p>Eleven of the twelve errors were citation-level and changed no conclusion. One was a real premise defect: the claim that abandoning a wrongly-attached shell is <em>free</em>. It is not — <code>attach</code> commits activation, clears pending output and may replay <strong>before</strong> it returns the incarnation the client would use to detect the mistake, and there is no detach RPC to undo it. That correction is folded in as C4.</p>
+      <p>I independently verified the duplicate-agent chain end to end, since it implicates my own code.</p>
+
+      <h2>9 · Where the models disagreed</h2>
+      <table>
+        <thead><tr><th>Conflict</th><th>Status</th></tr></thead>
+        <tbody>
+          <tr><td>Do shells survive a hard relay death on Windows/WSL?</td><td><span class="pill mid">Open</span> — adjudicated toward “dead” on POSIX evidence; the Windows case is not established</td></tr>
+          <tr><td>Does the 30-second recovery grant execute in production at all?</td><td><span class="pill mid">Open</span> — two reviewers read its comparison as unreachable for a real SSH pane; the covering test seeds a shape production cannot produce</td></tr>
+          <tr><td>Should <code>relayInstanceId</code> exist?</td><td><span class="pill mid">Open</span> — one would delete it and let incarnation carry the rule; the other keeps it because a re-minted id proves only that the relay restarted</td></tr>
+          <tr><td>Fix or delete the attach identity?</td><td><span class="pill ok">Resolved</span> — deletion, and the synthesizer went further than either reviewer</td></tr>
+        </tbody>
+      </table>
+
+      <h2>10 · Readiness</h2>
+      <p>A final pass re-checked whether the close-out actually closed its own blockers. Verdict: <span class="pill no">STILL NOT READY</span>.</p>
+      <table>
+        <thead><tr><th>Blocker</th><th>Close-out</th></tr></thead>
+        <tbody>
+          <tr><td>The spawn reattach path still wraps <em>any</em> not-found as expired, so client-side auto-respawn survives</td><td><span class="pill no">NOT CLOSED</span> — <strong>C1</strong> hardens the classifier, but the primary path never reaches a classifier. Every auto-respawn consumer must require proof, not just the one that catches a throw.</td></tr>
+          <tr><td>Migrated records have no incarnation, but the design requires one and throws on mismatch</td><td><span class="pill ok">CLOSED</span>, conditionally — <strong>C2/C3</strong> work only if an absent recorded incarnation means <em>learn and stamp</em>, never <em>mismatch</em>. That rule must be written into both the algorithm and the type.</td></tr>
+        </tbody>
+      </table>
+
+      <h2>11 · Decisions for you</h2>
+      <table>
+        <thead><tr><th>#</th><th>Decision</th></tr></thead>
+        <tbody>
+          <tr><td><strong>1</strong></td><td><strong>The live bug.</strong> It is independent of the redesign and fixable in isolation. Fix it now as its own change, or fold it into the track?</td></tr>
+          <tr><td><strong>2</strong></td><td><strong>Visible detached panes.</strong> The design replaces an invisible 30-second auto-recovery with an explicit state and two actions (reattach / start a new shell). That is a deliberate product change — a user-initiated relay reset would now show detached panes rather than silently recreating shells.</td></tr>
+          <tr><td><strong>3</strong></td><td><strong>Release policy.</strong> A leaf removed while its shell lives releases the claim — the shell becomes orphan-eligible and adoptable, and is never auto-killed. Confirm you want liveness preserved over tidiness.</td></tr>
+          <tr><td><strong>4</strong></td><td><strong>Sequencing.</strong> Two preconditions block everything: one partition per (target, pane), and one bind producer. The second is also what would make the shipped fence non-inert.</td></tr>
+        </tbody>
+      </table>
+
+      <div class="foot">
+        Companion to <code>report.html</code> (evidence for the shipped work) and <code>finalized-design.html</code> (the two-plane decision this supersedes at the control plane).
+        Click any diagram to zoom · scroll to scale · drag to pan.
+      </div>
+    </div>
+
+    <div id="ov"><span class="x">×</span><div class="inner"></div><div class="hint">scroll to zoom · drag to pan · Esc to close</div></div>
+
+    <script>
+      const ov = document.getElementById('ov')
+      const inner = ov.querySelector('.inner')
+      let scale = 1, tx = 0, ty = 0, dragging = false, sx = 0, sy = 0
+      function apply() { inner.style.transform = `translate(${tx}px, ${ty}px) scale(${scale})` }
+      function open(svgHtml) {
+        inner.innerHTML = svgHtml
+        const svg = inner.querySelector('svg')
+        if (svg) { svg.style.maxWidth = 'none'; svg.removeAttribute('width'); svg.removeAttribute('height')
+          svg.style.width = Math.min(window.innerWidth * 0.9, 1500) + 'px' }
+        scale = 1; tx = 0; ty = 0; apply()
+        ov.classList.add('on')
+        const b = inner.getBoundingClientRect()
+        tx = Math.max(16, (window.innerWidth - b.width) / 2)
+        ty = Math.max(16, (window.innerHeight - b.height) / 2)
+        apply()
+      }
+      function close() { ov.classList.remove('on'); inner.innerHTML = '' }
+      document.addEventListener('click', (e) => {
+        const fig = e.target.closest('figure')
+        if (fig && !ov.classList.contains('on')) {
+          const svg = [...fig.querySelectorAll('.dia > div')].find((d) => d.offsetParent !== null)
+          if (svg) open(svg.innerHTML)
+        }
+      })
+      ov.querySelector('.x').addEventListener('click', (e) => { e.stopPropagation(); close() })
+      document.addEventListener('keydown', (e) => { if (e.key === 'Escape') close() })
+      ov.addEventListener('wheel', (e) => {
+        e.preventDefault()
+        const f = e.deltaY < 0 ? 1.12 : 1 / 1.12
+        tx = e.clientX - (e.clientX - tx) * f; ty = e.clientY - (e.clientY - ty) * f; scale *= f; apply()
+      }, { passive: false })
+      ov.addEventListener('mousedown', (e) => { dragging = true; sx = e.clientX - tx; sy = e.clientY - ty; ov.style.cursor = 'grabbing' })
+      window.addEventListener('mousemove', (e) => { if (!dragging) return; tx = e.clientX - sx; ty = e.clientY - sy; apply() })
+      window.addEventListener('mouseup', () => { dragging = false; ov.style.cursor = 'grab' })
+    </script>
+  </body>
+</html>
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-brief-for-review.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-brief-for-review.md
new file mode 100644
index 00000000000..30d99ae116e
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-brief-for-review.md
@@ -0,0 +1,186 @@
+# Design brief — terminal session ownership & transport
+
+Review artifact. Repo: Orca (Electron + renderer + relay). Everything below marked
+**[V]** was verified by reading the code at the cited location. Everything marked
+**[R]** is agent-reported and only spot-checked. Treat **[R]** as a lead, not a fact.
+
+---
+
+## 1. The product problem
+
+Orca runs terminals on four "routes":
+
+| Route                 | Provider                                        | Survives app restart       |
+| --------------------- | ----------------------------------------------- | -------------------------- |
+| local in-process      | `LocalPtyProvider`                              | no                         |
+| local daemon          | `DaemonPtyAdapter` (swapped into the same slot) | yes                        |
+| direct SSH            | `SshPtyProvider` → remote relay                 | yes, within a grace window |
+| paired remote runtime | not an `IPtyProvider`; runtime RPC              | yes                        |
+
+Reported failures:
+
+1. **Pane cardinality growth (STA-3077).** SSH reconnect: 2 terminals → 19 → 20.
+   Most are panes the user never opened. Remote host fills with unused shells.
+2. **Duplicate agent resume.** A coding agent gets resumed twice, two processes
+   writing one conversation file. One report reached five.
+3. **Blast radius.** One PTY failing to re-prove its output stream could drop the
+   whole host connection, killing every pane, file transfer and git command on it.
+
+## 2. Verified facts (the evidence base)
+
+**[V] Dispatch is a substitution for daemon, a parallel registry for SSH.**
+`src/main/ipc/pty.ts:932-941`:
+
+```ts
+function getProvider(connectionId) {
+  if (!connectionId) return localProvider // local AND daemon — one slot
+  const provider = sshProviders.get(connectionId) // SSH — separate map
+}
+```
+
+The daemon is installed by `setLocalPtyProvider(routedAdapter)`
+(`src/main/daemon/daemon-init.ts:1031`) and adds **zero** branches to the shared
+spine. The paired runtime is encapsulated behind a `PtyTransport`. SSH is neither —
+it rides the local path carrying a `connectionId` tag.
+
+**[R] That tag leaks:** ~199 remoteness branches in main (52 in `pty.ts`, 143 in
+`orca-runtime.ts`), ~191 in the renderer, plus 25 `instanceof` provider checks.
+The `remote:` predicate is re-declared 5 times in the renderer.
+
+**[V] The transport dropped the half that makes it persistent.**
+`src/main/ssh/relay-protocol.ts:34`:
+
+```ts
+export const MessageType = { Regular: 1, KeepAlive: 9 } as const
+```
+
+The 13-byte frame header was copied from a well-known persistent protocol, but
+only 2 of its 9 message types were kept. Dropped: `Control`, `Ack`, `Disconnect`,
+`ReplayRequest`, `Pause`, `Resume`, `None`. The surviving ACK field feeds only
+`unackedTimestamps` (`ssh-channel-multiplexer.ts:107,448,596`), a seq→timestamp map
+read solely by the death timer. **Nothing is retained at the transport layer;
+nothing is replayed.** Consequence: three layers above it each rebuilt
+retain-and-replay independently (SSH credit ledger, runtime-RPC source-range
+ledger, daemon batcher — the last deliberately lossy).
+
+**[V] Method layer is transport-agnostic.** `runtime/rpc/methods/terminal.ts` and
+`git.ts` have 0 SSH references; `files.ts` has 27.
+
+**[V] Three durable records exist, plus a fourth copy on the host.**
+
+|                                       | key                       | pane identity is              |
+| ------------------------------------- | ------------------------- | ----------------------------- |
+| PTY binding (`WorkspaceSessionState`) | `(hostId, tabId, leafId)` | **the key**                   |
+| `SshRemotePtyLease`                   | `(targetId, relayPtyId)`  | **optional payload**          |
+| `SshPtyConsumerRecovery`              | `targetId`                | n/a (per-target resume token) |
+| relay `attachIdentity`                | per PTY, in-memory        | compare-only                  |
+
+**[R] ~374 lines of pure lease↔binding reconciliation in `persistence.ts`**, and 9
+enumerated states where the records can disagree. Example of an independent latent
+bug: absence of a lease means "restorable" in `isRestorablePtyBinding` but "not
+restorable" in `hasRestorableSshRemotePtyLease` — so whether a binding survives
+depends on whether a _sibling leaf_ had a binding.
+
+**[V] The relay holds nothing durably.** Its PTY table is
+`private ptys = new Map<string, ManagedPty>()` (`src/relay/pty-handler.ts:356`).
+No relay-side persistence of PTY state exists. `pty.serialize`/`revive` hand state
+to the _client_ and take it back; `revive` requires the original PIDs to still be
+alive. On PTY exit the entry is deleted with no tombstone.
+
+**[V] Pane identity is write-only over the wire.** `listProcesses` and `attach`
+never return `paneKey`/`tabId`/`leafId`; `attach` only compares and throws
+`identity mismatch`. The one RPC that returns identity (`pty.serialize`) has
+**zero production callers** — test files only.
+
+**[V] The client's lease is consulted from a synchronous, offline, disk-only path.**
+`hasRestorableSshRemotePtyLease` is called inside `setLocalWorkspaceSession`
+(`src/main/persistence.ts:6465`), a synchronous `void` method invoked on every
+renderer session publish including during quit (`:6287`, `:6351`).
+
+## 3. Alternatives already refuted
+
+**A. Merge the lease into the pane binding.** Blocked by two load-bearing
+properties: a lease must be able to name a live shell **no pane owns** (the actual
+STA-3077 field state; reattach enumerates these), and a lease **outlives** the
+binding — expiry deletes the binding and then authorizes recreating a shell for 30s
+(`SSH_PANE_RECOVERY_GRACE_MS`, `orca-runtime.ts:1771`).
+
+**B. Delete the lease; make the remote host authoritative.** Refuted. The host has
+no durable state, cannot be queried for pane identity, has no notion of "recently
+died, replacement authorized", and is by construction unreachable exactly when the
+record is needed. Decisive: you cannot replace a synchronous local disk read during
+quit with an RPC to a host that is down.
+
+**C. A second "authority architecture" beside the existing one** (+60,903 lines,
+394 new files). Rejected earlier: it fixed none of the three root causes.
+
+## 4. The design under review
+
+### Plane 1 — data plane (adopted from a separate proposal)
+
+Restore a delivery guarantee at the transport, then collapse what was rebuilt above
+it. Roughly: capability handshake; one delivery-identity type; one credit-ledger
+implementation parameterised by unit and limit; one chunk-and-ack primitive; one
+lane vocabulary; binary PTY payloads reusing the binary terminal frame Orca already
+ships to mobile; prebuilt native binaries so first connect stops needing a compiler;
+then teach the relay to listen on a loopback WebSocket, forward that port, and let
+the _same_ client serve the SSH route — after which SSH is "launch + access" only.
+
+### Plane 2 — control plane (proposed here; the reviewed contribution)
+
+The lease answers two different questions with one record keyed for neither:
+
+- "which shell does this pane own?" → wants a **pane** key
+- "which shells exist that nobody owns?" → wants a **pty** key
+
+Proposal: split by question.
+
+- **Ownership record**, keyed `(host, pane)` — the _same_ key local already uses.
+  Transport-specific payload (lease state + timestamps for SSH; nothing extra for
+  local). Makes "one pane, one live shell" structural rather than enforced.
+- **Orphan inventory**, keyed `(host, ptyId)` — live shells with no owner. Feeds the
+  reattach work list and the disconnected-cleanup UI.
+- The 30s recovery grant becomes a terminal state on the pane-keyed record.
+- Offline consumers keep reading local disk synchronously, unchanged.
+
+Claimed payoff: the ~209 lines of supersession/ranking/rollback/dual-matchers exist
+_only_ to bolt a pane-keyed constraint onto a pty-keyed record, and become
+unnecessary.
+
+## 5. Historical defect, now resolved
+
+This defect was resolved by the shared `bindPaneShell` producer used by relay reattach and both
+spawn handlers. Its mutation proof is recorded in
+[S5](./new-design-goalposts.md#s5--the-superseded-pane-fence-is-live-on-the-reattach-path--proven).
+
+## 6. Hard constraints
+
+- **Cross-platform**: macOS, Linux, Windows (+ WSL). No `echo $$`/`ps` assumptions.
+- **Folder workspaces**, not only git worktrees.
+- **Remote wire compatibility**: clients and remote hosts update independently;
+  mixed versions are normal. New optional field = safe; new stream opcode must be
+  capability-negotiated (decoders drop unknown opcodes silently); changing what a
+  host publishes reaches old clients with no wire change.
+- **Git 2.25 baseline** for git-touching work.
+- Durable on-disk state is also read by pinned older builds in cross-version tests.
+- "Unknown is not dead": disconnect, timeout, absent inventory, and retry
+  exhaustion must never authorize destroying a process.
+- No `max-lines` lint disables.
+
+## 7. What the review must answer
+
+1. **Correctness holes.** Which cases does the Plane 2 design get wrong or fail to
+   cover? Specifically: multi-window / multi-device on one host; app restart while
+   disconnected; relay restart; host reboot; PTY exit during disconnect; two panes
+   racing for one shell; migration from existing on-disk state; a pane deleted while
+   its shell lives; the same worktree open in two windows.
+2. **Simplicity.** Is there a _simpler_ design with the same correctness? Simpler
+   means fewer code paths and fewer concepts, not merely fewer lines. Is the
+   two-record split actually necessary, or is there a single-record formulation that
+   survives the section-3 refutations?
+3. **Migration.** Re-keying a durable record needs a story for existing state,
+   partial writes, and rollback.
+4. **Testability.** What oracle would fail if each guarantee were removed? A design
+   whose guarantees cannot be falsified by mutation is not finished.
+5. **Is Plane 2 even the right cut?** Attack the premise that data plane and control
+   plane are separable here.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-explained.html b/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-explained.html
new file mode 100644
index 00000000000..8718846bd98
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-explained.html
@@ -0,0 +1,235 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Terminals that don't duplicate — the plain-English design</title>
+    <style>
+      :root {
+        --bg: #0f1115; --panel: #161920; --panel-2: #1c2029; --ink: #e6e8ee; --ink-dim: #9aa3b2;
+        --line: #262b36; --good: #3fb950; --bad: #f85149; --warn: #d29922; --info: #58a6ff;
+        --accent: #7c8cff; --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, monospace;
+      }
+      @media (prefers-color-scheme: light) {
+        :root {
+          --bg: #fbfbfd; --panel: #fff; --panel-2: #f4f5f8; --ink: #14161a; --ink-dim: #5b6472;
+          --line: #e2e5ea; --good: #1a7f37; --bad: #cf222e; --warn: #9a6700; --info: #0969da; --accent: #4d5bd9;
+        }
+      }
+      * { box-sizing: border-box; }
+      body { margin: 0; background: var(--bg); color: var(--ink);
+        font: 17px/1.75 -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, system-ui, sans-serif; -webkit-font-smoothing: antialiased; }
+      .wrap { max-width: 820px; margin: 0 auto; padding: 56px 26px 140px; }
+      header.hero { padding-bottom: 30px; }
+      h1 { font-size: 38px; line-height: 1.15; margin: 0 0 10px; letter-spacing: -0.025em; }
+      .sub { color: var(--ink-dim); font-size: 17px; margin: 0; }
+      h2 { font-size: 27px; margin: 70px 0 4px; letter-spacing: -0.015em; }
+      .step { color: var(--accent); font-weight: 700; font-size: 14px; letter-spacing: 0.09em; text-transform: uppercase; margin-top: 70px; }
+      .step + h2 { margin-top: 4px; }
+      h3 { font-size: 20px; margin: 36px 0 4px; }
+      p { margin: 14px 0; }
+      .big { font-size: 20px; line-height: 1.6; }
+      .lede { color: var(--ink-dim); margin-top: 0; }
+      code { font-family: var(--mono); font-size: 0.88em; background: var(--panel-2); padding: 1px 6px; border-radius: 5px; }
+      figure { margin: 26px 0; background: var(--panel); border: 1px solid var(--line); border-radius: 14px; padding: 12px; }
+      figure .bar { display: flex; justify-content: space-between; align-items: center; padding: 6px 10px 12px; color: var(--ink-dim); font-size: 13px; }
+      figure .zoom { color: var(--accent); cursor: pointer; user-select: none; font-weight: 600; }
+      .mermaid { text-align: center; overflow: auto; }
+      .dia { text-align: center; padding: 4px 6px 12px; cursor: zoom-in; }
+      .dia svg { width: 100%; height: auto; max-width: 740px; }
+      .d-light { display: none; }
+      @media (prefers-color-scheme: light) { .d-dark { display: none; } .d-light { display: block; } }
+      table { border-collapse: collapse; width: 100%; margin: 22px 0; font-size: 16px; }
+      th, td { text-align: left; padding: 12px 14px; border-bottom: 1px solid var(--line); vertical-align: top; }
+      th { color: var(--ink-dim); font-weight: 600; font-size: 13px; text-transform: uppercase; letter-spacing: 0.04em; }
+      .callout { border-left: 4px solid var(--accent); background: var(--panel); padding: 18px 22px; border-radius: 0 12px 12px 0; margin: 26px 0; }
+      .callout.bad { border-left-color: var(--bad); } .callout.good { border-left-color: var(--good); } .callout.warn { border-left-color: var(--warn); }
+      .callout p:first-child { margin-top: 0; } .callout p:last-child { margin-bottom: 0; }
+      .k { font-size: 13px; text-transform: uppercase; letter-spacing: 0.07em; color: var(--ink-dim); font-weight: 700; display: block; margin-bottom: 6px; }
+      .say { background: var(--panel-2); border-radius: 12px; padding: 18px 22px; margin: 22px 0; font-size: 19px; line-height: 1.6; }
+      .say b { color: var(--accent); }
+      .glossary { background: var(--panel); border: 1px solid var(--line); border-radius: 14px; padding: 6px 22px 14px; margin: 26px 0; }
+      .foot { margin-top: 70px; padding-top: 22px; border-top: 1px solid var(--line); color: var(--ink-dim); font-size: 14px; }
+      #ov { position: fixed; inset: 0; background: var(--bg); display: none; z-index: 99; cursor: grab; overflow: hidden; }
+      #ov.on { display: block; }
+      #ov .inner { transform-origin: 0 0; position: absolute; top: 0; left: 0;
+        background: var(--panel); border: 1px solid var(--line); border-radius: 14px; padding: 24px; }
+      #ov .inner svg { display: block; }
+      #ov .hint { position: fixed; bottom: 18px; left: 50%; transform: translateX(-50%);
+        color: var(--ink-dim); background: var(--panel-2); border: 1px solid var(--line); border-radius: 999px; padding: 8px 18px; font-size: 14px; }
+      #ov .x { position: fixed; top: 14px; right: 20px; color: var(--ink); font-size: 26px; cursor: pointer; line-height: 1;
+        z-index: 2; background: var(--panel-2); border: 1px solid var(--line); border-radius: 8px; padding: 2px 10px 5px; }
+    </style>
+  </head>
+  <body>
+    <div class="wrap">
+      <header class="hero">
+        <h1>Why terminals duplicate,<br />and how we stop it</h1>
+        <p class="sub">Plain English, no code. Two bugs, two fixes, then one decision for you.</p>
+      </header>
+
+      <div class="say">
+        The whole design in one line:<br />
+        <b>Keep our own notes about which terminal is whose — and never guess whether a program died.</b>
+      </div>
+
+      <div class="step">Setup</div>
+      <h2>What's behind one terminal</h2>
+      <p class="big">When you open a terminal on a remote machine, there are three things, not one.</p>
+      <figure>
+        <div class="bar"><span>The three pieces</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark0" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 709.9375 116" role="graphics-document document" aria-roledescription="d0-flowchart-v2"><style>#gdark0{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark0 .error-icon{fill:#a44141;}#gdark0 .error-text{fill:#ddd;stroke:#ddd;}#gdark0 .edge-thickness-normal{stroke-width:1px;}#gdark0 .edge-thickness-thick{stroke-width:3.5px;}#gdark0 .edge-pattern-solid{stroke-dasharray:0;}#gdark0 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark0 .edge-pattern-dashed{stroke-dasharray:3;}#gdark0 .edge-pattern-dotted{stroke-dasharray:2;}#gdark0 .marker{fill:lightgrey;stroke:lightgrey;}#gdark0 .marker.cross{stroke:lightgrey;}#gdark0 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark0 p{margin:0;}#gdark0 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark0 .cluster-label text{fill:#F9FFFE;}#gdark0 .cluster-label span{color:#F9FFFE;}#gdark0 .cluster-label span p{background-color:transparent;}#gdark0 .label text,#gdark0 span{fill:#ccc;color:#ccc;}#gdark0 .node rect,#gdark0 .node circle,#gdark0 .node ellipse,#gdark0 .node polygon,#gdark0 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark0 .rough-node .label text,#gdark0 .node .label text,#gdark0 .image-shape .label,#gdark0 .icon-shape .label{text-anchor:middle;}#gdark0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark0 .rough-node .label,#gdark0 .node .label,#gdark0 .image-shape .label,#gdark0 .icon-shape .label{text-align:center;}#gdark0 .node.clickable{cursor:pointer;}#gdark0 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark0 .arrowheadPath{fill:lightgrey;}#gdark0 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark0 .d0-flowchart-link{stroke:lightgrey;fill:none;}#gdark0 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark0 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark0 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark0 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark0 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark0 .cluster text{fill:#F9FFFE;}#gdark0 .cluster span{color:#F9FFFE;}#gdark0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark0 rect.text{fill:none;stroke-width:0;}#gdark0 .icon-shape,#gdark0 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark0 .icon-shape p,#gdark0 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark0 .icon-shape .label rect,#gdark0 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark0 .node .neo-node{stroke:#ccc;}#gdark0 [data-look="neo"].node rect,#gdark0 [data-look="neo"].cluster rect,#gdark0 [data-look="neo"].node polygon{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark0 [data-look="neo"].node path{stroke:url(#gdark0-gradient);stroke-width:1px;}#gdark0 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark0 [data-look="neo"].node circle{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark0 [data-look="neo"].icon-shape .icon{fill:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark0_d0-flowchart-v2-pointEnd" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointStart" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointEnd-margin" class="marker d0-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointStart-margin" class="marker d0-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark0_d0-flowchart-v2-circleEnd" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleStart" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleEnd-margin" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleStart-margin" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-crossEnd" class="marker cross d0-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossStart" class="marker cross d0-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossEnd-margin" class="marker cross d0-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossStart-margin" class="marker cross d0-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M229.625,58L233.792,58C237.958,58,246.292,58,254.625,58C262.958,58,271.292,58,275.458,58L279.625,58" id="gdark0-L_A_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_B_0" data-points="W3sieCI6MjI5LjYyNSwieSI6NTh9LHsieCI6MjU0LjYyNSwieSI6NTh9LHsieCI6Mjc5LjYyNSwieSI6NTh9XQ==" data-look="classic"></path><path d="M464.422,58L468.589,58C472.755,58,481.089,58,489.422,58C497.755,58,506.089,58,510.255,58L514.422,58" id="gdark0-L_B_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_C_0" data-points="W3sieCI6NDY0LjQyMTg3NSwieSI6NTh9LHsieCI6NDg5LjQyMTg3NSwieSI6NTh9LHsieCI6NTE0LjQyMTg3NSwieSI6NTh9XQ==" data-look="classic"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark0-d0-flowchart-A-0" data-look="classic" transform="translate(118.8125, 58)"><rect class="basic label-container" style="" x="-110.8125" y="-38" width="221.625" height="76"></rect><g class="label" style="" transform="translate(-82.8125, -24)"><rect></rect><foreignObject width="165.625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>THE PANE<br/>the box on your screen</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-B-1" data-look="classic" transform="translate(372.0234375, 58)"><rect class="basic label-container" style="" x="-92.3984375" y="-50" width="184.796875" height="100"></rect><g class="label" style="" transform="translate(-64.3984375, -36)"><rect></rect><foreignObject width="128.796875" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>THE NOTE<br/>this pane goes<br/>with that program</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-C-3" data-look="classic" transform="translate(608.1796875, 58)"><rect class="basic label-container" style="" x="-93.7578125" y="-50" width="187.515625" height="100"></rect><g class="label" style="" transform="translate(-65.7578125, -36)"><rect></rect><foreignObject width="131.515625" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>THE PROGRAM<br/>really running on<br/>the other machine</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark0-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark0-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark0-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault0" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 709.9375 116" role="graphics-document document" aria-roledescription="l0-flowchart-v2"><style>#gdefault0{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault0 .error-icon{fill:#552222;}#gdefault0 .error-text{fill:#552222;stroke:#552222;}#gdefault0 .edge-thickness-normal{stroke-width:1px;}#gdefault0 .edge-thickness-thick{stroke-width:3.5px;}#gdefault0 .edge-pattern-solid{stroke-dasharray:0;}#gdefault0 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault0 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault0 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault0 .marker{fill:#333333;stroke:#333333;}#gdefault0 .marker.cross{stroke:#333333;}#gdefault0 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault0 p{margin:0;}#gdefault0 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault0 .cluster-label text{fill:#333;}#gdefault0 .cluster-label span{color:#333;}#gdefault0 .cluster-label span p{background-color:transparent;}#gdefault0 .label text,#gdefault0 span{fill:#333;color:#333;}#gdefault0 .node rect,#gdefault0 .node circle,#gdefault0 .node ellipse,#gdefault0 .node polygon,#gdefault0 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault0 .rough-node .label text,#gdefault0 .node .label text,#gdefault0 .image-shape .label,#gdefault0 .icon-shape .label{text-anchor:middle;}#gdefault0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault0 .rough-node .label,#gdefault0 .node .label,#gdefault0 .image-shape .label,#gdefault0 .icon-shape .label{text-align:center;}#gdefault0 .node.clickable{cursor:pointer;}#gdefault0 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault0 .arrowheadPath{fill:#333333;}#gdefault0 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault0 .l0-flowchart-link{stroke:#333333;fill:none;}#gdefault0 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault0 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault0 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault0 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault0 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault0 .cluster text{fill:#333;}#gdefault0 .cluster span{color:#333;}#gdefault0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault0 rect.text{fill:none;stroke-width:0;}#gdefault0 .icon-shape,#gdefault0 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault0 .icon-shape p,#gdefault0 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault0 .icon-shape .label rect,#gdefault0 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault0 .node .neo-node{stroke:#9370DB;}#gdefault0 [data-look="neo"].node rect,#gdefault0 [data-look="neo"].cluster rect,#gdefault0 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault0 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault0 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault0 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault0 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault0_l0-flowchart-v2-pointEnd" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointStart" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointEnd-margin" class="marker l0-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointStart-margin" class="marker l0-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault0_l0-flowchart-v2-circleEnd" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleStart" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleEnd-margin" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleStart-margin" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-crossEnd" class="marker cross l0-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossStart" class="marker cross l0-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossEnd-margin" class="marker cross l0-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossStart-margin" class="marker cross l0-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M229.625,58L233.792,58C237.958,58,246.292,58,254.625,58C262.958,58,271.292,58,275.458,58L279.625,58" id="gdefault0-L_A_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_B_0" data-points="W3sieCI6MjI5LjYyNSwieSI6NTh9LHsieCI6MjU0LjYyNSwieSI6NTh9LHsieCI6Mjc5LjYyNSwieSI6NTh9XQ==" data-look="classic"></path><path d="M464.422,58L468.589,58C472.755,58,481.089,58,489.422,58C497.755,58,506.089,58,510.255,58L514.422,58" id="gdefault0-L_B_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_C_0" data-points="W3sieCI6NDY0LjQyMTg3NSwieSI6NTh9LHsieCI6NDg5LjQyMTg3NSwieSI6NTh9LHsieCI6NTE0LjQyMTg3NSwieSI6NTh9XQ==" data-look="classic"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault0-l0-flowchart-A-0" data-look="classic" transform="translate(118.8125, 58)"><rect class="basic label-container" style="" x="-110.8125" y="-38" width="221.625" height="76"></rect><g class="label" style="" transform="translate(-82.8125, -24)"><rect></rect><foreignObject width="165.625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>THE PANE<br/>the box on your screen</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-B-1" data-look="classic" transform="translate(372.0234375, 58)"><rect class="basic label-container" style="" x="-92.3984375" y="-50" width="184.796875" height="100"></rect><g class="label" style="" transform="translate(-64.3984375, -36)"><rect></rect><foreignObject width="128.796875" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>THE NOTE<br/>this pane goes<br/>with that program</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-C-3" data-look="classic" transform="translate(608.1796875, 58)"><rect class="basic label-container" style="" x="-93.7578125" y="-50" width="187.515625" height="100"></rect><g class="label" style="" transform="translate(-65.7578125, -36)"><rect></rect><foreignObject width="131.515625" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>THE PROGRAM<br/>really running on<br/>the other machine</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault0-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault0-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>Your network blips. The pane stays on screen. The program keeps running over there. <strong>Only the connection between them breaks.</strong></p>
+      <p>So reconnecting is one job: match the notes back up to the programs. Both bugs below are that matching going wrong.</p>
+
+      <div class="step">Bug one</div>
+      <h2>The notes piled up</h2>
+      <p class="big">A real user report: <strong>2 terminals became 19, then 20.</strong> Most were panes they never opened.</p>
+      <figure>
+        <div class="bar"><span>Why they multiplied</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark1" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 272 698" role="graphics-document document" aria-roledescription="d1-flowchart-v2"><style>#gdark1{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark1 .error-icon{fill:#a44141;}#gdark1 .error-text{fill:#ddd;stroke:#ddd;}#gdark1 .edge-thickness-normal{stroke-width:1px;}#gdark1 .edge-thickness-thick{stroke-width:3.5px;}#gdark1 .edge-pattern-solid{stroke-dasharray:0;}#gdark1 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark1 .edge-pattern-dashed{stroke-dasharray:3;}#gdark1 .edge-pattern-dotted{stroke-dasharray:2;}#gdark1 .marker{fill:lightgrey;stroke:lightgrey;}#gdark1 .marker.cross{stroke:lightgrey;}#gdark1 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark1 p{margin:0;}#gdark1 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark1 .cluster-label text{fill:#F9FFFE;}#gdark1 .cluster-label span{color:#F9FFFE;}#gdark1 .cluster-label span p{background-color:transparent;}#gdark1 .label text,#gdark1 span{fill:#ccc;color:#ccc;}#gdark1 .node rect,#gdark1 .node circle,#gdark1 .node ellipse,#gdark1 .node polygon,#gdark1 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark1 .rough-node .label text,#gdark1 .node .label text,#gdark1 .image-shape .label,#gdark1 .icon-shape .label{text-anchor:middle;}#gdark1 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark1 .rough-node .label,#gdark1 .node .label,#gdark1 .image-shape .label,#gdark1 .icon-shape .label{text-align:center;}#gdark1 .node.clickable{cursor:pointer;}#gdark1 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark1 .arrowheadPath{fill:lightgrey;}#gdark1 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark1 .d1-flowchart-link{stroke:lightgrey;fill:none;}#gdark1 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark1 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark1 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark1 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark1 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark1 .cluster text{fill:#F9FFFE;}#gdark1 .cluster span{color:#F9FFFE;}#gdark1 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark1 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark1 rect.text{fill:none;stroke-width:0;}#gdark1 .icon-shape,#gdark1 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark1 .icon-shape p,#gdark1 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark1 .icon-shape .label rect,#gdark1 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark1 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark1 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark1 .node .neo-node{stroke:#ccc;}#gdark1 [data-look="neo"].node rect,#gdark1 [data-look="neo"].cluster rect,#gdark1 [data-look="neo"].node polygon{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark1 [data-look="neo"].node path{stroke:url(#gdark1-gradient);stroke-width:1px;}#gdark1 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark1 [data-look="neo"].node circle{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark1 [data-look="neo"].icon-shape .icon{fill:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark1_d1-flowchart-v2-pointEnd" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointStart" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointEnd-margin" class="marker d1-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointStart-margin" class="marker d1-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark1_d1-flowchart-v2-circleEnd" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleStart" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleEnd-margin" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleStart-margin" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-crossEnd" class="marker cross d1-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossStart" class="marker cross d1-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossEnd-margin" class="marker cross d1-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossStart-margin" class="marker cross d1-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M136,60L136,64.167C136,68.333,136,76.667,136,84.333C136,92,136,99,136,102.5L136,106" id="gdark1-L_S_R1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S_R1_0" data-points="W3sieCI6MTM2LCJ5Ijo2MH0seyJ4IjoxMzYsInkiOjg1fSx7IngiOjEzNiwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M136,162L136,166.167C136,170.333,136,178.667,136,186.333C136,194,136,201,136,204.5L136,208" id="gdark1-L_R1_N1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R1_N1_0" data-points="W3sieCI6MTM2LCJ5IjoxNjJ9LHsieCI6MTM2LCJ5IjoxODd9LHsieCI6MTM2LCJ5IjoyMTJ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M136,288L136,292.167C136,296.333,136,304.667,136,312.333C136,320,136,327,136,330.5L136,334" id="gdark1-L_N1_R2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N1_R2_0" data-points="W3sieCI6MTM2LCJ5IjoyODh9LHsieCI6MTM2LCJ5IjozMTN9LHsieCI6MTM2LCJ5IjozMzh9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M136,390L136,394.167C136,398.333,136,406.667,136,414.333C136,422,136,429,136,432.5L136,436" id="gdark1-L_R2_N2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R2_N2_0" data-points="W3sieCI6MTM2LCJ5IjozOTB9LHsieCI6MTM2LCJ5Ijo0MTV9LHsieCI6MTM2LCJ5Ijo0NDB9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M136,516L136,520.167C136,524.333,136,532.667,136,540.333C136,548,136,555,136,558.5L136,562" id="gdark1-L_N2_BOOM_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N2_BOOM_0" data-points="W3sieCI6MTM2LCJ5Ijo1MTZ9LHsieCI6MTM2LCJ5Ijo1NDF9LHsieCI6MTM2LCJ5Ijo1NjZ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_S_R1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R1_N1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N1_R2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R2_N2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N2_BOOM_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark1-d1-flowchart-S-0" data-look="classic" transform="translate(136, 34)"><rect class="basic label-container" style="" x="-102.5234375" y="-26" width="205.046875" height="52"></rect><g class="label" style="" transform="translate(-74.5234375, -12)"><rect></rect><foreignObject width="149.046875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>you have 2 terminals</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-R1-1" data-look="classic" transform="translate(136, 136)"><rect class="basic label-container" style="" x="-89.1171875" y="-26" width="178.234375" height="52"></rect><g class="label" style="" transform="translate(-61.1171875, -12)"><rect></rect><foreignObject width="122.234375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>blip → reconnect</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-N1-3" data-look="classic" transform="translate(136, 250)"><rect class="basic label-container" style="" x="-111.0390625" y="-38" width="222.078125" height="76"></rect><g class="label" style="" transform="translate(-83.0390625, -24)"><rect></rect><foreignObject width="166.078125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Orca writes a new note<br/>and keeps the old one</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-R2-5" data-look="classic" transform="translate(136, 364)"><rect class="basic label-container" style="" x="-71.2109375" y="-26" width="142.421875" height="52"></rect><g class="label" style="" transform="translate(-43.2109375, -12)"><rect></rect><foreignObject width="86.421875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>another blip</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-N2-7" data-look="classic" transform="translate(136, 478)"><rect class="basic label-container" style="" x="-93.40625" y="-38" width="186.8125" height="76"></rect><g class="label" style="" transform="translate(-65.40625, -24)"><rect></rect><foreignObject width="130.8125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>another note.<br/>old ones still kept.</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-BOOM-9" data-look="classic" transform="translate(136, 628)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>reconnect restores EVERY note.<br/>one pane per note.<br/><b>19 panes</b></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark1-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark1-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark1-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault1" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 272 698" role="graphics-document document" aria-roledescription="l1-flowchart-v2"><style>#gdefault1{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault1 .error-icon{fill:#552222;}#gdefault1 .error-text{fill:#552222;stroke:#552222;}#gdefault1 .edge-thickness-normal{stroke-width:1px;}#gdefault1 .edge-thickness-thick{stroke-width:3.5px;}#gdefault1 .edge-pattern-solid{stroke-dasharray:0;}#gdefault1 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault1 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault1 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault1 .marker{fill:#333333;stroke:#333333;}#gdefault1 .marker.cross{stroke:#333333;}#gdefault1 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault1 p{margin:0;}#gdefault1 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault1 .cluster-label text{fill:#333;}#gdefault1 .cluster-label span{color:#333;}#gdefault1 .cluster-label span p{background-color:transparent;}#gdefault1 .label text,#gdefault1 span{fill:#333;color:#333;}#gdefault1 .node rect,#gdefault1 .node circle,#gdefault1 .node ellipse,#gdefault1 .node polygon,#gdefault1 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault1 .rough-node .label text,#gdefault1 .node .label text,#gdefault1 .image-shape .label,#gdefault1 .icon-shape .label{text-anchor:middle;}#gdefault1 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault1 .rough-node .label,#gdefault1 .node .label,#gdefault1 .image-shape .label,#gdefault1 .icon-shape .label{text-align:center;}#gdefault1 .node.clickable{cursor:pointer;}#gdefault1 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault1 .arrowheadPath{fill:#333333;}#gdefault1 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault1 .l1-flowchart-link{stroke:#333333;fill:none;}#gdefault1 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault1 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault1 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault1 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault1 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault1 .cluster text{fill:#333;}#gdefault1 .cluster span{color:#333;}#gdefault1 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault1 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault1 rect.text{fill:none;stroke-width:0;}#gdefault1 .icon-shape,#gdefault1 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault1 .icon-shape p,#gdefault1 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault1 .icon-shape .label rect,#gdefault1 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault1 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault1 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault1 .node .neo-node{stroke:#9370DB;}#gdefault1 [data-look="neo"].node rect,#gdefault1 [data-look="neo"].cluster rect,#gdefault1 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault1 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault1 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault1 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault1 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault1_l1-flowchart-v2-pointEnd" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointStart" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointEnd-margin" class="marker l1-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointStart-margin" class="marker l1-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault1_l1-flowchart-v2-circleEnd" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleStart" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleEnd-margin" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleStart-margin" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-crossEnd" class="marker cross l1-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossStart" class="marker cross l1-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossEnd-margin" class="marker cross l1-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossStart-margin" class="marker cross l1-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M136,60L136,64.167C136,68.333,136,76.667,136,84.333C136,92,136,99,136,102.5L136,106" id="gdefault1-L_S_R1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S_R1_0" data-points="W3sieCI6MTM2LCJ5Ijo2MH0seyJ4IjoxMzYsInkiOjg1fSx7IngiOjEzNiwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M136,162L136,166.167C136,170.333,136,178.667,136,186.333C136,194,136,201,136,204.5L136,208" id="gdefault1-L_R1_N1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R1_N1_0" data-points="W3sieCI6MTM2LCJ5IjoxNjJ9LHsieCI6MTM2LCJ5IjoxODd9LHsieCI6MTM2LCJ5IjoyMTJ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M136,288L136,292.167C136,296.333,136,304.667,136,312.333C136,320,136,327,136,330.5L136,334" id="gdefault1-L_N1_R2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N1_R2_0" data-points="W3sieCI6MTM2LCJ5IjoyODh9LHsieCI6MTM2LCJ5IjozMTN9LHsieCI6MTM2LCJ5IjozMzh9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M136,390L136,394.167C136,398.333,136,406.667,136,414.333C136,422,136,429,136,432.5L136,436" id="gdefault1-L_R2_N2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R2_N2_0" data-points="W3sieCI6MTM2LCJ5IjozOTB9LHsieCI6MTM2LCJ5Ijo0MTV9LHsieCI6MTM2LCJ5Ijo0NDB9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M136,516L136,520.167C136,524.333,136,532.667,136,540.333C136,548,136,555,136,558.5L136,562" id="gdefault1-L_N2_BOOM_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N2_BOOM_0" data-points="W3sieCI6MTM2LCJ5Ijo1MTZ9LHsieCI6MTM2LCJ5Ijo1NDF9LHsieCI6MTM2LCJ5Ijo1NjZ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_S_R1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R1_N1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N1_R2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R2_N2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N2_BOOM_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault1-l1-flowchart-S-0" data-look="classic" transform="translate(136, 34)"><rect class="basic label-container" style="" x="-102.5234375" y="-26" width="205.046875" height="52"></rect><g class="label" style="" transform="translate(-74.5234375, -12)"><rect></rect><foreignObject width="149.046875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>you have 2 terminals</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-R1-1" data-look="classic" transform="translate(136, 136)"><rect class="basic label-container" style="" x="-89.1171875" y="-26" width="178.234375" height="52"></rect><g class="label" style="" transform="translate(-61.1171875, -12)"><rect></rect><foreignObject width="122.234375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>blip → reconnect</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-N1-3" data-look="classic" transform="translate(136, 250)"><rect class="basic label-container" style="" x="-111.0390625" y="-38" width="222.078125" height="76"></rect><g class="label" style="" transform="translate(-83.0390625, -24)"><rect></rect><foreignObject width="166.078125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Orca writes a new note<br/>and keeps the old one</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-R2-5" data-look="classic" transform="translate(136, 364)"><rect class="basic label-container" style="" x="-71.2109375" y="-26" width="142.421875" height="52"></rect><g class="label" style="" transform="translate(-43.2109375, -12)"><rect></rect><foreignObject width="86.421875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>another blip</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-N2-7" data-look="classic" transform="translate(136, 478)"><rect class="basic label-container" style="" x="-93.40625" y="-38" width="186.8125" height="76"></rect><g class="label" style="" transform="translate(-65.40625, -24)"><rect></rect><foreignObject width="130.8125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>another note.<br/>old ones still kept.</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-BOOM-9" data-look="classic" transform="translate(136, 628)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>reconnect restores EVERY note.<br/>one pane per note.<br/><b>19 panes</b></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault1-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault1-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The cause is boring and completely fixable: <strong>the notes were filed under the program's name, not the pane's.</strong> One pane could collect unlimited notes, and nothing threw the old ones away.</p>
+
+      <h3>The fix: one slot per pane</h3>
+      <figure>
+        <div class="bar"><span>Filed by pane instead</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark2" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 750.65625 270" role="graphics-document document" aria-roledescription="d2-flowchart-v2"><style>#gdark2{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark2 .error-icon{fill:#a44141;}#gdark2 .error-text{fill:#ddd;stroke:#ddd;}#gdark2 .edge-thickness-normal{stroke-width:1px;}#gdark2 .edge-thickness-thick{stroke-width:3.5px;}#gdark2 .edge-pattern-solid{stroke-dasharray:0;}#gdark2 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark2 .edge-pattern-dashed{stroke-dasharray:3;}#gdark2 .edge-pattern-dotted{stroke-dasharray:2;}#gdark2 .marker{fill:lightgrey;stroke:lightgrey;}#gdark2 .marker.cross{stroke:lightgrey;}#gdark2 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark2 p{margin:0;}#gdark2 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark2 .cluster-label text{fill:#F9FFFE;}#gdark2 .cluster-label span{color:#F9FFFE;}#gdark2 .cluster-label span p{background-color:transparent;}#gdark2 .label text,#gdark2 span{fill:#ccc;color:#ccc;}#gdark2 .node rect,#gdark2 .node circle,#gdark2 .node ellipse,#gdark2 .node polygon,#gdark2 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark2 .rough-node .label text,#gdark2 .node .label text,#gdark2 .image-shape .label,#gdark2 .icon-shape .label{text-anchor:middle;}#gdark2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark2 .rough-node .label,#gdark2 .node .label,#gdark2 .image-shape .label,#gdark2 .icon-shape .label{text-align:center;}#gdark2 .node.clickable{cursor:pointer;}#gdark2 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark2 .arrowheadPath{fill:lightgrey;}#gdark2 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark2 .d2-flowchart-link{stroke:lightgrey;fill:none;}#gdark2 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark2 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark2 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark2 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark2 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark2 .cluster text{fill:#F9FFFE;}#gdark2 .cluster span{color:#F9FFFE;}#gdark2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark2 rect.text{fill:none;stroke-width:0;}#gdark2 .icon-shape,#gdark2 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark2 .icon-shape p,#gdark2 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark2 .icon-shape .label rect,#gdark2 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark2 .node .neo-node{stroke:#ccc;}#gdark2 [data-look="neo"].node rect,#gdark2 [data-look="neo"].cluster rect,#gdark2 [data-look="neo"].node polygon{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark2 [data-look="neo"].node path{stroke:url(#gdark2-gradient);stroke-width:1px;}#gdark2 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark2 [data-look="neo"].node circle{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark2 [data-look="neo"].icon-shape .icon{fill:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark2_d2-flowchart-v2-pointEnd" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointStart" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointEnd-margin" class="marker d2-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointStart-margin" class="marker d2-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark2_d2-flowchart-v2-circleEnd" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleStart" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleEnd-margin" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleStart-margin" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-crossEnd" class="marker cross d2-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossStart" class="marker cross d2-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossEnd-margin" class="marker cross d2-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossStart-margin" class="marker cross d2-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M481.859,135L486.026,135C490.193,135,498.526,135,506.193,135C513.859,135,520.859,135,524.359,135L527.859,135" id="gdark2-L_BEF_AFT_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_BEF_AFT_0" data-points="W3sieCI6NDgxLjg1OTM3NSwieSI6MTM1fSx7IngiOjUwNi44NTkzNzUsInkiOjEzNX0seyJ4Ijo1MzEuODU5Mzc1LCJ5IjoxMzV9XQ==" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_BEF_AFT_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(523.859375, 0)"><g class="clusters"><g class="cluster " id="gdark2-AFT" data-look="classic"><rect style="" x="8" y="8" width="210.796875" height="254"></rect><g class="cluster-label " transform="translate(43.515625, 8)"><foreignObject width="139.765625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>after · filed by pane</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M113.398,97.5L113.398,103.75C113.398,110,113.398,122.5,113.398,134.333C113.398,146.167,113.398,157.333,113.398,162.917L113.398,168.5" id="gdark2-L_P2_L4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P2_L4_0" data-points="W3sieCI6MTEzLjM5ODQzNzUsInkiOjk3LjV9LHsieCI6MTEzLjM5ODQzNzUsInkiOjEzNX0seyJ4IjoxMTMuMzk4NDM3NSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_P2_L4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark2-d2-flowchart-P2-6" data-look="classic" transform="translate(113.3984375, 71.5)"><rect class="basic label-container" style="" x="-53.2421875" y="-26" width="106.484375" height="52"></rect><g class="label" style="" transform="translate(-25.2421875, -12)"><rect></rect><foreignObject width="50.484375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pane A</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-L4-7" data-look="classic" transform="translate(113.3984375, 198.5)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-70.3984375" y="-26" width="140.796875" height="52"></rect><g class="label" style="color:#fff !important" transform="translate(-42.3984375, -12)"><rect></rect><foreignObject width="84.796875" height="24"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>its one note</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(0, 0)"><g class="clusters"><g class="cluster " id="gdark2-BEF" data-look="classic"><rect style="" x="8" y="8" width="473.859375" height="254"></rect><g class="cluster-label " transform="translate(155.7109375, 8)"><foreignObject width="178.4375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>before · filed by program</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M190.383,93.921L174.125,100.768C157.867,107.614,125.352,121.307,109.094,133.737C92.836,146.167,92.836,157.333,92.836,162.917L92.836,168.5" id="gdark2-L_P1_L1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P1_L1_0" data-points="W3sieCI6MTkwLjM4MjgxMjUsInkiOjkzLjkyMTI0NzYwMzc1MTF9LHsieCI6OTIuODM1OTM3NSwieSI6MTM1fSx7IngiOjkyLjgzNTkzNzUsInkiOjE3Mi41fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M243.625,97.5L243.625,103.75C243.625,110,243.625,122.5,243.625,134.333C243.625,146.167,243.625,157.333,243.625,162.917L243.625,168.5" id="gdark2-L_P1_L2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P1_L2_0" data-points="W3sieCI6MjQzLjYyNSwieSI6OTcuNX0seyJ4IjoyNDMuNjI1LCJ5IjoxMzV9LHsieCI6MjQzLjYyNSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M296.867,93.729L313.342,100.607C329.818,107.486,362.768,121.243,379.243,133.705C395.719,146.167,395.719,157.333,395.719,162.917L395.719,168.5" id="gdark2-L_P1_L3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P1_L3_0" data-points="W3sieCI6Mjk2Ljg2NzE4NzUsInkiOjkzLjcyODkxNDExNTQ3MTU0fSx7IngiOjM5NS43MTg3NSwieSI6MTM1fSx7IngiOjM5NS43MTg3NSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_P1_L1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_P1_L2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_P1_L3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark2-d2-flowchart-P1-0" data-look="classic" transform="translate(243.625, 71.5)"><rect class="basic label-container" style="" x="-53.2421875" y="-26" width="106.484375" height="52"></rect><g class="label" style="" transform="translate(-25.2421875, -12)"><rect></rect><foreignObject width="50.484375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pane A</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-L1-1" data-look="classic" transform="translate(92.8359375, 198.5)"><rect class="basic label-container" style="" x="-49.8359375" y="-26" width="99.671875" height="52"></rect><g class="label" style="" transform="translate(-21.8359375, -12)"><rect></rect><foreignObject width="43.671875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>note 1</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-L2-3" data-look="classic" transform="translate(243.625, 198.5)"><rect class="basic label-container" style="" x="-50.953125" y="-26" width="101.90625" height="52"></rect><g class="label" style="" transform="translate(-22.953125, -12)"><rect></rect><foreignObject width="45.90625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>note 2</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-L3-5" data-look="classic" transform="translate(395.71875, 198.5)"><rect class="basic label-container" style="" x="-51.140625" y="-26" width="102.28125" height="52"></rect><g class="label" style="" transform="translate(-23.140625, -12)"><rect></rect><foreignObject width="46.28125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>note 3</p></span></div></foreignObject></g></g></g></g></g></g></g><defs><filter id="gdark2-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark2-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark2-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault2" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 750.65625 270" role="graphics-document document" aria-roledescription="l2-flowchart-v2"><style>#gdefault2{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault2 .error-icon{fill:#552222;}#gdefault2 .error-text{fill:#552222;stroke:#552222;}#gdefault2 .edge-thickness-normal{stroke-width:1px;}#gdefault2 .edge-thickness-thick{stroke-width:3.5px;}#gdefault2 .edge-pattern-solid{stroke-dasharray:0;}#gdefault2 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault2 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault2 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault2 .marker{fill:#333333;stroke:#333333;}#gdefault2 .marker.cross{stroke:#333333;}#gdefault2 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault2 p{margin:0;}#gdefault2 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault2 .cluster-label text{fill:#333;}#gdefault2 .cluster-label span{color:#333;}#gdefault2 .cluster-label span p{background-color:transparent;}#gdefault2 .label text,#gdefault2 span{fill:#333;color:#333;}#gdefault2 .node rect,#gdefault2 .node circle,#gdefault2 .node ellipse,#gdefault2 .node polygon,#gdefault2 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault2 .rough-node .label text,#gdefault2 .node .label text,#gdefault2 .image-shape .label,#gdefault2 .icon-shape .label{text-anchor:middle;}#gdefault2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault2 .rough-node .label,#gdefault2 .node .label,#gdefault2 .image-shape .label,#gdefault2 .icon-shape .label{text-align:center;}#gdefault2 .node.clickable{cursor:pointer;}#gdefault2 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault2 .arrowheadPath{fill:#333333;}#gdefault2 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault2 .l2-flowchart-link{stroke:#333333;fill:none;}#gdefault2 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault2 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault2 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault2 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault2 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault2 .cluster text{fill:#333;}#gdefault2 .cluster span{color:#333;}#gdefault2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault2 rect.text{fill:none;stroke-width:0;}#gdefault2 .icon-shape,#gdefault2 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault2 .icon-shape p,#gdefault2 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault2 .icon-shape .label rect,#gdefault2 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault2 .node .neo-node{stroke:#9370DB;}#gdefault2 [data-look="neo"].node rect,#gdefault2 [data-look="neo"].cluster rect,#gdefault2 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault2 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault2 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault2 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault2 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault2_l2-flowchart-v2-pointEnd" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointStart" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointEnd-margin" class="marker l2-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointStart-margin" class="marker l2-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault2_l2-flowchart-v2-circleEnd" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleStart" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleEnd-margin" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleStart-margin" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-crossEnd" class="marker cross l2-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossStart" class="marker cross l2-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossEnd-margin" class="marker cross l2-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossStart-margin" class="marker cross l2-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M481.859,135L486.026,135C490.193,135,498.526,135,506.193,135C513.859,135,520.859,135,524.359,135L527.859,135" id="gdefault2-L_BEF_AFT_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_BEF_AFT_0" data-points="W3sieCI6NDgxLjg1OTM3NSwieSI6MTM1fSx7IngiOjUwNi44NTkzNzUsInkiOjEzNX0seyJ4Ijo1MzEuODU5Mzc1LCJ5IjoxMzV9XQ==" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_BEF_AFT_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(523.859375, 0)"><g class="clusters"><g class="cluster " id="gdefault2-AFT" data-look="classic"><rect style="" x="8" y="8" width="210.796875" height="254"></rect><g class="cluster-label " transform="translate(43.515625, 8)"><foreignObject width="139.765625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>after · filed by pane</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M113.398,97.5L113.398,103.75C113.398,110,113.398,122.5,113.398,134.333C113.398,146.167,113.398,157.333,113.398,162.917L113.398,168.5" id="gdefault2-L_P2_L4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P2_L4_0" data-points="W3sieCI6MTEzLjM5ODQzNzUsInkiOjk3LjV9LHsieCI6MTEzLjM5ODQzNzUsInkiOjEzNX0seyJ4IjoxMTMuMzk4NDM3NSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_P2_L4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault2-l2-flowchart-P2-6" data-look="classic" transform="translate(113.3984375, 71.5)"><rect class="basic label-container" style="" x="-53.2421875" y="-26" width="106.484375" height="52"></rect><g class="label" style="" transform="translate(-25.2421875, -12)"><rect></rect><foreignObject width="50.484375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pane A</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-L4-7" data-look="classic" transform="translate(113.3984375, 198.5)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-70.3984375" y="-26" width="140.796875" height="52"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-42.3984375, -12)"><rect></rect><foreignObject width="84.796875" height="24"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>its one note</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(0, 0)"><g class="clusters"><g class="cluster " id="gdefault2-BEF" data-look="classic"><rect style="" x="8" y="8" width="473.859375" height="254"></rect><g class="cluster-label " transform="translate(155.7109375, 8)"><foreignObject width="178.4375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>before · filed by program</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M190.383,93.921L174.125,100.768C157.867,107.614,125.352,121.307,109.094,133.737C92.836,146.167,92.836,157.333,92.836,162.917L92.836,168.5" id="gdefault2-L_P1_L1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P1_L1_0" data-points="W3sieCI6MTkwLjM4MjgxMjUsInkiOjkzLjkyMTI0NzYwMzc1MTF9LHsieCI6OTIuODM1OTM3NSwieSI6MTM1fSx7IngiOjkyLjgzNTkzNzUsInkiOjE3Mi41fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M243.625,97.5L243.625,103.75C243.625,110,243.625,122.5,243.625,134.333C243.625,146.167,243.625,157.333,243.625,162.917L243.625,168.5" id="gdefault2-L_P1_L2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P1_L2_0" data-points="W3sieCI6MjQzLjYyNSwieSI6OTcuNX0seyJ4IjoyNDMuNjI1LCJ5IjoxMzV9LHsieCI6MjQzLjYyNSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M296.867,93.729L313.342,100.607C329.818,107.486,362.768,121.243,379.243,133.705C395.719,146.167,395.719,157.333,395.719,162.917L395.719,168.5" id="gdefault2-L_P1_L3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P1_L3_0" data-points="W3sieCI6Mjk2Ljg2NzE4NzUsInkiOjkzLjcyODkxNDExNTQ3MTU0fSx7IngiOjM5NS43MTg3NSwieSI6MTM1fSx7IngiOjM5NS43MTg3NSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_P1_L1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_P1_L2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_P1_L3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault2-l2-flowchart-P1-0" data-look="classic" transform="translate(243.625, 71.5)"><rect class="basic label-container" style="" x="-53.2421875" y="-26" width="106.484375" height="52"></rect><g class="label" style="" transform="translate(-25.2421875, -12)"><rect></rect><foreignObject width="50.484375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pane A</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-L1-1" data-look="classic" transform="translate(92.8359375, 198.5)"><rect class="basic label-container" style="" x="-49.8359375" y="-26" width="99.671875" height="52"></rect><g class="label" style="" transform="translate(-21.8359375, -12)"><rect></rect><foreignObject width="43.671875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>note 1</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-L2-3" data-look="classic" transform="translate(243.625, 198.5)"><rect class="basic label-container" style="" x="-50.953125" y="-26" width="101.90625" height="52"></rect><g class="label" style="" transform="translate(-22.953125, -12)"><rect></rect><foreignObject width="45.90625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>note 2</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-L3-5" data-look="classic" transform="translate(395.71875, 198.5)"><rect class="basic label-container" style="" x="-51.140625" y="-26" width="102.28125" height="52"></rect><g class="label" style="" transform="translate(-23.140625, -12)"><rect></rect><foreignObject width="46.28125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>note 3</p></span></div></foreignObject></g></g></g></g></g></g></g><defs><filter id="gdefault2-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault2-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>Piling up is no longer something we prevent — <strong>there is one slot, so it cannot happen.</strong> That's the difference between a rule you enforce and a shape where the bug has nowhere to live.</p>
+
+      <div class="callout">
+        <span class="k">One detail that matters</span>
+        <p>The note is filed under a <strong>permanent serial number</strong> stamped on the pane when it's created — not under "which tab it's in". Tabs change: you can drag a pane into another tab any time. A serial number never does. <strong>File things under what doesn't move.</strong></p>
+      </div>
+
+      <div class="step">Bug two</div>
+      <h2>"I can't find it" was read as "it died"</h2>
+      <p class="big">This is the worse one, because it's how you end up with <strong>two AI agents writing into the same conversation.</strong></p>
+      <figure>
+        <div class="bar"><span>Drag a pane to a new tab, then reconnect</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark3" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 272 818" role="graphics-document document" aria-roledescription="d3-flowchart-v2"><style>#gdark3{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark3 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark3 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark3 .error-icon{fill:#a44141;}#gdark3 .error-text{fill:#ddd;stroke:#ddd;}#gdark3 .edge-thickness-normal{stroke-width:1px;}#gdark3 .edge-thickness-thick{stroke-width:3.5px;}#gdark3 .edge-pattern-solid{stroke-dasharray:0;}#gdark3 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark3 .edge-pattern-dashed{stroke-dasharray:3;}#gdark3 .edge-pattern-dotted{stroke-dasharray:2;}#gdark3 .marker{fill:lightgrey;stroke:lightgrey;}#gdark3 .marker.cross{stroke:lightgrey;}#gdark3 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark3 p{margin:0;}#gdark3 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark3 .cluster-label text{fill:#F9FFFE;}#gdark3 .cluster-label span{color:#F9FFFE;}#gdark3 .cluster-label span p{background-color:transparent;}#gdark3 .label text,#gdark3 span{fill:#ccc;color:#ccc;}#gdark3 .node rect,#gdark3 .node circle,#gdark3 .node ellipse,#gdark3 .node polygon,#gdark3 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark3 .rough-node .label text,#gdark3 .node .label text,#gdark3 .image-shape .label,#gdark3 .icon-shape .label{text-anchor:middle;}#gdark3 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark3 .rough-node .label,#gdark3 .node .label,#gdark3 .image-shape .label,#gdark3 .icon-shape .label{text-align:center;}#gdark3 .node.clickable{cursor:pointer;}#gdark3 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark3 .arrowheadPath{fill:lightgrey;}#gdark3 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark3 .d3-flowchart-link{stroke:lightgrey;fill:none;}#gdark3 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark3 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark3 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark3 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark3 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark3 .cluster text{fill:#F9FFFE;}#gdark3 .cluster span{color:#F9FFFE;}#gdark3 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark3 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark3 rect.text{fill:none;stroke-width:0;}#gdark3 .icon-shape,#gdark3 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark3 .icon-shape p,#gdark3 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark3 .icon-shape .label rect,#gdark3 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark3 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark3 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark3 .node .neo-node{stroke:#ccc;}#gdark3 [data-look="neo"].node rect,#gdark3 [data-look="neo"].cluster rect,#gdark3 [data-look="neo"].node polygon{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark3 [data-look="neo"].node path{stroke:url(#gdark3-gradient);stroke-width:1px;}#gdark3 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark3 [data-look="neo"].node circle{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark3 [data-look="neo"].icon-shape .icon{fill:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark3_d3-flowchart-v2-pointEnd" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointStart" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointEnd-margin" class="marker d3-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointStart-margin" class="marker d3-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark3_d3-flowchart-v2-circleEnd" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleStart" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleEnd-margin" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleStart-margin" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-crossEnd" class="marker cross d3-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossStart" class="marker cross d3-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossEnd-margin" class="marker cross d3-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossStart-margin" class="marker cross d3-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M136,84L136,88.167C136,92.333,136,100.667,136,108.333C136,116,136,123,136,126.5L136,130" id="gdark3-L_A_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_B_0" data-points="W3sieCI6MTM2LCJ5Ijo4NH0seyJ4IjoxMzYsInkiOjEwOX0seyJ4IjoxMzYsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M136,210L136,214.167C136,218.333,136,226.667,136,234.333C136,242,136,249,136,252.5L136,256" id="gdark3-L_B_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_C_0" data-points="W3sieCI6MTM2LCJ5IjoyMTB9LHsieCI6MTM2LCJ5IjoyMzV9LHsieCI6MTM2LCJ5IjoyNjB9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M136,384L136,388.167C136,392.333,136,400.667,136,408.333C136,416,136,423,136,426.5L136,430" id="gdark3-L_C_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_D_0" data-points="W3sieCI6MTM2LCJ5IjozODR9LHsieCI6MTM2LCJ5Ijo0MDl9LHsieCI6MTM2LCJ5Ijo0MzR9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M136,510L136,514.167C136,518.333,136,526.667,136,534.333C136,542,136,549,136,552.5L136,556" id="gdark3-L_D_E_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_E_0" data-points="W3sieCI6MTM2LCJ5Ijo1MTB9LHsieCI6MTM2LCJ5Ijo1MzV9LHsieCI6MTM2LCJ5Ijo1NjB9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M136,660L136,664.167C136,668.333,136,676.667,136,684.333C136,692,136,699,136,702.5L136,706" id="gdark3-L_E_F_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_E_F_0" data-points="W3sieCI6MTM2LCJ5Ijo2NjB9LHsieCI6MTM2LCJ5Ijo2ODV9LHsieCI6MTM2LCJ5Ijo3MTB9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C_D_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D_E_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_E_F_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark3-d3-flowchart-A-0" data-look="classic" transform="translate(136, 46)"><rect class="basic label-container" style="" x="-86.1875" y="-38" width="172.375" height="76"></rect><g class="label" style="" transform="translate(-58.1875, -24)"><rect></rect><foreignObject width="116.375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>you drag a pane<br/>into a new tab</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-B-1" data-look="classic" transform="translate(136, 172)"><rect class="basic label-container" style="" x="-123.0859375" y="-38" width="246.171875" height="76"></rect><g class="label" style="" transform="translate(-95.0859375, -24)"><rect></rect><foreignObject width="190.171875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>the other machine still has<br/>the OLD tab written down</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-C-3" data-look="classic" transform="translate(136, 322)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>on reconnect it compares, sees<br/>a difference, and replies:<br/><b>no such terminal</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-D-5" data-look="classic" transform="translate(136, 472)"><rect class="basic label-container" style="" x="-94.578125" y="-38" width="189.15625" height="76"></rect><g class="label" style="" transform="translate(-66.578125, -24)"><rect></rect><foreignObject width="133.15625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Orca reads that as<br/><b>the program died</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-E-7" data-look="classic" transform="translate(136, 610)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>starts a replacement,<br/>and resumes your agent again</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-F-9" data-look="classic" transform="translate(136, 760)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-124.5703125" y="-50" width="249.140625" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-96.5703125, -36)"><rect></rect><foreignObject width="193.140625" height="72"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>TWO agents writing to one<br/>conversation. the first one<br/>never stopped.</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark3-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark3-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark3-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault3" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 272 818" role="graphics-document document" aria-roledescription="l3-flowchart-v2"><style>#gdefault3{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault3 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault3 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault3 .error-icon{fill:#552222;}#gdefault3 .error-text{fill:#552222;stroke:#552222;}#gdefault3 .edge-thickness-normal{stroke-width:1px;}#gdefault3 .edge-thickness-thick{stroke-width:3.5px;}#gdefault3 .edge-pattern-solid{stroke-dasharray:0;}#gdefault3 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault3 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault3 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault3 .marker{fill:#333333;stroke:#333333;}#gdefault3 .marker.cross{stroke:#333333;}#gdefault3 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault3 p{margin:0;}#gdefault3 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault3 .cluster-label text{fill:#333;}#gdefault3 .cluster-label span{color:#333;}#gdefault3 .cluster-label span p{background-color:transparent;}#gdefault3 .label text,#gdefault3 span{fill:#333;color:#333;}#gdefault3 .node rect,#gdefault3 .node circle,#gdefault3 .node ellipse,#gdefault3 .node polygon,#gdefault3 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault3 .rough-node .label text,#gdefault3 .node .label text,#gdefault3 .image-shape .label,#gdefault3 .icon-shape .label{text-anchor:middle;}#gdefault3 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault3 .rough-node .label,#gdefault3 .node .label,#gdefault3 .image-shape .label,#gdefault3 .icon-shape .label{text-align:center;}#gdefault3 .node.clickable{cursor:pointer;}#gdefault3 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault3 .arrowheadPath{fill:#333333;}#gdefault3 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault3 .l3-flowchart-link{stroke:#333333;fill:none;}#gdefault3 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault3 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault3 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault3 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault3 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault3 .cluster text{fill:#333;}#gdefault3 .cluster span{color:#333;}#gdefault3 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault3 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault3 rect.text{fill:none;stroke-width:0;}#gdefault3 .icon-shape,#gdefault3 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault3 .icon-shape p,#gdefault3 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault3 .icon-shape .label rect,#gdefault3 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault3 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault3 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault3 .node .neo-node{stroke:#9370DB;}#gdefault3 [data-look="neo"].node rect,#gdefault3 [data-look="neo"].cluster rect,#gdefault3 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault3 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault3 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault3 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault3 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault3_l3-flowchart-v2-pointEnd" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointStart" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointEnd-margin" class="marker l3-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointStart-margin" class="marker l3-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault3_l3-flowchart-v2-circleEnd" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleStart" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleEnd-margin" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleStart-margin" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-crossEnd" class="marker cross l3-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossStart" class="marker cross l3-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossEnd-margin" class="marker cross l3-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossStart-margin" class="marker cross l3-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M136,84L136,88.167C136,92.333,136,100.667,136,108.333C136,116,136,123,136,126.5L136,130" id="gdefault3-L_A_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_B_0" data-points="W3sieCI6MTM2LCJ5Ijo4NH0seyJ4IjoxMzYsInkiOjEwOX0seyJ4IjoxMzYsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M136,210L136,214.167C136,218.333,136,226.667,136,234.333C136,242,136,249,136,252.5L136,256" id="gdefault3-L_B_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_C_0" data-points="W3sieCI6MTM2LCJ5IjoyMTB9LHsieCI6MTM2LCJ5IjoyMzV9LHsieCI6MTM2LCJ5IjoyNjB9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M136,384L136,388.167C136,392.333,136,400.667,136,408.333C136,416,136,423,136,426.5L136,430" id="gdefault3-L_C_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_D_0" data-points="W3sieCI6MTM2LCJ5IjozODR9LHsieCI6MTM2LCJ5Ijo0MDl9LHsieCI6MTM2LCJ5Ijo0MzR9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M136,510L136,514.167C136,518.333,136,526.667,136,534.333C136,542,136,549,136,552.5L136,556" id="gdefault3-L_D_E_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_E_0" data-points="W3sieCI6MTM2LCJ5Ijo1MTB9LHsieCI6MTM2LCJ5Ijo1MzV9LHsieCI6MTM2LCJ5Ijo1NjB9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M136,660L136,664.167C136,668.333,136,676.667,136,684.333C136,692,136,699,136,702.5L136,706" id="gdefault3-L_E_F_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_E_F_0" data-points="W3sieCI6MTM2LCJ5Ijo2NjB9LHsieCI6MTM2LCJ5Ijo2ODV9LHsieCI6MTM2LCJ5Ijo3MTB9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C_D_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D_E_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_E_F_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault3-l3-flowchart-A-0" data-look="classic" transform="translate(136, 46)"><rect class="basic label-container" style="" x="-86.1875" y="-38" width="172.375" height="76"></rect><g class="label" style="" transform="translate(-58.1875, -24)"><rect></rect><foreignObject width="116.375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>you drag a pane<br/>into a new tab</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-B-1" data-look="classic" transform="translate(136, 172)"><rect class="basic label-container" style="" x="-123.0859375" y="-38" width="246.171875" height="76"></rect><g class="label" style="" transform="translate(-95.0859375, -24)"><rect></rect><foreignObject width="190.171875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>the other machine still has<br/>the OLD tab written down</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-C-3" data-look="classic" transform="translate(136, 322)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>on reconnect it compares, sees<br/>a difference, and replies:<br/><b>no such terminal</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-D-5" data-look="classic" transform="translate(136, 472)"><rect class="basic label-container" style="" x="-94.578125" y="-38" width="189.15625" height="76"></rect><g class="label" style="" transform="translate(-66.578125, -24)"><rect></rect><foreignObject width="133.15625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Orca reads that as<br/><b>the program died</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-E-7" data-look="classic" transform="translate(136, 610)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>starts a replacement,<br/>and resumes your agent again</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-F-9" data-look="classic" transform="translate(136, 760)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-124.5703125" y="-50" width="249.140625" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-96.5703125, -36)"><rect></rect><foreignObject width="193.140625" height="72"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>TWO agents writing to one<br/>conversation. the first one<br/>never stopped.</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault3-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault3-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+
+      <div class="callout bad">
+        <span class="k">The trick in it</span>
+        <p>The other machine <strong>did find your program.</strong> Comparing is how it noticed the tab was different. But it answered <em>"not found"</em> — so a message meaning <strong>"it's alive and I'm being fussy"</strong> looked exactly like <strong>"it's gone."</strong></p>
+      </div>
+
+      <h3>Fix, part one: stop comparing tabs</h3>
+      <p>Moving a pane between tabs is a normal thing you're allowed to do, so it must never make a terminal unreachable. That comparison is removed.</p>
+      <p>It was also failing at its real job anyway. It existed to catch a <em>different</em> problem — the remote machine reusing an old ID for a brand-new program, like an apartment number being handed to a new tenant. It never caught that. So we check the <strong>tenant</strong> instead of the apartment number: catches the real case, stops rejecting panes that merely moved.</p>
+
+      <h3>Fix, part two: never guess about death</h3>
+      <p class="big">A replacement terminal starts only on <strong>actual proof</strong> the old program is gone.</p>
+      <figure>
+        <div class="bar"><span>What counts as proof</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark4" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1499.546875 368" role="graphics-document document" aria-roledescription="d4-flowchart-v2"><style>#gdark4{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark4 .error-icon{fill:#a44141;}#gdark4 .error-text{fill:#ddd;stroke:#ddd;}#gdark4 .edge-thickness-normal{stroke-width:1px;}#gdark4 .edge-thickness-thick{stroke-width:3.5px;}#gdark4 .edge-pattern-solid{stroke-dasharray:0;}#gdark4 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark4 .edge-pattern-dashed{stroke-dasharray:3;}#gdark4 .edge-pattern-dotted{stroke-dasharray:2;}#gdark4 .marker{fill:lightgrey;stroke:lightgrey;}#gdark4 .marker.cross{stroke:lightgrey;}#gdark4 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark4 p{margin:0;}#gdark4 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark4 .cluster-label text{fill:#F9FFFE;}#gdark4 .cluster-label span{color:#F9FFFE;}#gdark4 .cluster-label span p{background-color:transparent;}#gdark4 .label text,#gdark4 span{fill:#ccc;color:#ccc;}#gdark4 .node rect,#gdark4 .node circle,#gdark4 .node ellipse,#gdark4 .node polygon,#gdark4 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark4 .rough-node .label text,#gdark4 .node .label text,#gdark4 .image-shape .label,#gdark4 .icon-shape .label{text-anchor:middle;}#gdark4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark4 .rough-node .label,#gdark4 .node .label,#gdark4 .image-shape .label,#gdark4 .icon-shape .label{text-align:center;}#gdark4 .node.clickable{cursor:pointer;}#gdark4 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark4 .arrowheadPath{fill:lightgrey;}#gdark4 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark4 .d4-flowchart-link{stroke:lightgrey;fill:none;}#gdark4 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark4 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark4 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark4 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark4 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark4 .cluster text{fill:#F9FFFE;}#gdark4 .cluster span{color:#F9FFFE;}#gdark4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark4 rect.text{fill:none;stroke-width:0;}#gdark4 .icon-shape,#gdark4 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark4 .icon-shape p,#gdark4 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark4 .icon-shape .label rect,#gdark4 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark4 .node .neo-node{stroke:#ccc;}#gdark4 [data-look="neo"].node rect,#gdark4 [data-look="neo"].cluster rect,#gdark4 [data-look="neo"].node polygon{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark4 [data-look="neo"].node path{stroke:url(#gdark4-gradient);stroke-width:1px;}#gdark4 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark4 [data-look="neo"].node circle{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark4 [data-look="neo"].icon-shape .icon{fill:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark4_d4-flowchart-v2-pointEnd" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointStart" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointEnd-margin" class="marker d4-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointStart-margin" class="marker d4-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark4_d4-flowchart-v2-circleEnd" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleStart" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleEnd-margin" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleStart-margin" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-crossEnd" class="marker cross d4-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossStart" class="marker cross d4-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossEnd-margin" class="marker cross d4-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossStart-margin" class="marker cross d4-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M678.996,41.714L582.652,48.928C486.307,56.143,293.618,70.571,197.274,85.286C100.93,100,100.93,115,100.93,122.5L100.93,130" id="gdark4-L_Q_Y1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_Y1_0" data-points="W3sieCI6Njc4Ljk5NjA5Mzc1LCJ5Ijo0MS43MTM4OTczNDg1NDM1MDV9LHsieCI6MTAwLjkyOTY4NzUsInkiOjg1fSx7IngiOjEwMC45Mjk2ODc1LCJ5IjoxMzR9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M678.996,46.809L627.807,53.174C576.617,59.54,474.238,72.27,423.049,82.135C371.859,92,371.859,99,371.859,102.5L371.859,106" id="gdark4-L_Q_Y2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_Y2_0" data-points="W3sieCI6Njc4Ljk5NjA5Mzc1LCJ5Ijo0Ni44MDkzNzkxMzY5NDQxNn0seyJ4IjozNzEuODU5Mzc1LCJ5Ijo4NX0seyJ4IjozNzEuODU5Mzc1LCJ5IjoxMTB9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M722.315,60L712.748,64.167C703.181,68.333,684.048,76.667,674.481,88.333C664.914,100,664.914,115,664.914,122.5L664.914,130" id="gdark4-L_Q_N1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N1_0" data-points="W3sieCI6NzIyLjMxNDg3NDM4NzI1NDksInkiOjYwfSx7IngiOjY2NC45MTQwNjI1LCJ5Ijo4NX0seyJ4Ijo2NjQuOTE0MDYyNSwieSI6MTM0fV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M841.709,60L851.275,64.167C860.842,68.333,879.976,76.667,889.543,88.333C899.109,100,899.109,115,899.109,122.5L899.109,130" id="gdark4-L_Q_N2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N2_0" data-points="W3sieCI6ODQxLjcwODU2MzExMjc0NTEsInkiOjYwfSx7IngiOjg5OS4xMDkzNzUsInkiOjg1fSx7IngiOjg5OS4xMDkzNzUsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M885.027,49.932L922.817,55.777C960.607,61.622,1036.186,73.311,1073.976,86.655C1111.766,100,1111.766,115,1111.766,122.5L1111.766,130" id="gdark4-L_Q_N3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N3_0" data-points="W3sieCI6ODg1LjAyNzM0Mzc1LCJ5Ijo0OS45MzI0NzgwNTUzNjc5OTR9LHsieCI6MTExMS43NjU2MjUsInkiOjg1fSx7IngiOjExMTEuNzY1NjI1LCJ5IjoxMzR9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M885.027,42.884L966.425,49.903C1047.823,56.922,1210.618,70.961,1292.016,85.481C1373.414,100,1373.414,115,1373.414,122.5L1373.414,130" id="gdark4-L_Q_N4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N4_0" data-points="W3sieCI6ODg1LjAyNzM0Mzc1LCJ5Ijo0Mi44ODM2MjUzODcyMjE4NH0seyJ4IjoxMzczLjQxNDA2MjUsInkiOjg1fSx7IngiOjEzNzMuNDE0MDYyNSwieSI6MTM0fV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M100.93,186L100.93,194.167C100.93,202.333,100.93,218.667,111.485,232.677C122.04,246.688,143.15,258.375,153.705,264.219L164.26,270.063" id="gdark4-L_Y1_OK_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Y1_OK_0" data-points="W3sieCI6MTAwLjkyOTY4NzUsInkiOjE4Nn0seyJ4IjoxMDAuOTI5Njg3NSwieSI6MjM1fSx7IngiOjE2Ny43NTkwMTA0MTY2NjY2OCwieSI6MjcyfV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M371.859,210L371.859,214.167C371.859,218.333,371.859,226.667,361.304,236.677C350.749,246.688,329.639,258.375,319.084,264.219L308.53,270.063" id="gdark4-L_Y2_OK_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Y2_OK_0" data-points="W3sieCI6MzcxLjg1OTM3NSwieSI6MjEwfSx7IngiOjM3MS44NTkzNzUsInkiOjIzNX0seyJ4IjozMDUuMDMwMDUyMDgzMzMzMywieSI6MjcyfV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M664.914,186L664.914,194.167C664.914,202.333,664.914,218.667,706.805,236.06C748.695,253.453,832.476,271.905,874.367,281.132L916.258,290.358" id="gdark4-L_N1_NO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N1_NO_0" data-points="W3sieCI6NjY0LjkxNDA2MjUsInkiOjE4Nn0seyJ4Ijo2NjQuOTE0MDYyNSwieSI6MjM1fSx7IngiOjkyMC4xNjQwNjI1LCJ5IjoyOTEuMjE4NTk3Mjg4MTgyMjV9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M899.109,186L899.109,194.167C899.109,202.333,899.109,218.667,904.472,230.616C909.834,242.565,920.559,250.13,925.921,253.912L931.283,257.694" id="gdark4-L_N2_NO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N2_NO_0" data-points="W3sieCI6ODk5LjEwOTM3NSwieSI6MTg2fSx7IngiOjg5OS4xMDkzNzUsInkiOjIzNX0seyJ4Ijo5MzQuNTUyMDgzMzMzMzMzNCwieSI6MjYwfV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M1111.766,186L1111.766,194.167C1111.766,202.333,1111.766,218.667,1106.403,230.616C1101.041,242.565,1090.316,250.13,1084.954,253.912L1079.592,257.694" id="gdark4-L_N3_NO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N3_NO_0" data-points="W3sieCI6MTExMS43NjU2MjUsInkiOjE4Nn0seyJ4IjoxMTExLjc2NTYyNSwieSI6MjM1fSx7IngiOjEwNzYuMzIyOTE2NjY2NjY2NywieSI6MjYwfV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M1373.414,186L1373.414,194.167C1373.414,202.333,1373.414,218.667,1326.95,236.303C1280.486,253.94,1187.558,272.881,1141.094,282.351L1094.63,291.821" id="gdark4-L_N4_NO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N4_NO_0" data-points="W3sieCI6MTM3My40MTQwNjI1LCJ5IjoxODZ9LHsieCI6MTM3My40MTQwNjI1LCJ5IjoyMzV9LHsieCI6MTA5MC43MTA5Mzc1LCJ5IjoyOTIuNjE5Nzk1NzU4MDUxODV9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_Q_Y1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_Y2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_N1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_N2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_N3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_N4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Y1_OK_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Y2_OK_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N1_NO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N2_NO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N3_NO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N4_NO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark4-d4-flowchart-Q-0" data-look="classic" transform="translate(782.01171875, 34)"><rect class="basic label-container" style="" x="-103.015625" y="-26" width="206.03125" height="52"></rect><g class="label" style="" transform="translate(-75.015625, -12)"><rect></rect><foreignObject width="150.03125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>did the program die?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-Y1-1" data-look="classic" transform="translate(100.9296875, 160)"><rect class="basic label-container" style="" x="-92.9296875" y="-26" width="185.859375" height="52"></rect><g class="label" style="" transform="translate(-64.9296875, -12)"><rect></rect><foreignObject width="129.859375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>we watched it exit</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-Y2-3" data-look="classic" transform="translate(371.859375, 160)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>the same helper that started it<br/>says it's gone</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-N1-5" data-look="classic" transform="translate(664.9140625, 160)"><rect class="basic label-container" style="" x="-115.0546875" y="-26" width="230.109375" height="52"></rect><g class="label" style="" transform="translate(-87.0546875, -12)"><rect></rect><foreignObject width="174.109375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>can't reach the machine</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-N2-7" data-look="classic" transform="translate(899.109375, 160)"><rect class="basic label-container" style="" x="-69.140625" y="-26" width="138.28125" height="52"></rect><g class="label" style="" transform="translate(-41.140625, -12)"><rect></rect><foreignObject width="82.28125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>it timed out</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-N3-9" data-look="classic" transform="translate(1111.765625, 160)"><rect class="basic label-container" style="" x="-93.515625" y="-26" width="187.03125" height="52"></rect><g class="label" style="" transform="translate(-65.515625, -12)"><rect></rect><foreignObject width="131.03125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>missing from a list</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-N4-11" data-look="classic" transform="translate(1373.4140625, 160)"><rect class="basic label-container" style="" x="-118.1328125" y="-26" width="236.265625" height="52"></rect><g class="label" style="" transform="translate(-90.1328125, -12)"><rect></rect><foreignObject width="180.265625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>confusing error message</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-OK-13" data-look="classic" transform="translate(236.39453125, 310)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-98.421875" y="-38" width="196.84375" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-70.421875, -24)"><rect></rect><foreignObject width="140.84375" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>PROOF<br/>start a replacement</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-NO-17" data-look="classic" transform="translate(1005.4375, 310)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-85.2734375" y="-50" width="170.546875" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-57.2734375, -36)"><rect></rect><foreignObject width="114.546875" height="72"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>NOT PROOF<br/>leave it running.<br/>ask the user.</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark4-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark4-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark4-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault4" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1499.546875 368" role="graphics-document document" aria-roledescription="l4-flowchart-v2"><style>#gdefault4{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault4 .error-icon{fill:#552222;}#gdefault4 .error-text{fill:#552222;stroke:#552222;}#gdefault4 .edge-thickness-normal{stroke-width:1px;}#gdefault4 .edge-thickness-thick{stroke-width:3.5px;}#gdefault4 .edge-pattern-solid{stroke-dasharray:0;}#gdefault4 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault4 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault4 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault4 .marker{fill:#333333;stroke:#333333;}#gdefault4 .marker.cross{stroke:#333333;}#gdefault4 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault4 p{margin:0;}#gdefault4 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault4 .cluster-label text{fill:#333;}#gdefault4 .cluster-label span{color:#333;}#gdefault4 .cluster-label span p{background-color:transparent;}#gdefault4 .label text,#gdefault4 span{fill:#333;color:#333;}#gdefault4 .node rect,#gdefault4 .node circle,#gdefault4 .node ellipse,#gdefault4 .node polygon,#gdefault4 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault4 .rough-node .label text,#gdefault4 .node .label text,#gdefault4 .image-shape .label,#gdefault4 .icon-shape .label{text-anchor:middle;}#gdefault4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault4 .rough-node .label,#gdefault4 .node .label,#gdefault4 .image-shape .label,#gdefault4 .icon-shape .label{text-align:center;}#gdefault4 .node.clickable{cursor:pointer;}#gdefault4 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault4 .arrowheadPath{fill:#333333;}#gdefault4 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault4 .l4-flowchart-link{stroke:#333333;fill:none;}#gdefault4 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault4 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault4 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault4 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault4 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault4 .cluster text{fill:#333;}#gdefault4 .cluster span{color:#333;}#gdefault4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault4 rect.text{fill:none;stroke-width:0;}#gdefault4 .icon-shape,#gdefault4 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault4 .icon-shape p,#gdefault4 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault4 .icon-shape .label rect,#gdefault4 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault4 .node .neo-node{stroke:#9370DB;}#gdefault4 [data-look="neo"].node rect,#gdefault4 [data-look="neo"].cluster rect,#gdefault4 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault4 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault4 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault4 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault4 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault4_l4-flowchart-v2-pointEnd" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointStart" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointEnd-margin" class="marker l4-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointStart-margin" class="marker l4-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault4_l4-flowchart-v2-circleEnd" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleStart" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleEnd-margin" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleStart-margin" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-crossEnd" class="marker cross l4-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossStart" class="marker cross l4-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossEnd-margin" class="marker cross l4-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossStart-margin" class="marker cross l4-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M678.996,41.714L582.652,48.928C486.307,56.143,293.618,70.571,197.274,85.286C100.93,100,100.93,115,100.93,122.5L100.93,130" id="gdefault4-L_Q_Y1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_Y1_0" data-points="W3sieCI6Njc4Ljk5NjA5Mzc1LCJ5Ijo0MS43MTM4OTczNDg1NDM1MDV9LHsieCI6MTAwLjkyOTY4NzUsInkiOjg1fSx7IngiOjEwMC45Mjk2ODc1LCJ5IjoxMzR9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M678.996,46.809L627.807,53.174C576.617,59.54,474.238,72.27,423.049,82.135C371.859,92,371.859,99,371.859,102.5L371.859,106" id="gdefault4-L_Q_Y2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_Y2_0" data-points="W3sieCI6Njc4Ljk5NjA5Mzc1LCJ5Ijo0Ni44MDkzNzkxMzY5NDQxNn0seyJ4IjozNzEuODU5Mzc1LCJ5Ijo4NX0seyJ4IjozNzEuODU5Mzc1LCJ5IjoxMTB9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M722.315,60L712.748,64.167C703.181,68.333,684.048,76.667,674.481,88.333C664.914,100,664.914,115,664.914,122.5L664.914,130" id="gdefault4-L_Q_N1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N1_0" data-points="W3sieCI6NzIyLjMxNDg3NDM4NzI1NDksInkiOjYwfSx7IngiOjY2NC45MTQwNjI1LCJ5Ijo4NX0seyJ4Ijo2NjQuOTE0MDYyNSwieSI6MTM0fV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M841.709,60L851.275,64.167C860.842,68.333,879.976,76.667,889.543,88.333C899.109,100,899.109,115,899.109,122.5L899.109,130" id="gdefault4-L_Q_N2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N2_0" data-points="W3sieCI6ODQxLjcwODU2MzExMjc0NTEsInkiOjYwfSx7IngiOjg5OS4xMDkzNzUsInkiOjg1fSx7IngiOjg5OS4xMDkzNzUsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M885.027,49.932L922.817,55.777C960.607,61.622,1036.186,73.311,1073.976,86.655C1111.766,100,1111.766,115,1111.766,122.5L1111.766,130" id="gdefault4-L_Q_N3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N3_0" data-points="W3sieCI6ODg1LjAyNzM0Mzc1LCJ5Ijo0OS45MzI0NzgwNTUzNjc5OTR9LHsieCI6MTExMS43NjU2MjUsInkiOjg1fSx7IngiOjExMTEuNzY1NjI1LCJ5IjoxMzR9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M885.027,42.884L966.425,49.903C1047.823,56.922,1210.618,70.961,1292.016,85.481C1373.414,100,1373.414,115,1373.414,122.5L1373.414,130" id="gdefault4-L_Q_N4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N4_0" data-points="W3sieCI6ODg1LjAyNzM0Mzc1LCJ5Ijo0Mi44ODM2MjUzODcyMjE4NH0seyJ4IjoxMzczLjQxNDA2MjUsInkiOjg1fSx7IngiOjEzNzMuNDE0MDYyNSwieSI6MTM0fV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M100.93,186L100.93,194.167C100.93,202.333,100.93,218.667,111.485,232.677C122.04,246.688,143.15,258.375,153.705,264.219L164.26,270.063" id="gdefault4-L_Y1_OK_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Y1_OK_0" data-points="W3sieCI6MTAwLjkyOTY4NzUsInkiOjE4Nn0seyJ4IjoxMDAuOTI5Njg3NSwieSI6MjM1fSx7IngiOjE2Ny43NTkwMTA0MTY2NjY2OCwieSI6MjcyfV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M371.859,210L371.859,214.167C371.859,218.333,371.859,226.667,361.304,236.677C350.749,246.688,329.639,258.375,319.084,264.219L308.53,270.063" id="gdefault4-L_Y2_OK_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Y2_OK_0" data-points="W3sieCI6MzcxLjg1OTM3NSwieSI6MjEwfSx7IngiOjM3MS44NTkzNzUsInkiOjIzNX0seyJ4IjozMDUuMDMwMDUyMDgzMzMzMywieSI6MjcyfV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M664.914,186L664.914,194.167C664.914,202.333,664.914,218.667,706.805,236.06C748.695,253.453,832.476,271.905,874.367,281.132L916.258,290.358" id="gdefault4-L_N1_NO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N1_NO_0" data-points="W3sieCI6NjY0LjkxNDA2MjUsInkiOjE4Nn0seyJ4Ijo2NjQuOTE0MDYyNSwieSI6MjM1fSx7IngiOjkyMC4xNjQwNjI1LCJ5IjoyOTEuMjE4NTk3Mjg4MTgyMjV9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M899.109,186L899.109,194.167C899.109,202.333,899.109,218.667,904.472,230.616C909.834,242.565,920.559,250.13,925.921,253.912L931.283,257.694" id="gdefault4-L_N2_NO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N2_NO_0" data-points="W3sieCI6ODk5LjEwOTM3NSwieSI6MTg2fSx7IngiOjg5OS4xMDkzNzUsInkiOjIzNX0seyJ4Ijo5MzQuNTUyMDgzMzMzMzMzNCwieSI6MjYwfV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M1111.766,186L1111.766,194.167C1111.766,202.333,1111.766,218.667,1106.403,230.616C1101.041,242.565,1090.316,250.13,1084.954,253.912L1079.592,257.694" id="gdefault4-L_N3_NO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N3_NO_0" data-points="W3sieCI6MTExMS43NjU2MjUsInkiOjE4Nn0seyJ4IjoxMTExLjc2NTYyNSwieSI6MjM1fSx7IngiOjEwNzYuMzIyOTE2NjY2NjY2NywieSI6MjYwfV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M1373.414,186L1373.414,194.167C1373.414,202.333,1373.414,218.667,1326.95,236.303C1280.486,253.94,1187.558,272.881,1141.094,282.351L1094.63,291.821" id="gdefault4-L_N4_NO_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N4_NO_0" data-points="W3sieCI6MTM3My40MTQwNjI1LCJ5IjoxODZ9LHsieCI6MTM3My40MTQwNjI1LCJ5IjoyMzV9LHsieCI6MTA5MC43MTA5Mzc1LCJ5IjoyOTIuNjE5Nzk1NzU4MDUxODV9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_Q_Y1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_Y2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_N1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_N2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_N3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q_N4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Y1_OK_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Y2_OK_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N1_NO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N2_NO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N3_NO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N4_NO_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault4-l4-flowchart-Q-0" data-look="classic" transform="translate(782.01171875, 34)"><rect class="basic label-container" style="" x="-103.015625" y="-26" width="206.03125" height="52"></rect><g class="label" style="" transform="translate(-75.015625, -12)"><rect></rect><foreignObject width="150.03125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>did the program die?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-Y1-1" data-look="classic" transform="translate(100.9296875, 160)"><rect class="basic label-container" style="" x="-92.9296875" y="-26" width="185.859375" height="52"></rect><g class="label" style="" transform="translate(-64.9296875, -12)"><rect></rect><foreignObject width="129.859375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>we watched it exit</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-Y2-3" data-look="classic" transform="translate(371.859375, 160)"><rect class="basic label-container" style="" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>the same helper that started it<br/>says it's gone</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-N1-5" data-look="classic" transform="translate(664.9140625, 160)"><rect class="basic label-container" style="" x="-115.0546875" y="-26" width="230.109375" height="52"></rect><g class="label" style="" transform="translate(-87.0546875, -12)"><rect></rect><foreignObject width="174.109375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>can't reach the machine</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-N2-7" data-look="classic" transform="translate(899.109375, 160)"><rect class="basic label-container" style="" x="-69.140625" y="-26" width="138.28125" height="52"></rect><g class="label" style="" transform="translate(-41.140625, -12)"><rect></rect><foreignObject width="82.28125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>it timed out</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-N3-9" data-look="classic" transform="translate(1111.765625, 160)"><rect class="basic label-container" style="" x="-93.515625" y="-26" width="187.03125" height="52"></rect><g class="label" style="" transform="translate(-65.515625, -12)"><rect></rect><foreignObject width="131.03125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>missing from a list</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-N4-11" data-look="classic" transform="translate(1373.4140625, 160)"><rect class="basic label-container" style="" x="-118.1328125" y="-26" width="236.265625" height="52"></rect><g class="label" style="" transform="translate(-90.1328125, -12)"><rect></rect><foreignObject width="180.265625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>confusing error message</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-OK-13" data-look="classic" transform="translate(236.39453125, 310)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-98.421875" y="-38" width="196.84375" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-70.421875, -24)"><rect></rect><foreignObject width="140.84375" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>PROOF<br/>start a replacement</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-NO-17" data-look="classic" transform="translate(1005.4375, 310)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-85.2734375" y="-50" width="170.546875" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-57.2734375, -36)"><rect></rect><foreignObject width="114.546875" height="72"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>NOT PROOF<br/>leave it running.<br/>ask the user.</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault4-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault4-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The second proof is the clever one. The helper on the remote machine keeps its list of running programs <strong>only in memory</strong>. So if that <em>same</em> helper — same process, not a restarted one — says a program isn't in its list, it must have exited. There is nowhere else it could be.</p>
+      <p>And if the helper <em>restarted</em>, it remembers nothing, so we say <strong>we don't know</strong>. We never treat a fresh helper's empty list as news that your programs died.</p>
+
+      <div class="step">Result</div>
+      <h2>What you'd actually notice</h2>
+      <table>
+        <thead><tr><th>Situation</th><th>Today</th><th>After</th></tr></thead>
+        <tbody>
+          <tr><td>Network drops and comes back</td><td>Terminals multiply; the remote machine fills with junk</td><td>Your terminals come back. Nothing invented.</td></tr>
+          <tr><td>You drag a pane to a new tab</td><td>A second agent resumes onto the same conversation</td><td>Just works.</td></tr>
+          <tr><td>Orca genuinely can't tell if a program survived</td><td>Silently starts a new one</td><td>Pane says "disconnected", with two buttons</td></tr>
+          <tr><td>Leftover programs on a remote machine</td><td>Invisible, pile up forever</td><td>Listed with folder and name — you choose what to close</td></tr>
+        </tbody>
+      </table>
+
+      <figure>
+        <div class="bar"><span>The one visible change</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark5" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 546.609375 290" role="graphics-document document" aria-roledescription="d5-flowchart-v2"><style>#gdark5{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark5 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark5 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark5 .error-icon{fill:#a44141;}#gdark5 .error-text{fill:#ddd;stroke:#ddd;}#gdark5 .edge-thickness-normal{stroke-width:1px;}#gdark5 .edge-thickness-thick{stroke-width:3.5px;}#gdark5 .edge-pattern-solid{stroke-dasharray:0;}#gdark5 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark5 .edge-pattern-dashed{stroke-dasharray:3;}#gdark5 .edge-pattern-dotted{stroke-dasharray:2;}#gdark5 .marker{fill:lightgrey;stroke:lightgrey;}#gdark5 .marker.cross{stroke:lightgrey;}#gdark5 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark5 p{margin:0;}#gdark5 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark5 .cluster-label text{fill:#F9FFFE;}#gdark5 .cluster-label span{color:#F9FFFE;}#gdark5 .cluster-label span p{background-color:transparent;}#gdark5 .label text,#gdark5 span{fill:#ccc;color:#ccc;}#gdark5 .node rect,#gdark5 .node circle,#gdark5 .node ellipse,#gdark5 .node polygon,#gdark5 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark5 .rough-node .label text,#gdark5 .node .label text,#gdark5 .image-shape .label,#gdark5 .icon-shape .label{text-anchor:middle;}#gdark5 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark5 .rough-node .label,#gdark5 .node .label,#gdark5 .image-shape .label,#gdark5 .icon-shape .label{text-align:center;}#gdark5 .node.clickable{cursor:pointer;}#gdark5 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark5 .arrowheadPath{fill:lightgrey;}#gdark5 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark5 .d5-flowchart-link{stroke:lightgrey;fill:none;}#gdark5 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark5 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark5 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark5 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark5 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark5 .cluster text{fill:#F9FFFE;}#gdark5 .cluster span{color:#F9FFFE;}#gdark5 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark5 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark5 rect.text{fill:none;stroke-width:0;}#gdark5 .icon-shape,#gdark5 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark5 .icon-shape p,#gdark5 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark5 .icon-shape .label rect,#gdark5 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark5 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark5 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark5 .node .neo-node{stroke:#ccc;}#gdark5 [data-look="neo"].node rect,#gdark5 [data-look="neo"].cluster rect,#gdark5 [data-look="neo"].node polygon{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark5 [data-look="neo"].node path{stroke:url(#gdark5-gradient);stroke-width:1px;}#gdark5 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark5 [data-look="neo"].node circle{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark5 [data-look="neo"].icon-shape .icon{fill:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark5_d5-flowchart-v2-pointEnd" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointStart" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointEnd-margin" class="marker d5-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointStart-margin" class="marker d5-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark5_d5-flowchart-v2-circleEnd" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleStart" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleEnd-margin" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleStart-margin" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-crossEnd" class="marker cross d5-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossStart" class="marker cross d5-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossEnd-margin" class="marker cross d5-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossStart-margin" class="marker cross d5-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M184.742,113L196.892,105.833C209.042,98.667,233.341,84.333,250.945,77.167C268.549,70,279.458,70,284.913,70L290.367,70" id="gdark5-L_U_T_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_U_T_0" data-points="W3sieCI6MTg0Ljc0MjE4NzUsInkiOjExM30seyJ4IjoyNTcuNjQwNjI1LCJ5Ijo3MH0seyJ4IjoyOTQuMzY3MTg3NSwieSI6NzB9XQ==" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path><path d="M184.742,189L196.892,196.167C209.042,203.333,233.341,217.667,248.991,224.833C264.641,232,271.641,232,275.141,232L278.641,232" id="gdark5-L_U_A_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_U_A_0" data-points="W3sieCI6MTg0Ljc0MjE4NzUsInkiOjE4OX0seyJ4IjoyNTcuNjQwNjI1LCJ5IjoyMzJ9LHsieCI6MjgyLjY0MDYyNSwieSI6MjMyfV0=" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_U_T_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_U_A_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark5-d5-flowchart-U-0" data-look="classic" transform="translate(120.3203125, 151)"><rect class="basic label-container" style="" x="-112.3203125" y="-38" width="224.640625" height="76"></rect><g class="label" style="" transform="translate(-84.3203125, -24)"><rect></rect><foreignObject width="168.640625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Orca isn't sure whether<br/>your program survived</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-T-1" data-look="classic" transform="translate(410.625, 70)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-116.2578125" y="-62" width="232.515625" height="124"></rect><g class="label" style="color:#fff !important" transform="translate(-88.2578125, -48)"><rect></rect><foreignObject width="176.515625" height="96"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>TODAY<br/>quietly starts a new one.<br/>you may not notice until<br/>there are two agents.</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-A-3" data-look="classic" transform="translate(410.625, 232)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-127.984375" y="-50" width="255.96875" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-99.984375, -36)"><rect></rect><foreignObject width="199.96875" height="72"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>AFTER<br/>pane shows 'disconnected'<br/>[ try again ] [ new terminal ]</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark5-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark5-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark5-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault5" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 546.609375 290" role="graphics-document document" aria-roledescription="l5-flowchart-v2"><style>#gdefault5{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault5 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault5 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault5 .error-icon{fill:#552222;}#gdefault5 .error-text{fill:#552222;stroke:#552222;}#gdefault5 .edge-thickness-normal{stroke-width:1px;}#gdefault5 .edge-thickness-thick{stroke-width:3.5px;}#gdefault5 .edge-pattern-solid{stroke-dasharray:0;}#gdefault5 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault5 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault5 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault5 .marker{fill:#333333;stroke:#333333;}#gdefault5 .marker.cross{stroke:#333333;}#gdefault5 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault5 p{margin:0;}#gdefault5 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault5 .cluster-label text{fill:#333;}#gdefault5 .cluster-label span{color:#333;}#gdefault5 .cluster-label span p{background-color:transparent;}#gdefault5 .label text,#gdefault5 span{fill:#333;color:#333;}#gdefault5 .node rect,#gdefault5 .node circle,#gdefault5 .node ellipse,#gdefault5 .node polygon,#gdefault5 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault5 .rough-node .label text,#gdefault5 .node .label text,#gdefault5 .image-shape .label,#gdefault5 .icon-shape .label{text-anchor:middle;}#gdefault5 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault5 .rough-node .label,#gdefault5 .node .label,#gdefault5 .image-shape .label,#gdefault5 .icon-shape .label{text-align:center;}#gdefault5 .node.clickable{cursor:pointer;}#gdefault5 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault5 .arrowheadPath{fill:#333333;}#gdefault5 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault5 .l5-flowchart-link{stroke:#333333;fill:none;}#gdefault5 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault5 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault5 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault5 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault5 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault5 .cluster text{fill:#333;}#gdefault5 .cluster span{color:#333;}#gdefault5 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault5 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault5 rect.text{fill:none;stroke-width:0;}#gdefault5 .icon-shape,#gdefault5 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault5 .icon-shape p,#gdefault5 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault5 .icon-shape .label rect,#gdefault5 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault5 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault5 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault5 .node .neo-node{stroke:#9370DB;}#gdefault5 [data-look="neo"].node rect,#gdefault5 [data-look="neo"].cluster rect,#gdefault5 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault5 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault5 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault5 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault5 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault5_l5-flowchart-v2-pointEnd" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointStart" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointEnd-margin" class="marker l5-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointStart-margin" class="marker l5-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault5_l5-flowchart-v2-circleEnd" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleStart" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleEnd-margin" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleStart-margin" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-crossEnd" class="marker cross l5-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossStart" class="marker cross l5-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossEnd-margin" class="marker cross l5-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossStart-margin" class="marker cross l5-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M184.742,113L196.892,105.833C209.042,98.667,233.341,84.333,250.945,77.167C268.549,70,279.458,70,284.913,70L290.367,70" id="gdefault5-L_U_T_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_U_T_0" data-points="W3sieCI6MTg0Ljc0MjE4NzUsInkiOjExM30seyJ4IjoyNTcuNjQwNjI1LCJ5Ijo3MH0seyJ4IjoyOTQuMzY3MTg3NSwieSI6NzB9XQ==" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path><path d="M184.742,189L196.892,196.167C209.042,203.333,233.341,217.667,248.991,224.833C264.641,232,271.641,232,275.141,232L278.641,232" id="gdefault5-L_U_A_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_U_A_0" data-points="W3sieCI6MTg0Ljc0MjE4NzUsInkiOjE4OX0seyJ4IjoyNTcuNjQwNjI1LCJ5IjoyMzJ9LHsieCI6MjgyLjY0MDYyNSwieSI6MjMyfV0=" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_U_T_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_U_A_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault5-l5-flowchart-U-0" data-look="classic" transform="translate(120.3203125, 151)"><rect class="basic label-container" style="" x="-112.3203125" y="-38" width="224.640625" height="76"></rect><g class="label" style="" transform="translate(-84.3203125, -24)"><rect></rect><foreignObject width="168.640625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Orca isn't sure whether<br/>your program survived</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-T-1" data-look="classic" transform="translate(410.625, 70)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-116.2578125" y="-62" width="232.515625" height="124"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-88.2578125, -48)"><rect></rect><foreignObject width="176.515625" height="96"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>TODAY<br/>quietly starts a new one.<br/>you may not notice until<br/>there are two agents.</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-A-3" data-look="classic" transform="translate(410.625, 232)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-127.984375" y="-50" width="255.96875" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-99.984375, -36)"><rect></rect><foreignObject width="199.96875" height="72"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>AFTER<br/>pane shows 'disconnected'<br/>[ try again ] [ new terminal ]</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault5-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault5-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+
+      <div class="callout warn">
+        <span class="k">This is the decision I need from you</span>
+        <p>Today, uncertainty gets resolved <em>silently and wrongly</em>. After this, uncertainty becomes <em>visible</em> — a disconnected pane with two buttons.</p>
+        <p>Slightly more friction in a rare case, in exchange for never resuming your agent twice. I think it's clearly right, but it changes what people see, so it's your call.</p>
+      </div>
+
+      <div class="step">Plan</div>
+      <h2>The order we'd build it</h2>
+      <p class="lede">Six steps. Each ships on its own and can be undone on its own.</p>
+      <table>
+        <thead><tr><th></th><th>Step</th><th>What it does</th></tr></thead>
+        <tbody>
+          <tr><td>1</td><td>Stop the tab comparison killing live terminals</td><td>Fixes the double-agent bug. Small, self-contained, helps immediately.</td></tr>
+          <tr><td>2</td><td>Stop faking "the program exited"</td><td>Today a failed reconnect tells the pane the program exited — a claim we can't back up. Ships with the two-button UI.</td></tr>
+          <tr><td>3</td><td>Write the notes in one place</td><td>They go to two different places today, which makes the cleanup silently do nothing. <strong>This is the actual cause of 2 → 19.</strong></td></tr>
+          <tr><td>4</td><td>One piece of code writes the notes</td><td>Two paths write them and a third forgets to — which is why an existing safety check never runs during reconnect.</td></tr>
+          <tr><td>5</td><td>Check whether an old recovery path ever runs</td><td>Two reviewers believe it's unreachable. Measure before building on it.</td></tr>
+          <tr><td>6</td><td>The proof rule</td><td>Only if step 5 shows it's needed.</td></tr>
+        </tbody>
+      </table>
+
+      <div class="glossary">
+        <h3>The five words I couldn't avoid</h3>
+        <table>
+          <tbody>
+            <tr><td><strong>Pane</strong></td><td>One terminal box on your screen.</td></tr>
+            <tr><td><strong>Program</strong></td><td>The shell or agent actually running — often on another machine.</td></tr>
+            <tr><td><strong>Note</strong></td><td>Orca's record that a pane goes with a program. Saved to disk, so it survives a restart.</td></tr>
+            <tr><td><strong>Helper</strong></td><td>The small program Orca installs on a remote machine to run terminals there.</td></tr>
+            <tr><td><strong>Orphan</strong></td><td>A program still running that no pane claims. We list them; we never close them for you.</td></tr>
+          </tbody>
+        </table>
+      </div>
+
+      <div class="callout good">
+        <span class="k">Why this is smaller, not bigger</span>
+        <p>It removes roughly <strong>900–1,250 lines</strong> and adds roughly <strong>450–700</strong>. Most of what goes away exists only to patch up disagreements between notes filed different ways. Once there's one note per pane, that code has nothing left to do.</p>
+      </div>
+
+      <div class="foot">
+        The detailed versions: <code>counsel-design.html</code> — how this was reviewed and what it cost.
+        <code>report.html</code> — evidence for the work already written.
+        Click any diagram to zoom · scroll to scale · drag to pan.
+      </div>
+    </div>
+
+    <div id="ov"><span class="x">×</span><div class="inner"></div><div class="hint">scroll to zoom · drag to pan · Esc to close</div></div>
+
+    <script>
+      const ov = document.getElementById('ov')
+      const inner = ov.querySelector('.inner')
+      let scale = 1, tx = 0, ty = 0, dragging = false, sx = 0, sy = 0
+      function apply() { inner.style.transform = `translate(${tx}px, ${ty}px) scale(${scale})` }
+      function open(svgHtml) {
+        inner.innerHTML = svgHtml
+        const svg = inner.querySelector('svg')
+        if (svg) { svg.style.maxWidth = 'none'; svg.removeAttribute('width'); svg.removeAttribute('height')
+          svg.style.width = Math.min(window.innerWidth * 0.9, 1500) + 'px' }
+        scale = 1; tx = 0; ty = 0; apply()
+        ov.classList.add('on')
+        const b = inner.getBoundingClientRect()
+        tx = Math.max(16, (window.innerWidth - b.width) / 2)
+        ty = Math.max(16, (window.innerHeight - b.height) / 2)
+        apply()
+      }
+      function close() { ov.classList.remove('on'); inner.innerHTML = '' }
+      document.addEventListener('click', (e) => {
+        const fig = e.target.closest('figure')
+        if (fig && !ov.classList.contains('on')) {
+          const svg = [...fig.querySelectorAll('.dia > div')].find((d) => d.offsetParent !== null)
+          if (svg) open(svg.innerHTML)
+        }
+      })
+      ov.querySelector('.x').addEventListener('click', (e) => { e.stopPropagation(); close() })
+      document.addEventListener('keydown', (e) => { if (e.key === 'Escape') close() })
+      ov.addEventListener('wheel', (e) => {
+        e.preventDefault()
+        const f = e.deltaY < 0 ? 1.12 : 1 / 1.12
+        tx = e.clientX - (e.clientX - tx) * f; ty = e.clientY - (e.clientY - ty) * f; scale *= f; apply()
+      }, { passive: false })
+      ov.addEventListener('mousedown', (e) => { dragging = true; sx = e.clientX - tx; sy = e.clientY - ty; ov.style.cursor = 'grabbing' })
+      window.addEventListener('mousemove', (e) => { if (!dragging) return; tx = e.clientX - sx; ty = e.clientY - sy; apply() })
+      window.addEventListener('mouseup', () => { dragging = false; ov.style.cursor = 'grab' })
+    </script>
+  </body>
+</html>
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-final-detail.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-final-detail.md
new file mode 100644
index 00000000000..d6b474c93a8
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-final-detail.md
@@ -0,0 +1,256 @@
+FINAL DESIGN — one leaf-keyed ownership record; pane identity deleted from the attach path; death proved only by the relay process that spawned the shell
+
+=====================================================================
+D0. SCOPE AND THE ONE RULE EVERYTHING FOLLOWS FROM
+=====================================================================
+Problem (from the brief): SSH reconnect grows pane cardinality (2 -> 19 -> 20, STA-3077); a coding agent gets resumed twice into one transcript (RC2); one PTY's failure can drop a whole host connection (RC3, out of scope — Plane 1).
+
+One rule, applied without exception:
+
+Ownership ("which shell does this pane own?") is DURABLE, CLIENT-LOCAL, and read
+synchronously from disk while offline. Evidence about a shell's FATE is
+NON-DURABLE, HOST-LOCAL, and must be REPORTED by the host, never INFERRED by the
+client from timing, from the absence of an entry, or from the shape of an error
+string.
+
+Every defect found across three review rounds is one violation of the second clause. The design's job is to remove all of them, not to add an authority layer.
+
+SCOPE DECLARATION (grok, low): the record is host-agnostic (`hostId` is a field). The _death rule_'s row 2 is relay-specific. Local and daemon panes reach `terminated` only through row 1 (an exit observed in-process, which is how they already work) and never through row 2. That is stated rather than left implicit.
+
+=====================================================================
+D1. THE DURABLE RECORD
+=====================================================================
+
+```ts
+/** Main-owned. TOP-LEVEL in PersistedState — never inside WorkspaceSessionState. */
+type PaneShellOwnership = {
+  leafId: string // PRIMARY KEY. Terminal-layout leaf UUID.
+  hostId: ExecutionHostId // FIELD: 'local' | 'ssh:<target>' | 'runtime:<id>'
+  worktreeId: string // FIELD. Opaque FULL string incl. any `::workspace:<uuid>` suffix.
+  ptyId: string // RELAY-NATIVE form for SSH (toRelaySshPtyId). One namespace, always.
+  incarnationId: string // REQUIRED. Relay mints one per pty (relay/pty-handler.ts:1525).
+  relayInstanceId?: string // The relay PROCESS that owned it, as reported at bind time.
+  state: 'attached' | 'detached' | 'terminated'
+  createdAt: number
+  updatedAt: number
+  lastAttachedAt?: number
+  lastDetachedAt?: number
+}
+// Storage: PersistedState.paneShellOwnershipByLeafId: Record<string, PaneShellOwnership>
+```
+
+Note what is NOT here: no `tabId`, no `paneKey`, no `hostEpoch`, no `resumed`, no second (pty-keyed) record.
+
+WHY `leafId` AND NOT `paneKey`. `makePaneKey(tabId, leafId)` returns `${tabId}:${leafId}` and the repo states at src/shared/stable-pane-id.ts:47-49 that "only the leaf UUID is remint-stable pane identity (the tab half changes on pane break-out)" — which is why `isEquivalentPaneKey` exists at :50-57. The mutation is a shipping gesture: `detachTerminalPaneToTab` (src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts:245-310) moves a LIVE pane and its ptyId into a new tab via `createTab(..., initialPtyId)` while explicitly not killing the PTY (:275-276). `leafId` is a UUID and is never remapped once it is one (src/main/persistence.ts:1858-1872 skips ids already passing `isTerminalLeafId`). Keying by the leaf deletes the transfer problem instead of managing it.
+
+WHY NO `tabId` AT ALL (this is the round-3 change). A stored tabId is either frozen (and then it names a tab the leaf no longer lives in) or updated (and then it desynchronizes from the relay's frozen copy). Both are live production failures — see D2. The tab is LOCATION, derived from the live layout at the moment it is needed; it is never stored and never trusted.
+
+WHY TOP-LEVEL. `session:set` / `session:set-sync` (src/main/ipc/session.ts:13, :31) accept a whole `WorkspaceSessionState` from a renderer with no revision or fencing token; the clobber guards at src/main/persistence.ts:6379, :6384-6476 exist only because of that. `sshRemotePtyLeases` is already top-level. The KEY is shared with the layout; the STORAGE LOCATION is not.
+
+UNIQUENESS. At most one non-terminal record may name a given `(hostId, ptyId, incarnationId)`, enforced on write through a reverse index. Not ptyId alone: leases store the relay-native id (`getRelayPtyIdForSshLeaseStorage` -> `toRelaySshPtyId` strips the connection scope, src/main/persistence.ts:6641-6643, src/shared/ssh-pty-id.ts:58-67) and relay ids are `pty-${this.nextId++}` with `nextId = 1` per relay PROCESS (src/relay/pty-handler.ts:356-357, :1440-1443), so `pty-1` recurs on every host after every relay restart. Round 1's rejection ("a cross-target collision on ptyId is impossible") is withdrawn; it is guaranteed, not impossible.
+
+=====================================================================
+D2. DELETE PANE IDENTITY FROM THE ATTACH PATH (the largest round-3 change)
+=====================================================================
+Both reviewers independently attacked the attach-time identity comparison. Verified, and it is worse than either stated: the apparatus is simultaneously over-strict and under-strict, and it is a live duplicate-agent bug today.
+
+VERIFIED FACTS
+
+- The relay compares frozen strings: `attachIdentityMismatches` (src/relay/pty-handler.ts:334-339) does full-string `expected.paneKey !== managed.paneKey || expected.tabId !== managed.tabId`; `attachIdentity` is captured once at spawn from `ORCA_PANE_KEY`/`ORCA_TAB_ID` (:1512-1517, :1446). On mismatch it throws `PTY "<id>" not found (identity mismatch)` (:1616-1626).
+- `isSshPtyNotFoundError` is a message regex `/PTY ".+" not found/i` (src/main/providers/ssh-pty-errors.ts:12-15), so it is TRUE for the mismatch string. `reattachSshPtySession` re-emits it as `SSH_SESSION_EXPIRED: <id> SSH_PTY_IDENTITY_MISMATCH` (src/main/providers/ssh-pty-session-reattach.ts:218-226).
+- The renderer's `isProvenSshSessionGoneError` returns TRUE for anything containing `SSH_SESSION_EXPIRED` and for the raw not-found regex, and IGNORES the mismatch marker (src/renderer/src/components/terminal-pane/reattach-failure-classification.ts:24-30). Its two call sites then clear the binding and call `startFreshColdRestoreAgentResume` (pty-connection.ts:8839-8847, :9086-9097) — a second shell and a SECOND AGENT RESUME while the original shell keeps running. That is RC2, on a live process, reachable from a shipped gesture.
+- The spawn-path reattach builds the expected identity from the CURRENT options (`args.options.paneKey ?? env.ORCA_PANE_KEY`, ssh-pty-session-reattach.ts:66-68), i.e. the current tab — so after a detach it mismatches. The connect-path reattach builds it from the lease's stored tabId (`expectedIdentityForLease`, src/main/ssh/ssh-relay-session.ts:190-210, consumed at :2201-2210), which is never re-keyed on detach — so it matches, attach succeeds, and then `persistPtyBinding(tabId = old tab, mayCreate:false)` refuses because the leaf is no longer in that tab's layout (src/main/persistence.ts:6821-6877 sets `terminalMembershipChanged` and returns false), leaving the shell running unbound (ssh-relay-session.ts:2513-2521). Grok's "scissors" is confirmed on both blades.
+- The apparatus does not even do its own stated job ("generation resets can reuse PTY IDs; reject conflicting identities", pty-handler.ts:1615): after a relay restart that recycles `pty-3` for the SAME pane, paneKey and tabId both match and a different shell is accepted.
+
+RESOLUTION — delete the comparison; do not replace it with another comparison.
+
+1. Relay: delete `attachIdentity`, `attachIdentityMismatches`, the `params.expectedPaneKey`/`expectedTabId` handling and the `(identity mismatch)` throw. `ManagedPty.paneKey`/`tabId` STAY — they are documented as separate from attach identity (pty-handler.ts:139-143) and are used by the exit listener (:765) and, newly, by listProcesses reporting (D4). paneKey stops being an authorization INPUT and becomes a reported HINT.
+2. Main: delete `ExpectedPtyIdentity`, `expectedIdentityForLease`, `expectedIdentityByPtyId`, the `expectedIdentity` parameter threaded through `attachPtyWithRetry`, `isSshPtyIdentityMismatchError`, `SSH_PTY_IDENTITY_MISMATCH_ERROR`, the marker append, and the mismatch branch at ssh-relay-session.ts:2628-2634.
+3. Renderer: `isProvenSshSessionGoneError` keeps only proofs. (After step 1/2 the mismatch string ceases to exist; the renderer fix ships FIRST and independently, because it must protect users running against relays that have not been redeployed.)
+4. Recycled-id rejection moves to two places that already hold exact data:
+   (a) PROCESS GATE, once per connection: if the owner grant reports a `relayInstanceId` different from the one recorded on a record, that record's ptyId is not attachable at all. One comparison covers every pty on the host. Within a single relay process ids never recycle (`nextId` is monotonic), so this is complete against new relays.
+   (b) PER-ATTACH GUARD, zero wire change: EVERY `pty.attach` success path already returns `incarnationId` (src/relay/pty-handler.ts:1646, :1653, :1668, :1676), and the client already parses and remembers it (`requestSshPtyAttach` -> `rememberPtyIncarnation`, ssh-pty-session-reattach.ts:74-100). Compare it to `record.incarnationId`; on mismatch, throw — the existing `activationLease.rollback()` already runs on a thrown error — and classify `detached`, never death. `RecentPtyOutputBuffer.read()` is explicitly non-mutating (src/main/runtime/recent-pty-output-buffer.ts:75-85), so abandoning a wrongly-attached shell does not consume its replay.
+   This is strictly stronger than the frozen-string check (a per-pty UUID vs a pane label), needs NO new request field, and works against OLD relays — which a new `expectedIncarnationId` request parameter would not.
+5. The reattach BIND resolves the tab from the live layout: find the tabId whose `terminalLayoutsByTabId[*].root` contains this `leafId`. If no layout contains it, refuse exactly as today (leave the shell running unbound, "no durable pane owns this"). `mayCreate:false`'s guarantee is preserved; its dependence on a stored tabId is deleted.
+
+ONE IDENTITY RULE, EVERYWHERE: the leaf is identity; the tab is derived location; the incarnation is shell identity; the relay instance is process identity. There is no fourth.
+
+=====================================================================
+D3. THE DEATH RULE — two rows, one new field
+=====================================================================
+`resumed` and `hostEpoch` are deleted and must not be built.
+
+- `resumed: replaces !== null` (src/shared/pty-consumer-session.ts:275); `expireOwner()` nulls the incumbent after `PTY_CONSUMER_OWNER_GRACE_MS = 30_000` (:281-287, contract :2), after which admission takes `if (!current) return this.newOwner(...)` (:215-216) and `resumed` is false regardless of proof. Unreachable for quit, sleep, overnight, reboot — the normal case. Its own contract comment says it means "the client's checkpoints for the previous claim no longer apply" (pty-consumer-session-contract.ts:49-52): a delivery-checkpoint flag, not liveness.
+- `hostEpoch = Date.now() - os.uptime()*1000` under exact equality is a reconstructed estimate; second-granularity uptime, NTP steps and suspend/resume make it differ on an unrebooted host, and "differs" was the grant-YES row — it fails OPEN toward respawn. Repo precedent settles it: `readCurrentDaemonReadyIdentity` reads `/proc/sys/kernel/random/boot_id` on Linux only and returns bare `{ startedAtMs }` elsewhere (src/main/daemon/daemon-ready-identity.ts:11-13).
+
+THE ONE NEW GRANT FIELD: `relayInstanceId?: string` on `PtyConsumerSessionGrant` (src/shared/pty-consumer-session-contract.ts:43-59) — a `randomUUID()` minted once at relay process start (`randomUUID` is already imported at relay/pty-handler.ts:6). It is genuinely new information: the grant's existing `serverBuildId` is `launchVersion` (src/relay/relay.ts:694-696), a build string that is identical across restarts of the same build.
+
+| Condition                                                                          | Transition   | Respawn grant        |
+| ---------------------------------------------------------------------------------- | ------------ | -------------------- |
+| PTY exit observed on a live attached stream                                        | `terminated` | yes                  |
+| attach returns not-found AND the grant's `relayInstanceId` EQUALS the recorded one | `terminated` | yes (subject to E-1) |
+| attach returns an incarnation different from the recorded one                      | `detached`   | no                   |
+| `relayInstanceId` absent on either side, or differing                              | `detached`   | no                   |
+| any other error (today's `restoreRequired` path, ssh-relay-session.ts:2612-2620)   | `detached`   | no                   |
+
+Row 2 is sound and UNBOUNDED IN TIME: `this.ptys` is the relay process's only store (pty-handler.ts:356) and entries are deleted on exit, so "the same process that minted this pty no longer has it" means it exited. It is sound on Windows too, because the relay OBSERVED the exit — unlike any rule that reasons from a relay restart. A restarted relay reports a different id and we correctly claim no knowledge.
+
+SHIP GATE (grok H4): row 2 grants a respawn on a not-found detected by a message regex. One shared normalization helper (`toRelaySshPtyId`) must be applied on every attach / mark / record / comparison path, and the record stores exactly one namespace (D1), so a namespace mismatch cannot manufacture a false not-found. Row-2 grant-yes does not ship until E-1 is green.
+
+STOP FABRICATING THE EXIT. `handlePtyReattachFailure` currently sends `pty:exit { code: -1 }` (ssh-relay-session.ts:2643-2647) plus `clearProviderPtyState` + `deletePtyOwnership` + `markSshRemotePtyLease('expired')` on a plain not-found. On every `detached` row this is a lie about a process the client knows nothing about. Remove the whole block and route the unknown case into the branch that ALREADY EXISTS three lines above it: `pending.restoreRequired = 'reattachAttemptsExhausted'` + `wakeRecovery` (:2612-2620), which is non-destructive by construction. This is a branch COLLAPSE, not a new signal — which is also the answer to the objection that removing only the send turns a wrong signal into no signal.
+
+=====================================================================
+D4. ORPHANS — a connect-time projection, never an authority
+=====================================================================
+
+```
+orphans(host) = successful listProcesses(host)
+                MINUS { (ptyId, incarnationId) named by a non-terminal record on this host }
+```
+
+Computed at connect/reattach, held in memory for the connection's life, discarded on disconnect. No durability, no migration, no rollback.
+
+WHAT `listProcesses` IS: it iterates only `this.ptys` (pty-handler.ts:1894-1911) — the current relay process's Map. No durability, no OS scan. It is therefore (i) the cleanup-UI source and (ii) a SUPPLEMENT to the reattach work list, never the sole discovery authority. The work list stays `getPtyIdsForConnection(target) UNION` the non-terminal records (today's `leasedPtyIds` shape, ssh-relay-session.ts:2211-2219).
+
+ABSENCE IS NEVER AUTHORITATIVE. The repo already adjudicated this with an issue number: `pty:listSessions` documents "Absence is authoritative only from a provider that serializes claims — otherwise it is 'unknown', never 'absent' (#8459)" (src/main/ipc/pty.ts:7343-7347), and `SshPtyProvider.hasPty` returns `null` before a completed listing "a miss there is ignorance about the host, not a dead PTY" (src/main/providers/ssh-pty-provider.ts:308-312). The only aggregating caller launders every remote failure with `provider.listProcesses().catch(() => [])` (ipc/pty.ts:7333), and `PtyProcessListAdmission.admit` throws on capacity and on `agent_session_ownership_unknown` (src/main/providers/pty-process-list-admission.ts:60-99). So: a rejected or truncated listing yields orphans = UNKNOWN (empty UI, no claims, no retirement), never orphans = everything.
+
+THE ONE NEW RESPONSE FIELD: `PtyProcessSummary` gains optional `paneKey`. The relay already holds it (`ManagedPty.paneKey`, pty-handler.ts:1446, :139-140) and omits it from the summary (:1899-1908). Additive optional response field — safe under docs/reference/remote-wire-compatibility.md, no opcode, no negotiation. It does NOT reach the client for free: `PtyProcessInfo` has no `paneKey` (src/main/providers/pty-process-info.ts:4-16) and `admit` REBUILDS an allowlist (pty-process-list-admission.ts:106-115). Three edits — relay summary, `PtyProcessInfo`, allowlist — and the oracle asserts survival THROUGH `admit`. `incarnationId` and `worktreeId` already traverse that whole chain, which is what makes the incarnation-scoped subtraction free.
+
+ADOPTION matches `parsePaneKey(reported.paneKey)?.leafId` — never the full string, because the relay's copy is frozen at spawn and names a tab the leaf may have left. Because the record is leaf-keyed this is a direct lookup, not fuzzy equivalence; `isEquivalentPaneKey` is not imported here. Adopt is a CAS: write `leafId -> (ptyId, incarnationId)` only if no non-terminal record exists for that leaf AND none on this host names that `(ptyId, incarnationId)`. Exactly one of two concurrent adopts wins; the loser gets a typed refusal.
+
+KILL POLICY (replaces the "owned elsewhere" classification, which is DELETED). Both reviewers attacked `worktreeId`-based classification from opposite directions and both are right, because `worktreeId = <repoId>::<path>` and `repoId` is a client-local `randomUUID()` minted at repo add (src/shared/worktree-id.ts:15-28; src/main/runtime/orca-runtime.ts:18729). So "unknown worktreeId" means "not in this install's current state file": it wrongly EXEMPTS the user's own shells after a repo re-add, profile transfer or state reset, and it wrongly INCLUDES another device's shells whenever the two installs share state. One rule replaces it: the orphan list never auto-kills, never bulk-kills, and never kills as a side effect of any reattach or cleanup pass. Kill is an explicit per-shell user action, with cwd, title, worktreeId and reported paneKey shown. No classifier, no new field, and it is safe in both directions.
+
+OLD-RELAY DEGRADATION: a relay that omits `paneKey` yields unclassified orphans that are listed and never killed — exactly today's behavior.
+
+=====================================================================
+D5. RECORD LIFETIME — three exits, none of them "absent from a list"
+=====================================================================
+
+1. RETIRE (delete). The record reached `terminated` (row 1 or row 2 of D3, or explicit user close via `retireExitedPty`, ssh-relay-session.ts:2153-2172). Terminal records are garbage-collected after a bounded retention (long enough to serve any surviving grant window) so they cannot mask a recycled `pty-1`. There is NO retire-on-absence clause: the case it was written for (shell exited during a disconnect, relay still up) is already covered by row 2 — the attach itself proves the exit — so deleting the clause costs nothing and removes a direct contradiction with #8459.
+2. RELEASE (keep the shell, drop the claim). Fired ONLY from the explicit pane-close and tab-delete code paths — never from "this publish did not contain the leaf". Detach is not atomic across layouts: `createTab` installs an empty layout, then `setTabLayout(sourceTabId, ...)` removes the leaf, then `setTabLayout(tab.id, ...)` adds it (terminal-pane-tab-detach.ts:298-300), so between the last two no layout contains the leafId, and any `session:set` flush in that window would look like a durable removal. Released records are cleared to a non-claiming state: the shell becomes orphan-eligible (visible, adoptable) and is deliberately NOT `terminated`, so it can never authorize a respawn.
+3. EXPLICIT USER CLOSE -> `terminated`, and the record dies with the shell.
+
+RESIDUAL, STATED HONESTLY: a shell that died while the relay ALSO restarted leaves a `detached` record with no proof available. It stays restorable until the user acts. That is the conservative direction and it is bounded by the affordance below, not by a timer.
+
+PRODUCT AFFORDANCE, REQUIRED IN THE SAME PR. A `detached` pane renders as disconnected with two explicit actions — "reattach (retry)" and "start a new shell" (the latter retires the record). Nothing infers death, nothing auto-spawns. Per AGENTS.md this must follow docs/STYLEGUIDE.md. COPY CONSTRAINT: the UI must never assert that a shell is dead. The claim "after a relay crash the shells are almost certainly dead" is REMOVED from this design: it rests on POSIX master-fd close SIGHUPing the foreground group, and on Windows the relay is deliberately launched through WMI because "Windows sshd kills the exec channel's process tree on close" (src/main/ssh/ssh-relay-deploy.ts:1805), with ConPTY and no SIGHUP. No rule in this design concludes anything from a relay restart, so the design is correct either way; only the copy had to change.
+
+=====================================================================
+D6. HISTORICAL — one partition per (target, pane). SUPERSEDED.
+=====================================================================
+This migration proposal was rejected. The shipped containment keeps the existing persistence
+planes and gives the pane binding one local home; see [S4](./new-design-goalposts.md#s4--one-partition-per-target-pane--proven).
+
+SSH pane bindings live in two partitions today. Readers and writers that consult ONLY `ssh:<target>`: `resolvePersistedStablePaneOwner` (src/main/ipc/pty.ts:676-677), `retirePersistedStablePaneOwner` (:760-761, :783), the CAS write `persistPtyBinding(..., expectedBinding)` (:833), and the two spawn upserts (:5108, :6493). Against that, the relay reattach write has no hostId (ssh-relay-session.ts:2500-2511 -> `resolveHostId(undefined)` -> `LOCAL_EXECUTION_HOST_ID`, persistence.ts:6243-6246) and the renderer keeps SSH worktrees in `local` deliberately (workspace-session-host-persistence.ts:167-173). `durablyBoundPtyIdForPane` hedges ssh-first-then-local (persistence.ts:7269-7277), so `supersedeSiblingLeasesForPane` early-returns when the bound pty differs (:7229-7232) — supersession silently no-ops and both leases stay live. That is the STA-3077 mechanism itself.
+
+FIX: one accessor `sessionForSshPaneBindings(connectionId): WorkspaceSessionState` returning the `local` partition, routed through by EVERY reader and EVERY writer above, flipped in a single atomic PR — not five write-site edits. `local` wins because the only publisher of pane membership writes there and `mayCreate:false` is evaluated there. A one-time fold moves `ssh:<target>.terminalLayoutsByTabId[*].ptyIdsByLeafId` and `tabsByWorktree[*].ptyId` into `local`, preferring `local` on conflict; the loser is NOT demoted to orphan-candidate by ptyId alone (recycled ids collide) — it carries `incarnationId` or is dropped.
+
+=====================================================================
+D7. HISTORICAL — one bind producer. RESOLVED.
+=====================================================================
+The shared `bindPaneShell` producer now serves relay reattach and both spawn handlers; see
+[S5](./new-design-goalposts.md#s5--the-superseded-pane-fence-is-live-on-the-reattach-path--proven).
+
+`rememberPaneKeyForPty` (ipc/pty.ts:517-525) has two callers, both spawn (:5222, :6668). `restoreReattachedPtyRuntime` calls `runtime.registerPty` instead (ssh-relay-session.ts:2523), and `isSupersededPtyId` returns `false` for an unrecorded id by design (:284-296) — so the shipped superseded-PTY fence is INERT on the path it was built for. Collapse to one `bindPaneShell({ hostId, worktreeId, leafId, ptyId, incarnationId, relayInstanceId })` that, in one call, (a) resolves the current tab containing the leaf (refusing if none), (b) writes the durable record, (c) writes the in-memory `ptyPaneKey`/`paneKeyPtyId` fence maps using the paneKey composed from the CURRENT tab, (d) calls `registerPty`. All three paths call it and nothing else.
+
+=====================================================================
+D8. COLLAPSE THE RESTORABLE FORK — and the offline/synchronous path
+=====================================================================
+`setLocalWorkspaceSession` forks on whether the INCOMING layout map is empty (persistence.ts:6450-6473): empty -> `isRestorablePtyBinding` (absence of a lease implies restorable, :6620-6631); partial -> `hasRestorableSshRemotePtyLease` (requires a live lease, :6670-6685). They disagree on the absent-record case, so whether a binding survives depends on whether a SIBLING LEAF had one.
+
+One predicate replaces both: RESTORABLE IFF `paneShellOwnershipByLeafId[leafId]` exists with state `attached` or `detached`.
+
+OFFLINE / SYNCHRONOUS ACCESS PATH (refutation B, honored exactly). `setLocalWorkspaceSession` is a synchronous `void` method invoked on every renderer publish including during quit (persistence.ts:6465, :6287, :6351). The loop at :6448-6462 already iterates `priorLayout.ptyIdsByLeafId` and therefore already holds a `leafId`, so the new predicate is a DIRECT map lookup on a top-level, main-owned, in-memory-mirrored disk record: no key composition, no lease-array scan, no `incomingHasAnyBinding` branch, no mux, no RPC, no host. It works with the host down and during quit — which is precisely what refutation B says cannot be replaced by asking the host.
+
+=====================================================================
+D9. THE REATTACH ALGORITHM (SSH, on connect)
+=====================================================================
+
+1. Obtain the consumer owner grant. Read `grant.relayInstanceId` (may be absent — old relay).
+2. Work list = `getPtyIdsForConnection(target)` UNION `{ r.ptyId | r.hostId === 'ssh:'+target and r.state !== 'terminated' }`, every id normalized through `toRelaySshPtyId`.
+3. PROCESS GATE. For each record: if both `grant.relayInstanceId` and `r.relayInstanceId` are present and differ, do not attach by that id. Set `detached`. Its shell, if any, is rediscoverable only through step 5.
+4. For each remaining id, call `pty.attach { id, cols, rows }` — with NO expectedPaneKey and NO expectedTabId.
+   4a. SUCCESS -> if a record exists and `response.incarnationId !== r.incarnationId`, throw (activation lease rolls back), set `detached`, no grant, no exit. Otherwise call `bindPaneShell(...)`: resolve the current tab containing `leafId`; if none, log and leave the shell running unbound (today's refusal, preserved); else write record (`attached`, `relayInstanceId = grant.relayInstanceId`), fence maps, `registerPty`.
+   4b. NOT-FOUND -> if `grant.relayInstanceId` is present and equals `r.relayInstanceId`: `terminated`, retire, grant authorized (gated on E-1). Otherwise: `detached`, no grant, and route into the existing `restoreRequired = 'reattachAttemptsExhausted'` branch. No `pty:exit -1`, no `clearProviderPtyState`, no `deletePtyOwnership`.
+   4c. ANY OTHER ERROR -> `detached` via the same existing branch.
+5. Call `listProcesses` best-effort. If it REJECTS or admission truncates it: orphans = unknown; do nothing. If it RESOLVES: orphans = returned MINUS `(ptyId, incarnationId)` named by non-terminal records on this host. For each orphan with a reported `paneKey`, look up `parsePaneKey(paneKey)?.leafId`; if that leaf exists in the live layout and has no non-terminal record, CAS-adopt it via `bindPaneShell`. The rest are listed in the cleanup UI, never auto-killed.
+
+=====================================================================
+D10. MIGRATION, SEQUENCING, ROLLBACK
+=====================================================================
+ORDER — each its own PR, each independently revertible:
+
+|     | Step                           | Contents                                                                                                                                                                                                                                                          |
+| --- | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| A   | Identity-mismatch is not death | Renderer: `isProvenSshSessionGoneError` stops treating the mismatch marker as proof. Relay+main: delete the whole attach-identity apparatus (D2). Pure bug fix, no design dependency, ships FIRST; the renderer half must ship even before relays are redeployed. |
+| E-0 | Stop lying about exits         | Collapse the plain-not-found branch of `handlePtyReattachFailure` into the existing non-destructive `restoreRequired` branch (D3). Ships with, or immediately followed by, the D5 disconnected-pane affordance.                                                   |
+| P   | Single partition               | D6: one accessor for every reader and writer, plus the fold migration, atomically.                                                                                                                                                                                |
+| F   | Single bind producer           | D7: `bindPaneShell`; makes the shipped fence live on the reattach path; introduces tab-from-layout resolution.                                                                                                                                                    |
+| E-1 | Prove the grant executes       | Production-id-shape oracle for `recoverTerminalPane`; record the actual behavior.                                                                                                                                                                                 |
+| E-2 | Death rule                     | `relayInstanceId` on the grant + the D3 table. Conditional on E-1.                                                                                                                                                                                                |
+| W   | Projection                     | `paneKey` through relay -> `PtyProcessInfo` -> admission allowlist; incarnation-scoped subtraction; explicit-only kill (D4).                                                                                                                                      |
+| K   | Re-key                         | The leaf-keyed record + D8 + D5 lifetime + `reassignSshTargetId` field rewrite + porting all lease readers.                                                                                                                                                       |
+
+E-1 CONTEXT (why E-2 is conditional). The chain `not-found -> expired -> 30s grant -> createTerminal` has one spawn-authorizing caller, `recoverTerminalPane` (src/main/runtime/orca-runtime.ts:16449-16490), gated on `getRecentExpiredSshLease(...)`, whose comparison is raw `lease.ptyId === ptyId` with no normalization (:6310). `lease.ptyId` is relay-native (persistence.ts:7184) while the graph's `pty.ptyId` is app-form `ssh:<conn>@@pty-N` (ssh-relay-session.ts:2523), so for a real SSH pane they can never be equal, and the branch also cannot be reached by a local pane (it requires an SSH lease). The covering test seeds both sides as `'pty-expired'` and registers with a NULL connectionId (orca-runtime.test.ts:1350-1370, :2932-2940) — a shape production cannot produce. Do not build grant-arbitration machinery before E-1 shows the branch executing.
+
+FORWARD MIGRATION AT K, per `SshRemotePtyLease`:
+
+- has `leafId` -> one record. `state`, `createdAt`, `updatedAt` copied VERBATIM (any surviving grace window reads `updatedAt`). `worktreeId` copied as an OPAQUE FULL STRING — the `::workspace:<uuid>` folder-workspace suffix must survive, since matching is full-string equality (persistence.ts:7239, orca-runtime.ts:6308) and issue #12474 was a comparator that stripped exactly that. `ptyId` stays relay-native. `tabId` is DROPPED (D1). `relayInstanceId` absent -> the record falls to `detached` on first reconnect with no ambiguity to resolve. `incarnationId` absent on a legacy row -> treat as adoption-eligible rather than as a subtracting claim, so it cannot mask a recycled id.
+- no `leafId` -> no record; recovered at first reconnect by the leaf-half `paneKey` match, or listed as an orphan.
+- ALSO synthesize a record from any live layout binding (`ptyIdsByLeafId`) whose ptyId has no lease, so a bound-but-unleased pane is not silently demoted.
+- Sequence AFTER the legacy numeric-leaf remap (persistence.ts:1858-1872) so every record keys on a UUID.
+
+PORT EVERY LEASE READER — the "write-only legacy projection" claim was FALSE and is corrected. Verified production readers of `sshRemotePtyLeases` outside persistence.ts:
+
+- `getRecentExpiredSshLease` (orca-runtime.ts:6295-6316) with `ptyId` UNDEFINED, feeding `hasRecentExpiredSshLeasePane` (:6318-6323) -> the headless-mobile terminal-tab filter (:5290-5299 region, the `onlyRuntimeOwnedTerminals` filter) and `hasLiveOrPersistedServeOrSshOwnedPtyBinding` (:6355-6360). These are a live VISIBILITY signal for paired mobile/HUB clients and are NOT killed by the namespace bug, because they pass `ptyId` undefined. Port: "a non-terminal record names this leaf" replaces "an `expired` lease within 30s". Visibility becomes bounded by the D5 lifetime rule instead of a timer; that behavior change is deliberate and must be covered by an oracle.
+- `ssh:terminateSessions` (src/main/ipc/ssh.ts:1282-1300) enumerates leases and distinguishes owned from expired (#2626). This is the EXISTING kill affordance; the D4 orphan UI FEEDS it rather than duplicating it. It is re-expressed over records: non-terminal records plus projection entries, with kill always explicit (D4).
+- `ssh:resetRelay` (ipc/ssh.ts:1370-1385) marks every live lease `expired` after force-killing the relay. Ported to: mark records `detached` (never `terminated` — the client killed the relay, which proves nothing about the shells). BEHAVIOR CHANGE, flagged for the owner: a user-initiated relay reset stops silently re-showing panes for 30s and instead shows the disconnected affordance.
+- `ssh-relay-session.ts:1914, :2197` internal lease reads -> record reads.
+
+CROSS-VERSION READS. Pinned older builds read `sshRemotePtyLeases`. For ONE release the new writer emits a derived legacy projection of the array. It must emit RELAY-NATIVE ptyIds via `toRelaySshPtyId` — leaking app-form ids gives pinned builds leases matching nothing, a silent no-op that looks like a passing test. Because the record already stores the relay-native form, this is a copy, not a conversion. It carries no `tabId`-dependent semantics, so old builds that call `expectedIdentityForLease` simply get `null` and attach without an identity — which, after step A, is the correct behavior anyway.
+
+PARTIAL WRITE / ROLLBACK. Reuse the existing discipline (persistence.ts:7346-7360): snapshot, mutate in memory, `flushOrThrow`, undo on failure. One record, so this is a single-record transaction. Rollback of K: the legacy projection lets an older build boot on new state; the one-way loss is leafId-less rows, which the old build also could not act on.
+
+`reassignSshTargetId` (persistence.ts:7055-7086) today re-keys partitions, rewrites lease `targetId`s and drops recoveries. Because `hostId` is a FIELD and not part of the key, it only rewrites a field in place plus the reverse index; no re-keying.
+
+=====================================================================
+D11. ORACLES — each must redden under a stated mutation
+=====================================================================
+
+1. DETACH-TO-TAB OVER SSH, THROUGH THE REAL RELAY COMPARISON. Bind an SSH pane in tab A leaf L, run `detachTerminalPaneToTab` to tab B, disconnect, reconnect. Assert: exactly one shell on the host, no second agent resume, the pane reattaches and the ptyId lands in tab B's layout. THIS MUST BE RED BEFORE STEP A. If it is green today, the harness stubbed the relay comparison or omitted `ORCA_PANE_KEY`/`ORCA_TAB_ID` from the spawn env, and the whole detach oracle family is measuring nothing. Gate the program on it going red first.
+2. Identity mismatch is not proof of death. Assert `isProvenSshSessionGoneError` is false for the mismatch string, no record reaches `terminated`, no grant. Mutation: restore `.includes(SSH_SESSION_EXPIRED)` as the sole predicate (reattach-failure-classification.ts:29).
+3. Wrong-incarnation attach is abandoned, not adopted and not fatal. Relay returns a different `incarnationId` than recorded: assert no bind, no stream, `detached`, no grant, activation lease rolled back. Mutation: skip the response check.
+4. Same-instance not-found is proof; different or absent is not. Two runs, recorded `relayInstanceId` equal -> `terminated` + grant; differing/absent -> `detached` + no grant. Mutation: flip the comparison.
+5. Failed listing is not an empty listing. Make `listProcesses` reject, and separately make `admit` throw `agent_session_ownership_unknown`: assert zero records retired and zero orphans reported. Mutation: replace the failure with a resolved `[]` — must redden, proving the implementation does not reuse the `.catch(() => [])` shape at ipc/pty.ts:7333.
+6. No fabricated exit on unknown. Drive `handlePtyReattachFailure` with a not-found and a differing `relayInstanceId`: assert `detached`, no grant, no `pty:exit -1`, and that provider state and ownership are NOT cleared. Mutation: restore the block at ssh-relay-session.ts:2641-2647.
+7. Detach mid-publish does not release. Force a `session:set` flush between `setTabLayout(source)` and `setTabLayout(target)`: assert ownership is NOT released. Mutation: release on any publish missing the leaf.
+8. Pane/tab delete releases. Delete a tab while its shell is live: assert the record is released, the shell IS an orphan, and no respawn is authorized. Mutation: remove the release rule — the shell must become invisible to both adopt and the cleanup UI.
+9. Production id shapes in the recovery grant (E-1). Seed relay-native `pty-7`; register the runtime pty as `ssh:<conn>@@pty-7` with a NON-NULL connectionId; call `recoverTerminalPane`; assert the actual behavior. Mutation: swap either namespace.
+10. E-2 false not-found. Same `relayInstanceId`, not-found caused by the wrong id form while the shell is in the Map under the correct id: assert NO `terminated` and NO grant. Mutation: skip `toRelaySshPtyId` on the attach path.
+11. Projection is incarnation-scoped. Record `pty-1@incX`; restart the relay; it mints `pty-1@incY` for a different pane: assert the fresh shell IS an orphan and the stale record does NOT mask it. Mutation: subtract on ptyId alone.
+12. `paneKey` survives `admit`. Mutation: remove it from the allowlist rebuild (pty-process-list-admission.ts:106-115).
+13. Detached shell is still re-adopted. Seed a leafId-less lease whose relay-reported `paneKey` names a DIFFERENT tab than the live pane: assert the shell is attached exactly once and no second shell spawns. Mutation: match on full-string paneKey. This is the migration gate — green before K, re-run after.
+14. Paired-client visibility survives the state rename. Record in `detached`, ptyId absent from every layout: assert `buildHeadlessMobileSessionTerminalTabs` still yields the tab. Mutation: drop the `expired`-equivalent — orca-runtime.ts:5964/:6290/:6322/:6359 must all be covered, not just the dead :16478 caller.
+15. Cleanup UI reaches the user's own abandoned shells. Delete the repo row (new `repoId` on re-add) while shells run: assert they are offered for cleanup. Mutation: reinstate worktreeId-based "owned elsewhere" — must redden.
+16. Nothing is killed implicitly. Any reattach/cleanup pass over foreign or unrecognized shells: assert zero kill RPCs. Mutation: auto-kill unclassified orphans.
+17. One pane, one live shell across partitions. Two live shells for one `(worktree, tab, leaf)` with the binding only in `local`: assert exactly one is bound. Mutation: restore the ssh-first preference in `durablyBoundPtyIdForPane` (persistence.ts:7271).
+18. P covers readers. Seed a binding only in `local`, call stable-pane resolve/retire with `connectionId` set: must find it. Mutation: revert either reader.
+19. Adopt is exclusive. Two concurrent adopts of one orphan: one succeeds, the other gets a typed refusal.
+20. Renderer cannot clobber ownership. Publish a stale full `WorkspaceSessionState` via `session:set`: assert the ownership map is byte-identical.
+21. Offline quit path. Restorable predicate with store only and a null mux: must not throw, must not require an RPC (persistence.ts:6465).
+22. Folder-workspace suffix. Two `::workspace:` instances on one path: a record for A must not reattach into B.
+23. Target reassign carries ownership. `reassignSshTargetId(old, new)`: every record's `hostId` field and the reverse index follow, with no re-keying.
+24. Windows/WSL relay kill. Assert the rules produce `detached`, never `terminated`, and that no UI copy asserts death. Mutation: assert-death — must redden on a Windows fixture even though it would pass on POSIX.
+25. Old-relay degradation. `listProcesses` without `paneKey`, grant without `relayInstanceId`: projection non-empty, nothing killed, reattach falls back to the `getPtyIdsForConnection UNION records` work list, and the per-attach incarnation guard still rejects a recycled id.
+
+=====================================================================
+D12. RE-TEST AGAINST THE SECTION-3 REFUTATIONS
+=====================================================================
+REFUTATION A LEG 1 — "a lease must name a live shell no pane owns." SURVIVES. Discovery never was the lease's job: reattach builds its list from `getPtyIdsForConnection(target) UNION` the durable rows (ssh-relay-session.ts:2211-2219), and the connect-time projection adds host-reported shells on top. Leaf-keying does not weaken this. D5's RELEASE-vs-RETIRE distinction is REQUIRED BY this leg: a record whose leaf is gone must be released (shell stays discoverable and adoptable) rather than deleted (knowledge lost) or terminated (respawn wrongly authorized).
+
+REFUTATION A LEG 2 — "a lease outlives the binding; expiry authorizes a 30s recreate." First clause survives exactly: `detached`/`terminated` are states on a main-owned, top-level record that persists after the layout binding is wiped. The recreate clause is PRESERVED AS A CONDITIONAL, not deleted: E-2 keeps a grant, gated on `relayInstanceId` equality, and only after E-1 shows the branch executes at production id shapes. Deleting the grant outright — proposed twice — is still refused as a simplification, because it dies to A leg 2 as written and rests on a read-not-run conclusion; it remains available as an E-1 OUTCOME. What does ship regardless is the user affordance, which covers every case a narrowed grant would drop.
+
+REFUTATION B — "make the host authoritative." SURVIVES, and is honored more cheaply than before. Ownership stays on local disk, top-level, main-owned, read synchronously inside `setLocalWorkspaceSession` during quit with the host down (D8). Everything this design changes is the record's KEY and WHAT MAY TRANSITION IT — never where it lives or how it is read. The host is consulted only while connected, and only for "which shells are in your Map?", "is this the same shell I bound?" (incarnation) and "are you the same process?" (relayInstanceId) — three questions it answers from data it already holds. Critically, D4's deletion of retire-on-absence is what keeps refutation B intact under load: a design that retired durable ownership because a remote listing timed out would have made the host authoritative by accident.
+
+REFUTATION C — a second authority architecture. Untouched, and this revision deletes more than the last: no decision table, no `hostEpoch`, no `os.uptime` math, no per-platform boot semantics, no paneKey transfer/alias layer, no attach-time identity apparatus, no orphan-ownership classifier, no second durable record.
+
+WHERE THE CUT IS. Plane 1 (delivery identity, credit ledger, chunk-and-ack, binary payloads, loopback WebSocket) proceeds in parallel. The cut is DURABILITY SCOPE vs EVIDENCE SOURCE, and this revision now applies that rule to all four inferences the prior round left standing: an error string means dead (deleted, D2), absence from a list means dead (deleted, D4/D5), a delivery-checkpoint flag means alive (deleted, D3), an arithmetic clock means rebooted (never built, D3). What remains on the wire is two optional fields: `relayInstanceId` on the grant and `paneKey` on the process summary. RC3 is entirely Plane 1's.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-overview.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-overview.md
new file mode 100644
index 00000000000..ca48bdb9e64
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/design-overview.md
@@ -0,0 +1,255 @@
+# Terminal session correctness — design overview
+
+Plain-language explanation of what breaks, why, and what we changed. No prior
+context needed.
+
+---
+
+## 1. The cast of characters
+
+When you look at a terminal in Orca, five different things are lined up behind
+that one rectangle on screen.
+
+```mermaid
+flowchart LR
+    subgraph YOU["What you see"]
+        PANE["Pane<br/><i>a rectangle in a tab</i>"]
+    end
+    subgraph APP["Orca's bookkeeping"]
+        BIND["Binding<br/><i>this pane uses that shell</i>"]
+        LEASE["Lease<br/><i>a note saying: we own<br/>a remote shell</i>"]
+    end
+    subgraph MACHINE["The actual computer"]
+        PTY["PTY<br/><i>the shell process</i>"]
+        HOST["Host<br/><i>your Mac, or an SSH box</i>"]
+    end
+
+    PANE -->|bound to| BIND
+    BIND -->|points at| PTY
+    LEASE -->|claims| PTY
+    PTY -->|runs on| HOST
+```
+
+The pane is what you see. The **PTY** is the real shell process doing the work.
+The **binding** is the note that connects them. On a remote machine there is also
+a **lease** — a second note saying "we still own that remote shell."
+
+**Everything that went wrong is one of those notes pointing at the wrong thing.**
+
+---
+
+## 2. The bug, in one picture
+
+You are working on an SSH machine. Your network hiccups. Orca reconnects.
+
+**What should happen:** your two terminals come back, same shells, same work.
+
+**What actually happened:**
+
+```mermaid
+flowchart TD
+    A["You have 2 terminals"] --> B["Network hiccup"]
+    B --> C["Orca reconnects"]
+    C --> D["Now you have<br/>19 terminals"]
+    D --> E["Hiccup again"]
+    E --> F["Now 20.<br/>Most are ghosts you<br/>never opened"]
+
+    style D fill:#ffe6e6,stroke:#cc0000
+    style F fill:#ffcccc,stroke:#cc0000
+```
+
+That is a real report: **2 → 19 → 20**. Meanwhile the remote machine fills up
+with shells nobody is using, until it refuses to start any more.
+
+A second, worse version: your AI coding agent gets **resumed twice**. Two copies
+of `claude` writing into the same conversation file. One report had **five**.
+
+---
+
+## 3. Why it happened — three root causes
+
+### Cause 1: the lease forgot which pane it belonged to
+
+Each lease is a note saying "we own remote shell X." The note _had_ a field for
+"which pane," but nobody checked it.
+
+```mermaid
+flowchart LR
+    subgraph BEFORE["Before — lease identified by shell only"]
+        P1["Pane A"] --> L1["Lease: shell-1"]
+        P1 -.->|reconnect makes<br/>a new shell| L2["Lease: shell-2"]
+        P1 -.->|and another| L3["Lease: shell-3"]
+        N1["Nothing retires<br/>the old notes"]
+    end
+    style N1 fill:#ffe6e6,stroke:#cc0000
+```
+
+Every reconnect added a note and removed none. Next reconnect, Orca dutifully
+restored **all** of them — one pane per stale note.
+
+**Fix:** a lease is now identified by _which pane_ it belongs to, not just which
+shell. One pane, one live lease. Older notes are retired.
+
+> Retired means **marked expired, not killed**. The remote shell is deliberately
+> left running — losing a note is not proof the shell died.
+
+### Cause 2: reconnecting could _create_ panes
+
+The function that says "pane A uses shell X" was also allowed to _invent_ pane A
+if it didn't exist. That is correct when you open a new terminal. It is very
+wrong when reconnecting.
+
+```mermaid
+flowchart TD
+    R["Reconnect finds a<br/>lease for shell-7"] --> Q{"Does its pane<br/>still exist?"}
+    Q -->|"Yes"| OK["Reattach. Correct."]
+    Q -->|"No — before"| BAD["Invent the pane.<br/>Ghost appears."]
+    Q -->|"No — after"| GOOD["Refuse. Leave the shell<br/>running, unbound."]
+
+    style BAD fill:#ffcccc,stroke:#cc0000
+    style GOOD fill:#e6ffe6,stroke:#00aa00
+```
+
+**Fix:** reattach now says _"bind only, never create."_ Spawning a new terminal
+still creates, exactly as before.
+
+### Cause 3: a living shell was reported as dead
+
+The remote side has two different bad-news messages:
+
+| Real meaning                                                  | What it was reported as        |
+| ------------------------------------------------------------- | ------------------------------ |
+| "This shell is gone."                                         | `SESSION_EXPIRED` ✅ correct   |
+| "Shell is fine, I just need to re-establish the output pipe." | `SESSION_EXPIRED` ❌ **wrong** |
+
+Orca's reaction to "expired" is to start a fresh shell — and because it passes
+the old session id along, the AI agent gets resumed a second time. **That is the
+duplicate-agent bug.**
+
+**Fix:** the second case gets its own message, and respawning now requires
+_positive proof_ the shell is gone. Anything unrecognised means "unknown", and
+unknown never justifies starting a replacement.
+
+---
+
+## 4. The one rule underneath all of it
+
+```mermaid
+flowchart LR
+    E["Evidence"] --> A{"What does it<br/>prove?"}
+    A -->|"Shell exited"| D["DEAD — cleanup allowed"]
+    A -->|"Can't reach it"| U["UNKNOWN"]
+    A -->|"Timed out"| U
+    A -->|"Not in a list"| U
+    A -->|"Tried 3 times"| U
+    U --> N["Do nothing destructive.<br/>Wait. Retry. Ask."]
+
+    style D fill:#e6ffe6,stroke:#00aa00
+    style U fill:#fff4e6,stroke:#dd8800
+    style N fill:#fff4e6,stroke:#dd8800
+```
+
+**Unknown is not dead.** A disconnect, a timeout, an empty list, or three failed
+retries tell you nothing about whether a process is alive. Every bug above is
+some version of treating silence as a death certificate.
+
+We also made the liveness check able to _say_ "unknown". It used to return only
+yes/no — so a provider whose network was down had no way to express "I can't
+see, don't ask me" and answered "no", meaning dead.
+
+---
+
+## 5. What we changed
+
+Six changes, ~214 lines of production code total.
+
+| #   | Change                                          | Stops                                           |
+| --- | ----------------------------------------------- | ----------------------------------------------- |
+| 1   | Reattach binds, never creates                   | Ghost panes                                     |
+| 2   | Leases identified by pane                       | 2 → 19 → 20 growth                              |
+| 3   | Heal already-corrupted lease data               | Existing installs stuck at 20                   |
+| 4   | "Needs re-establishing" ≠ "expired"             | Duplicate agent resume                          |
+| 5   | Liveness can answer "unknown"                   | Live shells declared dead                       |
+| 6   | One PTY's failure can't drop the shared channel | One bad pane killing every session on that host |
+
+### Change 6 in a picture
+
+```mermaid
+flowchart TD
+    subgraph B["Before"]
+        X1["Pane 3 can't re-prove<br/>its output stream"] --> X2["Give up after N tries"]
+        X2 --> X3["Drop the entire<br/>connection to that host"]
+        X3 --> X4["Every pane, file transfer<br/>and git command dies"]
+    end
+    subgraph A["After"]
+        Y1["Pane 3 can't re-prove<br/>its output stream"] --> Y2["Park pane 3 only"]
+        Y2 --> Y3["Its shell keeps running.<br/>Siblings untouched."]
+    end
+    style X4 fill:#ffcccc,stroke:#cc0000
+    style Y3 fill:#e6ffe6,stroke:#00aa00
+```
+
+### And a guard on every keystroke
+
+Orca queues your typing. If a pane switches to a different shell mid-flight,
+queued keystrokes could land on the **new** shell.
+
+```mermaid
+flowchart LR
+    K["Keystroke for shell-1"] --> C{"Is shell-1 still<br/>this pane's shell?"}
+    C -->|"Yes"| S["Deliver"]
+    C -->|"No — pane moved on"| R["Refuse"]
+    C -->|"Pane unknown"| S2["Deliver<br/><i>unknown ≠ stale</i>"]
+
+    style R fill:#fff4e6,stroke:#dd8800
+```
+
+We did this **without changing the wire format** — Orca already keeps two lookup
+tables in lock-step, so if they disagree, that _is_ proof the id is stale. No new
+data is sent per keystroke.
+
+---
+
+## 6. The approach we rejected
+
+A previous attempt built a **new authority architecture beside the old one**:
++60,903 lines of production code. It fixed **none** of the three root causes —
+they were still present, untouched, underneath.
+
+```mermaid
+flowchart LR
+    subgraph W["Rejected"]
+        O1["Old system<br/>(3 bugs)"]
+        N1["New system<br/>+60,903 lines"]
+        O1 -.->|"bugs still here"| O1
+    end
+    subgraph R["Taken"]
+        O2["Old system<br/>(3 bugs fixed)<br/>+214 lines"]
+    end
+    style N1 fill:#ffcccc,stroke:#cc0000
+    style O2 fill:#e6ffe6,stroke:#00aa00
+```
+
+A second proposal of mine was also rejected in review — it would have added a
+_second_ identity system beside an existing one, which is the same mistake in
+miniature. Three of its factual claims turned out to be false when checked
+against the code.
+
+**The lesson both times:** the machinery mostly existed already. The bug was that
+it wasn't being _called_.
+
+---
+
+## 7. What is still open
+
+| Thing                    | State                                                                            |
+| ------------------------ | -------------------------------------------------------------------------------- |
+| The three root causes    | Fixed                                                                            |
+| Duplicate agent resume   | Root cause fixed; the codebase still carries 3 older patches for it              |
+| Orphaned remote shells   | Left running on purpose. Not reachable from the UI yet — needs a recovery screen |
+| The keystroke quarantine | Still needed. We proved deleting it re-opens a real `rm -rf` hazard              |
+
+**On that last one:** there is a safety module that drops the tail of a half-typed
+line after a recovery, because `echo hi; rm -rf x` can otherwise arrive as
+`cho hi; rm -rf x` — the shell rejects `cho` and then happily runs `rm -rf x`. We
+tried to delete it. We proved by experiment that we cannot, yet.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/finalized-design.html b/docs/reference/terminal-session-correctness-handoff-2026-08-07/finalized-design.html
new file mode 100644
index 00000000000..afe8bcbbc86
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/finalized-design.html
@@ -0,0 +1,275 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Terminal Architecture — Finalized Design</title>
+    <style>
+      :root {
+        --bg: #0f1115; --panel: #161920; --panel-2: #1c2029; --ink: #e6e8ee; --ink-dim: #9aa3b2;
+        --line: #262b36; --good: #3fb950; --bad: #f85149; --warn: #d29922; --info: #58a6ff;
+        --accent: #7c8cff; --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, monospace;
+      }
+      @media (prefers-color-scheme: light) {
+        :root {
+          --bg: #fbfbfd; --panel: #fff; --panel-2: #f4f5f8; --ink: #14161a; --ink-dim: #5b6472;
+          --line: #e2e5ea; --good: #1a7f37; --bad: #cf222e; --warn: #9a6700; --info: #0969da; --accent: #4d5bd9;
+        }
+      }
+      * { box-sizing: border-box; }
+      body { margin: 0; background: var(--bg); color: var(--ink);
+        font: 16px/1.65 -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, system-ui, sans-serif;
+        -webkit-font-smoothing: antialiased; }
+      .wrap { max-width: 1080px; margin: 0 auto; padding: 48px 28px 120px; }
+      header.hero { border-bottom: 1px solid var(--line); padding-bottom: 28px; }
+      h1 { font-size: 34px; line-height: 1.2; margin: 0 0 8px; letter-spacing: -0.02em; }
+      .sub { color: var(--ink-dim); font-size: 15px; margin: 0; }
+      h2 { font-size: 24px; margin: 56px 0 6px; letter-spacing: -0.01em; padding-top: 20px; border-top: 1px solid var(--line); }
+      h3 { font-size: 18px; margin: 30px 0 6px; }
+      .lede { color: var(--ink-dim); margin-top: 0; }
+      code { font-family: var(--mono); font-size: 0.9em; background: var(--panel-2); padding: 1px 5px; border-radius: 4px; }
+      .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(190px, 1fr)); gap: 12px; margin: 22px 0; }
+      .stat { background: var(--panel); border: 1px solid var(--line); border-radius: 10px; padding: 16px 18px; }
+      .stat .n { font-size: 28px; font-weight: 650; letter-spacing: -0.02em; line-height: 1.1; }
+      .stat .l { color: var(--ink-dim); font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.05em; margin-top: 4px; }
+      .n.good { color: var(--good); } .n.bad { color: var(--bad); } .n.warn { color: var(--warn); } .n.info { color: var(--info); }
+      figure { margin: 22px 0; background: var(--panel); border: 1px solid var(--line); border-radius: 12px; padding: 10px; }
+      figure .bar { display: flex; justify-content: space-between; align-items: center; padding: 4px 8px 10px; color: var(--ink-dim); font-size: 12.5px; }
+      figure .zoom { color: var(--accent); cursor: pointer; user-select: none; font-weight: 600; }
+      .mermaid { text-align: center; overflow: auto; }
+      .dia { text-align: center; padding: 4px 6px 10px; cursor: zoom-in; }
+      .dia svg { width: 100%; height: auto; max-width: 900px; }
+      .d-light { display: none; }
+      @media (prefers-color-scheme: light) { .d-dark { display: none; } .d-light { display: block; } }
+      table { border-collapse: collapse; width: 100%; margin: 18px 0; font-size: 14.5px; }
+      th, td { text-align: left; padding: 9px 12px; border-bottom: 1px solid var(--line); vertical-align: top; }
+      th { color: var(--ink-dim); font-weight: 600; font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.04em; }
+      tbody tr:hover { background: var(--panel-2); }
+      .pill { display: inline-block; padding: 1px 9px; border-radius: 999px; font-size: 12px; font-weight: 650; white-space: nowrap; }
+      .pill.ok { background: color-mix(in srgb, var(--good) 18%, transparent); color: var(--good); }
+      .pill.no { background: color-mix(in srgb, var(--bad) 18%, transparent); color: var(--bad); }
+      .pill.mid { background: color-mix(in srgb, var(--warn) 20%, transparent); color: var(--warn); }
+      .pill.inf { background: color-mix(in srgb, var(--info) 18%, transparent); color: var(--info); }
+      .callout { border-left: 3px solid var(--accent); background: var(--panel); padding: 14px 18px; border-radius: 0 10px 10px 0; margin: 22px 0; }
+      .callout.bad { border-left-color: var(--bad); } .callout.good { border-left-color: var(--good); } .callout.warn { border-left-color: var(--warn); }
+      .callout p:first-child { margin-top: 0; } .callout p:last-child { margin-bottom: 0; }
+      .k { font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.06em; color: var(--ink-dim); font-weight: 650; }
+      pre.term { background: #0b0d12; color: #d7dbe4; border: 1px solid var(--line); border-radius: 10px;
+        padding: 14px 16px; overflow-x: auto; font-family: var(--mono); font-size: 13px; line-height: 1.55; }
+      pre.term .r { color: #ff7b72; } pre.term .g { color: #7ee787; } pre.term .d { color: #8b949e; }
+      #ov { position: fixed; inset: 0; background: var(--bg); display: none; z-index: 99; cursor: grab; overflow: hidden; }
+      #ov.on { display: block; }
+      #ov .inner { transform-origin: 0 0; position: absolute; top: 0; left: 0;
+        background: var(--panel); border: 1px solid var(--line); border-radius: 14px; padding: 22px; }
+      #ov .inner svg { display: block; }
+      #ov .hint { position: fixed; bottom: 18px; left: 50%; transform: translateX(-50%);
+        color: var(--ink-dim); background: var(--panel-2); border: 1px solid var(--line); border-radius: 999px; padding: 7px 16px; font-size: 13px; }
+      #ov .x { position: fixed; top: 14px; right: 20px; color: var(--ink); font-size: 26px; cursor: pointer; line-height: 1;
+        z-index: 2; background: var(--panel-2); border: 1px solid var(--line); border-radius: 8px; padding: 2px 10px 5px; }
+      .foot { margin-top: 60px; padding-top: 20px; border-top: 1px solid var(--line); color: var(--ink-dim); font-size: 13.5px; }
+    </style>
+  </head>
+  <body>
+    <div class="wrap">
+      <header class="hero">
+        <h1>Terminal Architecture — Finalized Design</h1>
+        <p class="sub">Synthesis of the “one protocol, three routes” proposal with a control-plane track it does not cover</p>
+      </header>
+
+      <div class="grid">
+        <div class="stat"><div class="n good">Adopt</div><div class="l">Data-plane proposal</div></div>
+        <div class="stat"><div class="n info">+1 track</div><div class="l">Control plane (missing)</div></div>
+        <div class="stat"><div class="n bad">REFUTED</div><div class="l">“Delete the lease”</div></div>
+        <div class="stat"><div class="n warn">~374</div><div class="l">Lines of reconciliation</div></div>
+        <div class="stat"><div class="n">~390</div><div class="l">Remoteness branches</div></div>
+      </div>
+
+      <div class="callout">
+        <p><span class="k">Verdict in one paragraph</span></p>
+        <p>The proposal is correct and its root cause is real — I verified it. Adopt it. But it is a <strong>data-plane</strong> design: framing, encoding, credit windows, backpressure. The bug that started this work is a <strong>control-plane</strong> bug, and none of its thirteen steps touch the records involved. The two tracks are independent and can run in parallel. My shipped work is a stopgap on the second track, framed around a symptom rather than a cause, and most of it should be deleted once the real fix lands.</p>
+      </div>
+
+      <h2>1 · Two planes, one system</h2>
+      <p class="lede">Nearly every disagreement here dissolves once you separate these.</p>
+      <figure>
+        <div class="bar"><span>What each plane owns</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark0" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1559.203125 312" role="graphics-document document" aria-roledescription="d0-flowchart-v2"><style>#gdark0{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark0 .error-icon{fill:#a44141;}#gdark0 .error-text{fill:#ddd;stroke:#ddd;}#gdark0 .edge-thickness-normal{stroke-width:1px;}#gdark0 .edge-thickness-thick{stroke-width:3.5px;}#gdark0 .edge-pattern-solid{stroke-dasharray:0;}#gdark0 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark0 .edge-pattern-dashed{stroke-dasharray:3;}#gdark0 .edge-pattern-dotted{stroke-dasharray:2;}#gdark0 .marker{fill:lightgrey;stroke:lightgrey;}#gdark0 .marker.cross{stroke:lightgrey;}#gdark0 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark0 p{margin:0;}#gdark0 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark0 .cluster-label text{fill:#F9FFFE;}#gdark0 .cluster-label span{color:#F9FFFE;}#gdark0 .cluster-label span p{background-color:transparent;}#gdark0 .label text,#gdark0 span{fill:#ccc;color:#ccc;}#gdark0 .node rect,#gdark0 .node circle,#gdark0 .node ellipse,#gdark0 .node polygon,#gdark0 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark0 .rough-node .label text,#gdark0 .node .label text,#gdark0 .image-shape .label,#gdark0 .icon-shape .label{text-anchor:middle;}#gdark0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark0 .rough-node .label,#gdark0 .node .label,#gdark0 .image-shape .label,#gdark0 .icon-shape .label{text-align:center;}#gdark0 .node.clickable{cursor:pointer;}#gdark0 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark0 .arrowheadPath{fill:lightgrey;}#gdark0 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark0 .d0-flowchart-link{stroke:lightgrey;fill:none;}#gdark0 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark0 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark0 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark0 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark0 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark0 .cluster text{fill:#F9FFFE;}#gdark0 .cluster span{color:#F9FFFE;}#gdark0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark0 rect.text{fill:none;stroke-width:0;}#gdark0 .icon-shape,#gdark0 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark0 .icon-shape p,#gdark0 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark0 .icon-shape .label rect,#gdark0 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark0 .node .neo-node{stroke:#ccc;}#gdark0 [data-look="neo"].node rect,#gdark0 [data-look="neo"].cluster rect,#gdark0 [data-look="neo"].node polygon{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark0 [data-look="neo"].node path{stroke:url(#gdark0-gradient);stroke-width:1px;}#gdark0 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark0 [data-look="neo"].node circle{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark0 [data-look="neo"].icon-shape .icon{fill:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark0_d0-flowchart-v2-pointEnd" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointStart" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointEnd-margin" class="marker d0-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointStart-margin" class="marker d0-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark0_d0-flowchart-v2-circleEnd" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleStart" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleEnd-margin" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleStart-margin" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-crossEnd" class="marker cross d0-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossStart" class="marker cross d0-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossEnd-margin" class="marker cross d0-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossStart-margin" class="marker cross d0-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M1159.164,154L1159.164,160.167C1159.164,166.333,1159.164,178.667,1159.164,192.333C1159.164,206,1159.164,221,1159.164,228.5L1159.164,236" id="gdark0-L_DP_OK_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_DP_OK_0" data-points="W3sieCI6MTE1OS4xNjQwNjI1LCJ5IjoxNTR9LHsieCI6MTE1OS4xNjQwNjI1LCJ5IjoxOTF9LHsieCI6MTE1OS4xNjQwNjI1LCJ5IjoyNDB9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M362.563,154L362.563,160.167C362.563,166.333,362.563,178.667,362.563,190.333C362.563,202,362.563,213,362.563,218.5L362.563,224" id="gdark0-L_CP_GAP_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_CP_GAP_0" data-points="W3sieCI6MzYyLjU2MjUsInkiOjE1NH0seyJ4IjozNjIuNTYyNSwieSI6MTkxfSx7IngiOjM2Mi41NjI1LCJ5IjoyMjh9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel" transform="translate(1159.1640625, 191)"><g class="label" data-id="L_DP_OK_0" transform="translate(-72.8828125, -12)"><foreignObject width="145.765625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>proposal covers this</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(362.5625, 191)"><g class="label" data-id="L_CP_GAP_0" transform="translate(-60.9609375, -12)"><foreignObject width="121.921875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>proposal is silent</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(0, 0)"><g class="clusters"><g class="cluster " id="gdark0-CP" data-look="classic"><rect style="" x="8" y="8" width="709.125" height="146"></rect><g class="cluster-label " transform="translate(230.8125, 8)"><foreignObject width="263.5" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>CONTROL PLANE — who owns what</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M226.25,81L232.5,81C238.75,81,251.25,81,263.083,81C274.917,81,286.083,81,291.667,81L297.25,81" id="gdark0-L_C1_C2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C1_C2_0" data-points="W3sieCI6MjI2LjI1LCJ5Ijo4MX0seyJ4IjoyNjMuNzUsInkiOjgxfSx7IngiOjMwMS4yNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M456.516,81L462.766,81C469.016,81,481.516,81,493.349,81C505.182,81,516.349,81,521.932,81L527.516,81" id="gdark0-L_C2_C3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C2_C3_0" data-points="W3sieCI6NDU2LjUxNTYyNSwieSI6ODF9LHsieCI6NDk0LjAxNTYyNSwieSI6ODF9LHsieCI6NTMxLjUxNTYyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_C1_C2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C2_C3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark0-d0-flowchart-C1-3" data-look="classic" transform="translate(135.875, 81)"><rect class="basic label-container" style="" x="-90.375" y="-38" width="180.75" height="76"></rect><g class="label" style="" transform="translate(-62.375, -24)"><rect></rect><foreignObject width="124.75" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which pane owns<br/>which shell</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-C2-4" data-look="classic" transform="translate(378.8828125, 81)"><rect class="basic label-container" style="" x="-77.6328125" y="-38" width="155.265625" height="76"></rect><g class="label" style="" transform="translate(-49.6328125, -24)"><rect></rect><foreignObject width="99.265625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>what survives<br/>a restart</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-C3-5" data-look="classic" transform="translate(605.5703125, 81)"><rect class="basic label-container" style="" x="-74.0546875" y="-38" width="148.109375" height="76"></rect><g class="label" style="" transform="translate(-46.0546875, -24)"><rect></rect><foreignObject width="92.109375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>what may be<br/>destroyed</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(759.125, 0)"><g class="clusters"><g class="cluster " id="gdark0-DP" data-look="classic"><rect style="" x="8" y="8" width="784.078125" height="146"></rect><g class="cluster-label " transform="translate(294.078125, 8)"><foreignObject width="211.921875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>DATA PLANE — moving bytes</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M237.047,81L243.297,81C249.547,81,262.047,81,273.88,81C285.714,81,296.88,81,302.464,81L308.047,81" id="gdark0-L_D1_D2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D1_D2_0" data-points="W3sieCI6MjM3LjA0Njg3NSwieSI6ODF9LHsieCI6Mjc0LjU0Njg3NSwieSI6ODF9LHsieCI6MzEyLjA0Njg3NSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M476.906,81L483.156,81C489.406,81,501.906,81,513.74,81C525.573,81,536.74,81,542.323,81L547.906,81" id="gdark0-L_D2_D3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D2_D3_0" data-points="W3sieCI6NDc2LjkwNjI1LCJ5Ijo4MX0seyJ4Ijo1MTQuNDA2MjUsInkiOjgxfSx7IngiOjU1MS45MDYyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_D1_D2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D2_D3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark0-d0-flowchart-D1-0" data-look="classic" transform="translate(141.2734375, 81)"><rect class="basic label-container" style="" x="-95.7734375" y="-26" width="191.546875" height="52"></rect><g class="label" style="" transform="translate(-67.7734375, -12)"><rect></rect><foreignObject width="135.546875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>framing · encoding</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-D2-1" data-look="classic" transform="translate(394.4765625, 81)"><rect class="basic label-container" style="" x="-82.4296875" y="-38" width="164.859375" height="76"></rect><g class="label" style="" transform="translate(-54.4296875, -24)"><rect></rect><foreignObject width="108.859375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>credit windows<br/>backpressure</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-D3-2" data-look="classic" transform="translate(653.2421875, 81)"><rect class="basic label-container" style="" x="-101.3359375" y="-26" width="202.671875" height="52"></rect><g class="label" style="" transform="translate(-73.3359375, -12)"><rect></rect><foreignObject width="146.671875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reconnect &amp; resume</p></span></div></foreignObject></g></g></g></g><g class="node default  " id="gdark0-d0-flowchart-OK-7" data-look="classic" transform="translate(1159.1640625, 266)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-58.3671875" y="-26" width="116.734375" height="52"></rect><g class="label" style="color:#fff !important" transform="translate(-30.3671875, -12)"><rect></rect><foreignObject width="60.734375" height="24"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>13 steps</p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-GAP-9" data-look="classic" transform="translate(362.5625, 266)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-125.90625" y="-38" width="251.8125" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-97.90625, -24)"><rect></rect><foreignObject width="195.8125" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>0 steps<br/>2 → 19 → 20 survives all 13</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark0-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark0-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark0-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault0" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1559.203125 312" role="graphics-document document" aria-roledescription="l0-flowchart-v2"><style>#gdefault0{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault0 .error-icon{fill:#552222;}#gdefault0 .error-text{fill:#552222;stroke:#552222;}#gdefault0 .edge-thickness-normal{stroke-width:1px;}#gdefault0 .edge-thickness-thick{stroke-width:3.5px;}#gdefault0 .edge-pattern-solid{stroke-dasharray:0;}#gdefault0 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault0 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault0 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault0 .marker{fill:#333333;stroke:#333333;}#gdefault0 .marker.cross{stroke:#333333;}#gdefault0 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault0 p{margin:0;}#gdefault0 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault0 .cluster-label text{fill:#333;}#gdefault0 .cluster-label span{color:#333;}#gdefault0 .cluster-label span p{background-color:transparent;}#gdefault0 .label text,#gdefault0 span{fill:#333;color:#333;}#gdefault0 .node rect,#gdefault0 .node circle,#gdefault0 .node ellipse,#gdefault0 .node polygon,#gdefault0 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault0 .rough-node .label text,#gdefault0 .node .label text,#gdefault0 .image-shape .label,#gdefault0 .icon-shape .label{text-anchor:middle;}#gdefault0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault0 .rough-node .label,#gdefault0 .node .label,#gdefault0 .image-shape .label,#gdefault0 .icon-shape .label{text-align:center;}#gdefault0 .node.clickable{cursor:pointer;}#gdefault0 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault0 .arrowheadPath{fill:#333333;}#gdefault0 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault0 .l0-flowchart-link{stroke:#333333;fill:none;}#gdefault0 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault0 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault0 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault0 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault0 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault0 .cluster text{fill:#333;}#gdefault0 .cluster span{color:#333;}#gdefault0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault0 rect.text{fill:none;stroke-width:0;}#gdefault0 .icon-shape,#gdefault0 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault0 .icon-shape p,#gdefault0 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault0 .icon-shape .label rect,#gdefault0 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault0 .node .neo-node{stroke:#9370DB;}#gdefault0 [data-look="neo"].node rect,#gdefault0 [data-look="neo"].cluster rect,#gdefault0 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault0 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault0 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault0 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault0 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault0_l0-flowchart-v2-pointEnd" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointStart" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointEnd-margin" class="marker l0-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointStart-margin" class="marker l0-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault0_l0-flowchart-v2-circleEnd" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleStart" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleEnd-margin" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleStart-margin" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-crossEnd" class="marker cross l0-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossStart" class="marker cross l0-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossEnd-margin" class="marker cross l0-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossStart-margin" class="marker cross l0-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M1159.164,154L1159.164,160.167C1159.164,166.333,1159.164,178.667,1159.164,192.333C1159.164,206,1159.164,221,1159.164,228.5L1159.164,236" id="gdefault0-L_DP_OK_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_DP_OK_0" data-points="W3sieCI6MTE1OS4xNjQwNjI1LCJ5IjoxNTR9LHsieCI6MTE1OS4xNjQwNjI1LCJ5IjoxOTF9LHsieCI6MTE1OS4xNjQwNjI1LCJ5IjoyNDB9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M362.563,154L362.563,160.167C362.563,166.333,362.563,178.667,362.563,190.333C362.563,202,362.563,213,362.563,218.5L362.563,224" id="gdefault0-L_CP_GAP_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_CP_GAP_0" data-points="W3sieCI6MzYyLjU2MjUsInkiOjE1NH0seyJ4IjozNjIuNTYyNSwieSI6MTkxfSx7IngiOjM2Mi41NjI1LCJ5IjoyMjh9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel" transform="translate(1159.1640625, 191)"><g class="label" data-id="L_DP_OK_0" transform="translate(-72.8828125, -12)"><foreignObject width="145.765625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>proposal covers this</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(362.5625, 191)"><g class="label" data-id="L_CP_GAP_0" transform="translate(-60.9609375, -12)"><foreignObject width="121.921875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>proposal is silent</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(0, 0)"><g class="clusters"><g class="cluster " id="gdefault0-CP" data-look="classic"><rect style="" x="8" y="8" width="709.125" height="146"></rect><g class="cluster-label " transform="translate(230.8125, 8)"><foreignObject width="263.5" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>CONTROL PLANE — who owns what</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M226.25,81L232.5,81C238.75,81,251.25,81,263.083,81C274.917,81,286.083,81,291.667,81L297.25,81" id="gdefault0-L_C1_C2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C1_C2_0" data-points="W3sieCI6MjI2LjI1LCJ5Ijo4MX0seyJ4IjoyNjMuNzUsInkiOjgxfSx7IngiOjMwMS4yNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M456.516,81L462.766,81C469.016,81,481.516,81,493.349,81C505.182,81,516.349,81,521.932,81L527.516,81" id="gdefault0-L_C2_C3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C2_C3_0" data-points="W3sieCI6NDU2LjUxNTYyNSwieSI6ODF9LHsieCI6NDk0LjAxNTYyNSwieSI6ODF9LHsieCI6NTMxLjUxNTYyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_C1_C2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C2_C3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault0-l0-flowchart-C1-3" data-look="classic" transform="translate(135.875, 81)"><rect class="basic label-container" style="" x="-90.375" y="-38" width="180.75" height="76"></rect><g class="label" style="" transform="translate(-62.375, -24)"><rect></rect><foreignObject width="124.75" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which pane owns<br/>which shell</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-C2-4" data-look="classic" transform="translate(378.8828125, 81)"><rect class="basic label-container" style="" x="-77.6328125" y="-38" width="155.265625" height="76"></rect><g class="label" style="" transform="translate(-49.6328125, -24)"><rect></rect><foreignObject width="99.265625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>what survives<br/>a restart</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-C3-5" data-look="classic" transform="translate(605.5703125, 81)"><rect class="basic label-container" style="" x="-74.0546875" y="-38" width="148.109375" height="76"></rect><g class="label" style="" transform="translate(-46.0546875, -24)"><rect></rect><foreignObject width="92.109375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>what may be<br/>destroyed</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(759.125, 0)"><g class="clusters"><g class="cluster " id="gdefault0-DP" data-look="classic"><rect style="" x="8" y="8" width="784.078125" height="146"></rect><g class="cluster-label " transform="translate(294.078125, 8)"><foreignObject width="211.921875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>DATA PLANE — moving bytes</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M237.047,81L243.297,81C249.547,81,262.047,81,273.88,81C285.714,81,296.88,81,302.464,81L308.047,81" id="gdefault0-L_D1_D2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D1_D2_0" data-points="W3sieCI6MjM3LjA0Njg3NSwieSI6ODF9LHsieCI6Mjc0LjU0Njg3NSwieSI6ODF9LHsieCI6MzEyLjA0Njg3NSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M476.906,81L483.156,81C489.406,81,501.906,81,513.74,81C525.573,81,536.74,81,542.323,81L547.906,81" id="gdefault0-L_D2_D3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D2_D3_0" data-points="W3sieCI6NDc2LjkwNjI1LCJ5Ijo4MX0seyJ4Ijo1MTQuNDA2MjUsInkiOjgxfSx7IngiOjU1MS45MDYyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_D1_D2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D2_D3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault0-l0-flowchart-D1-0" data-look="classic" transform="translate(141.2734375, 81)"><rect class="basic label-container" style="" x="-95.7734375" y="-26" width="191.546875" height="52"></rect><g class="label" style="" transform="translate(-67.7734375, -12)"><rect></rect><foreignObject width="135.546875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>framing · encoding</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-D2-1" data-look="classic" transform="translate(394.4765625, 81)"><rect class="basic label-container" style="" x="-82.4296875" y="-38" width="164.859375" height="76"></rect><g class="label" style="" transform="translate(-54.4296875, -24)"><rect></rect><foreignObject width="108.859375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>credit windows<br/>backpressure</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-D3-2" data-look="classic" transform="translate(653.2421875, 81)"><rect class="basic label-container" style="" x="-101.3359375" y="-26" width="202.671875" height="52"></rect><g class="label" style="" transform="translate(-73.3359375, -12)"><rect></rect><foreignObject width="146.671875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reconnect &amp; resume</p></span></div></foreignObject></g></g></g></g><g class="node default  " id="gdefault0-l0-flowchart-OK-7" data-look="classic" transform="translate(1159.1640625, 266)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-58.3671875" y="-26" width="116.734375" height="52"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-30.3671875, -12)"><rect></rect><foreignObject width="60.734375" height="24"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>13 steps</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-GAP-9" data-look="classic" transform="translate(362.5625, 266)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-125.90625" y="-38" width="251.8125" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-97.90625, -24)"><rect></rect><foreignObject width="195.8125" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>0 steps<br/>2 → 19 → 20 survives all 13</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault0-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault0-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>Verified: none of the ladder’s core files reference the lease or binding records at all. You could ship all thirteen steps and still get 19 ghost panes on the third reconnect.</p>
+
+      <h2>2 · The data-plane root cause — verified</h2>
+      <p class="lede">This is the strongest finding in either document, and it is correct.</p>
+      <p>Orca copied a well-known persistent protocol’s 13-byte frame header, and kept <strong>two of its nine message types</strong>:</p>
+      <pre class="term">export const MessageType = { <span class="g">Regular: 1</span>, <span class="g">KeepAlive: 9</span> } as const
+<span class="d">// dropped: Control · Ack · Disconnect · ReplayRequest · Pause · Resume · None</span></pre>
+      <p>The seven dropped are exactly the ones that make the protocol <em>persistent</em>. The ACK field that survived feeds only <code>unackedTimestamps</code> — a seq→timestamp map read solely by the death timer. Nothing is retained; nothing is replayed.</p>
+      <figure>
+        <div class="bar"><span>Why three ledgers exist</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark1" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 707.390625 368" role="graphics-document document" aria-roledescription="d1-flowchart-v2"><style>#gdark1{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark1 .error-icon{fill:#a44141;}#gdark1 .error-text{fill:#ddd;stroke:#ddd;}#gdark1 .edge-thickness-normal{stroke-width:1px;}#gdark1 .edge-thickness-thick{stroke-width:3.5px;}#gdark1 .edge-pattern-solid{stroke-dasharray:0;}#gdark1 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark1 .edge-pattern-dashed{stroke-dasharray:3;}#gdark1 .edge-pattern-dotted{stroke-dasharray:2;}#gdark1 .marker{fill:lightgrey;stroke:lightgrey;}#gdark1 .marker.cross{stroke:lightgrey;}#gdark1 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark1 p{margin:0;}#gdark1 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark1 .cluster-label text{fill:#F9FFFE;}#gdark1 .cluster-label span{color:#F9FFFE;}#gdark1 .cluster-label span p{background-color:transparent;}#gdark1 .label text,#gdark1 span{fill:#ccc;color:#ccc;}#gdark1 .node rect,#gdark1 .node circle,#gdark1 .node ellipse,#gdark1 .node polygon,#gdark1 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark1 .rough-node .label text,#gdark1 .node .label text,#gdark1 .image-shape .label,#gdark1 .icon-shape .label{text-anchor:middle;}#gdark1 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark1 .rough-node .label,#gdark1 .node .label,#gdark1 .image-shape .label,#gdark1 .icon-shape .label{text-align:center;}#gdark1 .node.clickable{cursor:pointer;}#gdark1 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark1 .arrowheadPath{fill:lightgrey;}#gdark1 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark1 .d1-flowchart-link{stroke:lightgrey;fill:none;}#gdark1 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark1 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark1 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark1 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark1 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark1 .cluster text{fill:#F9FFFE;}#gdark1 .cluster span{color:#F9FFFE;}#gdark1 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark1 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark1 rect.text{fill:none;stroke-width:0;}#gdark1 .icon-shape,#gdark1 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark1 .icon-shape p,#gdark1 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark1 .icon-shape .label rect,#gdark1 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark1 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark1 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark1 .node .neo-node{stroke:#ccc;}#gdark1 [data-look="neo"].node rect,#gdark1 [data-look="neo"].cluster rect,#gdark1 [data-look="neo"].node polygon{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark1 [data-look="neo"].node path{stroke:url(#gdark1-gradient);stroke-width:1px;}#gdark1 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark1 [data-look="neo"].node circle{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark1 [data-look="neo"].icon-shape .icon{fill:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark1_d1-flowchart-v2-pointEnd" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointStart" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointEnd-margin" class="marker d1-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointStart-margin" class="marker d1-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark1_d1-flowchart-v2-circleEnd" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleStart" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleEnd-margin" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleStart-margin" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-crossEnd" class="marker cross d1-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossStart" class="marker cross d1-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossEnd-margin" class="marker cross d1-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossStart-margin" class="marker cross d1-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M242.922,74.162L219.818,79.969C196.714,85.775,150.505,97.387,127.401,106.694C104.297,116,104.297,123,104.297,126.5L104.297,130" id="gdark1-L_T_A_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_A_0" data-points="W3sieCI6MjQyLjkyMTg3NSwieSI6NzQuMTYyMzAzNjY0OTIxNDd9LHsieCI6MTA0LjI5Njg3NSwieSI6MTA5fSx7IngiOjEwNC4yOTY4NzUsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M354.984,84L354.984,88.167C354.984,92.333,354.984,100.667,354.984,108.333C354.984,116,354.984,123,354.984,126.5L354.984,130" id="gdark1-L_T_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_B_0" data-points="W3sieCI6MzU0Ljk4NDM3NSwieSI6ODR9LHsieCI6MzU0Ljk4NDM3NSwieSI6MTA5fSx7IngiOjM1NC45ODQzNzUsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M467.047,74.308L489.936,80.09C512.826,85.872,558.604,97.436,581.493,106.718C604.383,116,604.383,123,604.383,126.5L604.383,130" id="gdark1-L_T_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_C_0" data-points="W3sieCI6NDY3LjA0Njg3NSwieSI6NzQuMzA3ODY1ODAyMDg2Mjd9LHsieCI6NjA0LjM4MjgxMjUsInkiOjEwOX0seyJ4Ijo2MDQuMzgyODEyNSwieSI6MTM0fV0=" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M104.297,210L104.297,214.167C104.297,218.333,104.297,226.667,124.106,236.76C143.915,246.853,183.534,258.706,203.343,264.632L223.152,270.559" id="gdark1-L_A_R_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_R_0" data-points="W3sieCI6MTA0LjI5Njg3NSwieSI6MjEwfSx7IngiOjEwNC4yOTY4NzUsInkiOjIzNX0seyJ4IjoyMjYuOTg0Mzc1LCJ5IjoyNzEuNzA1MzEwMzk2NDA5ODZ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M354.984,210L354.984,214.167C354.984,218.333,354.984,226.667,354.984,234.333C354.984,242,354.984,249,354.984,252.5L354.984,256" id="gdark1-L_B_R_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_R_0" data-points="W3sieCI6MzU0Ljk4NDM3NSwieSI6MjEwfSx7IngiOjM1NC45ODQzNzUsInkiOjIzNX0seyJ4IjozNTQuOTg0Mzc1LCJ5IjoyNjB9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M604.383,210L604.383,214.167C604.383,218.333,604.383,226.667,584.788,236.726C565.194,246.785,526.004,258.57,506.41,264.463L486.815,270.355" id="gdark1-L_C_R_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_R_0" data-points="W3sieCI6NjA0LjM4MjgxMjUsInkiOjIxMH0seyJ4Ijo2MDQuMzgyODEyNSwieSI6MjM1fSx7IngiOjQ4Mi45ODQzNzUsInkiOjI3MS41MDczNzcxMjYyMDk5fV0=" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_T_A_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_T_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_T_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_A_R_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_R_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C_R_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark1-d1-flowchart-T-0" data-look="classic" transform="translate(354.984375, 46)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-112.0625" y="-38" width="224.125" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-84.0625, -24)"><rect></rect><foreignObject width="168.125" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>transport gives<br/><b>no delivery guarantee</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-A-1" data-look="classic" transform="translate(104.296875, 172)"><rect class="basic label-container" style="" x="-96.296875" y="-38" width="192.59375" height="76"></rect><g class="label" style="" transform="translate(-68.296875, -24)"><rect></rect><foreignObject width="136.59375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>SSH stack rebuilds<br/>retain + replay</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-B-3" data-look="classic" transform="translate(354.984375, 172)"><rect class="basic label-container" style="" x="-104.390625" y="-38" width="208.78125" height="76"></rect><g class="label" style="" transform="translate(-76.390625, -24)"><rect></rect><foreignObject width="152.78125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>runtime RPC rebuilds<br/>retain + replay</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-C-5" data-look="classic" transform="translate(604.3828125, 172)"><rect class="basic label-container" style="" x="-95.0078125" y="-38" width="190.015625" height="76"></rect><g class="label" style="" transform="translate(-67.0078125, -24)"><rect></rect><foreignObject width="134.015625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>daemon rebuilds it<br/>lossily on purpose</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-R-7" data-look="classic" transform="translate(354.984375, 310)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>three ledgers · three sets of bugs<br/>4,847 lines in one of them</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark1-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark1-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark1-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault1" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 707.390625 368" role="graphics-document document" aria-roledescription="l1-flowchart-v2"><style>#gdefault1{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault1 .error-icon{fill:#552222;}#gdefault1 .error-text{fill:#552222;stroke:#552222;}#gdefault1 .edge-thickness-normal{stroke-width:1px;}#gdefault1 .edge-thickness-thick{stroke-width:3.5px;}#gdefault1 .edge-pattern-solid{stroke-dasharray:0;}#gdefault1 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault1 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault1 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault1 .marker{fill:#333333;stroke:#333333;}#gdefault1 .marker.cross{stroke:#333333;}#gdefault1 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault1 p{margin:0;}#gdefault1 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault1 .cluster-label text{fill:#333;}#gdefault1 .cluster-label span{color:#333;}#gdefault1 .cluster-label span p{background-color:transparent;}#gdefault1 .label text,#gdefault1 span{fill:#333;color:#333;}#gdefault1 .node rect,#gdefault1 .node circle,#gdefault1 .node ellipse,#gdefault1 .node polygon,#gdefault1 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault1 .rough-node .label text,#gdefault1 .node .label text,#gdefault1 .image-shape .label,#gdefault1 .icon-shape .label{text-anchor:middle;}#gdefault1 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault1 .rough-node .label,#gdefault1 .node .label,#gdefault1 .image-shape .label,#gdefault1 .icon-shape .label{text-align:center;}#gdefault1 .node.clickable{cursor:pointer;}#gdefault1 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault1 .arrowheadPath{fill:#333333;}#gdefault1 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault1 .l1-flowchart-link{stroke:#333333;fill:none;}#gdefault1 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault1 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault1 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault1 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault1 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault1 .cluster text{fill:#333;}#gdefault1 .cluster span{color:#333;}#gdefault1 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault1 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault1 rect.text{fill:none;stroke-width:0;}#gdefault1 .icon-shape,#gdefault1 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault1 .icon-shape p,#gdefault1 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault1 .icon-shape .label rect,#gdefault1 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault1 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault1 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault1 .node .neo-node{stroke:#9370DB;}#gdefault1 [data-look="neo"].node rect,#gdefault1 [data-look="neo"].cluster rect,#gdefault1 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault1 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault1 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault1 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault1 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault1_l1-flowchart-v2-pointEnd" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointStart" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointEnd-margin" class="marker l1-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointStart-margin" class="marker l1-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault1_l1-flowchart-v2-circleEnd" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleStart" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleEnd-margin" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleStart-margin" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-crossEnd" class="marker cross l1-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossStart" class="marker cross l1-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossEnd-margin" class="marker cross l1-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossStart-margin" class="marker cross l1-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M242.922,74.162L219.818,79.969C196.714,85.775,150.505,97.387,127.401,106.694C104.297,116,104.297,123,104.297,126.5L104.297,130" id="gdefault1-L_T_A_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_A_0" data-points="W3sieCI6MjQyLjkyMTg3NSwieSI6NzQuMTYyMzAzNjY0OTIxNDd9LHsieCI6MTA0LjI5Njg3NSwieSI6MTA5fSx7IngiOjEwNC4yOTY4NzUsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M354.984,84L354.984,88.167C354.984,92.333,354.984,100.667,354.984,108.333C354.984,116,354.984,123,354.984,126.5L354.984,130" id="gdefault1-L_T_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_B_0" data-points="W3sieCI6MzU0Ljk4NDM3NSwieSI6ODR9LHsieCI6MzU0Ljk4NDM3NSwieSI6MTA5fSx7IngiOjM1NC45ODQzNzUsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M467.047,74.308L489.936,80.09C512.826,85.872,558.604,97.436,581.493,106.718C604.383,116,604.383,123,604.383,126.5L604.383,130" id="gdefault1-L_T_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_T_C_0" data-points="W3sieCI6NDY3LjA0Njg3NSwieSI6NzQuMzA3ODY1ODAyMDg2Mjd9LHsieCI6NjA0LjM4MjgxMjUsInkiOjEwOX0seyJ4Ijo2MDQuMzgyODEyNSwieSI6MTM0fV0=" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M104.297,210L104.297,214.167C104.297,218.333,104.297,226.667,124.106,236.76C143.915,246.853,183.534,258.706,203.343,264.632L223.152,270.559" id="gdefault1-L_A_R_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_R_0" data-points="W3sieCI6MTA0LjI5Njg3NSwieSI6MjEwfSx7IngiOjEwNC4yOTY4NzUsInkiOjIzNX0seyJ4IjoyMjYuOTg0Mzc1LCJ5IjoyNzEuNzA1MzEwMzk2NDA5ODZ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M354.984,210L354.984,214.167C354.984,218.333,354.984,226.667,354.984,234.333C354.984,242,354.984,249,354.984,252.5L354.984,256" id="gdefault1-L_B_R_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_R_0" data-points="W3sieCI6MzU0Ljk4NDM3NSwieSI6MjEwfSx7IngiOjM1NC45ODQzNzUsInkiOjIzNX0seyJ4IjozNTQuOTg0Mzc1LCJ5IjoyNjB9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M604.383,210L604.383,214.167C604.383,218.333,604.383,226.667,584.788,236.726C565.194,246.785,526.004,258.57,506.41,264.463L486.815,270.355" id="gdefault1-L_C_R_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_R_0" data-points="W3sieCI6NjA0LjM4MjgxMjUsInkiOjIxMH0seyJ4Ijo2MDQuMzgyODEyNSwieSI6MjM1fSx7IngiOjQ4Mi45ODQzNzUsInkiOjI3MS41MDczNzcxMjYyMDk5fV0=" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_T_A_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_T_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_T_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_A_R_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_R_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C_R_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault1-l1-flowchart-T-0" data-look="classic" transform="translate(354.984375, 46)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-112.0625" y="-38" width="224.125" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-84.0625, -24)"><rect></rect><foreignObject width="168.125" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>transport gives<br/><b>no delivery guarantee</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-A-1" data-look="classic" transform="translate(104.296875, 172)"><rect class="basic label-container" style="" x="-96.296875" y="-38" width="192.59375" height="76"></rect><g class="label" style="" transform="translate(-68.296875, -24)"><rect></rect><foreignObject width="136.59375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>SSH stack rebuilds<br/>retain + replay</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-B-3" data-look="classic" transform="translate(354.984375, 172)"><rect class="basic label-container" style="" x="-104.390625" y="-38" width="208.78125" height="76"></rect><g class="label" style="" transform="translate(-76.390625, -24)"><rect></rect><foreignObject width="152.78125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>runtime RPC rebuilds<br/>retain + replay</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-C-5" data-look="classic" transform="translate(604.3828125, 172)"><rect class="basic label-container" style="" x="-95.0078125" y="-38" width="190.015625" height="76"></rect><g class="label" style="" transform="translate(-67.0078125, -24)"><rect></rect><foreignObject width="134.015625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>daemon rebuilds it<br/>lossily on purpose</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-R-7" data-look="classic" transform="translate(354.984375, 310)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>three ledgers · three sets of bugs<br/>4,847 lines in one of them</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault1-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault1-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <div class="callout good">
+        <p>This reframes the duplication as <strong>three teams correctly solving a missing primitive</strong>, not carelessness. Fix the transport and the duplication loses its reason to exist. That is a genuine root cause — the framing I shipped earlier (“identity compared with the wrong key”) named a symptom class instead.</p>
+      </div>
+
+      <h2>3 · Your principle, confirmed twice over</h2>
+      <p class="lede">“SSH should behave like local, plus its own reconnection logic.” The codebase already proves it — for the other routes.</p>
+      <pre class="term">function getProvider(connectionId) {
+  if (!connectionId) return localProvider          <span class="g">// local AND daemon — one slot</span>
+  const provider = sshProviders.get(connectionId)  <span class="r">// SSH — a parallel registry</span>
+}</pre>
+      <figure>
+        <div class="bar"><span>Three strategies, one exception</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark2" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 595.28125 845" role="graphics-document document" aria-roledescription="d2-flowchart-v2"><style>#gdark2{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark2 .error-icon{fill:#a44141;}#gdark2 .error-text{fill:#ddd;stroke:#ddd;}#gdark2 .edge-thickness-normal{stroke-width:1px;}#gdark2 .edge-thickness-thick{stroke-width:3.5px;}#gdark2 .edge-pattern-solid{stroke-dasharray:0;}#gdark2 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark2 .edge-pattern-dashed{stroke-dasharray:3;}#gdark2 .edge-pattern-dotted{stroke-dasharray:2;}#gdark2 .marker{fill:lightgrey;stroke:lightgrey;}#gdark2 .marker.cross{stroke:lightgrey;}#gdark2 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark2 p{margin:0;}#gdark2 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark2 .cluster-label text{fill:#F9FFFE;}#gdark2 .cluster-label span{color:#F9FFFE;}#gdark2 .cluster-label span p{background-color:transparent;}#gdark2 .label text,#gdark2 span{fill:#ccc;color:#ccc;}#gdark2 .node rect,#gdark2 .node circle,#gdark2 .node ellipse,#gdark2 .node polygon,#gdark2 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark2 .rough-node .label text,#gdark2 .node .label text,#gdark2 .image-shape .label,#gdark2 .icon-shape .label{text-anchor:middle;}#gdark2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark2 .rough-node .label,#gdark2 .node .label,#gdark2 .image-shape .label,#gdark2 .icon-shape .label{text-align:center;}#gdark2 .node.clickable{cursor:pointer;}#gdark2 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark2 .arrowheadPath{fill:lightgrey;}#gdark2 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark2 .d2-flowchart-link{stroke:lightgrey;fill:none;}#gdark2 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark2 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark2 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark2 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark2 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark2 .cluster text{fill:#F9FFFE;}#gdark2 .cluster span{color:#F9FFFE;}#gdark2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark2 rect.text{fill:none;stroke-width:0;}#gdark2 .icon-shape,#gdark2 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark2 .icon-shape p,#gdark2 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark2 .icon-shape .label rect,#gdark2 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark2 .node .neo-node{stroke:#ccc;}#gdark2 [data-look="neo"].node rect,#gdark2 [data-look="neo"].cluster rect,#gdark2 [data-look="neo"].node polygon{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark2 [data-look="neo"].node path{stroke:url(#gdark2-gradient);stroke-width:1px;}#gdark2 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark2 [data-look="neo"].node circle{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark2 [data-look="neo"].icon-shape .icon{fill:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark2_d2-flowchart-v2-pointEnd" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointStart" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointEnd-margin" class="marker d2-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointStart-margin" class="marker d2-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark2_d2-flowchart-v2-circleEnd" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleStart" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleEnd-margin" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleStart-margin" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-crossEnd" class="marker cross d2-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossStart" class="marker cross d2-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossEnd-margin" class="marker cross d2-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossStart-margin" class="marker cross d2-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"></g><g class="edgeLabels"></g><g class="nodes"><g class="root" transform="translate(126.640625, 0)"><g class="clusters"><g class="cluster " id="gdark2-BAD" data-look="classic"><rect style="" x="8" y="8" width="326" height="477"></rect><g class="cluster-label " transform="translate(121.9765625, 8)"><foreignObject width="98.046875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>the exception</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M171,121.5L171,127.75C171,134,171,146.5,171,158.333C171,170.167,171,181.333,171,186.917L171,192.5" id="gdark2-L_C1_C2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C1_C2_0" data-points="W3sieCI6MTcxLCJ5IjoxMjEuNX0seyJ4IjoxNzEsInkiOjE1OX0seyJ4IjoxNzEsInkiOjE5Ni41fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M171,272.5L171,278.75C171,285,171,297.5,171,309.333C171,321.167,171,332.333,171,337.917L171,343.5" id="gdark2-L_C2_C3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C2_C3_0" data-points="W3sieCI6MTcxLCJ5IjoyNzIuNX0seyJ4IjoxNzEsInkiOjMxMH0seyJ4IjoxNzEsInkiOjM0Ny41fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_C1_C2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C2_C3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark2-d2-flowchart-C1-4" data-look="classic" transform="translate(171, 83.5)"><rect class="basic label-container" style="" x="-53.5390625" y="-38" width="107.078125" height="76"></rect><g class="label" style="" transform="translate(-25.5390625, -24)"><rect></rect><foreignObject width="51.078125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>SSH<br/><i>neither</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-C2-5" data-look="classic" transform="translate(171, 234.5)"><rect class="basic label-container" style="" x="-125.8828125" y="-38" width="251.765625" height="76"></rect><g class="label" style="" transform="translate(-97.8828125, -24)"><rect></rect><foreignObject width="195.765625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>rides the local path<br/>wearing a connectionId tag</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-C3-7" data-look="classic" transform="translate(171, 397.5)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>~390 remoteness branches<br/>+ 25 instanceof checks</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(0, 527)"><g class="clusters"><g class="cluster " id="gdark2-GOOD" data-look="classic"><rect style="" x="8" y="8" width="579.28125" height="302"></rect><g class="cluster-label " transform="translate(253.828125, 8)"><foreignObject width="87.625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>works today</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M151.016,121.5L151.016,127.75C151.016,134,151.016,146.5,151.016,158.333C151.016,170.167,151.016,181.333,151.016,186.917L151.016,192.5" id="gdark2-L_A1_A2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A1_A2_0" data-points="W3sieCI6MTUxLjAxNTYyNSwieSI6MTIxLjV9LHsieCI6MTUxLjAxNTYyNSwieSI6MTU5fSx7IngiOjE1MS4wMTU2MjUsInkiOjE5Ni41fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M430.656,121.5L430.656,127.75C430.656,134,430.656,146.5,430.656,158.333C430.656,170.167,430.656,181.333,430.656,186.917L430.656,192.5" id="gdark2-L_B1_B2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B1_B2_0" data-points="W3sieCI6NDMwLjY1NjI1LCJ5IjoxMjEuNX0seyJ4Ijo0MzAuNjU2MjUsInkiOjE1OX0seyJ4Ijo0MzAuNjU2MjUsInkiOjE5Ni41fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A1_A2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B1_B2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark2-d2-flowchart-A1-0" data-look="classic" transform="translate(151.015625, 83.5)"><rect class="basic label-container" style="" x="-68.1171875" y="-38" width="136.234375" height="76"></rect><g class="label" style="" transform="translate(-40.1171875, -24)"><rect></rect><foreignObject width="80.234375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>daemon<br/><i>substitutes</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-A2-1" data-look="classic" transform="translate(151.015625, 234.5)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-108.015625" y="-38" width="216.03125" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-80.015625, -24)"><rect></rect><foreignObject width="160.03125" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>swap the provider slot<br/><b>0 branches added</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-B1-2" data-look="classic" transform="translate(430.65625, 83.5)"><rect class="basic label-container" style="" x="-80.546875" y="-38" width="161.09375" height="76"></rect><g class="label" style="" transform="translate(-52.546875, -24)"><rect></rect><foreignObject width="105.09375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>paired runtime<br/><i>encapsulates</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-B2-3" data-look="classic" transform="translate(430.65625, 234.5)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-121.625" y="-38" width="243.25" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-93.625, -24)"><rect></rect><foreignObject width="187.25" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>hidden behind a transport<br/><b>mostly negative guards</b></p></span></div></foreignObject></g></g></g></g></g></g></g><defs><filter id="gdark2-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark2-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark2-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault2" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 595.28125 845" role="graphics-document document" aria-roledescription="l2-flowchart-v2"><style>#gdefault2{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault2 .error-icon{fill:#552222;}#gdefault2 .error-text{fill:#552222;stroke:#552222;}#gdefault2 .edge-thickness-normal{stroke-width:1px;}#gdefault2 .edge-thickness-thick{stroke-width:3.5px;}#gdefault2 .edge-pattern-solid{stroke-dasharray:0;}#gdefault2 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault2 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault2 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault2 .marker{fill:#333333;stroke:#333333;}#gdefault2 .marker.cross{stroke:#333333;}#gdefault2 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault2 p{margin:0;}#gdefault2 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault2 .cluster-label text{fill:#333;}#gdefault2 .cluster-label span{color:#333;}#gdefault2 .cluster-label span p{background-color:transparent;}#gdefault2 .label text,#gdefault2 span{fill:#333;color:#333;}#gdefault2 .node rect,#gdefault2 .node circle,#gdefault2 .node ellipse,#gdefault2 .node polygon,#gdefault2 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault2 .rough-node .label text,#gdefault2 .node .label text,#gdefault2 .image-shape .label,#gdefault2 .icon-shape .label{text-anchor:middle;}#gdefault2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault2 .rough-node .label,#gdefault2 .node .label,#gdefault2 .image-shape .label,#gdefault2 .icon-shape .label{text-align:center;}#gdefault2 .node.clickable{cursor:pointer;}#gdefault2 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault2 .arrowheadPath{fill:#333333;}#gdefault2 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault2 .l2-flowchart-link{stroke:#333333;fill:none;}#gdefault2 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault2 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault2 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault2 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault2 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault2 .cluster text{fill:#333;}#gdefault2 .cluster span{color:#333;}#gdefault2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault2 rect.text{fill:none;stroke-width:0;}#gdefault2 .icon-shape,#gdefault2 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault2 .icon-shape p,#gdefault2 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault2 .icon-shape .label rect,#gdefault2 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault2 .node .neo-node{stroke:#9370DB;}#gdefault2 [data-look="neo"].node rect,#gdefault2 [data-look="neo"].cluster rect,#gdefault2 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault2 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault2 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault2 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault2 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault2_l2-flowchart-v2-pointEnd" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointStart" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointEnd-margin" class="marker l2-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointStart-margin" class="marker l2-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault2_l2-flowchart-v2-circleEnd" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleStart" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleEnd-margin" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleStart-margin" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-crossEnd" class="marker cross l2-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossStart" class="marker cross l2-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossEnd-margin" class="marker cross l2-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossStart-margin" class="marker cross l2-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"></g><g class="edgeLabels"></g><g class="nodes"><g class="root" transform="translate(126.640625, 0)"><g class="clusters"><g class="cluster " id="gdefault2-BAD" data-look="classic"><rect style="" x="8" y="8" width="326" height="477"></rect><g class="cluster-label " transform="translate(121.9765625, 8)"><foreignObject width="98.046875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>the exception</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M171,121.5L171,127.75C171,134,171,146.5,171,158.333C171,170.167,171,181.333,171,186.917L171,192.5" id="gdefault2-L_C1_C2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C1_C2_0" data-points="W3sieCI6MTcxLCJ5IjoxMjEuNX0seyJ4IjoxNzEsInkiOjE1OX0seyJ4IjoxNzEsInkiOjE5Ni41fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M171,272.5L171,278.75C171,285,171,297.5,171,309.333C171,321.167,171,332.333,171,337.917L171,343.5" id="gdefault2-L_C2_C3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C2_C3_0" data-points="W3sieCI6MTcxLCJ5IjoyNzIuNX0seyJ4IjoxNzEsInkiOjMxMH0seyJ4IjoxNzEsInkiOjM0Ny41fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_C1_C2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C2_C3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault2-l2-flowchart-C1-4" data-look="classic" transform="translate(171, 83.5)"><rect class="basic label-container" style="" x="-53.5390625" y="-38" width="107.078125" height="76"></rect><g class="label" style="" transform="translate(-25.5390625, -24)"><rect></rect><foreignObject width="51.078125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>SSH<br/><i>neither</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-C2-5" data-look="classic" transform="translate(171, 234.5)"><rect class="basic label-container" style="" x="-125.8828125" y="-38" width="251.765625" height="76"></rect><g class="label" style="" transform="translate(-97.8828125, -24)"><rect></rect><foreignObject width="195.765625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>rides the local path<br/>wearing a connectionId tag</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-C3-7" data-look="classic" transform="translate(171, 397.5)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>~390 remoteness branches<br/>+ 25 instanceof checks</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(0, 527)"><g class="clusters"><g class="cluster " id="gdefault2-GOOD" data-look="classic"><rect style="" x="8" y="8" width="579.28125" height="302"></rect><g class="cluster-label " transform="translate(253.828125, 8)"><foreignObject width="87.625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>works today</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M151.016,121.5L151.016,127.75C151.016,134,151.016,146.5,151.016,158.333C151.016,170.167,151.016,181.333,151.016,186.917L151.016,192.5" id="gdefault2-L_A1_A2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A1_A2_0" data-points="W3sieCI6MTUxLjAxNTYyNSwieSI6MTIxLjV9LHsieCI6MTUxLjAxNTYyNSwieSI6MTU5fSx7IngiOjE1MS4wMTU2MjUsInkiOjE5Ni41fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M430.656,121.5L430.656,127.75C430.656,134,430.656,146.5,430.656,158.333C430.656,170.167,430.656,181.333,430.656,186.917L430.656,192.5" id="gdefault2-L_B1_B2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B1_B2_0" data-points="W3sieCI6NDMwLjY1NjI1LCJ5IjoxMjEuNX0seyJ4Ijo0MzAuNjU2MjUsInkiOjE1OX0seyJ4Ijo0MzAuNjU2MjUsInkiOjE5Ni41fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A1_A2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B1_B2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault2-l2-flowchart-A1-0" data-look="classic" transform="translate(151.015625, 83.5)"><rect class="basic label-container" style="" x="-68.1171875" y="-38" width="136.234375" height="76"></rect><g class="label" style="" transform="translate(-40.1171875, -24)"><rect></rect><foreignObject width="80.234375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>daemon<br/><i>substitutes</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-A2-1" data-look="classic" transform="translate(151.015625, 234.5)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-108.015625" y="-38" width="216.03125" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-80.015625, -24)"><rect></rect><foreignObject width="160.03125" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>swap the provider slot<br/><b>0 branches added</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-B1-2" data-look="classic" transform="translate(430.65625, 83.5)"><rect class="basic label-container" style="" x="-80.546875" y="-38" width="161.09375" height="76"></rect><g class="label" style="" transform="translate(-52.546875, -24)"><rect></rect><foreignObject width="105.09375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>paired runtime<br/><i>encapsulates</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-B2-3" data-look="classic" transform="translate(430.65625, 234.5)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-121.625" y="-38" width="243.25" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-93.625, -24)"><rect></rect><foreignObject width="187.25" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>hidden behind a transport<br/><b>mostly negative guards</b></p></span></div></foreignObject></g></g></g></g></g></g></g><defs><filter id="gdefault2-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault2-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The daemon is a <strong>3,604-line provider that adds zero branches to the shared spine</strong>. SSH gets a second registry, and the tag then leaks outward as a condition ~390 call sites re-derive independently. Your instinct was not a preference — SSH is the only route that broke a pattern the codebase already implements correctly twice.</p>
+
+      <h2>4 · What I got wrong</h2>
+      <table>
+        <thead><tr><th>Claim</th><th>Status</th><th>Evidence</th></tr></thead>
+        <tbody>
+          <tr><td>“Identity compared with the wrong key” is the root cause</td><td><span class="pill no">Symptom</span></td><td>The real cause is one layer down — a transport with no delivery guarantee, and a tag instead of a substitution</td></tr>
+          <tr><td>My change consolidates</td><td><span class="pill no">Inverted</span></td><td>~310 of ~405 added lines are SSH-only special case; every new function in the largest file is lease machinery</td></tr>
+          <tr><td>The superseded-keystroke fence protects reconnect</td><td><span class="pill no">Inert there</span></td><td>Its maps have two writers, both spawn paths; relay reattach never populates them, so the guard permits every reattached PTY</td></tr>
+          <tr><td>“Less code proves a better design”</td><td><span class="pill mid">Too blunt</span></td><td>The right control-plane fix is roughly net-neutral in lines; the payoff is a dissolved failure class, not a smaller diff</td></tr>
+        </tbody>
+      </table>
+      <div class="callout bad">
+        <p><span class="k">The fence failure is the thesis in miniature</span></p>
+        <p>A guard placed on the shared spine silently does not apply to the one route that does not ride the spine. That is not a coding slip — it is the predicted failure mode of tag-based divergence, and it happened to me while I was writing the fix for it.</p>
+      </div>
+
+      <h2>5 · The control-plane defect</h2>
+      <p class="lede">Two questions, one record, keyed for neither.</p>
+      <figure>
+        <div class="bar"><span>The key inversion</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark3" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 505.546875 714" role="graphics-document document" aria-roledescription="d3-flowchart-v2"><style>#gdark3{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark3 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark3 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark3 .error-icon{fill:#a44141;}#gdark3 .error-text{fill:#ddd;stroke:#ddd;}#gdark3 .edge-thickness-normal{stroke-width:1px;}#gdark3 .edge-thickness-thick{stroke-width:3.5px;}#gdark3 .edge-pattern-solid{stroke-dasharray:0;}#gdark3 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark3 .edge-pattern-dashed{stroke-dasharray:3;}#gdark3 .edge-pattern-dotted{stroke-dasharray:2;}#gdark3 .marker{fill:lightgrey;stroke:lightgrey;}#gdark3 .marker.cross{stroke:lightgrey;}#gdark3 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark3 p{margin:0;}#gdark3 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark3 .cluster-label text{fill:#F9FFFE;}#gdark3 .cluster-label span{color:#F9FFFE;}#gdark3 .cluster-label span p{background-color:transparent;}#gdark3 .label text,#gdark3 span{fill:#ccc;color:#ccc;}#gdark3 .node rect,#gdark3 .node circle,#gdark3 .node ellipse,#gdark3 .node polygon,#gdark3 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark3 .rough-node .label text,#gdark3 .node .label text,#gdark3 .image-shape .label,#gdark3 .icon-shape .label{text-anchor:middle;}#gdark3 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark3 .rough-node .label,#gdark3 .node .label,#gdark3 .image-shape .label,#gdark3 .icon-shape .label{text-align:center;}#gdark3 .node.clickable{cursor:pointer;}#gdark3 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark3 .arrowheadPath{fill:lightgrey;}#gdark3 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark3 .d3-flowchart-link{stroke:lightgrey;fill:none;}#gdark3 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark3 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark3 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark3 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark3 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark3 .cluster text{fill:#F9FFFE;}#gdark3 .cluster span{color:#F9FFFE;}#gdark3 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark3 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark3 rect.text{fill:none;stroke-width:0;}#gdark3 .icon-shape,#gdark3 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark3 .icon-shape p,#gdark3 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark3 .icon-shape .label rect,#gdark3 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark3 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark3 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark3 .node .neo-node{stroke:#ccc;}#gdark3 [data-look="neo"].node rect,#gdark3 [data-look="neo"].cluster rect,#gdark3 [data-look="neo"].node polygon{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark3 [data-look="neo"].node path{stroke:url(#gdark3-gradient);stroke-width:1px;}#gdark3 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark3 [data-look="neo"].node circle{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark3 [data-look="neo"].icon-shape .icon{fill:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark3_d3-flowchart-v2-pointEnd" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointStart" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointEnd-margin" class="marker d3-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointStart-margin" class="marker d3-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark3_d3-flowchart-v2-circleEnd" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleStart" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleEnd-margin" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleStart-margin" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-crossEnd" class="marker cross d3-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossStart" class="marker cross d3-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossEnd-margin" class="marker cross d3-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossStart-margin" class="marker cross d3-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"><g class="cluster " id="gdark3-T" data-look="classic"><rect style="" x="29.4765625" y="184" width="427.7734375" height="174"></rect><g class="cluster-label " transform="translate(179.54296875, 184)"><foreignObject width="127.640625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>today: one record</p></span></div></foreignObject></g></g><g class="cluster " id="gdark3-Q" data-look="classic"><rect style="" x="8" y="8" width="489.546875" height="126"></rect><g class="cluster-label " transform="translate(169.3203125, 8)"><foreignObject width="166.90625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>two different questions</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M130.977,109L130.977,113.167C130.977,117.333,130.977,125.667,130.977,134C130.977,142.333,130.977,150.667,130.977,159C130.977,167.333,130.977,175.667,136.063,183.603C141.149,191.539,151.322,199.079,156.408,202.849L161.495,206.618" id="gdark3-L_Q1_L_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q1_L_0" data-points="W3sieCI6MTMwLjk3NjU2MjUsInkiOjEwOX0seyJ4IjoxMzAuOTc2NTYyNSwieSI6MTM0fSx7IngiOjEzMC45NzY1NjI1LCJ5IjoxNTl9LHsieCI6MTMwLjk3NjU2MjUsInkiOjE4NH0seyJ4IjoxNjQuNzA4Mzc4MjMyNzU4NiwieSI6MjA5fV0=" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M365.75,109L365.75,113.167C365.75,117.333,365.75,125.667,365.75,134C365.75,142.333,365.75,150.667,365.75,159C365.75,167.333,365.75,175.667,360.664,183.603C355.577,191.539,345.405,199.079,340.318,202.849L335.232,206.618" id="gdark3-L_Q2_L_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q2_L_0" data-points="W3sieCI6MzY1Ljc1LCJ5IjoxMDl9LHsieCI6MzY1Ljc1LCJ5IjoxMzR9LHsieCI6MzY1Ljc1LCJ5IjoxNTl9LHsieCI6MzY1Ljc1LCJ5IjoxODR9LHsieCI6MzMyLjAxODE4NDI2NzI0MTQsInkiOjIwOX1d" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M248.363,333L248.363,337.167C248.363,341.333,248.363,349.667,248.363,358C248.363,366.333,248.363,374.667,248.363,382.333C248.363,390,248.363,397,248.363,400.5L248.363,404" id="gdark3-L_L_P_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_L_P_0" data-points="W3sieCI6MjQ4LjM2MzI4MTI1LCJ5IjozMzN9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5IjozNTh9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5IjozODN9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5Ijo0MDh9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M248.363,556L248.363,560.167C248.363,564.333,248.363,572.667,248.363,580.333C248.363,588,248.363,595,248.363,598.5L248.363,602" id="gdark3-L_P_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_N_0" data-points="W3sieCI6MjQ4LjM2MzI4MTI1LCJ5Ijo1NTZ9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5Ijo1ODF9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5Ijo2MDZ9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_Q1_L_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q2_L_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_L_P_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_P_N_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark3-d3-flowchart-Q1-0" data-look="classic" transform="translate(130.9765625, 71)"><rect class="basic label-container" style="" x="-87.9765625" y="-38" width="175.953125" height="76"></rect><g class="label" style="" transform="translate(-59.9765625, -24)"><rect></rect><foreignObject width="119.953125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which shell does<br/>this pane own?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-Q2-1" data-look="classic" transform="translate(365.75, 71)"><rect class="basic label-container" style="" x="-96.796875" y="-38" width="193.59375" height="76"></rect><g class="label" style="" transform="translate(-68.796875, -24)"><rect></rect><foreignObject width="137.59375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which shells exist<br/>that nobody owns?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-L-2" data-look="classic" transform="translate(248.36328125, 271)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>lease<br/>keyed by (target, ptyId)<br/><i>pane identity is optional payload</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-P-8" data-look="classic" transform="translate(248.36328125, 482)"><rect class="basic label-container" style="" x="-128" y="-74" width="256" height="148"></rect><g class="label" style="" transform="translate(-100, -60)"><rect></rect><foreignObject width="200" height="120"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>pane uniqueness is not structural<br/>→ bolt on supersession, ranking,<br/>rollback, dual matchers</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-N-10" data-look="classic" transform="translate(248.36328125, 656)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>~374 lines of reconciliation<br/>9 states where records disagree</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark3-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark3-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark3-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault3" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 505.546875 714" role="graphics-document document" aria-roledescription="l3-flowchart-v2"><style>#gdefault3{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault3 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault3 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault3 .error-icon{fill:#552222;}#gdefault3 .error-text{fill:#552222;stroke:#552222;}#gdefault3 .edge-thickness-normal{stroke-width:1px;}#gdefault3 .edge-thickness-thick{stroke-width:3.5px;}#gdefault3 .edge-pattern-solid{stroke-dasharray:0;}#gdefault3 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault3 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault3 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault3 .marker{fill:#333333;stroke:#333333;}#gdefault3 .marker.cross{stroke:#333333;}#gdefault3 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault3 p{margin:0;}#gdefault3 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault3 .cluster-label text{fill:#333;}#gdefault3 .cluster-label span{color:#333;}#gdefault3 .cluster-label span p{background-color:transparent;}#gdefault3 .label text,#gdefault3 span{fill:#333;color:#333;}#gdefault3 .node rect,#gdefault3 .node circle,#gdefault3 .node ellipse,#gdefault3 .node polygon,#gdefault3 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault3 .rough-node .label text,#gdefault3 .node .label text,#gdefault3 .image-shape .label,#gdefault3 .icon-shape .label{text-anchor:middle;}#gdefault3 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault3 .rough-node .label,#gdefault3 .node .label,#gdefault3 .image-shape .label,#gdefault3 .icon-shape .label{text-align:center;}#gdefault3 .node.clickable{cursor:pointer;}#gdefault3 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault3 .arrowheadPath{fill:#333333;}#gdefault3 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault3 .l3-flowchart-link{stroke:#333333;fill:none;}#gdefault3 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault3 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault3 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault3 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault3 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault3 .cluster text{fill:#333;}#gdefault3 .cluster span{color:#333;}#gdefault3 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault3 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault3 rect.text{fill:none;stroke-width:0;}#gdefault3 .icon-shape,#gdefault3 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault3 .icon-shape p,#gdefault3 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault3 .icon-shape .label rect,#gdefault3 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault3 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault3 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault3 .node .neo-node{stroke:#9370DB;}#gdefault3 [data-look="neo"].node rect,#gdefault3 [data-look="neo"].cluster rect,#gdefault3 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault3 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault3 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault3 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault3 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault3_l3-flowchart-v2-pointEnd" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointStart" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointEnd-margin" class="marker l3-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointStart-margin" class="marker l3-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault3_l3-flowchart-v2-circleEnd" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleStart" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleEnd-margin" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleStart-margin" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-crossEnd" class="marker cross l3-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossStart" class="marker cross l3-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossEnd-margin" class="marker cross l3-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossStart-margin" class="marker cross l3-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"><g class="cluster " id="gdefault3-T" data-look="classic"><rect style="" x="29.4765625" y="184" width="427.7734375" height="174"></rect><g class="cluster-label " transform="translate(179.54296875, 184)"><foreignObject width="127.640625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>today: one record</p></span></div></foreignObject></g></g><g class="cluster " id="gdefault3-Q" data-look="classic"><rect style="" x="8" y="8" width="489.546875" height="126"></rect><g class="cluster-label " transform="translate(169.3203125, 8)"><foreignObject width="166.90625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>two different questions</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M130.977,109L130.977,113.167C130.977,117.333,130.977,125.667,130.977,134C130.977,142.333,130.977,150.667,130.977,159C130.977,167.333,130.977,175.667,136.063,183.603C141.149,191.539,151.322,199.079,156.408,202.849L161.495,206.618" id="gdefault3-L_Q1_L_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q1_L_0" data-points="W3sieCI6MTMwLjk3NjU2MjUsInkiOjEwOX0seyJ4IjoxMzAuOTc2NTYyNSwieSI6MTM0fSx7IngiOjEzMC45NzY1NjI1LCJ5IjoxNTl9LHsieCI6MTMwLjk3NjU2MjUsInkiOjE4NH0seyJ4IjoxNjQuNzA4Mzc4MjMyNzU4NiwieSI6MjA5fV0=" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M365.75,109L365.75,113.167C365.75,117.333,365.75,125.667,365.75,134C365.75,142.333,365.75,150.667,365.75,159C365.75,167.333,365.75,175.667,360.664,183.603C355.577,191.539,345.405,199.079,340.318,202.849L335.232,206.618" id="gdefault3-L_Q2_L_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q2_L_0" data-points="W3sieCI6MzY1Ljc1LCJ5IjoxMDl9LHsieCI6MzY1Ljc1LCJ5IjoxMzR9LHsieCI6MzY1Ljc1LCJ5IjoxNTl9LHsieCI6MzY1Ljc1LCJ5IjoxODR9LHsieCI6MzMyLjAxODE4NDI2NzI0MTQsInkiOjIwOX1d" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M248.363,333L248.363,337.167C248.363,341.333,248.363,349.667,248.363,358C248.363,366.333,248.363,374.667,248.363,382.333C248.363,390,248.363,397,248.363,400.5L248.363,404" id="gdefault3-L_L_P_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_L_P_0" data-points="W3sieCI6MjQ4LjM2MzI4MTI1LCJ5IjozMzN9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5IjozNTh9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5IjozODN9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5Ijo0MDh9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M248.363,556L248.363,560.167C248.363,564.333,248.363,572.667,248.363,580.333C248.363,588,248.363,595,248.363,598.5L248.363,602" id="gdefault3-L_P_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_N_0" data-points="W3sieCI6MjQ4LjM2MzI4MTI1LCJ5Ijo1NTZ9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5Ijo1ODF9LHsieCI6MjQ4LjM2MzI4MTI1LCJ5Ijo2MDZ9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_Q1_L_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q2_L_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_L_P_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_P_N_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault3-l3-flowchart-Q1-0" data-look="classic" transform="translate(130.9765625, 71)"><rect class="basic label-container" style="" x="-87.9765625" y="-38" width="175.953125" height="76"></rect><g class="label" style="" transform="translate(-59.9765625, -24)"><rect></rect><foreignObject width="119.953125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which shell does<br/>this pane own?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-Q2-1" data-look="classic" transform="translate(365.75, 71)"><rect class="basic label-container" style="" x="-96.796875" y="-38" width="193.59375" height="76"></rect><g class="label" style="" transform="translate(-68.796875, -24)"><rect></rect><foreignObject width="137.59375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which shells exist<br/>that nobody owns?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-L-2" data-look="classic" transform="translate(248.36328125, 271)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>lease<br/>keyed by (target, ptyId)<br/><i>pane identity is optional payload</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-P-8" data-look="classic" transform="translate(248.36328125, 482)"><rect class="basic label-container" style="" x="-128" y="-74" width="256" height="148"></rect><g class="label" style="" transform="translate(-100, -60)"><rect></rect><foreignObject width="200" height="120"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>pane uniqueness is not structural<br/>→ bolt on supersession, ranking,<br/>rollback, dual matchers</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-N-10" data-look="classic" transform="translate(248.36328125, 656)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>~374 lines of reconciliation<br/>9 states where records disagree</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault3-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault3-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>Because the lease is keyed by shell rather than pane, “one pane, one live shell” is not expressible — it has to be <em>enforced</em>. My +209 lines are that enforcement: supersession, rank comparison, deferral, rollback. They exist only to compensate for the key.</p>
+
+      <h3>Why the obvious fixes are both wrong</h3>
+      <table>
+        <thead><tr><th>Proposal</th><th>Verdict</th><th>Why</th></tr></thead>
+        <tbody>
+          <tr><td>Merge the lease into the pane binding</td><td><span class="pill no">Blocked</span></td><td>A lease must be able to name a live shell <em>no pane owns</em>, and must <em>outlive</em> the binding — expiry deletes the binding, then authorizes recovery for 30s</td></tr>
+          <tr><td>Delete the lease; let the host be authoritative</td><td><span class="pill no">Refuted</span></td><td>See below — tested adversarially and it failed on all five probes</td></tr>
+        </tbody>
+      </table>
+      <figure>
+        <div class="bar"><span>Why the host cannot be the authority</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark4" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 884 641.75" role="graphics-document document" aria-roledescription="d4-flowchart-v2"><style>#gdark4{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark4 .error-icon{fill:#a44141;}#gdark4 .error-text{fill:#ddd;stroke:#ddd;}#gdark4 .edge-thickness-normal{stroke-width:1px;}#gdark4 .edge-thickness-thick{stroke-width:3.5px;}#gdark4 .edge-pattern-solid{stroke-dasharray:0;}#gdark4 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark4 .edge-pattern-dashed{stroke-dasharray:3;}#gdark4 .edge-pattern-dotted{stroke-dasharray:2;}#gdark4 .marker{fill:lightgrey;stroke:lightgrey;}#gdark4 .marker.cross{stroke:lightgrey;}#gdark4 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark4 p{margin:0;}#gdark4 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark4 .cluster-label text{fill:#F9FFFE;}#gdark4 .cluster-label span{color:#F9FFFE;}#gdark4 .cluster-label span p{background-color:transparent;}#gdark4 .label text,#gdark4 span{fill:#ccc;color:#ccc;}#gdark4 .node rect,#gdark4 .node circle,#gdark4 .node ellipse,#gdark4 .node polygon,#gdark4 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark4 .rough-node .label text,#gdark4 .node .label text,#gdark4 .image-shape .label,#gdark4 .icon-shape .label{text-anchor:middle;}#gdark4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark4 .rough-node .label,#gdark4 .node .label,#gdark4 .image-shape .label,#gdark4 .icon-shape .label{text-align:center;}#gdark4 .node.clickable{cursor:pointer;}#gdark4 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark4 .arrowheadPath{fill:lightgrey;}#gdark4 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark4 .d4-flowchart-link{stroke:lightgrey;fill:none;}#gdark4 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark4 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark4 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark4 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark4 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark4 .cluster text{fill:#F9FFFE;}#gdark4 .cluster span{color:#F9FFFE;}#gdark4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark4 rect.text{fill:none;stroke-width:0;}#gdark4 .icon-shape,#gdark4 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark4 .icon-shape p,#gdark4 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark4 .icon-shape .label rect,#gdark4 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark4 .node .neo-node{stroke:#ccc;}#gdark4 [data-look="neo"].node rect,#gdark4 [data-look="neo"].cluster rect,#gdark4 [data-look="neo"].node polygon{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark4 [data-look="neo"].node path{stroke:url(#gdark4-gradient);stroke-width:1px;}#gdark4 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark4 [data-look="neo"].node circle{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark4 [data-look="neo"].icon-shape .icon{fill:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark4_d4-flowchart-v2-pointEnd" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointStart" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointEnd-margin" class="marker d4-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointStart-margin" class="marker d4-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark4_d4-flowchart-v2-circleEnd" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleStart" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleEnd-margin" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleStart-margin" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-crossEnd" class="marker cross d4-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossStart" class="marker cross d4-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossEnd-margin" class="marker cross d4-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossStart-margin" class="marker cross d4-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M335,68.029L301.833,74.858C268.667,81.686,202.333,95.343,169.167,109.619C136,123.896,136,138.792,136,146.24L136,153.688" id="gdark4-L_H_A_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_H_A_0" data-points="W3sieCI6MzM1LCJ5Ijo2OC4wMjk0MTE3NjQ3MDU4OH0seyJ4IjoxMzYsInkiOjEwOX0seyJ4IjoxMzYsInkiOjE1Ny42ODc1fV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M136,364.063L136,374.177C136,384.292,136,404.521,136,426.135C136,447.75,136,470.75,136,482.25L136,493.75" id="gdark4-L_A_A1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_A1_0" data-points="W3sieCI6MTM2LCJ5IjozNjQuMDYyNX0seyJ4IjoxMzYsInkiOjQyNC43NX0seyJ4IjoxMzYsInkiOjQ5Ny43NX1d" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M442,84L442,88.167C442,92.333,442,100.667,442,108.333C442,116,442,123,442,126.5L442,130" id="gdark4-L_H_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_H_B_0" data-points="W3sieCI6NDQyLCJ5Ijo4NH0seyJ4Ijo0NDIsInkiOjEwOX0seyJ4Ijo0NDIsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M442,387.75L442,393.917C442,400.083,442,412.417,442,424.083C442,435.75,442,446.75,442,452.25L442,457.75" id="gdark4-L_B_B1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_B1_0" data-points="W3sieCI6NDQyLCJ5IjozODcuNzV9LHsieCI6NDQyLCJ5Ijo0MjQuNzV9LHsieCI6NDQyLCJ5Ijo0NjEuNzV9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M549,68.029L582.167,74.858C615.333,81.686,681.667,95.343,714.833,107.929C748,120.516,748,132.031,748,137.789L748,143.547" id="gdark4-L_H_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_H_C_0" data-points="W3sieCI6NTQ5LCJ5Ijo2OC4wMjk0MTE3NjQ3MDU4OH0seyJ4Ijo3NDgsInkiOjEwOX0seyJ4Ijo3NDgsInkiOjE0Ny41NDY4NzV9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M748,374.203L748,382.628C748,391.052,748,407.901,748,423.826C748,439.75,748,454.75,748,462.25L748,469.75" id="gdark4-L_C_C1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_C1_0" data-points="W3sieCI6NzQ4LCJ5IjozNzQuMjAzMTI1fSx7IngiOjc0OCwieSI6NDI0Ljc1fSx7IngiOjc0OCwieSI6NDczLjc1fV0=" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_H_A_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(136, 424.75)"><g class="label" data-id="L_A_A1_0" transform="translate(-9.0859375, -12)"><foreignObject width="18.171875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no</p></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_H_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(442, 424.75)"><g class="label" data-id="L_B_B1_0" transform="translate(-9.0859375, -12)"><foreignObject width="18.171875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no</p></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_H_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(748, 424.75)"><g class="label" data-id="L_C_C1_0" transform="translate(-9.0859375, -12)"><foreignObject width="18.171875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark4-d4-flowchart-H-0" data-look="classic" transform="translate(442, 46)"><rect class="basic label-container" style="" x="-107" y="-38" width="214" height="76"></rect><g class="label" style="" transform="translate(-79, -24)"><rect></rect><foreignObject width="158" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>make the remote host<br/>the source of truth</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-A-1" data-look="classic" transform="translate(136, 260.875)"><polygon points="103.1875,0 206.375,-103.1875 103.1875,-206.375 0,-103.1875" class="label-container" transform="translate(-102.6875, 103.1875)"></polygon><g class="label" style="" transform="translate(-65.1875, -24)"><rect></rect><foreignObject width="130.375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>does it hold<br/>the state durably?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-A1-3" data-look="classic" transform="translate(136, 547.75)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>PTY table is an in-memory Map<br/>no persistence layer at all</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-B-5" data-look="classic" transform="translate(442, 260.875)"><polygon points="126.875,0 253.75,-126.875 126.875,-253.75 0,-126.875" class="label-container" transform="translate(-126.375, 126.875)"></polygon><g class="label" style="" transform="translate(-88.875, -24)"><rect></rect><foreignObject width="177.75" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>can the client<br/>read pane identity back?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-B1-7" data-look="classic" transform="translate(442, 547.75)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-128" y="-86" width="256" height="172"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -72)"><rect></rect><foreignObject width="200" height="144"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>listProcesses and attach never return it<br/>attach only compares, then throws<br/>the one RPC that returns it has 0 callers</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-C-9" data-look="classic" transform="translate(748, 260.875)"><polygon points="113.328125,0 226.65625,-113.328125 113.328125,-226.65625 0,-113.328125" class="label-container" transform="translate(-112.828125, 113.328125)"></polygon><g class="label" style="" transform="translate(-75.328125, -24)"><rect></rect><foreignObject width="150.65625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>is the host reachable<br/>when it matters?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-C1-11" data-look="classic" transform="translate(748, 547.75)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-128" y="-74" width="256" height="148"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -60)"><rect></rect><foreignObject width="200" height="120"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>the decisive one:<br/>a <b>synchronous</b> disk read during quit<br/>cannot become an RPC to a host that is down</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark4-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark4-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark4-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault4" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 884 641.75" role="graphics-document document" aria-roledescription="l4-flowchart-v2"><style>#gdefault4{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault4 .error-icon{fill:#552222;}#gdefault4 .error-text{fill:#552222;stroke:#552222;}#gdefault4 .edge-thickness-normal{stroke-width:1px;}#gdefault4 .edge-thickness-thick{stroke-width:3.5px;}#gdefault4 .edge-pattern-solid{stroke-dasharray:0;}#gdefault4 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault4 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault4 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault4 .marker{fill:#333333;stroke:#333333;}#gdefault4 .marker.cross{stroke:#333333;}#gdefault4 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault4 p{margin:0;}#gdefault4 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault4 .cluster-label text{fill:#333;}#gdefault4 .cluster-label span{color:#333;}#gdefault4 .cluster-label span p{background-color:transparent;}#gdefault4 .label text,#gdefault4 span{fill:#333;color:#333;}#gdefault4 .node rect,#gdefault4 .node circle,#gdefault4 .node ellipse,#gdefault4 .node polygon,#gdefault4 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault4 .rough-node .label text,#gdefault4 .node .label text,#gdefault4 .image-shape .label,#gdefault4 .icon-shape .label{text-anchor:middle;}#gdefault4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault4 .rough-node .label,#gdefault4 .node .label,#gdefault4 .image-shape .label,#gdefault4 .icon-shape .label{text-align:center;}#gdefault4 .node.clickable{cursor:pointer;}#gdefault4 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault4 .arrowheadPath{fill:#333333;}#gdefault4 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault4 .l4-flowchart-link{stroke:#333333;fill:none;}#gdefault4 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault4 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault4 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault4 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault4 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault4 .cluster text{fill:#333;}#gdefault4 .cluster span{color:#333;}#gdefault4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault4 rect.text{fill:none;stroke-width:0;}#gdefault4 .icon-shape,#gdefault4 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault4 .icon-shape p,#gdefault4 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault4 .icon-shape .label rect,#gdefault4 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault4 .node .neo-node{stroke:#9370DB;}#gdefault4 [data-look="neo"].node rect,#gdefault4 [data-look="neo"].cluster rect,#gdefault4 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault4 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault4 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault4 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault4 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault4_l4-flowchart-v2-pointEnd" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointStart" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointEnd-margin" class="marker l4-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointStart-margin" class="marker l4-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault4_l4-flowchart-v2-circleEnd" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleStart" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleEnd-margin" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleStart-margin" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-crossEnd" class="marker cross l4-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossStart" class="marker cross l4-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossEnd-margin" class="marker cross l4-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossStart-margin" class="marker cross l4-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M335,68.029L301.833,74.858C268.667,81.686,202.333,95.343,169.167,109.619C136,123.896,136,138.792,136,146.24L136,153.688" id="gdefault4-L_H_A_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_H_A_0" data-points="W3sieCI6MzM1LCJ5Ijo2OC4wMjk0MTE3NjQ3MDU4OH0seyJ4IjoxMzYsInkiOjEwOX0seyJ4IjoxMzYsInkiOjE1Ny42ODc1fV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M136,364.063L136,374.177C136,384.292,136,404.521,136,426.135C136,447.75,136,470.75,136,482.25L136,493.75" id="gdefault4-L_A_A1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_A1_0" data-points="W3sieCI6MTM2LCJ5IjozNjQuMDYyNX0seyJ4IjoxMzYsInkiOjQyNC43NX0seyJ4IjoxMzYsInkiOjQ5Ny43NX1d" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M442,84L442,88.167C442,92.333,442,100.667,442,108.333C442,116,442,123,442,126.5L442,130" id="gdefault4-L_H_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_H_B_0" data-points="W3sieCI6NDQyLCJ5Ijo4NH0seyJ4Ijo0NDIsInkiOjEwOX0seyJ4Ijo0NDIsInkiOjEzNH1d" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M442,387.75L442,393.917C442,400.083,442,412.417,442,424.083C442,435.75,442,446.75,442,452.25L442,457.75" id="gdefault4-L_B_B1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_B1_0" data-points="W3sieCI6NDQyLCJ5IjozODcuNzV9LHsieCI6NDQyLCJ5Ijo0MjQuNzV9LHsieCI6NDQyLCJ5Ijo0NjEuNzV9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M549,68.029L582.167,74.858C615.333,81.686,681.667,95.343,714.833,107.929C748,120.516,748,132.031,748,137.789L748,143.547" id="gdefault4-L_H_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_H_C_0" data-points="W3sieCI6NTQ5LCJ5Ijo2OC4wMjk0MTE3NjQ3MDU4OH0seyJ4Ijo3NDgsInkiOjEwOX0seyJ4Ijo3NDgsInkiOjE0Ny41NDY4NzV9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M748,374.203L748,382.628C748,391.052,748,407.901,748,423.826C748,439.75,748,454.75,748,462.25L748,469.75" id="gdefault4-L_C_C1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_C1_0" data-points="W3sieCI6NzQ4LCJ5IjozNzQuMjAzMTI1fSx7IngiOjc0OCwieSI6NDI0Ljc1fSx7IngiOjc0OCwieSI6NDczLjc1fV0=" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_H_A_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(136, 424.75)"><g class="label" data-id="L_A_A1_0" transform="translate(-9.0859375, -12)"><foreignObject width="18.171875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no</p></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_H_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(442, 424.75)"><g class="label" data-id="L_B_B1_0" transform="translate(-9.0859375, -12)"><foreignObject width="18.171875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no</p></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_H_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(748, 424.75)"><g class="label" data-id="L_C_C1_0" transform="translate(-9.0859375, -12)"><foreignObject width="18.171875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault4-l4-flowchart-H-0" data-look="classic" transform="translate(442, 46)"><rect class="basic label-container" style="" x="-107" y="-38" width="214" height="76"></rect><g class="label" style="" transform="translate(-79, -24)"><rect></rect><foreignObject width="158" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>make the remote host<br/>the source of truth</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-A-1" data-look="classic" transform="translate(136, 260.875)"><polygon points="103.1875,0 206.375,-103.1875 103.1875,-206.375 0,-103.1875" class="label-container" transform="translate(-102.6875, 103.1875)"></polygon><g class="label" style="" transform="translate(-65.1875, -24)"><rect></rect><foreignObject width="130.375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>does it hold<br/>the state durably?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-A1-3" data-look="classic" transform="translate(136, 547.75)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-128" y="-50" width="256" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -36)"><rect></rect><foreignObject width="200" height="72"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>PTY table is an in-memory Map<br/>no persistence layer at all</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-B-5" data-look="classic" transform="translate(442, 260.875)"><polygon points="126.875,0 253.75,-126.875 126.875,-253.75 0,-126.875" class="label-container" transform="translate(-126.375, 126.875)"></polygon><g class="label" style="" transform="translate(-88.875, -24)"><rect></rect><foreignObject width="177.75" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>can the client<br/>read pane identity back?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-B1-7" data-look="classic" transform="translate(442, 547.75)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-128" y="-86" width="256" height="172"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -72)"><rect></rect><foreignObject width="200" height="144"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>listProcesses and attach never return it<br/>attach only compares, then throws<br/>the one RPC that returns it has 0 callers</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-C-9" data-look="classic" transform="translate(748, 260.875)"><polygon points="113.328125,0 226.65625,-113.328125 113.328125,-226.65625 0,-113.328125" class="label-container" transform="translate(-112.828125, 113.328125)"></polygon><g class="label" style="" transform="translate(-75.328125, -24)"><rect></rect><foreignObject width="150.65625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>is the host reachable<br/>when it matters?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-C1-11" data-look="classic" transform="translate(748, 547.75)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-128" y="-74" width="256" height="148"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -60)"><rect></rect><foreignObject width="200" height="120"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>the decisive one:<br/>a <b>synchronous</b> disk read during quit<br/>cannot become an RPC to a host that is down</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault4-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault4-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>I verified all three personally. The client-side record is load-bearing precisely <em>because</em> it works offline.</p>
+
+      <h2>6 · The proposed control-plane fix</h2>
+      <p class="lede">Don’t merge the records and don’t delete one. Give each question the key that answers it.</p>
+      <figure>
+        <div class="bar"><span>Split by question, not by transport</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark5" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 608.9140625 616" role="graphics-document document" aria-roledescription="d5-flowchart-v2"><style>#gdark5{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark5 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark5 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark5 .error-icon{fill:#a44141;}#gdark5 .error-text{fill:#ddd;stroke:#ddd;}#gdark5 .edge-thickness-normal{stroke-width:1px;}#gdark5 .edge-thickness-thick{stroke-width:3.5px;}#gdark5 .edge-pattern-solid{stroke-dasharray:0;}#gdark5 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark5 .edge-pattern-dashed{stroke-dasharray:3;}#gdark5 .edge-pattern-dotted{stroke-dasharray:2;}#gdark5 .marker{fill:lightgrey;stroke:lightgrey;}#gdark5 .marker.cross{stroke:lightgrey;}#gdark5 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark5 p{margin:0;}#gdark5 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark5 .cluster-label text{fill:#F9FFFE;}#gdark5 .cluster-label span{color:#F9FFFE;}#gdark5 .cluster-label span p{background-color:transparent;}#gdark5 .label text,#gdark5 span{fill:#ccc;color:#ccc;}#gdark5 .node rect,#gdark5 .node circle,#gdark5 .node ellipse,#gdark5 .node polygon,#gdark5 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark5 .rough-node .label text,#gdark5 .node .label text,#gdark5 .image-shape .label,#gdark5 .icon-shape .label{text-anchor:middle;}#gdark5 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark5 .rough-node .label,#gdark5 .node .label,#gdark5 .image-shape .label,#gdark5 .icon-shape .label{text-align:center;}#gdark5 .node.clickable{cursor:pointer;}#gdark5 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark5 .arrowheadPath{fill:lightgrey;}#gdark5 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark5 .d5-flowchart-link{stroke:lightgrey;fill:none;}#gdark5 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark5 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark5 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark5 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark5 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark5 .cluster text{fill:#F9FFFE;}#gdark5 .cluster span{color:#F9FFFE;}#gdark5 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark5 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark5 rect.text{fill:none;stroke-width:0;}#gdark5 .icon-shape,#gdark5 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark5 .icon-shape p,#gdark5 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark5 .icon-shape .label rect,#gdark5 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark5 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark5 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark5 .node .neo-node{stroke:#ccc;}#gdark5 [data-look="neo"].node rect,#gdark5 [data-look="neo"].cluster rect,#gdark5 [data-look="neo"].node polygon{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark5 [data-look="neo"].node path{stroke:url(#gdark5-gradient);stroke-width:1px;}#gdark5 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark5 [data-look="neo"].node circle{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark5 [data-look="neo"].icon-shape .icon{fill:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark5_d5-flowchart-v2-pointEnd" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointStart" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointEnd-margin" class="marker d5-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointStart-margin" class="marker d5-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark5_d5-flowchart-v2-circleEnd" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleStart" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleEnd-margin" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleStart-margin" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-crossEnd" class="marker cross d5-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossStart" class="marker cross d5-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossEnd-margin" class="marker cross d5-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossStart-margin" class="marker cross d5-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"><g class="cluster " id="gdark5-AFTER" data-look="classic"><rect style="" x="8" y="134" width="592.9140625" height="174"></rect><g class="cluster-label " transform="translate(287.46484375, 134)"><foreignObject width="33.984375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>after</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M171,84L171,88.167C171,92.333,171,100.667,171,109C171,117.333,171,125.667,171,133.333C171,141,171,148,171,151.5L171,155" id="gdark5-L_Q1_O_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q1_O_0" data-points="W3sieCI6MTcxLCJ5Ijo4NH0seyJ4IjoxNzEsInkiOjEwOX0seyJ4IjoxNzEsInkiOjEzNH0seyJ4IjoxNzEsInkiOjE1OX1d" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path><path d="M459.023,84L459.023,88.167C459.023,92.333,459.023,100.667,459.023,109C459.023,117.333,459.023,125.667,459.023,135.333C459.023,145,459.023,156,459.023,161.5L459.023,167" id="gdark5-L_Q2_I_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q2_I_0" data-points="W3sieCI6NDU5LjAyMzQzNzUsInkiOjg0fSx7IngiOjQ1OS4wMjM0Mzc1LCJ5IjoxMDl9LHsieCI6NDU5LjAyMzQzNzUsInkiOjEzNH0seyJ4Ijo0NTkuMDIzNDM3NSwieSI6MTcxfV0=" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path><path d="M171,283L171,287.167C171,291.333,171,299.667,171,308C171,316.333,171,324.667,171,332.333C171,340,171,347,171,350.5L171,354" id="gdark5-L_O_R1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_O_R1_0" data-points="W3sieCI6MTcxLCJ5IjoyODN9LHsieCI6MTcxLCJ5IjozMDh9LHsieCI6MTcxLCJ5IjozMzN9LHsieCI6MTcxLCJ5IjozNTh9XQ==" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path><path d="M459.023,271L459.023,277.167C459.023,283.333,459.023,295.667,459.023,306C459.023,316.333,459.023,324.667,459.023,332.333C459.023,340,459.023,347,459.023,350.5L459.023,354" id="gdark5-L_I_R2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_I_R2_0" data-points="W3sieCI6NDU5LjAyMzQzNzUsInkiOjI3MX0seyJ4Ijo0NTkuMDIzNDM3NSwieSI6MzA4fSx7IngiOjQ1OS4wMjM0Mzc1LCJ5IjozMzN9LHsieCI6NDU5LjAyMzQzNzUsInkiOjM1OH1d" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path><path d="M171,434L171,438.167C171,442.333,171,450.667,171,458.333C171,466,171,473,171,476.5L171,480" id="gdark5-L_R1_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R1_D_0" data-points="W3sieCI6MTcxLCJ5Ijo0MzR9LHsieCI6MTcxLCJ5Ijo0NTl9LHsieCI6MTcxLCJ5Ijo0ODR9XQ==" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_Q1_O_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q2_I_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_O_R1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_I_R2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R1_D_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark5-d5-flowchart-O-0" data-look="classic" transform="translate(171, 221)"><rect class="basic label-container" style="" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>OWNERSHIP<br/>keyed by (host, pane)<br/><i>same key local already uses</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-I-1" data-look="classic" transform="translate(459.0234375, 221)"><rect class="basic label-container" style="" x="-106.890625" y="-50" width="213.78125" height="100"></rect><g class="label" style="" transform="translate(-78.890625, -36)"><rect></rect><foreignObject width="157.78125" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>INVENTORY<br/>keyed by (host, ptyId)<br/><i>shells with no owner</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-Q1-2" data-look="classic" transform="translate(171, 46)"><rect class="basic label-container" style="" x="-87.9765625" y="-38" width="175.953125" height="76"></rect><g class="label" style="" transform="translate(-59.9765625, -24)"><rect></rect><foreignObject width="119.953125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which shell does<br/>this pane own?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-Q2-4" data-look="classic" transform="translate(459.0234375, 46)"><rect class="basic label-container" style="" x="-96.796875" y="-38" width="193.59375" height="76"></rect><g class="label" style="" transform="translate(-68.796875, -24)"><rect></rect><foreignObject width="137.59375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which shells exist<br/>that nobody owns?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-R1-7" data-look="classic" transform="translate(171, 396)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-120.296875" y="-38" width="240.59375" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-92.296875, -24)"><rect></rect><foreignObject width="184.59375" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>one pane, one shell<br/><b>structural, not enforced</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-R2-9" data-look="classic" transform="translate(459.0234375, 396)"><rect class="basic label-container" style="" x="-117.7265625" y="-38" width="235.453125" height="76"></rect><g class="label" style="" transform="translate(-89.7265625, -24)"><rect></rect><foreignObject width="179.453125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reattach work list ·<br/>disconnected cleanup UI</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-D-11" data-look="classic" transform="translate(171, 546)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#fff !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(255, 255, 255) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>supersession, ranking, rollback,<br/>dual matchers all become unnecessary</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark5-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark5-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark5-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault5" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 608.9140625 616" role="graphics-document document" aria-roledescription="l5-flowchart-v2"><style>#gdefault5{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault5 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault5 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault5 .error-icon{fill:#552222;}#gdefault5 .error-text{fill:#552222;stroke:#552222;}#gdefault5 .edge-thickness-normal{stroke-width:1px;}#gdefault5 .edge-thickness-thick{stroke-width:3.5px;}#gdefault5 .edge-pattern-solid{stroke-dasharray:0;}#gdefault5 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault5 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault5 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault5 .marker{fill:#333333;stroke:#333333;}#gdefault5 .marker.cross{stroke:#333333;}#gdefault5 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault5 p{margin:0;}#gdefault5 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault5 .cluster-label text{fill:#333;}#gdefault5 .cluster-label span{color:#333;}#gdefault5 .cluster-label span p{background-color:transparent;}#gdefault5 .label text,#gdefault5 span{fill:#333;color:#333;}#gdefault5 .node rect,#gdefault5 .node circle,#gdefault5 .node ellipse,#gdefault5 .node polygon,#gdefault5 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault5 .rough-node .label text,#gdefault5 .node .label text,#gdefault5 .image-shape .label,#gdefault5 .icon-shape .label{text-anchor:middle;}#gdefault5 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault5 .rough-node .label,#gdefault5 .node .label,#gdefault5 .image-shape .label,#gdefault5 .icon-shape .label{text-align:center;}#gdefault5 .node.clickable{cursor:pointer;}#gdefault5 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault5 .arrowheadPath{fill:#333333;}#gdefault5 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault5 .l5-flowchart-link{stroke:#333333;fill:none;}#gdefault5 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault5 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault5 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault5 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault5 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault5 .cluster text{fill:#333;}#gdefault5 .cluster span{color:#333;}#gdefault5 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault5 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault5 rect.text{fill:none;stroke-width:0;}#gdefault5 .icon-shape,#gdefault5 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault5 .icon-shape p,#gdefault5 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault5 .icon-shape .label rect,#gdefault5 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault5 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault5 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault5 .node .neo-node{stroke:#9370DB;}#gdefault5 [data-look="neo"].node rect,#gdefault5 [data-look="neo"].cluster rect,#gdefault5 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault5 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault5 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault5 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault5 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault5_l5-flowchart-v2-pointEnd" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointStart" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointEnd-margin" class="marker l5-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointStart-margin" class="marker l5-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault5_l5-flowchart-v2-circleEnd" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleStart" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleEnd-margin" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleStart-margin" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-crossEnd" class="marker cross l5-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossStart" class="marker cross l5-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossEnd-margin" class="marker cross l5-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossStart-margin" class="marker cross l5-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"><g class="cluster " id="gdefault5-AFTER" data-look="classic"><rect style="" x="8" y="134" width="592.9140625" height="174"></rect><g class="cluster-label " transform="translate(287.46484375, 134)"><foreignObject width="33.984375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>after</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M171,84L171,88.167C171,92.333,171,100.667,171,109C171,117.333,171,125.667,171,133.333C171,141,171,148,171,151.5L171,155" id="gdefault5-L_Q1_O_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q1_O_0" data-points="W3sieCI6MTcxLCJ5Ijo4NH0seyJ4IjoxNzEsInkiOjEwOX0seyJ4IjoxNzEsInkiOjEzNH0seyJ4IjoxNzEsInkiOjE1OX1d" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path><path d="M459.023,84L459.023,88.167C459.023,92.333,459.023,100.667,459.023,109C459.023,117.333,459.023,125.667,459.023,135.333C459.023,145,459.023,156,459.023,161.5L459.023,167" id="gdefault5-L_Q2_I_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q2_I_0" data-points="W3sieCI6NDU5LjAyMzQzNzUsInkiOjg0fSx7IngiOjQ1OS4wMjM0Mzc1LCJ5IjoxMDl9LHsieCI6NDU5LjAyMzQzNzUsInkiOjEzNH0seyJ4Ijo0NTkuMDIzNDM3NSwieSI6MTcxfV0=" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path><path d="M171,283L171,287.167C171,291.333,171,299.667,171,308C171,316.333,171,324.667,171,332.333C171,340,171,347,171,350.5L171,354" id="gdefault5-L_O_R1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_O_R1_0" data-points="W3sieCI6MTcxLCJ5IjoyODN9LHsieCI6MTcxLCJ5IjozMDh9LHsieCI6MTcxLCJ5IjozMzN9LHsieCI6MTcxLCJ5IjozNTh9XQ==" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path><path d="M459.023,271L459.023,277.167C459.023,283.333,459.023,295.667,459.023,306C459.023,316.333,459.023,324.667,459.023,332.333C459.023,340,459.023,347,459.023,350.5L459.023,354" id="gdefault5-L_I_R2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_I_R2_0" data-points="W3sieCI6NDU5LjAyMzQzNzUsInkiOjI3MX0seyJ4Ijo0NTkuMDIzNDM3NSwieSI6MzA4fSx7IngiOjQ1OS4wMjM0Mzc1LCJ5IjozMzN9LHsieCI6NDU5LjAyMzQzNzUsInkiOjM1OH1d" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path><path d="M171,434L171,438.167C171,442.333,171,450.667,171,458.333C171,466,171,473,171,476.5L171,480" id="gdefault5-L_R1_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R1_D_0" data-points="W3sieCI6MTcxLCJ5Ijo0MzR9LHsieCI6MTcxLCJ5Ijo0NTl9LHsieCI6MTcxLCJ5Ijo0ODR9XQ==" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_Q1_O_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Q2_I_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_O_R1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_I_R2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_R1_D_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault5-l5-flowchart-O-0" data-look="classic" transform="translate(171, 221)"><rect class="basic label-container" style="" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="nodeLabel "><p>OWNERSHIP<br/>keyed by (host, pane)<br/><i>same key local already uses</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-I-1" data-look="classic" transform="translate(459.0234375, 221)"><rect class="basic label-container" style="" x="-106.890625" y="-50" width="213.78125" height="100"></rect><g class="label" style="" transform="translate(-78.890625, -36)"><rect></rect><foreignObject width="157.78125" height="72"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>INVENTORY<br/>keyed by (host, ptyId)<br/><i>shells with no owner</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-Q1-2" data-look="classic" transform="translate(171, 46)"><rect class="basic label-container" style="" x="-87.9765625" y="-38" width="175.953125" height="76"></rect><g class="label" style="" transform="translate(-59.9765625, -24)"><rect></rect><foreignObject width="119.953125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which shell does<br/>this pane own?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-Q2-4" data-look="classic" transform="translate(459.0234375, 46)"><rect class="basic label-container" style="" x="-96.796875" y="-38" width="193.59375" height="76"></rect><g class="label" style="" transform="translate(-68.796875, -24)"><rect></rect><foreignObject width="137.59375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>which shells exist<br/>that nobody owns?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-R1-7" data-look="classic" transform="translate(171, 396)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-120.296875" y="-38" width="240.59375" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-92.296875, -24)"><rect></rect><foreignObject width="184.59375" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>one pane, one shell<br/><b>structural, not enforced</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-R2-9" data-look="classic" transform="translate(459.0234375, 396)"><rect class="basic label-container" style="" x="-117.7265625" y="-38" width="235.453125" height="76"></rect><g class="label" style="" transform="translate(-89.7265625, -24)"><rect></rect><foreignObject width="179.453125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reattach work list ·<br/>disconnected cleanup UI</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-D-11" data-look="classic" transform="translate(171, 546)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-128" y="-62" width="256" height="124"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-100, -48)"><rect></rect><foreignObject width="200" height="96"><div style="color: rgb(28, 33, 40) !important; display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>supersession, ranking, rollback,<br/>dual matchers all become unnecessary</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault5-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault5-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>Ownership becomes the <em>same shape</em> for local, daemon and SSH — one record per pane per host, with transport-specific payload (lease state and timestamps for SSH, nothing extra for local). That is your principle applied at the record layer. Inventory becomes its own small list, because “a live shell nobody owns” is genuinely a different fact, not a degenerate ownership row.</p>
+      <p>The 30-second recovery grant survives as a terminal state on the pane-keyed record, so nothing load-bearing is lost. And the offline consumers keep reading local disk synchronously, exactly as today.</p>
+
+      <h2>7 · Where the proposal needs correcting</h2>
+      <table>
+        <thead><tr><th>Claim in the proposal</th><th>Assessment</th></tr></thead>
+        <tbody>
+          <tr><td>“Main is no longer in the data path at all” for a phone on an SSH host</td><td><span class="pill mid">Overstated</span> — the pivot step forwards the host’s loopback socket to a port on <em>your machine</em>. Pairing, E2EE and the broker remain main’s. The ledger duplication collapses; the hop does not.</td></tr>
+          <tr><td>Target is “one wire contract”</td><td><span class="pill mid">Incomplete</span> — no step migrates the local daemon onto it. After the final step you have two protocols, not one. There is an unstated additional step, and it is large.</td></tr>
+          <tr><td>“The method layer is already transport-agnostic”</td><td><span class="pill ok">True</span>, and it volunteers its own counterexample. But 191 remoteness branches sit in the <em>renderer</em> above that boundary — including five separate re-declarations of one predicate — and no step addresses them.</td></tr>
+          <tr><td>Measured encoding cost (wire and CPU)</td><td><span class="pill ok">Honestly reported</span> — it states plainly that the absolute throughput is not a bottleneck, and argues from where the cost is paid instead. Not oversold.</td></tr>
+        </tbody>
+      </table>
+
+      <h2>8 · Combined roadmap</h2>
+      <figure>
+        <div class="bar"><span>Two independent tracks</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark6" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 821.3125 699" role="graphics-document document" aria-roledescription="d6-flowchart-v2"><style>#gdark6{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark6 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark6 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark6 .error-icon{fill:#a44141;}#gdark6 .error-text{fill:#ddd;stroke:#ddd;}#gdark6 .edge-thickness-normal{stroke-width:1px;}#gdark6 .edge-thickness-thick{stroke-width:3.5px;}#gdark6 .edge-pattern-solid{stroke-dasharray:0;}#gdark6 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark6 .edge-pattern-dashed{stroke-dasharray:3;}#gdark6 .edge-pattern-dotted{stroke-dasharray:2;}#gdark6 .marker{fill:lightgrey;stroke:lightgrey;}#gdark6 .marker.cross{stroke:lightgrey;}#gdark6 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark6 p{margin:0;}#gdark6 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark6 .cluster-label text{fill:#F9FFFE;}#gdark6 .cluster-label span{color:#F9FFFE;}#gdark6 .cluster-label span p{background-color:transparent;}#gdark6 .label text,#gdark6 span{fill:#ccc;color:#ccc;}#gdark6 .node rect,#gdark6 .node circle,#gdark6 .node ellipse,#gdark6 .node polygon,#gdark6 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark6 .rough-node .label text,#gdark6 .node .label text,#gdark6 .image-shape .label,#gdark6 .icon-shape .label{text-anchor:middle;}#gdark6 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark6 .rough-node .label,#gdark6 .node .label,#gdark6 .image-shape .label,#gdark6 .icon-shape .label{text-align:center;}#gdark6 .node.clickable{cursor:pointer;}#gdark6 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark6 .arrowheadPath{fill:lightgrey;}#gdark6 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark6 .d6-flowchart-link{stroke:lightgrey;fill:none;}#gdark6 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark6 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark6 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark6 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark6 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark6 .cluster text{fill:#F9FFFE;}#gdark6 .cluster span{color:#F9FFFE;}#gdark6 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark6 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark6 rect.text{fill:none;stroke-width:0;}#gdark6 .icon-shape,#gdark6 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark6 .icon-shape p,#gdark6 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark6 .icon-shape .label rect,#gdark6 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark6 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark6 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark6 .node .neo-node{stroke:#ccc;}#gdark6 [data-look="neo"].node rect,#gdark6 [data-look="neo"].cluster rect,#gdark6 [data-look="neo"].node polygon{stroke:url(#gdark6-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark6 [data-look="neo"].node path{stroke:url(#gdark6-gradient);stroke-width:1px;}#gdark6 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark6 [data-look="neo"].node circle{stroke:url(#gdark6-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark6 [data-look="neo"].icon-shape .icon{fill:url(#gdark6-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark6-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark6_d6-flowchart-v2-pointEnd" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-pointStart" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-pointEnd-margin" class="marker d6-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-pointStart-margin" class="marker d6-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark6_d6-flowchart-v2-circleEnd" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark6_d6-flowchart-v2-circleStart" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark6_d6-flowchart-v2-circleEnd-margin" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark6_d6-flowchart-v2-circleStart-margin" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark6_d6-flowchart-v2-crossEnd" class="marker cross d6-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-crossStart" class="marker cross d6-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-crossEnd-margin" class="marker cross d6-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark6_d6-flowchart-v2-crossStart-margin" class="marker cross d6-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M294.125,349.5L314.958,349.5C335.792,349.5,377.458,349.5,418.458,349.5C459.458,349.5,499.792,349.5,519.958,349.5L540.125,349.5" id="gdark6-L_D_C_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_C_0" data-points="W3sieCI6Mjk0LjEyNSwieSI6MzQ5LjV9LHsieCI6NDE5LjEyNSwieSI6MzQ5LjV9LHsieCI6NTQ0LjEyNSwieSI6MzQ5LjV9XQ==" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel" transform="translate(419.125, 349.5)"><g class="label" data-id="L_D_C_0" transform="translate(-100, -24)"><foreignObject width="200" height="48"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="edgeLabel "><p>independent — run in parallel</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(536.125, 39.5)"><g class="clusters"><g class="cluster " id="gdark6-C" data-look="classic"><rect style="" x="8" y="8" width="269.1875" height="604"></rect><g class="cluster-label " transform="translate(25.59375, 8)"><foreignObject width="234" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>CONTROL PLANE — added here</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M142.594,121.5L142.594,127.75C142.594,134,142.594,146.5,142.594,158.333C142.594,170.167,142.594,181.333,142.594,186.917L142.594,192.5" id="gdark6-L_C0_C1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C0_C1_0" data-points="W3sieCI6MTQyLjU5Mzc1LCJ5IjoxMjEuNX0seyJ4IjoxNDIuNTkzNzUsInkiOjE1OX0seyJ4IjoxNDIuNTkzNzUsInkiOjE5Ni41fV0=" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path><path d="M142.594,272.5L142.594,278.75C142.594,285,142.594,297.5,142.594,309.333C142.594,321.167,142.594,332.333,142.594,337.917L142.594,343.5" id="gdark6-L_C1_C2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C1_C2_0" data-points="W3sieCI6MTQyLjU5Mzc1LCJ5IjoyNzIuNX0seyJ4IjoxNDIuNTkzNzUsInkiOjMxMH0seyJ4IjoxNDIuNTkzNzUsInkiOjM0Ny41fV0=" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path><path d="M142.594,423.5L142.594,429.75C142.594,436,142.594,448.5,142.594,460.333C142.594,472.167,142.594,483.333,142.594,488.917L142.594,494.5" id="gdark6-L_C2_C3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C2_C3_0" data-points="W3sieCI6MTQyLjU5Mzc1LCJ5Ijo0MjMuNX0seyJ4IjoxNDIuNTkzNzUsInkiOjQ2MX0seyJ4IjoxNDIuNTkzNzUsInkiOjQ5OC41fV0=" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_C0_C1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C1_C2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C2_C3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark6-d6-flowchart-C0-5" data-look="classic" transform="translate(142.59375, 83.5)"><rect class="basic label-container" style="" x="-94.203125" y="-38" width="188.40625" height="76"></rect><g class="label" style="" transform="translate(-66.203125, -24)"><rect></rect><foreignObject width="132.40625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pin behaviour with<br/>oracles that bite</p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-C1-6" data-look="classic" transform="translate(142.59375, 234.5)"><rect class="basic label-container" style="" x="-90.734375" y="-38" width="181.46875" height="76"></rect><g class="label" style="" transform="translate(-62.734375, -24)"><rect></rect><foreignObject width="125.46875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>re-key ownership<br/>by pane</p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-C2-7" data-look="classic" transform="translate(142.59375, 385.5)"><rect class="basic label-container" style="" x="-89.1875" y="-38" width="178.375" height="76"></rect><g class="label" style="" transform="translate(-61.1875, -24)"><rect></rect><foreignObject width="122.375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>split out<br/>orphan inventory</p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-C3-8" data-look="classic" transform="translate(142.59375, 536.5)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-99.59375" y="-38" width="199.1875" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-71.59375, -24)"><rect></rect><foreignObject width="143.1875" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>delete the<br/>compensating code</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(0, 0)"><g class="clusters"><g class="cluster " id="gdark6-D" data-look="classic"><rect style="" x="8" y="8" width="286.125" height="683"></rect><g class="cluster-label " transform="translate(34.9140625, 8)"><foreignObject width="232.296875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>DATA PLANE — adopt as written</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M151.063,97.5L151.063,103.75C151.063,110,151.063,122.5,151.063,134.333C151.063,146.167,151.063,157.333,151.063,162.917L151.063,168.5" id="gdark6-L_D0_D1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D0_D1_0" data-points="W3sieCI6MTUxLjA2MjUsInkiOjk3LjV9LHsieCI6MTUxLjA2MjUsInkiOjEzNX0seyJ4IjoxNTEuMDYyNSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path><path d="M151.063,248.5L151.063,254.75C151.063,261,151.063,273.5,151.063,285.333C151.063,297.167,151.063,308.333,151.063,313.917L151.063,319.5" id="gdark6-L_D1_D2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D1_D2_0" data-points="W3sieCI6MTUxLjA2MjUsInkiOjI0OC41fSx7IngiOjE1MS4wNjI1LCJ5IjoyODZ9LHsieCI6MTUxLjA2MjUsInkiOjMyMy41fV0=" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path><path d="M151.063,375.5L151.063,381.75C151.063,388,151.063,400.5,151.063,412.333C151.063,424.167,151.063,435.333,151.063,440.917L151.063,446.5" id="gdark6-L_D2_D3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D2_D3_0" data-points="W3sieCI6MTUxLjA2MjUsInkiOjM3NS41fSx7IngiOjE1MS4wNjI1LCJ5Ijo0MTN9LHsieCI6MTUxLjA2MjUsInkiOjQ1MC41fV0=" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path><path d="M151.063,502.5L151.063,508.75C151.063,515,151.063,527.5,151.063,539.333C151.063,551.167,151.063,562.333,151.063,567.917L151.063,573.5" id="gdark6-L_D3_D4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D3_D4_0" data-points="W3sieCI6MTUxLjA2MjUsInkiOjUwMi41fSx7IngiOjE1MS4wNjI1LCJ5Ijo1NDB9LHsieCI6MTUxLjA2MjUsInkiOjU3Ny41fV0=" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_D0_D1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D1_D2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D2_D3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D3_D4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark6-d6-flowchart-D0-0" data-look="classic" transform="translate(151.0625, 71.5)"><rect class="basic label-container" style="" x="-108.0625" y="-26" width="216.125" height="52"></rect><g class="label" style="" transform="translate(-80.0625, -12)"><rect></rect><foreignObject width="160.125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>see it · capability hello</p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-D1-1" data-look="classic" transform="translate(151.0625, 210.5)"><rect class="basic label-container" style="" x="-101.7578125" y="-38" width="203.515625" height="76"></rect><g class="label" style="" transform="translate(-73.7578125, -24)"><rect></rect><foreignObject width="147.515625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>unify types · ledger ·<br/>chunk-ack · lanes</p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-D2-2" data-look="classic" transform="translate(151.0625, 349.5)"><rect class="basic label-container" style="" x="-85.0625" y="-26" width="170.125" height="52"></rect><g class="label" style="" transform="translate(-57.0625, -12)"><rect></rect><foreignObject width="114.125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>binary payloads</p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-D3-3" data-look="classic" transform="translate(151.0625, 476.5)"><rect class="basic label-container" style="" x="-99.046875" y="-26" width="198.09375" height="52"></rect><g class="label" style="" transform="translate(-71.046875, -12)"><rect></rect><foreignObject width="142.09375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>boring first connect</p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-D4-4" data-look="classic" transform="translate(151.0625, 615.5)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-80.40625" y="-38" width="160.8125" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-52.40625, -24)"><rect></rect><foreignObject width="104.8125" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>SSH becomes<br/>a port-forward</p></span></div></foreignObject></g></g></g></g></g></g></g><defs><filter id="gdark6-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark6-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark6-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault6" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 821.3125 699" role="graphics-document document" aria-roledescription="l6-flowchart-v2"><style>#gdefault6{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault6 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault6 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault6 .error-icon{fill:#552222;}#gdefault6 .error-text{fill:#552222;stroke:#552222;}#gdefault6 .edge-thickness-normal{stroke-width:1px;}#gdefault6 .edge-thickness-thick{stroke-width:3.5px;}#gdefault6 .edge-pattern-solid{stroke-dasharray:0;}#gdefault6 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault6 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault6 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault6 .marker{fill:#333333;stroke:#333333;}#gdefault6 .marker.cross{stroke:#333333;}#gdefault6 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault6 p{margin:0;}#gdefault6 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault6 .cluster-label text{fill:#333;}#gdefault6 .cluster-label span{color:#333;}#gdefault6 .cluster-label span p{background-color:transparent;}#gdefault6 .label text,#gdefault6 span{fill:#333;color:#333;}#gdefault6 .node rect,#gdefault6 .node circle,#gdefault6 .node ellipse,#gdefault6 .node polygon,#gdefault6 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault6 .rough-node .label text,#gdefault6 .node .label text,#gdefault6 .image-shape .label,#gdefault6 .icon-shape .label{text-anchor:middle;}#gdefault6 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault6 .rough-node .label,#gdefault6 .node .label,#gdefault6 .image-shape .label,#gdefault6 .icon-shape .label{text-align:center;}#gdefault6 .node.clickable{cursor:pointer;}#gdefault6 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault6 .arrowheadPath{fill:#333333;}#gdefault6 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault6 .l6-flowchart-link{stroke:#333333;fill:none;}#gdefault6 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault6 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault6 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault6 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault6 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault6 .cluster text{fill:#333;}#gdefault6 .cluster span{color:#333;}#gdefault6 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault6 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault6 rect.text{fill:none;stroke-width:0;}#gdefault6 .icon-shape,#gdefault6 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault6 .icon-shape p,#gdefault6 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault6 .icon-shape .label rect,#gdefault6 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault6 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault6 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault6 .node .neo-node{stroke:#9370DB;}#gdefault6 [data-look="neo"].node rect,#gdefault6 [data-look="neo"].cluster rect,#gdefault6 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault6 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault6 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault6 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault6 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault6_l6-flowchart-v2-pointEnd" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-pointStart" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-pointEnd-margin" class="marker l6-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-pointStart-margin" class="marker l6-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault6_l6-flowchart-v2-circleEnd" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault6_l6-flowchart-v2-circleStart" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault6_l6-flowchart-v2-circleEnd-margin" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault6_l6-flowchart-v2-circleStart-margin" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault6_l6-flowchart-v2-crossEnd" class="marker cross l6-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-crossStart" class="marker cross l6-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-crossEnd-margin" class="marker cross l6-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault6_l6-flowchart-v2-crossStart-margin" class="marker cross l6-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M294.125,349.5L314.958,349.5C335.792,349.5,377.458,349.5,418.458,349.5C459.458,349.5,499.792,349.5,519.958,349.5L540.125,349.5" id="gdefault6-L_D_C_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_C_0" data-points="W3sieCI6Mjk0LjEyNSwieSI6MzQ5LjV9LHsieCI6NDE5LjEyNSwieSI6MzQ5LjV9LHsieCI6NTQ0LjEyNSwieSI6MzQ5LjV9XQ==" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel" transform="translate(419.125, 349.5)"><g class="label" data-id="L_D_C_0" transform="translate(-100, -24)"><foreignObject width="200" height="48"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table; white-space: break-spaces; line-height: 1.5; max-width: 200px; text-align: center; width: 200px;"><span class="edgeLabel "><p>independent — run in parallel</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="root" transform="translate(536.125, 39.5)"><g class="clusters"><g class="cluster " id="gdefault6-C" data-look="classic"><rect style="" x="8" y="8" width="269.1875" height="604"></rect><g class="cluster-label " transform="translate(25.59375, 8)"><foreignObject width="234" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>CONTROL PLANE — added here</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M142.594,121.5L142.594,127.75C142.594,134,142.594,146.5,142.594,158.333C142.594,170.167,142.594,181.333,142.594,186.917L142.594,192.5" id="gdefault6-L_C0_C1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C0_C1_0" data-points="W3sieCI6MTQyLjU5Mzc1LCJ5IjoxMjEuNX0seyJ4IjoxNDIuNTkzNzUsInkiOjE1OX0seyJ4IjoxNDIuNTkzNzUsInkiOjE5Ni41fV0=" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path><path d="M142.594,272.5L142.594,278.75C142.594,285,142.594,297.5,142.594,309.333C142.594,321.167,142.594,332.333,142.594,337.917L142.594,343.5" id="gdefault6-L_C1_C2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C1_C2_0" data-points="W3sieCI6MTQyLjU5Mzc1LCJ5IjoyNzIuNX0seyJ4IjoxNDIuNTkzNzUsInkiOjMxMH0seyJ4IjoxNDIuNTkzNzUsInkiOjM0Ny41fV0=" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path><path d="M142.594,423.5L142.594,429.75C142.594,436,142.594,448.5,142.594,460.333C142.594,472.167,142.594,483.333,142.594,488.917L142.594,494.5" id="gdefault6-L_C2_C3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C2_C3_0" data-points="W3sieCI6MTQyLjU5Mzc1LCJ5Ijo0MjMuNX0seyJ4IjoxNDIuNTkzNzUsInkiOjQ2MX0seyJ4IjoxNDIuNTkzNzUsInkiOjQ5OC41fV0=" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_C0_C1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C1_C2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C2_C3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault6-l6-flowchart-C0-5" data-look="classic" transform="translate(142.59375, 83.5)"><rect class="basic label-container" style="" x="-94.203125" y="-38" width="188.40625" height="76"></rect><g class="label" style="" transform="translate(-66.203125, -24)"><rect></rect><foreignObject width="132.40625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pin behaviour with<br/>oracles that bite</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-C1-6" data-look="classic" transform="translate(142.59375, 234.5)"><rect class="basic label-container" style="" x="-90.734375" y="-38" width="181.46875" height="76"></rect><g class="label" style="" transform="translate(-62.734375, -24)"><rect></rect><foreignObject width="125.46875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>re-key ownership<br/>by pane</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-C2-7" data-look="classic" transform="translate(142.59375, 385.5)"><rect class="basic label-container" style="" x="-89.1875" y="-38" width="178.375" height="76"></rect><g class="label" style="" transform="translate(-61.1875, -24)"><rect></rect><foreignObject width="122.375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>split out<br/>orphan inventory</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-C3-8" data-look="classic" transform="translate(142.59375, 536.5)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-99.59375" y="-38" width="199.1875" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-71.59375, -24)"><rect></rect><foreignObject width="143.1875" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>delete the<br/>compensating code</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(0, 0)"><g class="clusters"><g class="cluster " id="gdefault6-D" data-look="classic"><rect style="" x="8" y="8" width="286.125" height="683"></rect><g class="cluster-label " transform="translate(34.9140625, 8)"><foreignObject width="232.296875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>DATA PLANE — adopt as written</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M151.063,97.5L151.063,103.75C151.063,110,151.063,122.5,151.063,134.333C151.063,146.167,151.063,157.333,151.063,162.917L151.063,168.5" id="gdefault6-L_D0_D1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D0_D1_0" data-points="W3sieCI6MTUxLjA2MjUsInkiOjk3LjV9LHsieCI6MTUxLjA2MjUsInkiOjEzNX0seyJ4IjoxNTEuMDYyNSwieSI6MTcyLjV9XQ==" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path><path d="M151.063,248.5L151.063,254.75C151.063,261,151.063,273.5,151.063,285.333C151.063,297.167,151.063,308.333,151.063,313.917L151.063,319.5" id="gdefault6-L_D1_D2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D1_D2_0" data-points="W3sieCI6MTUxLjA2MjUsInkiOjI0OC41fSx7IngiOjE1MS4wNjI1LCJ5IjoyODZ9LHsieCI6MTUxLjA2MjUsInkiOjMyMy41fV0=" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path><path d="M151.063,375.5L151.063,381.75C151.063,388,151.063,400.5,151.063,412.333C151.063,424.167,151.063,435.333,151.063,440.917L151.063,446.5" id="gdefault6-L_D2_D3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D2_D3_0" data-points="W3sieCI6MTUxLjA2MjUsInkiOjM3NS41fSx7IngiOjE1MS4wNjI1LCJ5Ijo0MTN9LHsieCI6MTUxLjA2MjUsInkiOjQ1MC41fV0=" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path><path d="M151.063,502.5L151.063,508.75C151.063,515,151.063,527.5,151.063,539.333C151.063,551.167,151.063,562.333,151.063,567.917L151.063,573.5" id="gdefault6-L_D3_D4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D3_D4_0" data-points="W3sieCI6MTUxLjA2MjUsInkiOjUwMi41fSx7IngiOjE1MS4wNjI1LCJ5Ijo1NDB9LHsieCI6MTUxLjA2MjUsInkiOjU3Ny41fV0=" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_D0_D1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D1_D2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D2_D3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D3_D4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault6-l6-flowchart-D0-0" data-look="classic" transform="translate(151.0625, 71.5)"><rect class="basic label-container" style="" x="-108.0625" y="-26" width="216.125" height="52"></rect><g class="label" style="" transform="translate(-80.0625, -12)"><rect></rect><foreignObject width="160.125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>see it · capability hello</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-D1-1" data-look="classic" transform="translate(151.0625, 210.5)"><rect class="basic label-container" style="" x="-101.7578125" y="-38" width="203.515625" height="76"></rect><g class="label" style="" transform="translate(-73.7578125, -24)"><rect></rect><foreignObject width="147.515625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>unify types · ledger ·<br/>chunk-ack · lanes</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-D2-2" data-look="classic" transform="translate(151.0625, 349.5)"><rect class="basic label-container" style="" x="-85.0625" y="-26" width="170.125" height="52"></rect><g class="label" style="" transform="translate(-57.0625, -12)"><rect></rect><foreignObject width="114.125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>binary payloads</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-D3-3" data-look="classic" transform="translate(151.0625, 476.5)"><rect class="basic label-container" style="" x="-99.046875" y="-26" width="198.09375" height="52"></rect><g class="label" style="" transform="translate(-71.046875, -12)"><rect></rect><foreignObject width="142.09375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>boring first connect</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-D4-4" data-look="classic" transform="translate(151.0625, 615.5)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-80.40625" y="-38" width="160.8125" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-52.40625, -24)"><rect></rect><foreignObject width="104.8125" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>SSH becomes<br/>a port-forward</p></span></div></foreignObject></g></g></g></g></g></g></g><defs><filter id="gdefault6-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault6-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The tracks touch disjoint files, so they can proceed simultaneously. The control-plane track should land its <em>oracles</em> first, because re-keying a durable record is a migration with a corruption story, and the existing tests pin the current key rather than the intended behaviour.</p>
+
+      <h2>9 · What happens to the shipped work</h2>
+      <table>
+        <thead><tr><th>Change</th><th>Now</th><th>After the control-plane track</th></tr></thead>
+        <tbody>
+          <tr><td>Reattach binds, never creates</td><td>Holds the line</td><td><span class="pill ok">Keep</span> — correct at any key</td></tr>
+          <tr><td>Pane-keyed lease supersession (+209)</td><td>Holds the line</td><td><span class="pill no">Delete</span> — the key makes it structural</td></tr>
+          <tr><td>Corrupted-lease healing</td><td>Needed for existing installs</td><td><span class="pill mid">Folds into the migration</span></td></tr>
+          <tr><td>“Needs re-establishing” ≠ “expired”</td><td>Fixes duplicate agent resume</td><td><span class="pill ok">Keep</span> — an error-taxonomy fix, orthogonal</td></tr>
+          <tr><td>Three-valued liveness</td><td>Correct generalization</td><td><span class="pill ok">Keep</span></td></tr>
+          <tr><td>Superseded-keystroke fence</td><td><span class="pill no">Inert on reattach</span></td><td><span class="pill mid">Fix or withdraw</span> — decision needed</td></tr>
+        </tbody>
+      </table>
+
+      <h2>10 · Verification status</h2>
+      <p class="lede">Stated explicitly, because two earlier claims in this program were retracted after checking.</p>
+      <table>
+        <thead><tr><th>Finding</th><th>Status</th></tr></thead>
+        <tbody>
+          <tr><td>Only 2 of 9 message types kept; ACK feeds the death timer only</td><td><span class="pill ok">Personally verified</span></td></tr>
+          <tr><td>Daemon substitutes via the provider slot; SSH uses a parallel registry</td><td><span class="pill ok">Personally verified</span></td></tr>
+          <tr><td>Pane maps have two writers, both spawn; fence inert on reattach</td><td><span class="pill ok">Personally verified</span></td></tr>
+          <tr><td>Relay PTY table is in-memory only; identity RPC has no production caller</td><td><span class="pill ok">Personally verified</span></td></tr>
+          <tr><td>Lease consulted from a synchronous, offline disk path</td><td><span class="pill ok">Personally verified</span></td></tr>
+          <tr><td>Method layer transport-agnostic (0 / 0 / 27 references)</td><td><span class="pill ok">Personally verified</span></td></tr>
+          <tr><td>~390 branch count, LOC ratios, the 9 disagreement states, ~374 reconciliation lines</td><td><span class="pill mid">Agent-reported, spot-checked</span></td></tr>
+          <tr><td>Encoding throughput measurements in the proposal</td><td><span class="pill inf">Not re-measured</span></td></tr>
+        </tbody>
+      </table>
+
+      <h2>11 · Decisions needed</h2>
+      <table>
+        <thead><tr><th>#</th><th>Decision</th></tr></thead>
+        <tbody>
+          <tr><td><strong>1</strong></td><td><strong>Adopt the data-plane proposal as written?</strong> My review found no defect in its reasoning — only two overstated claims and one missing step. It is independent of everything below.</td></tr>
+          <tr><td><strong>2</strong></td><td><strong>Approve the control-plane track?</strong> Re-keying a durable record needs a migration and a corruption story. It is roughly net-neutral in lines and deletes a failure class rather than a file.</td></tr>
+          <tr><td><strong>3</strong></td><td><strong>The inert fence</strong> — populate the pane maps on the reattach path, or withdraw the guard and its test? Shipping it as-is means a test asserting a protection that does not apply where it matters.</td></tr>
+          <tr><td><strong>4</strong></td><td><strong>The open PRs</strong> — merge as a stopgap that keeps the reported bug closed, or hold them and go straight at the control-plane track?</td></tr>
+        </tbody>
+      </table>
+
+      <div class="foot">
+        Companion to <code>report.html</code> (evidence for the shipped work). Click any diagram to zoom · scroll to scale · drag to pan.
+      </div>
+    </div>
+
+    <div id="ov"><span class="x">×</span><div class="inner"></div><div class="hint">scroll to zoom · drag to pan · Esc to close</div></div>
+
+    <script>
+      const ov = document.getElementById('ov')
+      const inner = ov.querySelector('.inner')
+      let scale = 1, tx = 0, ty = 0, dragging = false, sx = 0, sy = 0
+      function apply() { inner.style.transform = `translate(${tx}px, ${ty}px) scale(${scale})` }
+      function open(svgHtml) {
+        inner.innerHTML = svgHtml
+        const svg = inner.querySelector('svg')
+        if (svg) { svg.style.maxWidth = 'none'; svg.removeAttribute('width'); svg.removeAttribute('height')
+          svg.style.width = Math.min(window.innerWidth * 0.9, 1500) + 'px' }
+        scale = 1; tx = 0; ty = 0; apply()
+        // Must be visible before measuring; a display:none overlay measures zero.
+        ov.classList.add('on')
+        const b = inner.getBoundingClientRect()
+        tx = Math.max(16, (window.innerWidth - b.width) / 2)
+        ty = Math.max(16, (window.innerHeight - b.height) / 2)
+        apply()
+      }
+      function close() { ov.classList.remove('on'); inner.innerHTML = '' }
+      document.addEventListener('click', (e) => {
+        const fig = e.target.closest('figure')
+        if (fig && !ov.classList.contains('on')) {
+          const svg = [...fig.querySelectorAll('.dia > div')].find((d) => d.offsetParent !== null)
+          if (svg) open(svg.innerHTML)
+        }
+      })
+      ov.querySelector('.x').addEventListener('click', (e) => { e.stopPropagation(); close() })
+      document.addEventListener('keydown', (e) => { if (e.key === 'Escape') close() })
+      ov.addEventListener('wheel', (e) => {
+        e.preventDefault()
+        const f = e.deltaY < 0 ? 1.12 : 1 / 1.12
+        tx = e.clientX - (e.clientX - tx) * f; ty = e.clientY - (e.clientY - ty) * f; scale *= f; apply()
+      }, { passive: false })
+      ov.addEventListener('mousedown', (e) => { dragging = true; sx = e.clientX - tx; sy = e.clientY - ty; ov.style.cursor = 'grabbing' })
+      window.addEventListener('mousemove', (e) => { if (!dragging) return; tx = e.clientX - sx; ty = e.clientY - sy; apply() })
+      window.addEventListener('mouseup', () => { dragging = false; ov.style.cursor = 'grab' })
+    </script>
+  </body>
+</html>
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/github-overlap-query.graphql b/docs/reference/terminal-session-correctness-handoff-2026-08-07/github-overlap-query.graphql
new file mode 100644
index 00000000000..5008d103cec
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/github-overlap-query.graphql
@@ -0,0 +1,324 @@
+query TerminalSessionCorrectnessRelatedWork {
+  repository(owner: "stablyai", name: "orca") {
+    n8129: issueOrPullRequest(number: 8129) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n8275: issueOrPullRequest(number: 8275) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n8585: issueOrPullRequest(number: 8585) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n8618: issueOrPullRequest(number: 8618) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9034: issueOrPullRequest(number: 9034) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9092: issueOrPullRequest(number: 9092) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9093: issueOrPullRequest(number: 9093) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9138: issueOrPullRequest(number: 9138) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9562: issueOrPullRequest(number: 9562) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9585: issueOrPullRequest(number: 9585) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9819: issueOrPullRequest(number: 9819) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9820: issueOrPullRequest(number: 9820) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9827: issueOrPullRequest(number: 9827) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n9833: issueOrPullRequest(number: 9833) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n10118: issueOrPullRequest(number: 10118) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n10208: issueOrPullRequest(number: 10208) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n10235: issueOrPullRequest(number: 10235) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n10385: issueOrPullRequest(number: 10385) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n10415: issueOrPullRequest(number: 10415) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n10744: issueOrPullRequest(number: 10744) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11006: issueOrPullRequest(number: 11006) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11265: issueOrPullRequest(number: 11265) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11339: issueOrPullRequest(number: 11339) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11342: issueOrPullRequest(number: 11342) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11495: issueOrPullRequest(number: 11495) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11574: issueOrPullRequest(number: 11574) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11575: issueOrPullRequest(number: 11575) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11596: issueOrPullRequest(number: 11596) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11622: issueOrPullRequest(number: 11622) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11729: issueOrPullRequest(number: 11729) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11800: issueOrPullRequest(number: 11800) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11801: issueOrPullRequest(number: 11801) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11803: issueOrPullRequest(number: 11803) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11804: issueOrPullRequest(number: 11804) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n11904: issueOrPullRequest(number: 11904) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12036: issueOrPullRequest(number: 12036) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12134: issueOrPullRequest(number: 12134) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12140: issueOrPullRequest(number: 12140) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12220: issueOrPullRequest(number: 12220) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12241: issueOrPullRequest(number: 12241) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12264: issueOrPullRequest(number: 12264) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12339: issueOrPullRequest(number: 12339) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12447: issueOrPullRequest(number: 12447) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12448: issueOrPullRequest(number: 12448) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12456: issueOrPullRequest(number: 12456) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12474: issueOrPullRequest(number: 12474) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12477: issueOrPullRequest(number: 12477) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12568: issueOrPullRequest(number: 12568) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12600: issueOrPullRequest(number: 12600) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12634: issueOrPullRequest(number: 12634) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12683: issueOrPullRequest(number: 12683) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12699: issueOrPullRequest(number: 12699) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12702: issueOrPullRequest(number: 12702) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12743: issueOrPullRequest(number: 12743) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12749: issueOrPullRequest(number: 12749) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12751: issueOrPullRequest(number: 12751) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12760: issueOrPullRequest(number: 12760) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12768: issueOrPullRequest(number: 12768) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12798: issueOrPullRequest(number: 12798) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12882: issueOrPullRequest(number: 12882) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12903: issueOrPullRequest(number: 12903) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n12987: issueOrPullRequest(number: 12987) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n13013: issueOrPullRequest(number: 13013) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n13110: issueOrPullRequest(number: 13110) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    n13111: issueOrPullRequest(number: 13111) {
+      ...IssueDetails
+      ...PullRequestDetails
+    }
+    p13110: pullRequest(number: 13110) {
+      ...ReviewDetails
+    }
+    p13111: pullRequest(number: 13111) {
+      ...ReviewDetails
+    }
+  }
+}
+
+fragment IssueDetails on Issue {
+  number
+  title
+  url
+  state
+  stateReason
+  updatedAt
+}
+
+fragment PullRequestDetails on PullRequest {
+  number
+  title
+  url
+  state
+  isDraft
+  merged
+  reviewDecision
+  mergeable
+  mergeStateStatus
+  headRefName
+  baseRefName
+  additions
+  deletions
+  changedFiles
+  updatedAt
+  commits(last: 1) {
+    nodes {
+      commit {
+        oid
+        statusCheckRollup {
+          state
+        }
+      }
+    }
+  }
+}
+
+fragment ReviewDetails on PullRequest {
+  reviewThreads(first: 100) {
+    nodes {
+      isResolved
+      isOutdated
+      comments(last: 1) {
+        nodes {
+          url
+          author {
+            login
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/goalposts.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/goalposts.md
new file mode 100644
index 00000000000..d6842d0d563
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/goalposts.md
@@ -0,0 +1,683 @@
+# Goalposts and proof contract
+
+This file answers one question: **what exact evidence is required before an
+agent may write “proven”?**
+
+The current status is **0/8 proven goalposts** and **2/13 proven
+journeys**. Status may change only from evidence produced on the same rebased,
+converged release candidate. Historical snapshot tests and independently useful
+narrow PRs may be cited as partial evidence but cannot promote a row.
+
+## Recorded user decisions
+
+These amend the contract above. Only the user may add to this list.
+
+### D1 — G6 relaxed from strictly net-negative (2026-08-07)
+
+> "It's okay if we must increase LOC but try not to."
+
+G6's pass condition is no longer a strict inequality against the frozen
+baseline. It is now: **minimise added production code, and justify every net
+addition against the correctness it buys.** A net-positive total does not fail
+G6 on its own; an unjustified one does.
+
+Why this was needed: the deletion budget the plan assumed does not exist. An
+entrypoint-rooted import graph over all 20 real build entrypoints found that
+51 of the 53 candidate files in `src/relay/*pty-source-*`,
+`src/shared/pty-consumer-*`, and `src/main/ipc/ssh-pty-*` are reachable and
+value-instantiated on live paths. Only 2 files (263 LOC) are unreachable, and 2
+of the candidates did not exist at the baseline so deleting them earns no
+credit. Against roughly +1,021 LOC to offset, a strict inequality was not
+reachable without deleting load-bearing code — which the governing rule forbids.
+
+Still binding: correctness may not be weakened to reduce line count, and a
+replacement architecture added beside the old one does not earn its lines.
+
+## Proven journeys
+
+### Journey evidence not yet sufficient to promote
+
+**Journey 2 (daemon half).** `tests/e2e/daemon-restart-session-liveness.spec.ts`,
+3 tests. Two mutations each redden exactly one clause, on macOS and Linux:
+reverting three-valued `hasPty` reddens only the unknown-not-dead clause;
+widening the sole-provider fallback reddens only the stale-generation clause.
+The lead re-verified the first mutation independently. **Missing: physical WSL**,
+which the journey names explicitly. That host is now unblocked (the distro has a
+provisioned default user) and the run is outstanding.
+
+**Journey 12.** `tests/e2e/cross-version-wire/`, 13 tests against a real published
+baseline. Reverting the restore-required publication to expiry reddens 7 of 13;
+restore greens. Lead-verified. **Missing: live skew.** These are in-process wire
+tests. The original ledger named live paired-runtime and SSH skew as the gap, and
+an in-process decoder test does not close it.
+
+**Journey 4.** Sibling-pane isolation on one host reddens when
+`mux.dispose('connection_lost')` is restored. **The cross-host clause cannot be
+proven by mutation**: a mux belongs to one relay session per SSH target, so its
+dispose cannot cross a host boundary — the cross-host test stayed green under the
+mutation, which is the empirical receipt. That clause rests on
+isolation-by-construction, and saying otherwise would be a false claim.
+
+**Journey 6.** `tests/e2e/ssh-maxsessions-remote-pid-binding-identity.spec.ts`,
+4 tests against a real Docker OpenSSH container configured `MaxSessions 1`, the
+cap read back from `sshd -T` inside each test. Three of the four clauses
+discriminate, clause-selectively, in single runs (the spec is not `serial`, so a
+red test never reports the others as "did not run"):
+
+- dropping `mayCreate: false` from the reattach binding write reddens only the
+  authority-reconnect test, with the unowned leaf grafted into the `local`
+  partition;
+- marking leases `terminated` instead of `detached` in `beginShutdownDetach`
+  reddens only the two restart tests, with a cold-spawned shell beside the
+  surviving one.
+
+**Missing: the transport-disconnect clause does not discriminate.** Four guard
+removals were tried and it stayed green under all of them, including publishing
+`SSH_SESSION_EXPIRED` in place of `SSH_SOURCE_RESTORE_REQUIRED` and making
+`isProvenSshSessionGoneError` return true for every error. A sever that leaves
+the detached relay holding its delivery record reattaches through the checkpoint
+path, so no reattach failure is ever classified and the respawn-requires-proof
+guards are off that path. Inducing `restoreRequired` needs a lost or mismatched
+delivery record, which this fault does not produce. That clause is therefore a
+forward guard and cannot promote the row. Also missing: only Docker-on-macOS was
+run; the explicit-close/proven-teardown retirement clause is not covered.
+
+**Journey 13.** Not proven. One of ten named dimensions measured. The
+`isSupersededPtyId` fence costs roughly 14ns per call, but it was measured on
+lifted predicates in plain Node, not through real Electron IPC — that part is an
+inference, not a measurement.
+
+### Correction: Journey 12's cross-version tests exercise a route production does not have
+
+Recorded earlier that the cross-version suite "confirms the new
+`SSH_SOURCE_RESTORE_REQUIRED` token mutates nothing on an old client." That
+claim is withdrawn.
+
+An attempt to build a LIVE two-process skew oracle established that the token
+never crosses a version boundary at all. It is minted in main
+(`src/main/providers/ssh-pty-provider.ts:110`) and consumed in the same app's
+renderer (`pty-connection.ts:8833`, `:9080`) over Electron IPC — always one
+version. The only cross-version terminal boundary, paired client to HUB runtime,
+goes through `remote-runtime-pty-transport.ts`, whose sole respawn trigger is
+`SSH_SESSION_EXPIRED` (line 1481), and whose reattach never reaches
+`SshPtyProvider.spawn`.
+
+The in-process suite injects the token into `terminal.resolvePane`, which is a
+pure lookup and not a route production takes. So those 13 tests are a decoder
+guard, not evidence about old clients.
+
+Two consequences, both good: the wire-compatibility risk this branch was thought
+to introduce **does not exist**, because there is no version boundary for the new
+token to cross. And Journey 12 needs a different oracle entirely — one aimed at a
+boundary that is genuinely cross-version.
+
+### Journey 6 — evidence, and why it is not promotable
+
+`tests/e2e/ssh-maxsessions-remote-pid-binding-identity.spec.ts`, 4 tests, each
+with its own container and Electron profile, against real OpenSSH with
+`MaxSessions 1` read back from `sshd -T` rather than assumed. Remote pids are
+read on the container two independent ways and must agree, each carrying its
+kernel start time.
+
+Two mutations discriminate and are disjoint: removing `mayCreate: false` reddens
+only the reconnect clause; marking leases `terminated` instead of `detached` at
+quit reddens only the two restart clauses.
+
+**Not promotable:** the "same remote PID and exact binding survive a transport
+disconnect" clause is a forward guard. Four separate guard removals left it
+green. It asserts a real property, but nothing shipped is load-bearing for it,
+so it cannot be claimed as proof of this branch's work.
+
+### Journey 3 — evidence, and why it is not promotable
+
+`tests/e2e/ssh-lazy-discovery-skipped-host-restart.spec.ts`, 3 tests, two real
+containers, sampling sshd's own accept log and live session census 20+ times over
+22 seconds with the in-use host as a positive control.
+
+**Not promotable:** no mutation reddens clause 3 alone. The genuine cross-host
+lease-scoping guard is load-bearing, but removing it breaks the sibling host
+during setup, so the failure carries no clause information.
+
+### Journey 2 — Daemon and physical WSL (proven 2026-08-08)
+
+Oracle: `tests/e2e/daemon-restart-session-liveness.spec.ts`, 3 tests, plus
+`tests/e2e/helpers/daemon-shell-process-identity.ts`. The PTY leader is a real
+login shell that reports `$$` back through the production write path
+(`DaemonPtyRouter.write` -> daemon socket -> PTY), and that pid is resolved to a
+kernel start time, so a look-alike respawn cannot pass as a survivor.
+
+It replaced a spec that never crossed the daemon boundary and whose successor
+generation owned nothing, which made "the live successor is neither killed nor
+replaced" vacuous.
+
+| Environment                                  | Result   | Discrimination watched                              |
+| -------------------------------------------- | -------- | --------------------------------------------------- |
+| macOS 26.3.1 arm64                           | 3 passed | 2 mutations, each reddening one clause              |
+| Ubuntu 24.04 x86_64 native                   | 3 passed | same 2 mutations, same single-clause reds           |
+| WSL2 Ubuntu 26.04 on a physical Windows host | 3 passed | reverting three-valued `hasPty` reddens test 1 only |
+
+Clause-selective on all three. The spec runs `mode: 'serial'`, so a red test 1
+reports 2 and 3 as "did not run" rather than passing — selectivity was therefore
+established by re-running 2 and 3 _alone under the same mutation_ and watching
+them stay green, not by assuming it.
+
+Mutation A (`hasPty` reverted to `activeSessionIds.has(id)`) reddens only the
+unknown-not-dead clause. Mutation B (widening the sole-provider fallback in
+`daemon-session-owner-resolution.ts`) reddens only the stale-generation clause.
+The lead independently reproduced Mutation A on macOS.
+
+Also confirmed on the WSL host, independently of the spec: an Orca WSL-mode
+terminal now starts and returns real output. It could not start before — the
+distro had no provisioned default Unix user, so every interactive `wsl.exe`
+launch blocked on first-run provisioning.
+
+Limits, stated rather than implied:
+
+- The WSL run used `ELECTRON_RUN_AS_NODE=1`, which is what this oracle needs
+  (real daemon processes and real PTYs, no renderer). It does **not** show that
+  Electron's GUI starts under WSL; no display server was started and that
+  remains an open question for any journey needing a window.
+- WSL evidence is against `d74f5ed0eae` and on Node 22 rather than the required 24. The other two platforms ran the same oracle on Node 24.
+- `src/main/providers` is red on that distro for an unrelated reason:
+  `local-pty-shell-ready.test.ts` pins an exact OSC 133 marker count and saw 7
+  splits where it expects 4. The WSL run attributed that to bash 5.3.9, but that
+  is **not** the cause — macOS runs the same bash 5.3.9 and the spec passes there
+  67/67. The trigger is environmental to that distro, most plausibly a
+  system-wide bashrc contributing prompt hooks, and the underlying defect is that
+  the spec asserts an absolute count of markers it does not own. Outside this
+  journey's surface, so left for its owner rather than reinterpreted blind — but
+  it means "the unit suites are green on WSL" would be false.
+
+### Journey 1 — Local macOS, Linux, and Windows (proven 2026-08-08)
+
+Oracle: `tests/e2e/local-terminal-restart-binding-identity.spec.ts`. Two tests —
+the same pane, full binding and OS shell process survive renderer reload and app
+restart; and a stale pre-spawn session write is rejected instead of retiring the
+live binding.
+
+Process identity is proved by the shell reporting its own pid through the
+production write path, plus the kernel-reported start time, so a recycled pid
+cannot pass as a survivor.
+
+| Platform                    | Result   | Discrimination watched                                                                                                                                          |
+| --------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| macOS 26.3.1 arm64          | 2 passed | mutation reddens; restore greens                                                                                                                                |
+| Ubuntu 24.04 x86_64, native | 2 passed | 4 cycles, incl. deleting `restorableBindings` reconciliation — reddens test 2 only                                                                              |
+| Windows 11 26200, native    | 2 passed | A: forcing `shutdownDaemon()` in will-quit reddens test 1 (pid 13756 -> 8852, start times 5.4s apart). B: disabling the same reconciliation reddens test 2 only |
+
+Every run used an isolated TMPDIR, because the harness keys its seeded-repo
+pointer on a machine-global tmpdir path and concurrent runs can both fabricate
+and mask a red.
+
+Selectivity holds on two platforms: mutation B reddens only the stale-operation
+test and leaves the restart test green, so the two clauses are independently
+proved rather than jointly.
+
+Residual limit, stated: "every stale exact operation" is proved for the
+pre-spawn session-write class. Local `pty:write`/`resize`/`signal` are fenced by
+`isSupersededPtyId` with its own oracle, but that fence compares a binding, not
+an incarnation — see `binding-identity-design.md`.
+
+## Universal proof rule
+
+A gate is `proven` only when both exist:
+
+1. the complete behavior is reachable through every named production path; and
+2. the named proof exercises that behavior and its failure boundaries on the
+   final candidate.
+
+Every proof receipt must record:
+
+- candidate commit SHA and exact merge base;
+- unfixed baseline SHA used for red/green discrimination;
+- exact command or manual journey protocol;
+- OS, architecture, filesystem, runtime, Git, SSH, daemon, relay, client, and
+  host versions relevant to that journey;
+- UTC start/end time, exit status, counts, and artifact/log location;
+- the production caller, persistence boundary, transport, and cleanup path
+  exercised;
+- the expected oracle and the observed result; and
+- independent reviewer identity and unresolved-finding count.
+
+For a new regression oracle, demonstrate that it fails for the intended reason
+on the unfixed baseline and passes on the candidate. A test that passes both is
+a forward guard and cannot prove the fix.
+
+## G0 — One design contract
+
+**Current status: partial.**
+
+G0 is proven only when:
+
+- every reachable production path follows one reconciled identity, host
+  boundary, operations, delivery, migration, compatibility, and minimal-shape
+  contract;
+- there is one final-host authority service, thin transport adapters, one app
+  projection/controller, and one bounded pre-cutover legacy importer;
+- no adapter or renderer owns a parallel authority state machine;
+- all retained existing primitives are mapped by semantics, not similar names;
+- the lost-consumer/compaction liveness gap has a safe, bounded, authenticated,
+  operator-reachable resolution that does not infer death from time; and
+- an independent production-graph audit finds no contradictory path.
+
+The design document alone, a behavior contract, or focused tests do not prove
+G0.
+
+## G1 — One final-host authority
+
+**Current status: partial.**
+
+G1 is proven only when local, daemon, WSL, direct SSH, nested SSH, paired
+runtime, and remote server all resolve:
+
+- a stable identity minted or validated by the final PTY-owning host;
+- a canonical host-local namespace for worktree, folder, and floating
+  workspaces;
+- one exact pane-generation/PTY-incarnation binding;
+- host connections keyed by final-host identity with lazy discovery;
+- concurrent host isolation; and
+- namespace-local admission, failure, grant, handover, and retirement.
+
+`connectionId`, SSH target ID, client repository ID, path spelling, or
+`worktreeId` may be routing metadata. Their existing names and usage counts are
+not proof that they satisfy final-host identity or namespace semantics.
+
+Proof requires the applicable live journeys below, including simultaneous hosts
+and independent client/host updates.
+
+## G2 — Exact operations only
+
+**Current status: partial.**
+
+G2 is proven only when input, resize, signal, close, output, and exit are fenced
+by the full binding captured before any await:
+
+- authority host;
+- namespace;
+- pane generation;
+- owner/writer incarnation;
+- physical PTY;
+- PTY incarnation; and
+- negotiated operation/source generation where applicable.
+
+Stale, partial, absent, timed-out, disconnected, or unknown evidence must not
+affect a successor. An authoritative operation must never retry through an
+ID-only provider call or a legacy mutation path.
+
+Proof must cover all operations across local, daemon, WSL, SSH, paired runtime,
+remote server, renderer fallback, restart, concurrent replacement, and both
+mixed-version directions. Store-row counts and source-text assertions are not
+sufficient.
+
+## G3 — Durable ordered delivery
+
+**Current status: partial.**
+
+G3 is proven only when the final production design provides all observable
+properties below, even if its internal mechanism differs from the preserved
+construction design:
+
+- complete boundary snapshot before later events;
+- producer held while boundary/replay is established;
+- contiguous replay before reconciliation and live resume;
+- durable semantic outcomes, including exit and state needed by a newly
+  attached consumer;
+- durable idempotent main-process projection before acknowledgement;
+- final-host-owned cumulative acknowledgement or an explicitly approved
+  equivalent with the same crash/replay guarantees;
+- renderer snapshot-plus-delta observation;
+- app, renderer, host, and transport restart resume;
+- gap detection and resnapshot without silent omission;
+- bounded memory, queues, pages, listeners, timers, and retained output;
+- independent consumer retirement and safe compaction liveness; and
+- no app-side duplicate cursor, settlement, receipt, or suffix-reconciliation
+  authority.
+
+Proof must include crash-before/after-ACK cuts, lost responses, disconnected
+replay, gap recovery, slow/stalled consumers, retired and permanently lost
+consumers, paired/remote restart, mixed versions, and scale.
+
+## G4 — One-way legacy cutover
+
+**Current status: partial.**
+
+G4 is proven only when each namespace performs, in order:
+
+1. explicit capability negotiation;
+2. a brief legacy-write freeze;
+3. exact non-mutating inventory;
+4. a deterministic import plan;
+5. validation with ambiguity kept visible and non-destructive;
+6. one self-contained durable authority commit;
+7. topology attachment; and
+8. exact client opening through the authoritative path.
+
+There must be no dual writer, destructive inference, authority-to-legacy
+fallback, or second durable migration catalog after cutover. Old peers remain
+on an unchanged isolated legacy surface or fail before mutation.
+
+Proof requires crash cuts at every phase, replay from the self-contained commit,
+ambiguous-row isolation, independent namespace failure, and legacy-writer and
+reconciliation deletion.
+
+## G5 — Wire and platform compatibility
+
+**Current status: not started.**
+
+G5 is proven only when all exchanged changes follow the remote-wire
+compatibility contract and the final candidate passes:
+
+- old client to new host;
+- new client to old host;
+- native macOS;
+- native Linux at Ubuntu 20.04 / glibc 2.31 compatibility floor;
+- native Windows;
+- physical WSL, including Git Bash/`.cmd` boundaries where relevant;
+- Docker OpenSSH;
+- daemon;
+- direct and nested SSH;
+- paired runtime;
+- remote server;
+- git worktree;
+- folder workspace;
+- floating workspace; and
+- drive-letter and UNC namespace paths.
+
+Run both skew directions independently across every changed deployment boundary:
+app↔daemon, app↔SSH relay/final host, paired client↔paired runtime, remote
+client↔remote server, and mobile/E2EE RPC where affected. A single in-process
+codec test or one client/host pairing cannot stand in for this matrix.
+
+New opcodes or semantics require explicit capability negotiation. An optional
+field that parses on an old peer does not by itself prove that old behavior
+remains correct.
+
+Mocking `process.platform`, running Linux inside Docker, or passing in-process
+wire unit tests does not prove the corresponding native or live-skew row.
+
+## G6 — Simpler, minimised production code
+
+**Current status: partial; structural clauses remain open.**
+
+Decision D1 replaces the original strict inequality: the final integrated
+program must minimise production source and justify every net addition against
+the correctness it buys.
+
+The default baseline is
+`5ed45739e94bdf6460364e033bfcec9b32c0b42a`, the base recorded by GitHub for
+PR #12600. This broader program subsumes #12600. Changing the baseline requires
+an explicit user decision recorded before more implementation begins.
+
+G6 is proven only when:
+
+- aggregate program-attributable production source net LOC is **minimised and
+  every net addition justified** against the frozen baseline — see decision D1
+  under "Recorded user decisions", which replaced the original strict
+  inequality once the assumed deletion budget was shown not to exist;
+- every program-attributable prerequisite merged after the baseline and every
+  stacked PR is included, even if a later rebase places it in `main`;
+- overlapping changes are recomputed from the frozen baseline to the final tree
+  so additions and later deletions are not double-counted;
+- unrelated upstream or user deletions cannot offset program additions;
+- production, test, documentation, CI/runner, generated, and vendored changes
+  are reported separately;
+- every new production module is reachable from a real entrypoint;
+- no test fixture remains under production compilation;
+- there is one identity comparison, transition implementation, exact-operation
+  client, mutation admission path, and delivery state machine;
+- no re-export shim or one-type module exists solely to preserve construction
+  layering;
+- no superseded quarantine, sliding-window, retry-verdict, reconciliation,
+  duplicate cursor, receipt ledger, legacy writer, or migration bridge remains
+  reachable after cutover; and
+- an independent reachability and duplicate-state-machine audit is clean.
+
+Tests or docs cannot offset positive production LOC. A smaller narrow PR is not
+proof if the final stack remains net positive. Deleting correctness or platform
+coverage to hit the number is prohibited.
+
+Classify by behavior, not directory name: shipped runtime code, migration code,
+and build-time code that enforces a shipped artifact invariant are production;
+test-only runners and fixtures are tests even when misplaced, and their presence
+under production compilation independently fails this gate. Publish the final
+file-by-file classification so the count cannot be moved between buckets.
+
+### G6 clause assessment (2026-08-08)
+
+Checked against the current branch rather than assumed:
+
+| Clause                                                                                                                                                      | State                                                                                                                                                                         |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| aggregate net production LOC minimised and justified (D1)                                                                                                   | +228, each addition justified in its commit; 201 LOC deleted after verifying unreachability from all 20 build entrypoints                                                     |
+| every new production module reachable from a real entrypoint                                                                                                | holds — no new unreachable module was added                                                                                                                                   |
+| no test fixture under production compilation                                                                                                                | not audited on this branch                                                                                                                                                    |
+| one identity comparison / transition / exact-op client / admission path / delivery state machine                                                            | **fails** — several remain, and this is the clause the rejected binding proposal would have made worse by adding a second identity comparison beside `resolveStablePaneOwner` |
+| no re-export shim or one-type module for layering                                                                                                           | holds for this branch's additions                                                                                                                                             |
+| **no superseded quarantine, sliding-window, retry-verdict, reconciliation, duplicate cursor, receipt ledger, legacy writer, or migration bridge reachable** | **fails** — `terminal-input-quarantine.ts` is imported by `pty-connection.ts:98` and `terminal-pane-recovery.ts:6`                                                            |
+| independent reachability and duplicate-state-machine audit clean                                                                                            | not run                                                                                                                                                                       |
+
+On the quarantine specifically: it is **not** subsumed by the superseded-PTY
+fence, and claiming otherwise would be wrong. The fence refuses writes aimed at
+a stale ptyId. The quarantine guards the user's _subsequent_ typing — the tail
+of a half-typed line — landing on the successor shell under its current and
+correct ptyId, which the fence never sees.
+
+Deleting it therefore requires contract property B: a _different_ shell surfaces
+unresolved and never silently receives the pane, at which point there is no
+mangled tail to suppress. That is a behaviour change to the recovery path, not a
+deletion, and an earlier attempt to shortcut it was rejected for reintroducing
+the `echo hi; rm -rf x` hazard by disarming per-pane state that is keyed per-tab.
+
+G6 is therefore not promotable, and its blocking clauses are structural rather
+than arithmetic.
+
+### The input quarantine is load-bearing, not superseded (2026-08-08)
+
+G6's clause lists "no superseded quarantine ... remains reachable" and
+`terminal-input-quarantine.ts` was assumed to be one. It is not, and the
+evidence is direct.
+
+**The hazard is live.** Disabling the single call site in `pty-connection.ts`
+and running the pane's own oracle reproduces it verbatim, lead-verified:
+
+    AssertionError: expected "vi.fn()" to not be called with arguments:
+      [ 'cho hi; rm -rf x' ]
+
+Deleting the module without a replacement re-opens `rm -rf` execution.
+
+**Contract property B was costed by building it, not estimated.** Threading the
+incarnation to the renderer compiles at **+26 production LOC**, and completing it
+(publishing an incarnation from `resolveTerminalPane`, plus a new exported reader
+for the module-private `ptyIncarnationById` map) is about **+33**. The
+cross-remount state the comparison needs must outlive the destroyed pane, so it
+becomes a module of roughly the size of the one being deleted — the two in-tree
+precedents are 88 and 86 lines. Adding a renderer-side identity comparison would
+also worsen G6's already-failing "one identity comparison" clause. Floor: about
+**+140 production LOC to delete 88**.
+
+**And the route is not uniformly available.** `RuntimeTerminalCreate` and
+`RuntimeTerminalResolvePane` carry no `incarnationId`; remote connect results are
+built without one; and the transport latches `resolvePaneUnavailable` when a host
+answers `method_not_found`. Mixed client/host versions are the normal state, and
+an optional field does not make an old host publish it. So a paired client reads
+_unknown_ — which under this program's own governing rule is not proof of "same
+shell". Requiring proof makes every remote reattach surface unresolved; not
+requiring it needs a fallback, and the only correct fallback is this quarantine.
+Either way the module stays reachable.
+
+`endpointReplaced` is also routine rather than rare — a daemon death remounts
+every live pane — so property B would convert each into a manual per-pane
+reconnect, which is the coverage deletion G6 explicitly prohibits.
+
+**Consequence:** this clause of G6 cannot be closed by deletion. Either the
+clause is amended to recognise the module as load-bearing, or the program accepts
+a net-positive change to replace it with something weaker on remote hosts. That
+is a user decision (call it D5), not one to assume.
+
+### G6 clause: test fixtures under production compilation (audited 2026-08-08)
+
+Audited by importer rather than filename, then checked against what the build
+actually emits. **The clause is already satisfied on the meaning that matters,
+and cannot be closed by moving files on the other meaning.**
+
+36 candidates; 4 have genuine production importers and are correctly placed. The
+other 32 (~3,300 LOC) have zero non-test importers.
+
+**They do not ship.** Spot-checked the emitted bundle for
+`terminal-restore-parity`, `ipcEventsTestHarness`, `storeTestHelpers` and
+`sshRelayNativeDepsInstallFixture`: none appears in `out/`. Rollup drops them
+because no production entrypoint reaches them. Under "compiles into the shipped
+product", this clause holds today.
+
+**Moving them would close nothing under the other reading.**
+`config/tsconfig.node.json` and `config/tsconfig.tc.web.json` declare `include`
+globs such as `../src/main/**/*` with **no `exclude` at all**. A `__tests__/`
+directory is matched by that glob exactly as any other path is, and so is every
+`*.test.ts` file in the repo. Relocating 32 fixtures would not remove one file
+from typecheck scope.
+
+A sweep was started and stopped once this was verified, rather than landing 32
+moves across areas this program does not own for no measurable gain.
+
+If the intent behind the clause is that typecheck scope should exclude test code,
+that is a repo-wide tsconfig change affecting every test file — different work
+with a different owner, and it should be stated as such rather than pursued by
+relocating fixtures.
+
+One genuine defect was found and fixed while auditing:
+`terminal-pane/xterm-bypass-event-fixture.ts` and
+`terminal-pane/__fixtures__/xterm-bypass-event.ts` were byte-identical apart from
+an import path, and the `__fixtures__` copy had zero importers — a half-finished
+move left in place. The dead copy is deleted and the live one completed its move.
+
+## G7 — No regression and reviewable comprehensive change
+
+**Current status: not started.**
+
+G7 is proven only on the rebased, converged candidate after G0–G6 and all
+thirteen journeys are proven. It requires:
+
+- correctness and security gates;
+- A/B input latency and output throughput;
+- backpressure and bounded-memory results;
+- renderer/app/daemon/relay restore and startup results;
+- large-pane, long-session, and multi-host scale results;
+- native packaging/startup on macOS, Linux, and Windows;
+- WSL, Docker SSH, paired, remote, folder, floating, worktree, drive, and UNC
+  coverage;
+- both live mixed-version directions;
+- final categorized LOC census;
+- independent repository review with no unresolved P0–P2 findings;
+- release-readiness review with no unresolved correctness, security,
+  compatibility, or performance findings; and
+- a detailed comprehensive PR whose claims match the receipts.
+
+Before implementation, record a performance protocol that makes “no
+regression” falsifiable:
+
+- fixed candidate and baseline builds, hardware, OS, power mode, network shape,
+  pane/session population, payloads, and background-load policy;
+- warm-up policy, randomized A/B order, sample count, raw-data location, and
+  statistical method;
+- input latency, output throughput, memory, backpressure, restore, startup, and
+  large-pane metrics with directionality;
+- deterministic ceilings for writes, scans, queues, listeners, timers, and
+  allocations on hot paths; and
+- a predeclared equivalence/no-regression bound no larger than measured baseline
+  noise. A nonzero bound handles measurement noise; it is not permission for a
+  known slowdown and requires explicit user approval.
+
+Unless an independently reviewed protocol justifies another count, use at least
+five warm-up trials and thirty measured trials per latency/startup/restore
+configuration, retain raw samples, and report confidence intervals. Throughput,
+backpressure, and memory tests must also include a fixed-duration steady-state
+run and a leak-slope result. Choose all workloads and thresholds before looking
+at candidate results.
+
+Green CI, thousands of tests, mergeability, or “reviewable for what shipped” do
+not prove G7.
+
+## Thirteen required production journeys
+
+Every row is currently **not proven**.
+
+The issue-to-journey matrix in
+[`related-open-work.md`](./related-open-work.md#mandatory-issue-to-journey-matrix)
+is part of these journeys, not optional context. Every bound incident needs a
+red-on-baseline/green-on-candidate oracle, or explicit evidence plus user
+acceptance that it is unrelated.
+
+|   # | Journey                                               | Required oracle                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| --: | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+|   1 | Local macOS, Linux, and Windows                       | The same pane, full binding, and OS process survive renderer and app restart; every stale exact operation is rejected. Run natively on all three OSes.                                                                                                                                                                                                                                                                                                                 |
+|   2 | Daemon and physical WSL                               | The same PTY survives client and daemon reconnect/restart boundaries; generation skew fails closed without killing or replacing a live successor.                                                                                                                                                                                                                                                                                                                      |
+|   3 | Lazy discovery and skipped-host restart               | An unused host is not probed eagerly. After a restart that skipped it, lazy rediscovery restores only that host's sessions and never adopts host-current or sibling-host state.                                                                                                                                                                                                                                                                                        |
+|   4 | Concurrent multi-host connections                     | At least two distinct final-host connections operate simultaneously. One host's disconnect, CAS, timeout, or failure cannot affect the other.                                                                                                                                                                                                                                                                                                                          |
+|   5 | Namespace-partial admission failure                   | One namespace on a multiplexed connection fails challenge/CAS/grant publication while another commits. Only the failed host-plus-namespace is fenced.                                                                                                                                                                                                                                                                                                                  |
+|   6 | Docker OpenSSH with `MaxSessions=1`                   | The same remote PID and exact binding survive disconnect and client restart. Authority restart imports exactly or exposes unresolved recovery without creating, killing, or adopting. Explicit close or exact proven teardown durably retires the lease and process; unknown ownership stays visible and recoverable rather than being killed. Count actual remote processes, panes, tabs, bindings, leases, and session-cap slots before and after a settle interval. |
+|   7 | Two independent Docker SSH hosts                      | Two simultaneous final hosts keep endpoint credentials, principals, namespaces, sessions, cursors, failures, and cleanup completely isolated.                                                                                                                                                                                                                                                                                                                          |
+|   8 | Paired client and remote server                       | The final host remains authoritative across independently updated peers, pairing reconnect, client restart, and remote-runtime restart.                                                                                                                                                                                                                                                                                                                                |
+|   9 | Worktree, folder, floating, drive, and UNC namespaces | Each resolves the same stable host-local namespace across spelling/restart changes, without using client repository ID or target ID as identity.                                                                                                                                                                                                                                                                                                                       |
+|  10 | Stable proof and exact retry                          | One bounded device proof identity admits fresh process/session nonces. A lost response retries the exact challenge/request; changed, replayed, cross-host, cross-namespace, or host-current state is rejected.                                                                                                                                                                                                                                                         |
+|  11 | Identity reset and re-enrollment                      | Crash-resumable host retirement, relay revoke acknowledgement, transport closure, local credential removal, and atomic successor publication occur in order. Offline and old peers remain explicitly pending.                                                                                                                                                                                                                                                          |
+|  12 | Mixed versions in both directions                     | No unknown opcode or ungranted publication mutates state. Unsupported challenge, grant, delivery, or operation semantics stay on isolated legacy behavior or fail before mutation.                                                                                                                                                                                                                                                                                     |
+|  13 | Performance and scale                                 | Under the predeclared protocol above, input/output latency, throughput, backpressure, memory, reconnect/restore, startup, large-pane, long-session, and multi-host ceilings show no regression against the fixed baseline. Raw samples, confidence intervals, deterministic counters, and leak slopes satisfy their predeclared bounds.                                                                                                                                |
+
+## Cross-cutting correctness cases
+
+Every relevant journey must exercise:
+
+- stale, missing, unknown, rejected, timed-out, and disconnected evidence;
+- concurrent replacement and sibling-host/namespace isolation;
+- lost request and lost response;
+- cancellation and partial setup cleanup;
+- crash immediately before and after every durable boundary;
+- restart from disk rather than process-memory state;
+- duplicate and out-of-order delivery;
+- gaps, overflow, and slow/stalled consumers;
+- explicit close versus detach;
+- eventual exact retirement after explicit close or proven teardown while
+  uncertain ownership remains intact and visible;
+- legacy data with missing optional fields;
+- relay/daemon incarnation reuse;
+- sleep/resume and clock movement where timers schedule retries;
+- exact remote process/PID census, not only persisted-row state; and
+- cleanup that requires positive identity proof.
+
+## Forbidden proof substitutions
+
+- A mock is not a native-platform journey.
+- A source grep is not a production call-path journey.
+- A row marked `expired` is not proof that its remote process exited.
+- Optional pane metadata plus an O(n) repair scan is not structural uniqueness.
+- An empty list from an unavailable provider is not proof of absence.
+- A timer or retry budget is not proof of death.
+- A broad test count is not a correctness oracle.
+- A test that passes unfixed code is not evidence that a change fixed the bug.
+- An open or green PR is not shipped behavior.
+- Historical construction receipts are not proof for a rebased candidate.
+- Prior art or an uncited LOC comparison cannot delete a requirement.
+
+## Promotion template
+
+Before changing any row to `proven`, add a receipt containing:
+
+```text
+Gate or journey:
+Candidate SHA:
+Merge-base SHA:
+Unfixed/red SHA:
+Production path exercised:
+Exact command or manual protocol:
+Environment and versions:
+Expected oracle:
+Red result:
+Green result:
+UTC start/end:
+Artifact/log:
+Independent reviewer:
+Unresolved P0/P1/P2:
+LOC/performance impact:
+```
+
+If any field is missing, the row remains partial or not started.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/new-design-goalposts.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/new-design-goalposts.md
new file mode 100644
index 00000000000..fce53501a7c
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/new-design-goalposts.md
@@ -0,0 +1,386 @@
+# New design — goalposts
+
+Tracks the design approved on 2026-08-09 (`design-explained.html`, detail in
+`counsel-design.html`). Updated as work lands. Progress in every status update
+is reported against this file.
+
+## How to read a status
+
+| Status | Means |
+| --- | --- |
+| **PROVEN** | An oracle asserts the behaviour, removing the production guard **reddens** that oracle, and the mutation was verified to actually land before the result was believed. |
+| **ORACLE RED** | The oracle is written and currently fails for the right reason. The production change is not written yet. This is the intended pre-implementation state. |
+| **NOT STARTED** | No oracle. |
+| **BLOCKED** | Waiting on another goalpost or an owner decision. |
+
+A green test is **not** a status. This program shipped three guards that passed
+their tests while sitting off the route production takes; "PROVEN" exists to
+make that impossible to claim by accident.
+
+---
+
+## Scoreboard
+
+| | Count |
+| --- | --- |
+| Step goalposts proven | **7 of 7** (one deleted as unreachable) |
+| Global goalposts proven | **5 of 6** — G1 missed, see below |
+| Scope removed by evidence | S7 (death rule) — never built |
+| Oracle clauses green | 26 |
+| Oracle clauses red (awaiting implementation) | 0 |
+| Net production lines, correctness work | **+13** |
+| Net production lines, incl. the approved affordance | **+83** |
+| Net test lines | +2,578 |
+
+**G1 is not met, and that is reported rather than smoothed over.** The design's
+net-negative target assumed the remaining steps were collapses. Three were
+(S3 −21, S8 −32, and the relay half of S5), but two genuinely add code: the
+single `bindPaneShell` producer (+60, since one function replaces three
+divergent call sites without those sites shrinking much) and the D1
+disconnected-pane affordance (+70), which is a new product surface the owner
+approved — a feature, not a refactor. Excluding the affordance the correctness
+work is +13, i.e. roughly a wash. See "G1" below for the full accounting.
+
+---
+
+## Step goalposts
+
+### S1 — An identity mismatch is never read as death · **PROVEN**
+
+*Guarantee.* The relay reports a pane-identity mismatch by saying the pty was
+not found. It found it — comparing is how it noticed. That must never reach a
+respawn decision as proof of death.
+
+- Oracle: `src/main/providers/ssh-pty-identity-mismatch-is-not-death.test.ts`,
+  `src/renderer/src/components/terminal-pane/reattach-failure-classification.test.ts`
+- Clauses: 7 + 3
+- Mutations proven: restoring the destructive wrap reddens 2 clauses; deleting
+  the classifier guard reddens 1 — clause-selective, each proven separately.
+- Landed: `e2524b0472f`
+
+### S2 — Pane identity is not sent on reattach · **PROVEN**
+
+*Guarantee.* Moving a pane to another tab must never make its terminal
+unreachable.
+
+- Oracle: same file, `reattach does not ask the relay to police pane identity` (2 clauses)
+- Also inverted an existing test that pinned the removed behaviour, so the new
+  intent stays covered rather than silently dropped.
+- Works against **already-deployed relays**: the relay's comparison is
+  presence-guarded, so not sending the fields disarms it everywhere. No wire
+  change, no redeploy.
+- Landed: `c51be8072ba`
+
+### S3 — A failed reattach never fabricates an exit · **PROVEN**
+
+*Guarantee.* On an unproven not-found, the pane is not told the program exited,
+ownership is not deleted, provider state is not cleared, and the lease is not
+expired. The case routes into the non-destructive recovery branch that already
+exists.
+
+- Oracle: `src/main/ssh/ssh-relay-reattach-exit-proof.test.ts` — 8 green
+- Mutation proven: restoring the destructive block reddens 6 of 8 clauses; the
+  2 producer pins stay green, so the mutation is clause-selective.
+- Two tests pinned the deleted premise ("attach verifies liveness before
+  answering not-found") and were **inverted**, not patched.
+- Shipped with the disconnected-pane affordance below, since panes now stay
+  visible instead of silently respawning.
+- Landed: `c19f1b386b4` (−21 production lines)
+
+### S4 — One partition per (target, pane) · **PROVEN**
+
+*Guarantee.* A pane that re-leases under a new relay id across reconnects ends
+with exactly **one** live claim; the predecessor is superseded, not left live.
+
+- Oracle: `src/main/ssh-pane-binding-partition.test.ts` — 7 green (one clause added)
+- The highest-value goalpost: the mechanism behind the reported 2 → 19 → 20.
+- Mutation proven as a **2×2**, because the two edits mask each other:
+
+  | reader | load fold | result |
+  | --- | --- | --- |
+  | hedge (original) | off | 6 red — baseline |
+  | hedge | off | 4 red — the 2 source-text clauses now green |
+  | local-only | off | 1 red — the reader carries 3 clauses |
+  | hedge | **on** | **all green** ← the fold masks the reader |
+  | local-only | on | all green |
+
+  That fourth row is why an **eighth clause was added**: with the fold shipping,
+  the fold erases the divergent copy at boot, so the reader guard would have
+  shipped unproven — precisely the failure mode G5 exists to catch. The new
+  clause rewrites `ssh:<target>` mid-session (orphan adoption still writes
+  there) and reddens when the hedge is restored, pinning the reader on its own.
+- Five clauses in `ipc/pty.test.ts` pinned the two-partition shape and were
+  **inverted** to the single home, each keeping an arity check so a re-added
+  partition argument fails loudly.
+- Side effect found while verifying: the renderer never hydrated the `ssh:*`
+  partition (`listKnownRuntimeHostIds` filters to `runtime:*`), so the Issue
+  #217 force-quit binding protection had never worked for SSH panes. It does now.
+- Landed: `2733c59879b` (+9 production lines — the call sites shrank; the fold
+  is new state repair)
+
+### S5 — The superseded-pane fence is live on the reattach path · **PROVEN**
+
+*Guarantee.* After a relay-driven reattach binds a pane, a stale write aimed at
+the superseded predecessor is **refused**. It used to be permitted, because the
+fence's bookkeeping was only written by spawn.
+
+- Oracle: `src/main/ssh/ssh-relay-session-reattach-pane-fence.test.ts` — 4 green
+  (one clause added)
+- Collapsed to one `bindPaneShell` producer used by the relay reattach and both
+  spawn handlers. Error policy stays at the call sites because it genuinely
+  differs: a caller that just created a shell must clean it up on a failed
+  durable write; a caller that merely reattached must not detach anything.
+- Mutation proven, both sub-guards isolated:
+  - drop the `rememberPaneKeyForPty` call → 3 clauses redden
+  - prefer the stored `tabId` over the live layout → 1 clause reddens
+- That second clause is **new**. Every pre-existing clause used one tabId on
+  both sides, so a producer that simply forwarded `lease.tabId` would have gone
+  green and shipped the moved-pane bug unnoticed. Only the leaf half of a pane
+  key is remint-stable; `detachTerminalPaneToTab` moves a live pane and its PTY.
+- Two source-text clauses were **strengthened**: they used to require the relay
+  to hold a `persistPtyBinding` call and merely forbade an ssh-partition
+  argument. The relay now has none, so they assert **zero** direct binding
+  writes there — a second bind producer is exactly the defect being removed.
+- Repaired a latent false green: the "persistence fails" case in
+  `ssh-relay-session-reconnect-incarnation` was passing because a missing mock
+  made the call throw a TypeError that happened to emit the asserted
+  `console.error`. The failure is now injected at the producer.
+- Landed: `0f409055d3f` (+60 production lines — the one step that grows)
+
+### S6 — Settle whether the 30s recovery grant executes at all · **PROVEN — it is dead code**
+
+*Result.* It cannot execute for a real SSH pane. Verified personally:
+
+- The lease stores a **relay-native** pty id, normalized on write
+  (`persistence.ts:7184`, comment: "app ids are global").
+- The caller passes the **app-form** id (`orca-runtime.ts:16478` ← `toAppSshPtyId`).
+- The comparison is raw `lease.ptyId === ptyId` (`orca-runtime.ts:6310`) with no
+  normalization, so the two forms can never be equal.
+- The branch is also unreachable for a local pane, since it requires an SSH lease.
+- Its covering test seeds both sides as the same literal with a null
+  connectionId — a shape production cannot produce.
+
+### S7 — The death rule · **DELETED on S6's evidence**
+
+Not built. The arbitration machinery existed to referee a branch that never
+executes. Per the design: "if E-1 shows the grant branch unreachable, E-2 is
+deleted and the marker simply never fires, which is the safe end state."
+
+### S8 — Remove the dead recovery-grant path · **PROVEN**
+
+*Guarantee.* Deleting it changes no behaviour, because it has none.
+
+- Oracle: `src/main/runtime/ssh-pane-recovery-grant-reachability.test.ts`, written
+  and green **before** the deletion, so inertness is demonstrated rather than assumed.
+- It mints **both** id forms from the production helpers rather than as two
+  hand-typed literals, so it tracks the real namespace split instead of
+  restating it, and seeds a lease qualifying on every other predicate (state,
+  worktree, tab, leaf, grace window). Anti-vacuity clauses pin that control
+  actually reaches the gate rather than bailing out earlier.
+- Mutation proven **before** deleting: normalizing the `lease.ptyId === ptyId`
+  comparison makes the grant fire and reddens the oracle. That is the exact fix
+  someone would reach for, so the oracle is pinned to unreachability, not to the
+  throw.
+- Deleted: the grant tail, the `terminalPaneRecoveryByIdentity` dedup map (whose
+  only consumer was the grant), and the dead `ptyId` parameter.
+- **Not** deleted, because over-deleting here breaks users: `getRecentExpiredSshLease`,
+  `hasRecentExpiredSshLeasePane` and `SSH_PANE_RECOVERY_GRACE_MS` all stay. Their
+  other two callers pass `ptyId` undefined, which short-circuits the broken
+  comparison — those are live and feed headless-mobile terminal-tab visibility.
+- Also **not** done: deleting only the gate while keeping the spawn. That would
+  have granted a respawn to every disconnected pane — a change in the dangerous
+  direction. The refusal is what stays.
+- Three tests pinned the grant and were **inverted**; a fourth is now
+  tautological and carries a comment saying so rather than being left hollow.
+- Honest limit, recorded in the oracle: unreachable **by construction** for SSH
+  panes; for a local pane, unreachable only up to a random-UUID collision.
+- Landed: `7d44315437a` (−32 production lines)
+
+### Product affordance (D1) — **SHIPPED with S3**
+
+A pane that cannot be verified renders as disconnected with two explicit actions
+— "Try again" and "Start a new terminal" — instead of silently respawning.
+
+- No new IPC channel: the silent-respawn decision was always renderer-local.
+  Both actions are things the code already did, moved behind a click.
+- Copy constraint enforced **as an oracle**, not as a review note: the rendered
+  text must match no death verb and show no wire token. STYLEGUIDE.md:236 already
+  forbids result verbs without result data, and a failed attach is not result data.
+- `TerminalRemoteRuntimeReconnectBanner` → `TerminalPaneDisconnectedBanner`; it
+  now serves any transport. Existing i18n key strings kept verbatim so no shipped
+  translation breaks; the SSH copy is additive.
+- Landed: `5e1b57bb2f9` (+70 production lines)
+
+---
+
+## Global goalposts
+
+### G1 — Net production code is negative · **NOT MET (+83 this phase)**
+
+Counted from the pre-work merge base, production only. Reported as a miss rather
+than reframed until it passes.
+
+| Step | Net production |
+| --- | --- |
+| S3 — collapse the fabricated exit | **−21** |
+| S4 — one partition | +9 |
+| S5 — one bind producer | **+60** |
+| S8 — delete the dead grant | **−32** |
+| D1 affordance (new product surface) | **+70** |
+| Banner rename (pure move, no behaviour) | +36 of the above, not real growth |
+| **Correctness work only (S3–S8)** | **+13** |
+| **Total this phase** | **+83** |
+
+Why it missed. The target assumed the remaining steps were collapses. Three were.
+Two were not, for reasons worth stating:
+
+- **S5 (+60).** One producer replacing three divergent call sites only shrinks
+  the code if those sites were duplicating the whole bind. They were not — they
+  each did *part* of it differently, which is exactly the defect. The producer is
+  net-new; the call sites shrank by 7 lines. Collapsing the two spawn handlers'
+  surrounding logic as well would buy the difference back, but it would reorder
+  side effects that existing ordering assertions pin, so it was left alone.
+- **D1 affordance (+70).** A new user-facing surface the owner approved. Features
+  add lines; counting it against a refactor budget would be the wrong pressure —
+  the way to make this number go negative would be to delete the affordance.
+
+Where the remaining slack is, if the goal is to be met later: steps P and K of
+the design (the leaf-keyed record replacing `SshRemotePtyLease`, and the lease
+readers ported onto it) are the deletions this phase deferred.
+
+### G2 — No redeploy required for the user-visible fixes · **PROVEN for S1–S8**
+
+Fixes must work against relays already installed on people's hosts. Every step
+that landed is client-side only:
+
+- S1, S2 — proven previously.
+- S3 — deletes client-side reactions to a relay message; the relay is unchanged.
+- S4 — client-local persistence layout only; nothing crosses the wire.
+- S5 — client-local in-memory fence maps and the durable binding.
+- S8 — deletes a client-side branch.
+- D1 — renderer only.
+
+**No relay redeploy is required for any of it**, which matters because the
+reported failure is happening on hosts people have already deployed.
+
+### G3 — Wire compatibility · **SATISFIED — nothing on the wire changed**
+
+Clients and hosts update independently. This phase added **no** RPC parameter,
+no stream opcode and no published field, so there is nothing to negotiate. The
+orphan projection that would have added one optional field belongs to step W,
+which is not in this phase.
+
+One wire-adjacent behaviour change is worth naming for reviewers: `terminal.recoverPane`
+(RPC) now always refuses for a disconnected pane. The method still exists and its
+signature is unchanged, so older clients get a refusal rather than a
+`method_not_found` — and the renderer already handles refusal, because that is
+what the branch did in practice anyway.
+
+### G4 — Cross-platform · **SATISFIED by construction**
+
+macOS, Linux, Windows, WSL. No oracle added in this phase shells out, and none
+uses `echo $$` or `ps` — they assert against persisted state, in-memory maps and
+rendered text. No rule that landed concludes anything from a relay restart or
+from whether a shell survives a hard relay death, which is the Windows-divergent
+question the design deliberately refuses to depend on. The affordance copy holds
+on every platform precisely because it never claims the shell died.
+
+### G5 — Every guard is proven live on the production route · **PROVEN for S1–S8**
+
+For each new guard, an oracle must redden when the **producer** is removed — not
+only when the guard itself is removed.
+
+This exists because it had failed three times here: an inert `mayCreate`, a
+keystroke fence inert on reattach, and a respawn gate on a minority path. S5 is
+the remediation of the second.
+
+**It nearly failed a fourth time in this phase, and the rule caught it.** S4's
+reader guard (`durablyBoundPtyIdForPane` reading one partition) initially showed
+*no* mutation response: restoring the ssh-first hedge left all six clauses green,
+because the load fold had already erased the divergent copy at boot. The guard
+was correct and would have shipped unproven. The fix was an added clause that
+rewrites the ssh partition **mid-session**, which reddens on the hedge and pins
+the reader independently of the fold.
+
+Two further near-misses found and closed the same way:
+- S5's clauses all used one tabId on both sides, so "compose the paneKey from
+  the current tab" was unpinned — a producer forwarding `lease.tabId` would have
+  gone green. A moved-pane clause now pins it.
+- A case in `ssh-relay-session-reconnect-incarnation` was a **latent false
+  green**: it passed because a missing mock threw a TypeError that happened to
+  emit the `console.error` it asserted. Now injected at the producer.
+
+### G6 — No `max-lines` disables · **HOLDING**
+
+Per AGENTS.md. No per-file bumps either.
+
+---
+
+## Definition of done
+
+| | Criterion | Status |
+| --- | --- | --- |
+| 1 | S1–S5 and S7 PROVEN, or S7 deleted on S6's evidence | **MET** — S1–S6 and S8 proven; S7 deleted on S6's evidence |
+| 2 | G1–G6 satisfied, each with evidence recorded here | **PARTIAL** — G2–G6 met; **G1 missed at +83**, accounted for above |
+| 3 | The reported failures covered by an oracle that reddens without the fix | **MET.** Pane cardinality: S4's ten-reconnect clause, plus an E2E spec driving three real reconnects against a Docker relay (passes). Duplicate resume: the classification clauses, plus an E2E spec where the **host itself** records every shell launch (passes). Writing the second one is what exposed that RC2 was still live — see below |
+| 4 | No guard shipped without a producer-side mutation proving it is reachable | **MET** — and it caught one guard that would otherwise have shipped unproven (see G5) |
+
+### Found after the goalposts were met
+
+Two defects surfaced *after* every step goalpost was proven, and both were invisible to the unit
+oracles that had already gone green. Recorded because they are the most useful evidence in this
+phase about where these oracles stop reaching.
+
+**RC2 survived S3 — found by writing the E2E test.** `7cd7fef927f`.
+The reported duplicate agent resume was not fixed. `reattachSshPtySession` maps every relay
+not-found to `SSH_SESSION_EXPIRED`, and `isProvenSshSessionGoneError` returned true for it, so the
+renderer's reattach arm still respawned. The E2E harness produced the shape directly: a stalled
+relay is superseded by a fresh one with no memory of `pty-1`, while the old shells keep running
+under the stopped process. The new relay answers not-found for a live shell.
+
+A not-found proves an exit only if the relay process that minted the pty is the one answering —
+design D3 row 2, gated on `relayInstanceId`, which step E-2 never built. `SSH_SESSION_EXPIRED` is
+not independent evidence: its only producer is that same mapping, and the token's own doc comment
+claimed "the host proved the session is gone", which it never did.
+
+So `isProvenSshSessionGoneError` returns false. This is also what makes the D1 affordance
+load-bearing rather than near-unreachable. The respawn tails are deliberately kept — the design
+preserves the grant as a conditional for E-2 — with a clause pinning that nothing reaches them.
+
+**The fold left half a fence behind — found by adversarial review.** `994733d8b1a`.
+`persistPtyBinding` writes the binding and its incarnation into the same partition, and the
+incarnation is what its CAS compares. The fold moved only `ptyIdsByLeafId`, so after upgrade the
+guard stayed in the partition nothing reads and the CAS compared `undefined` against `undefined`.
+Not data loss and not a wrong-shell bind, but a guard silently weakened by a migration is the exact
+shape this program keeps finding.
+
+### Residuals, stated rather than closed quietly
+
+- **Orphan adoption still writes the `ssh:<target>` partition.**
+  `adoptTerminalOrphansFromInventory` (via `tryGetWorkspaceSessionHostIdForWorktree`)
+  writes pane bindings there. S4's reader ignores that partition, so supersession
+  is unaffected and the guarantee holds — but the write now lands somewhere
+  nothing reads. Harmless today, and a trap for whoever touches it next. Belongs
+  with step W.
+- **The load fold moves leaf bindings only.** It deliberately does not touch
+  `tabsByWorktree[*].ptyId` in the ssh partition: that field is a tab-level
+  pointer no supersession path reads, and nulling it without a local counterpart
+  to move it to would be data loss. Narrowing the fold to what the defect
+  actually requires is why `reassignSshTargetId` needed no inversion.
+- **The main-side detached branch still has no renderer signal.** S3 made the
+  main process stop lying; the affordance covers the renderer-initiated reattach
+  arms. A relay-driven reattach failure remains silent to the user. Closing it
+  needs a `pty:detached` channel — deferred deliberately, not overlooked.
+
+## Deliberately out of scope
+
+- The data-plane work (transport delivery guarantee, binary payloads, one credit
+  ledger). Real and separately justified, but independent of these goalposts.
+- Rebuilding the authority architecture rejected earlier at +60,903 lines.
+
+## Owner decisions
+
+| | Decision | Status |
+| --- | --- | --- |
+| D1 | An unverifiable pane becomes visibly disconnected with two actions, instead of silently respawning | **Approved 2026-08-09** (implicit in approving the design; flagged for correction if not intended) |
+| D2 | Whether the older gate/journey framing is rescoped or retired now that this design supersedes it | **Open** |
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/related-open-work.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/related-open-work.md
new file mode 100644
index 00000000000..0d20afdf08e
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/related-open-work.md
@@ -0,0 +1,341 @@
+# Related GitHub work
+
+This is a curated overlap map, not a merge queue. States were verified against
+GitHub on 2026-08-08 UTC and must be refreshed before any rebase, merge, close,
+or implementation decision.
+
+Rules:
+
+- Do not stack PRs merely because they appear in the same section.
+- “Conflict” means semantic or file overlap that requires one coherent design,
+  not an instruction to merge both.
+- A related PR can supply diagnosis, tests, or a small reusable primitive
+  without becoming a dependency.
+- Landing a related PR does not promote G0–G7 or one of the thirteen journeys
+  unless the final converged tree passes that gate's complete proof.
+- GitHub issue/PR text is context, not authority over the user's goal.
+
+## Immediate incident and competing implementations
+
+- [Issue #11729 — SSH remote environment not restored after login on Rocky Linux
+  9.4](https://github.com/stablyai/orca/issues/11729) — **open**. This is the
+  named STA-3077 customer incident. Its final acceptance must include Rocky
+  Linux SSH, repeated reconnect, the same PID/process/session/transcript
+  identity, restored workspace environment, visible pane count, and actual
+  remote relay PTY/process count.
+- [PR #13111 — stop reconnect grafting panes, stacking leases, and respawning
+  live shells](https://github.com/stablyai/orca/pull/13111) — **open**, current
+  branch, green checks, no approval. It is narrow containment and leaves remote
+  shell reclamation unresolved. One major Docker settle review thread remains
+  [unresolved](https://github.com/stablyai/orca/pull/13111#discussion_r3739665033).
+- [PR #12264 — stop reconnect from grafting ghost terminal
+  panes](https://github.com/stablyai/orca/pull/12264) — **open and conflicting**.
+  It targets the same incident and overlaps persistence, PTY, SSH relay, and E2E
+  files. Mine its diagnosis and discriminating artifacts; do not stack it
+  wholesale with #13111.
+- [PR #12743 — contain reattach to existing panes, quarantine
+  orphans](https://github.com/stablyai/orca/pull/12743) — **open and
+  conflicting**. It shares `mayCreate: false` and broader relay coverage, but
+  quarantine must be judged against the no-reconciliation final design.
+- [PR #12456 — reattach on `restoreRequired` instead of expiring a live
+  session](https://github.com/stablyai/orca/pull/12456) — **open**. It addresses
+  the #12448 branch through retry rather than cold respawn. Treat it as a
+  semantic alternative or complementary recovery path only after choosing one
+  exact restore protocol.
+- [PR #9820 — reap orphaned relay PTYs before session-cap
+  exhaustion](https://github.com/stablyai/orca/pull/9820) — **open**. Its
+  time-based remote kill conflicts with unknown-is-not-dead and #13111's
+  deliberate non-kill behavior. Use it as incident evidence, not a safe default
+  dependency.
+- [PR #12798 — opt-in zmx-backed durable SSH
+  terminals](https://github.com/stablyai/orca/pull/12798) — **open**. This is a
+  broad architectural alternative for final remote PTY ownership with direct
+  file overlap. Evaluate capability-by-capability; never blend it into the
+  current model accidentally.
+
+## Open incident issues that should become explicit oracles
+
+- [Issue #9819 — SSH relay leaks orphaned PTYs until the 50-session
+  cap](https://github.com/stablyai/orca/issues/9819) — explicit close,
+  disconnected close with a lost shutdown response, and worktree teardown must
+  durably retry retirement of the exact lease and process. Uncertain sessions
+  must survive visibly until resolved. Repeated reconnect must reclaim actual
+  relay PIDs/session slots rather than accumulate toward the cap.
+- [Issue #9034 — SSH reconnect repeatedly spawns detached PTYs for one
+  pane](https://github.com/stablyai/orca/issues/9034) — count actual remote PTYs
+  and prove bounded one-pane ownership across repeated reconnect.
+- [Issue #11006 — transient SSH disconnect treats live relay PTYs as dead and
+  duplicate-respawns agents](https://github.com/stablyai/orca/issues/11006) —
+  disconnect with a live process must remain unresolved/reattachable and must
+  not start another agent.
+- [Issue #12447 — closed SSH tabs resurrect and auto-resume old
+  sessions](https://github.com/stablyai/orca/issues/12447) — explicit close must
+  persist its pending tombstone before a kill RPC, survive a lost reply plus app
+  and relay restart, retry after handshake, reclaim the exact remote PTY, and
+  never recreate UI or automatic resume.
+- [Issue #12448 — `restoreRequired` is misreported as session
+  expiry](https://github.com/stablyai/orca/issues/12448) — source recovery must
+  replay/repaint on the same PID and binding without starting a replacement
+  `--resume`; identity drift, timeout, or unknown state must not become proof of
+  process death or cold resume authority.
+- [Issue #12699 — SSH sleeping-agent wake sweep forks live remote
+  sessions](https://github.com/stablyai/orca/issues/12699) — all wake/resume
+  paths must share the same exact liveness and identity contract.
+- [Issue #12683 — remote-runtime disconnect spends recovery on stale same-handle
+  reattach](https://github.com/stablyai/orca/issues/12683) — paired/web terminal
+  recovery must fence generations and retain automatic liveness.
+- [Issue #10208 — duplicate terminal tab on worktree session
+  restore](https://github.com/stablyai/orca/issues/10208) — local/worktree
+  restore must prove the same pane and process rather than creating a duplicate.
+
+These issues are separate customer-visible symptoms. A single structural model
+should make their shared invalid transitions impossible, while each issue keeps
+its own discriminating regression journey.
+
+## Daemon, relay generation, and liveness work
+
+The acceptance matrix must also reproduce these open lifecycle incidents:
+
+- [Issue #11904 — tab close with a broken binding orphans the daemon
+  session](https://github.com/stablyai/orca/issues/11904) — close intent must be
+  durable before transport work and eventually retire the exact process.
+- [Issue #8585 — detached relay generations are never
+  reaped](https://github.com/stablyai/orca/issues/8585) — termination must name
+  the exact relay generation; path/PID reuse or a failed connection cannot kill
+  a successor.
+- [Issue #9138 — updates leave old daemon generations and sessions
+  alive](https://github.com/stablyai/orca/issues/9138) and
+  [issue #11342 — stale daemon/PTY generations leak across upgrade and
+  close](https://github.com/stablyai/orca/issues/11342) — upgrade must converge
+  without invisible sessions, guessed ownership, or unbounded retention.
+- [Issue #10415 — Windows daemon crash on unkillable PTY and protocol
+  bump](https://github.com/stablyai/orca/issues/10415) — native Windows must
+  preserve live old-generation sessions or expose exact unresolved recovery;
+  one unkillable PTY cannot crash the daemon.
+- [Issue #8275 — worktree teardown kills unrelated split-pane
+  sessions](https://github.com/stablyai/orca/issues/8275) — teardown and failure
+  must remain exact-namespace/exact-binding scoped.
+
+- [PR #12882 — publisher-owned daemon endpoint
+  replacement](https://github.com/stablyai/orca/pull/12882) — **open and
+  mergeable** when checked. It provides single-writer endpoint publication and
+  three-valued liveness. Reconcile it before editing overlapping daemon paths;
+  do not assume the older handoff's merge order is still current.
+- [PR #11622 — fence daemon session ownership across
+  generations](https://github.com/stablyai/orca/pull/11622) — **open** and held
+  behind further audit per its description. Strong explicit
+  owned/unavailable/ambiguous semantics, but broad overlap makes it design input,
+  not an automatic dependency.
+- [PR #9833 — report local PTY inventory
+  readiness](https://github.com/stablyai/orca/pull/9833) — **open**. Its
+  pending/ready/stale distinction is reusable context for unknown-is-not-dead.
+- [PR #12760 — reap only the proven relay
+  generation](https://github.com/stablyai/orca/pull/12760) — **open**. It adds
+  exact relay generation ownership before termination and conflicts in
+  `ssh-relay-session.ts`; reconcile before designing remote shell cleanup.
+- [PR #8618 — reap a detached relay after failed
+  reconnect](https://github.com/stablyai/orca/pull/8618) — **open** and an older
+  competing predecessor to #12760. Do not combine both ownership schemes.
+- [PR #12749 — wait for a disconnected PTY owner's full
+  grace](https://github.com/stablyai/orca/pull/12749) — **open**. Useful owner
+  admission and grace context; timers may schedule retry but cannot independently
+  authorize takeover or destruction.
+- [PR #12702 — stop sleeping-agent wake sweep from forking live SSH
+  sessions](https://github.com/stablyai/orca/pull/12702) — **open**. Complementary
+  #12699 work that must converge on the same ownership/liveness behavior; it
+  need not share an internal primitive unless the reconciled design calls for
+  one.
+- [PR #10118 — durable persistence write
+  seam](https://github.com/stablyai/orca/pull/10118) — **open**. It overlaps
+  `persistence.ts` and is relevant to durability and main-thread performance;
+  reconcile before large persistence changes.
+
+## Paired runtime, remote server, and E2EE lifecycle work
+
+These open issues are mandatory inputs to the paired/remote/platform journeys:
+
+- [Issue #11495 — paired viewer loses attachments across update/restart while
+  host PTYs remain alive](https://github.com/stablyai/orca/issues/11495) — the
+  reported large host population is a strong restore/scale oracle; each pane
+  must return to the same host PTY/process.
+- [Issue #11265 — paired terminals stall despite live TCP
+  sockets](https://github.com/stablyai/orca/issues/11265) — transport connectivity
+  is not delivery liveness; recovery must resume output without an unrelated RPC
+  kick.
+- [Issue #11803 — remote stop respawns tabs from a stale
+  owner](https://github.com/stablyai/orca/issues/11803) — exact durable retirement
+  must remain retired after host/client restart.
+- [Issue #12241 — paired-host session partitions grow without
+  bound](https://github.com/stablyai/orca/issues/12241) — paired and scale
+  journeys must prove bounded state and safe lost-consumer
+  retirement/compaction liveness.
+- [Issue #11574 — same-server re-pairing changes host identity and strands
+  sessions](https://github.com/stablyai/orca/issues/11574) — stable final-host
+  identity must survive re-pairing without adopting another host.
+- [Issue #9827 — investigate WSL session
+  restoration](https://github.com/stablyai/orca/issues/9827) and
+  [issue #11339 — WSL commands are not restored after
+  restart](https://github.com/stablyai/orca/issues/11339) — the daemon/WSL
+  journey must run on physical WSL and preserve both shell commands and agent
+  sessions.
+
+Additional open incident inputs must be triaged into a named journey or ruled
+unrelated with explicit evidence and user acceptance:
+
+| Issue                                                                                                       | Required question                                                                                           |
+| ----------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| [#11800 — paired null-PTY terminal ghosts](https://github.com/stablyai/orca/issues/11800)                   | Does host topology advancement retire exact placeholders without inference or a permanent timer reconciler? |
+| [#9092 — remote runtime fails after macOS sleep](https://github.com/stablyai/orca/issues/9092)              | Does generation-fenced reconnect recover after sleep with bounded resources and no identity change?         |
+| [#9585 — remote ghost tabs after host restart](https://github.com/stablyai/orca/issues/9585)                | Are exit/retirement outcomes durable and idempotent across host restart?                                    |
+| [#9562 — remote host session restarts empty](https://github.com/stablyai/orca/issues/9562)                  | Does the complete boundary plus replay restore terminal state after server restart?                         |
+| [#12568 — no PTY provider after SSH relay recovery/update](https://github.com/stablyai/orca/issues/12568)   | Does lazy rediscovery restore the exact host/provider generation?                                           |
+| [#10385 — mobile remains falsely connected after RPC stalls](https://github.com/stablyai/orca/issues/10385) | Can E2EE/mobile liveness recover when transport looks connected but RPC is stalled?                         |
+| [#12140 — mobile pairing socket closes immediately](https://github.com/stablyai/orca/issues/12140)          | Do capability, identity, and E2EE negotiation fail explicitly and recover across LAN/Tailscale?             |
+| [#8129 — mobile events lost while disconnected](https://github.com/stablyai/orca/issues/8129)               | Are semantic outcomes durable and replayed to a disconnected/backgrounded consumer?                         |
+
+- [PR #11575 — preserve host identity across same-server
+  re-pairing](https://github.com/stablyai/orca/pull/11575) — **open**. Direct
+  identity context for the paired reconnect journey.
+- [PR #12768 — restore paired snapshots at the source
+  grid](https://github.com/stablyai/orca/pull/12768) — **open**. Complementary
+  host-snapshot authority work with renderer file overlap.
+- [PR #9093 — recover remote runtime streams after client
+  wake](https://github.com/stablyai/orca/pull/9093) — **open**. Provides
+  generation-cancelled bounded-backoff reconnect context.
+- [PR #10235 — self-heal remote subscriptions after server
+  restart](https://github.com/stablyai/orca/pull/10235) — **open**. Relevant to
+  E2EE session loss hidden by a live relay transport.
+- [PR #11596 — recover falsely connected mobile RPC
+  sessions](https://github.com/stablyai/orca/pull/11596) — **open and
+  conflicting**. Broad mobile/E2EE reconnect context; do not absorb its parallel
+  lifecycle machinery without a full state-machine audit.
+- [PR #12036 — stop blocking E2EE handshake on synchronous ACL
+  writes](https://github.com/stablyai/orca/pull/12036) — **open and conflicting**.
+  Preserve its metadata-versus-correctness durability distinction and measured
+  Windows performance constraint during identity lifecycle work.
+- [PR #12134 — refresh stale capabilities before
+  pairing](https://github.com/stablyai/orca/pull/12134) — **open**. Capability
+  freshness and reauthentication are required mixed-version/pairing context.
+- [PR #11804 — make remote stop retirement
+  durable](https://github.com/stablyai/orca/pull/11804) — **open**. Strong
+  complementary evidence for exact persisted owner routing and host-side
+  retirement acknowledgement.
+- [PR #12987 — distinguish an absent worktree from an empty tab
+  list](https://github.com/stablyai/orca/pull/12987) — **open**. Reusable
+  unknown-versus-authoritative-empty semantics.
+- [PR #12751 — preserve tabs when a snapshot reports
+  none](https://github.com/stablyai/orca/pull/12751) — **open** and a competing
+  less-exact alternative to #12987; its described multi-client non-convergence
+  must not become the final model.
+- [PR #12339 — stop remote workspace pulls from resurrecting closed
+  tabs](https://github.com/stablyai/orca/pull/12339) — **open**. Direct topology
+  reconciliation context for explicit close and stale snapshots.
+- [PR #13013 — stop stale snapshot applies from erasing fresh terminal
+  tabs](https://github.com/stablyai/orca/pull/13013) — **open**. Relevant legacy
+  snapshot race; decide whether its machinery is deleted by the final authority
+  cutover rather than layering another permanent reconciler.
+- [PR #12903 — retry snapshot tabs whose paths resolve after
+  apply](https://github.com/stablyai/orca/pull/12903) — **open**. Deferred
+  hydration is relevant legacy-importer context and may become deletable after
+  authoritative namespace resolution; do not retain it by default.
+
+## Delivery, backpressure, and lifecycle alternatives
+
+- [Draft PR #12220 — keep SSH alive when a terminal outruns a slow
+  link](https://github.com/stablyai/orca/pull/12220) — **open draft**. Useful G3
+  and performance evidence, but its own description has behavioral blockers and
+  a stalled-consumer wedge. Do not treat it as merge-ready.
+- [PR #10744 — durable lost-worker archive and mixed-version SSH
+  revive](https://github.com/stablyai/orca/pull/10744) — **open** and broad. It
+  is major architectural context for exact close, outcomes, retirement, and
+  mixed versions, with substantial overlap. Mine proof and semantics rather
+  than stacking blindly.
+- [PR #11801 — prune stale remote tab
+  ghosts](https://github.com/stablyai/orca/pull/11801) — **open**. Its snapshot
+  omission plus timer policy is relevant but may conflict with the rule that
+  absence/time alone cannot prove destructive cleanup.
+
+## Mandatory issue-to-journey matrix
+
+This table binds customer incidents to the thirteen journeys in
+[`goalposts.md`](./goalposts.md#thirteen-required-production-journeys). Closing
+an issue or merging a narrow PR does not remove its oracle. Each row must be red
+on an unfixed baseline and green on the final candidate, or the user must accept
+explicit evidence that the issue is unrelated.
+
+| Open issue(s)                                                                                                                                                             | Journey(s)       | Mandatory discriminating outcome                                                                                                               |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| [#11729](https://github.com/stablyai/orca/issues/11729)                                                                                                                   | 6, 9, 13         | Rocky Linux reconnect preserves the same workspace, transcript, pane, binding, PID, and environment without PTY growth.                        |
+| [#9819](https://github.com/stablyai/orca/issues/9819), [#9034](https://github.com/stablyai/orca/issues/9034)                                                              | 6, 13            | Reconnect cannot accumulate detached PTYs/session slots; explicit close and teardown reclaim the exact process, including lost-response retry. |
+| [#11006](https://github.com/stablyai/orca/issues/11006), [#12448](https://github.com/stablyai/orca/issues/12448), [#12699](https://github.com/stablyai/orca/issues/12699) | 2, 6             | Disconnect, source recovery, and wake keep the same live PID/session and never start a duplicate resume without proof of death.                |
+| [#12447](https://github.com/stablyai/orca/issues/12447), [#11904](https://github.com/stablyai/orca/issues/11904)                                                          | 2, 6             | Durable close intent survives lost RPC, app/daemon/relay restart, retries exact retirement, reclaims the process, and never resurrects UI.     |
+| [#10208](https://github.com/stablyai/orca/issues/10208)                                                                                                                   | 1, 9             | Worktree switch/restore preserves one exact pane/process and does not duplicate a tab.                                                         |
+| [#8585](https://github.com/stablyai/orca/issues/8585)                                                                                                                     | 2, 6, 12         | Cleanup affects only the proven relay generation across reconnect and version change; ID/path reuse cannot kill a successor.                   |
+| [#9138](https://github.com/stablyai/orca/issues/9138), [#11342](https://github.com/stablyai/orca/issues/11342)                                                            | 2, 12, 13        | Upgrade/restart converges old daemon generations and their PTYs without invisible sessions, leaks, or destructive guessing.                    |
+| [#8275](https://github.com/stablyai/orca/issues/8275)                                                                                                                     | 1, 2, 5          | Worktree teardown cannot terminate a sibling namespace or split-pane session.                                                                  |
+| [#10415](https://github.com/stablyai/orca/issues/10415)                                                                                                                   | 1, 2, 5, 12      | Native Windows handles an unkillable PTY and protocol bump without daemon crash, live-session loss, or cross-session damage.                   |
+| [#9827](https://github.com/stablyai/orca/issues/9827), [#11339](https://github.com/stablyai/orca/issues/11339)                                                            | 2, 9             | Physical WSL restart restores the same shell command and agent session under the exact namespace/binding.                                      |
+| [#12568](https://github.com/stablyai/orca/issues/12568)                                                                                                                   | 3, 6, 12         | Relay recovery/update lazily rediscovers the same SSH host/provider and restores only its exact sessions.                                      |
+| [#11495](https://github.com/stablyai/orca/issues/11495), [#11574](https://github.com/stablyai/orca/issues/11574)                                                          | 4, 8, 10, 12, 13 | Paired restart/re-pair preserves stable host identity and every reported live host PTY at scale across independent updates.                    |
+| [#11265](https://github.com/stablyai/orca/issues/11265), [#9092](https://github.com/stablyai/orca/issues/9092)                                                            | 8, 13            | Live-but-stalled transport and sleep/wake automatically resume bounded delivery without an unrelated RPC kick or identity replacement.         |
+| [#11803](https://github.com/stablyai/orca/issues/11803), [#9585](https://github.com/stablyai/orca/issues/9585), [#11800](https://github.com/stablyai/orca/issues/11800)   | 3, 8             | Remote stop/host topology outcome remains durably retired after restart; no stale-owner tab or null-PTY ghost returns.                         |
+| [#9562](https://github.com/stablyai/orca/issues/9562), [#8129](https://github.com/stablyai/orca/issues/8129)                                                              | 3, 8, 13         | Complete boundary plus replay restores disconnected/restarted consumers without an empty session or lost semantic outcome.                     |
+| [#12241](https://github.com/stablyai/orca/issues/12241)                                                                                                                   | 8, 11, 13        | Paired partitions and retained-consumer state remain bounded; lost-consumer retirement safely restores compaction liveness.                    |
+| [#12683](https://github.com/stablyai/orca/issues/12683)                                                                                                                   | 8, 12            | Stale same-handle reconnect is generation-fenced and automatic recovery remains live across independent peer versions.                         |
+| [#10385](https://github.com/stablyai/orca/issues/10385), [#12140](https://github.com/stablyai/orca/issues/12140)                                                          | 8, 10, 12        | False-connected or rejected E2EE/pairing state fails explicitly and reauthenticates without stale identity, capability, or session adoption.   |
+
+Journeys 4, 5, 7, 10, and 11 remain mandatory even where no single issue fully
+specifies them. This matrix adds incident oracles; it never narrows the journey
+definitions.
+
+## Original containment/refactor line
+
+- [PR #12600 — break Activity and terminal React 185
+  loops](https://github.com/stablyai/orca/pull/12600) — **merged**. It is current
+  containment/background context, not the whole program and not a release gate.
+- [PR #12634 — replace React 185 timers with structural
+  handoffs](https://github.com/stablyai/orca/pull/12634) — **open**. This is the
+  direct structural follow-up for deleting #12600's window/timer brakes and must
+  be reconciled with the broader terminal-session model.
+- [PR #13110 — sandboxed preload artifact
+  guard](https://github.com/stablyai/orca/pull/13110) — **open**, independent of
+  #13111, green at its head, no approval. Its unresolved major review says raw
+  source matching can reject safe strings/comments; resolve or supersede that
+  [finding](https://github.com/stablyai/orca/pull/13110#discussion_r3739646949)
+  before calling it ready.
+
+## Already merged base context
+
+These were described as open in older notes but were merged when this handoff
+was written:
+
+- [PR #12474 — isolate same-path folder workspace PTY
+  identity](https://github.com/stablyai/orca/pull/12474)
+- [PR #12477 — stop a closed remote workspace window reading
+  Ready](https://github.com/stablyai/orca/pull/12477)
+- [PR #12600 — React/terminal loop containment](https://github.com/stablyai/orca/pull/12600)
+
+Refresh `main` and recalculate conflicts; do not follow the stale sequence
+`#12882 → #12474 → #12477 → #13111` as written.
+
+## Required GitHub refresh before action
+
+At minimum, re-query:
+
+```bash
+gh pr view 13111 --repo stablyai/orca --json state,isDraft,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,headRefOid,baseRefOid,url
+gh pr view 13110 --repo stablyai/orca --json state,isDraft,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,headRefOid,baseRefOid,url
+gh issue view 11729 --repo stablyai/orca --json state,title,updatedAt,url
+```
+
+Refresh the complete catalog in one batched request:
+
+```bash
+handoff_query_text="$(tr '\n' ' ' < docs/reference/terminal-session-correctness-handoff-2026-08-07/github-overlap-query.graphql)"
+gh api graphql -f query="$handoff_query_text"
+```
+
+The query includes current PR state/check summaries and unresolved-thread state
+for #13110/#13111. Read PR bodies/diffs only for the slice being changed. Do not
+close, comment, merge, push, or checkout a PR from the handoff audit without
+explicit authorization.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/report.html b/docs/reference/terminal-session-correctness-handoff-2026-08-07/report.html
new file mode 100644
index 00000000000..4497d1f42e4
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/report.html
@@ -0,0 +1,376 @@
+<!doctype html>
+<html lang="en">
+  <!--
+    Self-contained: all 9 diagrams are pre-rendered to inline SVG (dark + light),
+    so this opens offline with no CDN and stays vector-sharp at any zoom.
+    Diagram sources are the mermaid blocks in design-overview.md / test-overview.md.
+  -->
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Terminal Session Correctness — Design &amp; Test Report</title>
+    <style>
+      :root {
+        --bg: #0f1115;
+        --panel: #161920;
+        --panel-2: #1c2029;
+        --ink: #e6e8ee;
+        --ink-dim: #9aa3b2;
+        --line: #262b36;
+        --good: #3fb950;
+        --bad: #f85149;
+        --warn: #d29922;
+        --info: #58a6ff;
+        --accent: #7c8cff;
+        --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, monospace;
+      }
+      @media (prefers-color-scheme: light) {
+        :root {
+          --bg: #fbfbfd;
+          --panel: #fff;
+          --panel-2: #f4f5f8;
+          --ink: #14161a;
+          --ink-dim: #5b6472;
+          --line: #e2e5ea;
+          --good: #1a7f37;
+          --bad: #cf222e;
+          --warn: #9a6700;
+          --info: #0969da;
+          --accent: #4d5bd9;
+        }
+      }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0;
+        background: var(--bg);
+        color: var(--ink);
+        font: 16px/1.65 -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, system-ui, sans-serif;
+        -webkit-font-smoothing: antialiased;
+      }
+      .wrap { max-width: 1080px; margin: 0 auto; padding: 48px 28px 120px; }
+      header.hero { border-bottom: 1px solid var(--line); padding-bottom: 28px; margin-bottom: 8px; }
+      h1 { font-size: 34px; line-height: 1.2; margin: 0 0 8px; letter-spacing: -0.02em; }
+      .sub { color: var(--ink-dim); font-size: 15px; margin: 0; }
+      h2 {
+        font-size: 24px; margin: 56px 0 6px; letter-spacing: -0.01em;
+        padding-top: 20px; border-top: 1px solid var(--line);
+      }
+      h3 { font-size: 18px; margin: 30px 0 6px; }
+      p, li { color: var(--ink); }
+      .lede { color: var(--ink-dim); margin-top: 0; }
+      code { font-family: var(--mono); font-size: 0.9em; background: var(--panel-2); padding: 1px 5px; border-radius: 4px; }
+      a { color: var(--info); }
+
+      .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(190px, 1fr)); gap: 12px; margin: 22px 0; }
+      .stat { background: var(--panel); border: 1px solid var(--line); border-radius: 10px; padding: 16px 18px; }
+      .stat .n { font-size: 30px; font-weight: 650; letter-spacing: -0.02em; line-height: 1.1; }
+      .stat .l { color: var(--ink-dim); font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.05em; margin-top: 4px; }
+      .n.good { color: var(--good); } .n.bad { color: var(--bad); } .n.warn { color: var(--warn); } .n.info { color: var(--info); }
+
+      figure { margin: 22px 0; background: var(--panel); border: 1px solid var(--line); border-radius: 12px; padding: 10px; }
+      figure .bar {
+        display: flex; justify-content: space-between; align-items: center;
+        padding: 4px 8px 10px; color: var(--ink-dim); font-size: 12.5px;
+      }
+      figure .zoom { color: var(--accent); cursor: pointer; user-select: none; font-weight: 600; }
+      .mermaid { text-align: center; overflow: auto; }
+      .dia { text-align: center; padding: 4px 6px 10px; cursor: zoom-in; }
+      .dia svg { width: 100%; height: auto; max-width: 900px; }
+      .d-light { display: none; }
+      @media (prefers-color-scheme: light) { .d-dark { display: none; } .d-light { display: block; } }
+
+      table { border-collapse: collapse; width: 100%; margin: 18px 0; font-size: 14.5px; }
+      th, td { text-align: left; padding: 9px 12px; border-bottom: 1px solid var(--line); vertical-align: top; }
+      th { color: var(--ink-dim); font-weight: 600; font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.04em; }
+      tbody tr:hover { background: var(--panel-2); }
+
+      .pill { display: inline-block; padding: 1px 9px; border-radius: 999px; font-size: 12px; font-weight: 650; white-space: nowrap; }
+      .pill.ok { background: color-mix(in srgb, var(--good) 18%, transparent); color: var(--good); }
+      .pill.no { background: color-mix(in srgb, var(--bad) 18%, transparent); color: var(--bad); }
+      .pill.mid { background: color-mix(in srgb, var(--warn) 20%, transparent); color: var(--warn); }
+      .pill.inf { background: color-mix(in srgb, var(--info) 18%, transparent); color: var(--info); }
+
+      .callout { border-left: 3px solid var(--accent); background: var(--panel); padding: 14px 18px; border-radius: 0 10px 10px 0; margin: 22px 0; }
+      .callout.bad { border-left-color: var(--bad); }
+      .callout.good { border-left-color: var(--good); }
+      .callout.warn { border-left-color: var(--warn); }
+      .callout p:first-child { margin-top: 0; } .callout p:last-child { margin-bottom: 0; }
+      .k { font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.06em; color: var(--ink-dim); font-weight: 650; }
+
+      pre.term {
+        background: #0b0d12; color: #d7dbe4; border: 1px solid var(--line); border-radius: 10px;
+        padding: 14px 16px; overflow-x: auto; font-family: var(--mono); font-size: 13px; line-height: 1.55;
+      }
+      pre.term .r { color: #ff7b72; } pre.term .g { color: #7ee787; } pre.term .d { color: #8b949e; }
+
+      #ov {
+        position: fixed; inset: 0; background: var(--bg); display: none; z-index: 99;
+        cursor: grab; overflow: hidden;
+      }
+      #ov.on { display: block; }
+      #ov .inner {
+        transform-origin: 0 0; position: absolute; top: 0; left: 0;
+        background: var(--panel); border: 1px solid var(--line); border-radius: 14px; padding: 22px;
+      }
+      #ov .inner svg { display: block; }
+      #ov .hint {
+        position: fixed; bottom: 18px; left: 50%; transform: translateX(-50%);
+        color: var(--ink-dim); background: var(--panel-2); border: 1px solid var(--line); border-radius: 999px;
+        padding: 7px 16px; font-size: 13px;
+      }
+      #ov .x {
+        position: fixed; top: 14px; right: 20px; color: var(--ink); font-size: 26px; cursor: pointer;
+        line-height: 1; z-index: 2; background: var(--panel-2); border: 1px solid var(--line);
+        border-radius: 8px; padding: 2px 10px 5px;
+      }
+      .foot { margin-top: 60px; padding-top: 20px; border-top: 1px solid var(--line); color: var(--ink-dim); font-size: 13.5px; }
+    </style>
+  </head>
+  <body>
+    <div class="wrap">
+      <header class="hero">
+        <h1>Terminal Session Correctness</h1>
+        <p class="sub">Design &amp; test report · branch <code>nwparker/sta-3077-reattach-pane-cardinality</code> · PRs #13110, #13111</p>
+      </header>
+
+      <div class="grid">
+        <div class="stat"><div class="n good">+214</div><div class="l">Production lines</div></div>
+        <div class="stat"><div class="n bad">+60,903</div><div class="l">Rejected approach</div></div>
+        <div class="stat"><div class="n info">12</div><div class="l">Oracles that bite</div></div>
+        <div class="stat"><div class="n warn">2 / 13</div><div class="l">Journeys proven</div></div>
+        <div class="stat"><div class="n warn">0 / 8</div><div class="l">Gates proven</div></div>
+        <div class="stat"><div class="n">2</div><div class="l">Claims retracted</div></div>
+      </div>
+
+      <div class="callout">
+        <p><span class="k">The one-sentence version</span></p>
+        <p>Every bug here is the same bug — <strong>identity compared with the wrong key, or not compared at all</strong>. A previous attempt added a second identity system beside the first at a cost of 60,903 lines and fixed none of the three root causes. This fixes all three in 214.</p>
+      </div>
+
+      <h2>1 · What sits behind one terminal</h2>
+      <p class="lede">Five separate things line up behind the rectangle you see.</p>
+      <figure>
+        <div class="bar"><span>Anatomy of a terminal</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark0" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1336.3125 288" role="graphics-document document" aria-roledescription="d0-flowchart-v2"><style>#gdark0{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark0 .error-icon{fill:#a44141;}#gdark0 .error-text{fill:#ddd;stroke:#ddd;}#gdark0 .edge-thickness-normal{stroke-width:1px;}#gdark0 .edge-thickness-thick{stroke-width:3.5px;}#gdark0 .edge-pattern-solid{stroke-dasharray:0;}#gdark0 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark0 .edge-pattern-dashed{stroke-dasharray:3;}#gdark0 .edge-pattern-dotted{stroke-dasharray:2;}#gdark0 .marker{fill:lightgrey;stroke:lightgrey;}#gdark0 .marker.cross{stroke:lightgrey;}#gdark0 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark0 p{margin:0;}#gdark0 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark0 .cluster-label text{fill:#F9FFFE;}#gdark0 .cluster-label span{color:#F9FFFE;}#gdark0 .cluster-label span p{background-color:transparent;}#gdark0 .label text,#gdark0 span{fill:#ccc;color:#ccc;}#gdark0 .node rect,#gdark0 .node circle,#gdark0 .node ellipse,#gdark0 .node polygon,#gdark0 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark0 .rough-node .label text,#gdark0 .node .label text,#gdark0 .image-shape .label,#gdark0 .icon-shape .label{text-anchor:middle;}#gdark0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark0 .rough-node .label,#gdark0 .node .label,#gdark0 .image-shape .label,#gdark0 .icon-shape .label{text-align:center;}#gdark0 .node.clickable{cursor:pointer;}#gdark0 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark0 .arrowheadPath{fill:lightgrey;}#gdark0 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark0 .d0-flowchart-link{stroke:lightgrey;fill:none;}#gdark0 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark0 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark0 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark0 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark0 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark0 .cluster text{fill:#F9FFFE;}#gdark0 .cluster span{color:#F9FFFE;}#gdark0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark0 rect.text{fill:none;stroke-width:0;}#gdark0 .icon-shape,#gdark0 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark0 .icon-shape p,#gdark0 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark0 .icon-shape .label rect,#gdark0 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark0 .node .neo-node{stroke:#ccc;}#gdark0 [data-look="neo"].node rect,#gdark0 [data-look="neo"].cluster rect,#gdark0 [data-look="neo"].node polygon{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark0 [data-look="neo"].node path{stroke:url(#gdark0-gradient);stroke-width:1px;}#gdark0 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark0 [data-look="neo"].node circle{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark0 [data-look="neo"].icon-shape .icon{fill:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark0-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark0 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark0_d0-flowchart-v2-pointEnd" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointStart" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointEnd-margin" class="marker d0-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-pointStart-margin" class="marker d0-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark0_d0-flowchart-v2-circleEnd" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleStart" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleEnd-margin" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-circleStart-margin" class="marker d0-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark0_d0-flowchart-v2-crossEnd" class="marker cross d0-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossStart" class="marker cross d0-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossEnd-margin" class="marker cross d0-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark0_d0-flowchart-v2-crossStart-margin" class="marker cross d0-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"><g class="cluster " id="gdark0-MACHINE" data-look="classic"><rect style="" x="760.953125" y="24.5" width="567.359375" height="229"></rect><g class="cluster-label " transform="translate(978.3203125, 24.5)"><foreignObject width="132.625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>The real computer</p></span></div></foreignObject></g></g><g class="cluster " id="gdark0-APP" data-look="classic"><rect style="" x="367.265625" y="8" width="280.8125" height="272"></rect><g class="cluster-label " transform="translate(435.2734375, 8)"><foreignObject width="144.796875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>Orca's bookkeeping</p></span></div></foreignObject></g></g><g class="cluster " id="gdark0-YOU" data-look="classic"><rect style="" x="8" y="8" width="244.328125" height="146"></rect><g class="cluster-label " transform="translate(80.859375, 8)"><foreignObject width="98.609375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>What you see</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M227.328,81L231.495,81C235.661,81,243.995,81,257.74,81C271.484,81,290.641,81,309.797,81C328.953,81,348.109,81,361.188,81C374.266,81,381.266,81,384.766,81L388.266,81" id="gdark0-L_PANE_BIND_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_PANE_BIND_0" data-points="W3sieCI6MjI3LjMyODEyNSwieSI6ODF9LHsieCI6MjUyLjMyODEyNSwieSI6ODF9LHsieCI6MzA5Ljc5Njg3NSwieSI6ODF9LHsieCI6MzY3LjI2NTYyNSwieSI6ODF9LHsieCI6MzkyLjI2NTYyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M623.078,81L627.245,81C631.411,81,639.745,81,653.318,81C666.891,81,685.703,81,704.516,81C723.328,81,742.141,81,758.527,84.845C774.913,88.69,788.873,96.38,795.853,100.225L802.833,104.07" id="gdark0-L_BIND_PTY_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_BIND_PTY_0" data-points="W3sieCI6NjIzLjA3ODEyNSwieSI6ODF9LHsieCI6NjQ4LjA3ODEyNSwieSI6ODF9LHsieCI6NzA0LjUxNTYyNSwieSI6ODF9LHsieCI6NzYwLjk1MzEyNSwieSI6ODF9LHsieCI6ODA2LjMzNjkyOTU2MzQ5MiwieSI6MTA2fV0=" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M616.234,207L621.542,207C626.849,207,637.464,207,652.177,207C666.891,207,685.703,207,704.516,207C723.328,207,742.141,207,758.527,203.155C774.913,199.31,788.873,191.62,795.853,187.775L802.833,183.93" id="gdark0-L_LEASE_PTY_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_LEASE_PTY_0" data-points="W3sieCI6NjE2LjIzNDM3NSwieSI6MjA3fSx7IngiOjY0OC4wNzgxMjUsInkiOjIwN30seyJ4Ijo3MDQuNTE1NjI1LCJ5IjoyMDd9LHsieCI6NzYwLjk1MzEyNSwieSI6MjA3fSx7IngiOjgwNi4zMzY5Mjk1NjM0OTIsInkiOjE4Mn1d" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path><path d="M964.688,144L973.375,144C982.063,144,999.438,144,1016.146,144C1032.854,144,1048.896,144,1056.917,144L1064.938,144" id="gdark0-L_PTY_HOST_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_PTY_HOST_0" data-points="W3sieCI6OTY0LjY4NzUsInkiOjE0NH0seyJ4IjoxMDE2LjgxMjUsInkiOjE0NH0seyJ4IjoxMDY4LjkzNzUsInkiOjE0NH1d" data-look="classic" marker-end="url(#gdark0_d0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel" transform="translate(309.796875, 81)"><g class="label" data-id="L_PANE_BIND_0" transform="translate(-32.46875, -12)"><foreignObject width="64.9375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>bound to</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(704.515625, 81)"><g class="label" data-id="L_BIND_PTY_0" transform="translate(-31.4375, -12)"><foreignObject width="62.875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>points at</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(704.515625, 207)"><g class="label" data-id="L_LEASE_PTY_0" transform="translate(-23.1015625, -12)"><foreignObject width="46.203125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>claims</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(1016.8125, 144)"><g class="label" data-id="L_PTY_HOST_0" transform="translate(-27.125, -12)"><foreignObject width="54.25" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>runs on</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark0-d0-flowchart-PANE-0" data-look="classic" transform="translate(130.1640625, 81)"><rect class="basic label-container" style="" x="-97.1640625" y="-38" width="194.328125" height="76"></rect><g class="label" style="" transform="translate(-69.1640625, -24)"><rect></rect><foreignObject width="138.328125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Pane<br/><i>a rectangle in a tab</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-BIND-1" data-look="classic" transform="translate(507.671875, 81)"><rect class="basic label-container" style="" x="-115.40625" y="-38" width="230.8125" height="76"></rect><g class="label" style="" transform="translate(-87.40625, -24)"><rect></rect><foreignObject width="174.8125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Binding<br/><i>this pane uses that shell</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-LEASE-2" data-look="classic" transform="translate(507.671875, 207)"><rect class="basic label-container" style="" x="-108.5625" y="-38" width="217.125" height="76"></rect><g class="label" style="" transform="translate(-80.5625, -24)"><rect></rect><foreignObject width="161.125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Lease<br/><i>we own a remote shell</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-PTY-3" data-look="classic" transform="translate(875.3203125, 144)"><rect class="basic label-container" style="" x="-89.3671875" y="-38" width="178.734375" height="76"></rect><g class="label" style="" transform="translate(-61.3671875, -24)"><rect></rect><foreignObject width="122.734375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>PTY<br/><i>the shell process</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdark0-d0-flowchart-HOST-4" data-look="classic" transform="translate(1186.125, 144)"><rect class="basic label-container" style="" x="-117.1875" y="-38" width="234.375" height="76"></rect><g class="label" style="" transform="translate(-89.1875, -24)"><rect></rect><foreignObject width="178.375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Host<br/><i>your Mac, or an SSH box</i></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark0-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark0-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark0-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault0" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1336.3125 288" role="graphics-document document" aria-roledescription="l0-flowchart-v2"><style>#gdefault0{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault0 .error-icon{fill:#552222;}#gdefault0 .error-text{fill:#552222;stroke:#552222;}#gdefault0 .edge-thickness-normal{stroke-width:1px;}#gdefault0 .edge-thickness-thick{stroke-width:3.5px;}#gdefault0 .edge-pattern-solid{stroke-dasharray:0;}#gdefault0 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault0 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault0 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault0 .marker{fill:#333333;stroke:#333333;}#gdefault0 .marker.cross{stroke:#333333;}#gdefault0 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault0 p{margin:0;}#gdefault0 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault0 .cluster-label text{fill:#333;}#gdefault0 .cluster-label span{color:#333;}#gdefault0 .cluster-label span p{background-color:transparent;}#gdefault0 .label text,#gdefault0 span{fill:#333;color:#333;}#gdefault0 .node rect,#gdefault0 .node circle,#gdefault0 .node ellipse,#gdefault0 .node polygon,#gdefault0 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault0 .rough-node .label text,#gdefault0 .node .label text,#gdefault0 .image-shape .label,#gdefault0 .icon-shape .label{text-anchor:middle;}#gdefault0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault0 .rough-node .label,#gdefault0 .node .label,#gdefault0 .image-shape .label,#gdefault0 .icon-shape .label{text-align:center;}#gdefault0 .node.clickable{cursor:pointer;}#gdefault0 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault0 .arrowheadPath{fill:#333333;}#gdefault0 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault0 .l0-flowchart-link{stroke:#333333;fill:none;}#gdefault0 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault0 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault0 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault0 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault0 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault0 .cluster text{fill:#333;}#gdefault0 .cluster span{color:#333;}#gdefault0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault0 rect.text{fill:none;stroke-width:0;}#gdefault0 .icon-shape,#gdefault0 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault0 .icon-shape p,#gdefault0 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault0 .icon-shape .label rect,#gdefault0 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault0 .node .neo-node{stroke:#9370DB;}#gdefault0 [data-look="neo"].node rect,#gdefault0 [data-look="neo"].cluster rect,#gdefault0 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault0 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault0 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault0 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault0 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault0 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault0_l0-flowchart-v2-pointEnd" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointStart" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointEnd-margin" class="marker l0-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-pointStart-margin" class="marker l0-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault0_l0-flowchart-v2-circleEnd" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleStart" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleEnd-margin" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-circleStart-margin" class="marker l0-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault0_l0-flowchart-v2-crossEnd" class="marker cross l0-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossStart" class="marker cross l0-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossEnd-margin" class="marker cross l0-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault0_l0-flowchart-v2-crossStart-margin" class="marker cross l0-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"><g class="cluster " id="gdefault0-MACHINE" data-look="classic"><rect style="" x="760.953125" y="24.5" width="567.359375" height="229"></rect><g class="cluster-label " transform="translate(978.3203125, 24.5)"><foreignObject width="132.625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>The real computer</p></span></div></foreignObject></g></g><g class="cluster " id="gdefault0-APP" data-look="classic"><rect style="" x="367.265625" y="8" width="280.8125" height="272"></rect><g class="cluster-label " transform="translate(435.2734375, 8)"><foreignObject width="144.796875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>Orca's bookkeeping</p></span></div></foreignObject></g></g><g class="cluster " id="gdefault0-YOU" data-look="classic"><rect style="" x="8" y="8" width="244.328125" height="146"></rect><g class="cluster-label " transform="translate(80.859375, 8)"><foreignObject width="98.609375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>What you see</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M227.328,81L231.495,81C235.661,81,243.995,81,257.74,81C271.484,81,290.641,81,309.797,81C328.953,81,348.109,81,361.188,81C374.266,81,381.266,81,384.766,81L388.266,81" id="gdefault0-L_PANE_BIND_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_PANE_BIND_0" data-points="W3sieCI6MjI3LjMyODEyNSwieSI6ODF9LHsieCI6MjUyLjMyODEyNSwieSI6ODF9LHsieCI6MzA5Ljc5Njg3NSwieSI6ODF9LHsieCI6MzY3LjI2NTYyNSwieSI6ODF9LHsieCI6MzkyLjI2NTYyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M623.078,81L627.245,81C631.411,81,639.745,81,653.318,81C666.891,81,685.703,81,704.516,81C723.328,81,742.141,81,758.527,84.845C774.913,88.69,788.873,96.38,795.853,100.225L802.833,104.07" id="gdefault0-L_BIND_PTY_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_BIND_PTY_0" data-points="W3sieCI6NjIzLjA3ODEyNSwieSI6ODF9LHsieCI6NjQ4LjA3ODEyNSwieSI6ODF9LHsieCI6NzA0LjUxNTYyNSwieSI6ODF9LHsieCI6NzYwLjk1MzEyNSwieSI6ODF9LHsieCI6ODA2LjMzNjkyOTU2MzQ5MiwieSI6MTA2fV0=" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M616.234,207L621.542,207C626.849,207,637.464,207,652.177,207C666.891,207,685.703,207,704.516,207C723.328,207,742.141,207,758.527,203.155C774.913,199.31,788.873,191.62,795.853,187.775L802.833,183.93" id="gdefault0-L_LEASE_PTY_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_LEASE_PTY_0" data-points="W3sieCI6NjE2LjIzNDM3NSwieSI6MjA3fSx7IngiOjY0OC4wNzgxMjUsInkiOjIwN30seyJ4Ijo3MDQuNTE1NjI1LCJ5IjoyMDd9LHsieCI6NzYwLjk1MzEyNSwieSI6MjA3fSx7IngiOjgwNi4zMzY5Mjk1NjM0OTIsInkiOjE4Mn1d" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path><path d="M964.688,144L973.375,144C982.063,144,999.438,144,1016.146,144C1032.854,144,1048.896,144,1056.917,144L1064.938,144" id="gdefault0-L_PTY_HOST_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l0-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_PTY_HOST_0" data-points="W3sieCI6OTY0LjY4NzUsInkiOjE0NH0seyJ4IjoxMDE2LjgxMjUsInkiOjE0NH0seyJ4IjoxMDY4LjkzNzUsInkiOjE0NH1d" data-look="classic" marker-end="url(#gdefault0_l0-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel" transform="translate(309.796875, 81)"><g class="label" data-id="L_PANE_BIND_0" transform="translate(-32.46875, -12)"><foreignObject width="64.9375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>bound to</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(704.515625, 81)"><g class="label" data-id="L_BIND_PTY_0" transform="translate(-31.4375, -12)"><foreignObject width="62.875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>points at</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(704.515625, 207)"><g class="label" data-id="L_LEASE_PTY_0" transform="translate(-23.1015625, -12)"><foreignObject width="46.203125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>claims</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(1016.8125, 144)"><g class="label" data-id="L_PTY_HOST_0" transform="translate(-27.125, -12)"><foreignObject width="54.25" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>runs on</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault0-l0-flowchart-PANE-0" data-look="classic" transform="translate(130.1640625, 81)"><rect class="basic label-container" style="" x="-97.1640625" y="-38" width="194.328125" height="76"></rect><g class="label" style="" transform="translate(-69.1640625, -24)"><rect></rect><foreignObject width="138.328125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Pane<br/><i>a rectangle in a tab</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-BIND-1" data-look="classic" transform="translate(507.671875, 81)"><rect class="basic label-container" style="" x="-115.40625" y="-38" width="230.8125" height="76"></rect><g class="label" style="" transform="translate(-87.40625, -24)"><rect></rect><foreignObject width="174.8125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Binding<br/><i>this pane uses that shell</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-LEASE-2" data-look="classic" transform="translate(507.671875, 207)"><rect class="basic label-container" style="" x="-108.5625" y="-38" width="217.125" height="76"></rect><g class="label" style="" transform="translate(-80.5625, -24)"><rect></rect><foreignObject width="161.125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Lease<br/><i>we own a remote shell</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-PTY-3" data-look="classic" transform="translate(875.3203125, 144)"><rect class="basic label-container" style="" x="-89.3671875" y="-38" width="178.734375" height="76"></rect><g class="label" style="" transform="translate(-61.3671875, -24)"><rect></rect><foreignObject width="122.734375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>PTY<br/><i>the shell process</i></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault0-l0-flowchart-HOST-4" data-look="classic" transform="translate(1186.125, 144)"><rect class="basic label-container" style="" x="-117.1875" y="-38" width="234.375" height="76"></rect><g class="label" style="" transform="translate(-89.1875, -24)"><rect></rect><foreignObject width="178.375" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Host<br/><i>your Mac, or an SSH box</i></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault0-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault0-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The <strong>PTY</strong> is the real shell doing the work. The <strong>binding</strong> is the note connecting it to your pane. On a remote machine a <strong>lease</strong> is a second note saying “we still own that shell.” Every failure below is one of those notes pointing at the wrong thing.</p>
+
+      <h2>2 · The reported failure</h2>
+      <figure>
+        <div class="bar"><span>Reconnect growth — a real customer report</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark1" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1119.6875 92" role="graphics-document document" aria-roledescription="d1-flowchart-v2"><style>#gdark1{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark1 .error-icon{fill:#a44141;}#gdark1 .error-text{fill:#ddd;stroke:#ddd;}#gdark1 .edge-thickness-normal{stroke-width:1px;}#gdark1 .edge-thickness-thick{stroke-width:3.5px;}#gdark1 .edge-pattern-solid{stroke-dasharray:0;}#gdark1 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark1 .edge-pattern-dashed{stroke-dasharray:3;}#gdark1 .edge-pattern-dotted{stroke-dasharray:2;}#gdark1 .marker{fill:lightgrey;stroke:lightgrey;}#gdark1 .marker.cross{stroke:lightgrey;}#gdark1 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark1 p{margin:0;}#gdark1 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark1 .cluster-label text{fill:#F9FFFE;}#gdark1 .cluster-label span{color:#F9FFFE;}#gdark1 .cluster-label span p{background-color:transparent;}#gdark1 .label text,#gdark1 span{fill:#ccc;color:#ccc;}#gdark1 .node rect,#gdark1 .node circle,#gdark1 .node ellipse,#gdark1 .node polygon,#gdark1 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark1 .rough-node .label text,#gdark1 .node .label text,#gdark1 .image-shape .label,#gdark1 .icon-shape .label{text-anchor:middle;}#gdark1 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark1 .rough-node .label,#gdark1 .node .label,#gdark1 .image-shape .label,#gdark1 .icon-shape .label{text-align:center;}#gdark1 .node.clickable{cursor:pointer;}#gdark1 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark1 .arrowheadPath{fill:lightgrey;}#gdark1 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark1 .d1-flowchart-link{stroke:lightgrey;fill:none;}#gdark1 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark1 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark1 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark1 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark1 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark1 .cluster text{fill:#F9FFFE;}#gdark1 .cluster span{color:#F9FFFE;}#gdark1 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark1 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark1 rect.text{fill:none;stroke-width:0;}#gdark1 .icon-shape,#gdark1 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark1 .icon-shape p,#gdark1 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark1 .icon-shape .label rect,#gdark1 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark1 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark1 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark1 .node .neo-node{stroke:#ccc;}#gdark1 [data-look="neo"].node rect,#gdark1 [data-look="neo"].cluster rect,#gdark1 [data-look="neo"].node polygon{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark1 [data-look="neo"].node path{stroke:url(#gdark1-gradient);stroke-width:1px;}#gdark1 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark1 [data-look="neo"].node circle{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark1 [data-look="neo"].icon-shape .icon{fill:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark1-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark1 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark1_d1-flowchart-v2-pointEnd" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointStart" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointEnd-margin" class="marker d1-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-pointStart-margin" class="marker d1-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark1_d1-flowchart-v2-circleEnd" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleStart" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleEnd-margin" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-circleStart-margin" class="marker d1-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark1_d1-flowchart-v2-crossEnd" class="marker cross d1-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossStart" class="marker cross d1-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossEnd-margin" class="marker cross d1-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark1_d1-flowchart-v2-crossStart-margin" class="marker cross d1-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M144.266,46L148.432,46C152.599,46,160.932,46,168.599,46C176.266,46,183.266,46,186.766,46L190.266,46" id="gdark1-L_A_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_B_0" data-points="W3sieCI6MTQ0LjI2NTYyNSwieSI6NDZ9LHsieCI6MTY5LjI2NTYyNSwieSI6NDZ9LHsieCI6MTk0LjI2NTYyNSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M361.375,46L365.542,46C369.708,46,378.042,46,385.708,46C393.375,46,400.375,46,403.875,46L407.375,46" id="gdark1-L_B_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_C_0" data-points="W3sieCI6MzYxLjM3NSwieSI6NDZ9LHsieCI6Mzg2LjM3NSwieSI6NDZ9LHsieCI6NDExLjM3NSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M540.703,46L544.87,46C549.036,46,557.37,46,565.036,46C572.703,46,579.703,46,583.203,46L586.703,46" id="gdark1-L_C_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_D_0" data-points="W3sieCI6NTQwLjcwMzEyNSwieSI6NDZ9LHsieCI6NTY1LjcwMzEyNSwieSI6NDZ9LHsieCI6NTkwLjcwMzEyNSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M734.609,46L738.776,46C742.943,46,751.276,46,758.943,46C766.609,46,773.609,46,777.109,46L780.609,46" id="gdark1-L_D_E_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_E_0" data-points="W3sieCI6NzM0LjYwOTM3NSwieSI6NDZ9LHsieCI6NzU5LjYwOTM3NSwieSI6NDZ9LHsieCI6Nzg0LjYwOTM3NSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path><path d="M889.109,46L893.276,46C897.443,46,905.776,46,913.443,46C921.109,46,928.109,46,931.609,46L935.109,46" id="gdark1-L_E_F_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_E_F_0" data-points="W3sieCI6ODg5LjEwOTM3NSwieSI6NDZ9LHsieCI6OTE0LjEwOTM3NSwieSI6NDZ9LHsieCI6OTM5LjEwOTM3NSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdark1_d1-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C_D_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D_E_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_E_F_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark1-d1-flowchart-A-0" data-look="classic" transform="translate(76.1328125, 46)"><rect class="basic label-container" style="" x="-68.1328125" y="-26" width="136.265625" height="52"></rect><g class="label" style="" transform="translate(-40.1328125, -12)"><rect></rect><foreignObject width="80.265625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>2 terminals</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-B-1" data-look="classic" transform="translate(277.8203125, 46)"><rect class="basic label-container" style="" x="-83.5546875" y="-26" width="167.109375" height="52"></rect><g class="label" style="" transform="translate(-55.5546875, -12)"><rect></rect><foreignObject width="111.109375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>network hiccup</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-C-2" data-look="classic" transform="translate(476.0390625, 46)"><rect class="basic label-container" style="" x="-64.6640625" y="-26" width="129.328125" height="52"></rect><g class="label" style="" transform="translate(-36.6640625, -12)"><rect></rect><foreignObject width="73.328125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reconnect</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-D-4" data-look="classic" transform="translate(662.65625, 46)"><rect class="basic label-container" style="fill:#4a1f22 !important;stroke:#f85149 !important" x="-71.953125" y="-26" width="143.90625" height="52"></rect><g class="label" style="color:#fff !important" transform="translate(-43.953125, -12)"><rect></rect><foreignObject width="87.90625" height="24"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>19 terminals</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-E-5" data-look="classic" transform="translate(836.859375, 46)"><rect class="basic label-container" style="" x="-52.25" y="-26" width="104.5" height="52"></rect><g class="label" style="" transform="translate(-24.25, -12)"><rect></rect><foreignObject width="48.5" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>hiccup</p></span></div></foreignObject></g></g><g class="node default  " id="gdark1-d1-flowchart-F-6" data-look="classic" transform="translate(1025.3984375, 46)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-86.2890625" y="-38" width="172.578125" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-58.2890625, -24)"><rect></rect><foreignObject width="116.578125" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>20 terminals<br/>most are ghosts</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark1-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark1-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark1-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault1" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 1119.6875 92" role="graphics-document document" aria-roledescription="l1-flowchart-v2"><style>#gdefault1{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault1 .error-icon{fill:#552222;}#gdefault1 .error-text{fill:#552222;stroke:#552222;}#gdefault1 .edge-thickness-normal{stroke-width:1px;}#gdefault1 .edge-thickness-thick{stroke-width:3.5px;}#gdefault1 .edge-pattern-solid{stroke-dasharray:0;}#gdefault1 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault1 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault1 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault1 .marker{fill:#333333;stroke:#333333;}#gdefault1 .marker.cross{stroke:#333333;}#gdefault1 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault1 p{margin:0;}#gdefault1 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault1 .cluster-label text{fill:#333;}#gdefault1 .cluster-label span{color:#333;}#gdefault1 .cluster-label span p{background-color:transparent;}#gdefault1 .label text,#gdefault1 span{fill:#333;color:#333;}#gdefault1 .node rect,#gdefault1 .node circle,#gdefault1 .node ellipse,#gdefault1 .node polygon,#gdefault1 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault1 .rough-node .label text,#gdefault1 .node .label text,#gdefault1 .image-shape .label,#gdefault1 .icon-shape .label{text-anchor:middle;}#gdefault1 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault1 .rough-node .label,#gdefault1 .node .label,#gdefault1 .image-shape .label,#gdefault1 .icon-shape .label{text-align:center;}#gdefault1 .node.clickable{cursor:pointer;}#gdefault1 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault1 .arrowheadPath{fill:#333333;}#gdefault1 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault1 .l1-flowchart-link{stroke:#333333;fill:none;}#gdefault1 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault1 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault1 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault1 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault1 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault1 .cluster text{fill:#333;}#gdefault1 .cluster span{color:#333;}#gdefault1 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault1 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault1 rect.text{fill:none;stroke-width:0;}#gdefault1 .icon-shape,#gdefault1 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault1 .icon-shape p,#gdefault1 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault1 .icon-shape .label rect,#gdefault1 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault1 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault1 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault1 .node .neo-node{stroke:#9370DB;}#gdefault1 [data-look="neo"].node rect,#gdefault1 [data-look="neo"].cluster rect,#gdefault1 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault1 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault1 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault1 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault1 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault1 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault1_l1-flowchart-v2-pointEnd" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointStart" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointEnd-margin" class="marker l1-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-pointStart-margin" class="marker l1-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault1_l1-flowchart-v2-circleEnd" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleStart" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleEnd-margin" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-circleStart-margin" class="marker l1-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault1_l1-flowchart-v2-crossEnd" class="marker cross l1-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossStart" class="marker cross l1-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossEnd-margin" class="marker cross l1-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault1_l1-flowchart-v2-crossStart-margin" class="marker cross l1-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M144.266,46L148.432,46C152.599,46,160.932,46,168.599,46C176.266,46,183.266,46,186.766,46L190.266,46" id="gdefault1-L_A_B_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_B_0" data-points="W3sieCI6MTQ0LjI2NTYyNSwieSI6NDZ9LHsieCI6MTY5LjI2NTYyNSwieSI6NDZ9LHsieCI6MTk0LjI2NTYyNSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M361.375,46L365.542,46C369.708,46,378.042,46,385.708,46C393.375,46,400.375,46,403.875,46L407.375,46" id="gdefault1-L_B_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_B_C_0" data-points="W3sieCI6MzYxLjM3NSwieSI6NDZ9LHsieCI6Mzg2LjM3NSwieSI6NDZ9LHsieCI6NDExLjM3NSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M540.703,46L544.87,46C549.036,46,557.37,46,565.036,46C572.703,46,579.703,46,583.203,46L586.703,46" id="gdefault1-L_C_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_C_D_0" data-points="W3sieCI6NTQwLjcwMzEyNSwieSI6NDZ9LHsieCI6NTY1LjcwMzEyNSwieSI6NDZ9LHsieCI6NTkwLjcwMzEyNSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M734.609,46L738.776,46C742.943,46,751.276,46,758.943,46C766.609,46,773.609,46,777.109,46L780.609,46" id="gdefault1-L_D_E_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_D_E_0" data-points="W3sieCI6NzM0LjYwOTM3NSwieSI6NDZ9LHsieCI6NzU5LjYwOTM3NSwieSI6NDZ9LHsieCI6Nzg0LjYwOTM3NSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path><path d="M889.109,46L893.276,46C897.443,46,905.776,46,913.443,46C921.109,46,928.109,46,931.609,46L935.109,46" id="gdefault1-L_E_F_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l1-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_E_F_0" data-points="W3sieCI6ODg5LjEwOTM3NSwieSI6NDZ9LHsieCI6OTE0LjEwOTM3NSwieSI6NDZ9LHsieCI6OTM5LjEwOTM3NSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdefault1_l1-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_A_B_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_B_C_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_C_D_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_D_E_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_E_F_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault1-l1-flowchart-A-0" data-look="classic" transform="translate(76.1328125, 46)"><rect class="basic label-container" style="" x="-68.1328125" y="-26" width="136.265625" height="52"></rect><g class="label" style="" transform="translate(-40.1328125, -12)"><rect></rect><foreignObject width="80.265625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>2 terminals</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-B-1" data-look="classic" transform="translate(277.8203125, 46)"><rect class="basic label-container" style="" x="-83.5546875" y="-26" width="167.109375" height="52"></rect><g class="label" style="" transform="translate(-55.5546875, -12)"><rect></rect><foreignObject width="111.109375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>network hiccup</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-C-2" data-look="classic" transform="translate(476.0390625, 46)"><rect class="basic label-container" style="" x="-64.6640625" y="-26" width="129.328125" height="52"></rect><g class="label" style="" transform="translate(-36.6640625, -12)"><rect></rect><foreignObject width="73.328125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reconnect</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-D-4" data-look="classic" transform="translate(662.65625, 46)"><rect class="basic label-container" style="fill:#ffe3e6 !important;stroke:#cf222e !important" x="-71.953125" y="-26" width="143.90625" height="52"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-43.953125, -12)"><rect></rect><foreignObject width="87.90625" height="24"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>19 terminals</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-E-5" data-look="classic" transform="translate(836.859375, 46)"><rect class="basic label-container" style="" x="-52.25" y="-26" width="104.5" height="52"></rect><g class="label" style="" transform="translate(-24.25, -12)"><rect></rect><foreignObject width="48.5" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>hiccup</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault1-l1-flowchart-F-6" data-look="classic" transform="translate(1025.3984375, 46)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-86.2890625" y="-38" width="172.578125" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-58.2890625, -24)"><rect></rect><foreignObject width="116.578125" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>20 terminals<br/>most are ghosts</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault1-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault1-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The remote machine also fills with unused shells until it refuses to start more. A second, worse variant: an AI coding agent <strong>resumed twice</strong> — two <code>claude</code> processes writing to one conversation file. One report reached <strong>five</strong>.</p>
+
+      <h2>3 · Three root causes</h2>
+
+      <h3>Cause 1 — the lease forgot its pane</h3>
+      <p>A lease identified a shell but never checked <em>which pane</em> it belonged to. Every reconnect added a note; nothing removed one.</p>
+      <figure>
+        <div class="bar"><span>Lease accumulation</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark2" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 901.984375 284" role="graphics-document document" aria-roledescription="d2-flowchart-v2"><style>#gdark2{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark2 .error-icon{fill:#a44141;}#gdark2 .error-text{fill:#ddd;stroke:#ddd;}#gdark2 .edge-thickness-normal{stroke-width:1px;}#gdark2 .edge-thickness-thick{stroke-width:3.5px;}#gdark2 .edge-pattern-solid{stroke-dasharray:0;}#gdark2 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark2 .edge-pattern-dashed{stroke-dasharray:3;}#gdark2 .edge-pattern-dotted{stroke-dasharray:2;}#gdark2 .marker{fill:lightgrey;stroke:lightgrey;}#gdark2 .marker.cross{stroke:lightgrey;}#gdark2 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark2 p{margin:0;}#gdark2 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark2 .cluster-label text{fill:#F9FFFE;}#gdark2 .cluster-label span{color:#F9FFFE;}#gdark2 .cluster-label span p{background-color:transparent;}#gdark2 .label text,#gdark2 span{fill:#ccc;color:#ccc;}#gdark2 .node rect,#gdark2 .node circle,#gdark2 .node ellipse,#gdark2 .node polygon,#gdark2 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark2 .rough-node .label text,#gdark2 .node .label text,#gdark2 .image-shape .label,#gdark2 .icon-shape .label{text-anchor:middle;}#gdark2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark2 .rough-node .label,#gdark2 .node .label,#gdark2 .image-shape .label,#gdark2 .icon-shape .label{text-align:center;}#gdark2 .node.clickable{cursor:pointer;}#gdark2 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark2 .arrowheadPath{fill:lightgrey;}#gdark2 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark2 .d2-flowchart-link{stroke:lightgrey;fill:none;}#gdark2 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark2 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark2 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark2 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark2 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark2 .cluster text{fill:#F9FFFE;}#gdark2 .cluster span{color:#F9FFFE;}#gdark2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark2 rect.text{fill:none;stroke-width:0;}#gdark2 .icon-shape,#gdark2 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark2 .icon-shape p,#gdark2 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark2 .icon-shape .label rect,#gdark2 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark2 .node .neo-node{stroke:#ccc;}#gdark2 [data-look="neo"].node rect,#gdark2 [data-look="neo"].cluster rect,#gdark2 [data-look="neo"].node polygon{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark2 [data-look="neo"].node path{stroke:url(#gdark2-gradient);stroke-width:1px;}#gdark2 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark2 [data-look="neo"].node circle{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark2 [data-look="neo"].icon-shape .icon{fill:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark2-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark2 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark2_d2-flowchart-v2-pointEnd" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointStart" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointEnd-margin" class="marker d2-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-pointStart-margin" class="marker d2-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark2_d2-flowchart-v2-circleEnd" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleStart" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleEnd-margin" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-circleStart-margin" class="marker d2-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark2_d2-flowchart-v2-crossEnd" class="marker cross d2-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossStart" class="marker cross d2-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossEnd-margin" class="marker cross d2-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark2_d2-flowchart-v2-crossStart-margin" class="marker cross d2-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M90.581,110L104.855,97.333C119.13,84.667,147.678,59.333,171.78,46.667C195.883,34,215.539,34,225.367,34L235.195,34" id="gdark2-L_P_L1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_L1_0" data-points="W3sieCI6OTAuNTgxMDM1NTM5MjE1NjksInkiOjExMH0seyJ4IjoxNzYuMjI2NTYyNSwieSI6MzR9LHsieCI6MjM5LjE5NTMxMjUsInkiOjM0fV0=" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M114.563,136L124.84,136C135.117,136,155.672,136,175.591,136C195.51,136,214.794,136,224.436,136L234.078,136" id="gdark2-L_P_L2_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_L2_0" data-points="W3sieCI6MTE0LjU2MjUsInkiOjEzNn0seyJ4IjoxNzYuMjI2NTYyNSwieSI6MTM2fSx7IngiOjIzOC4wNzgxMjUsInkiOjEzNn1d" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M90.581,162L104.855,174.667C119.13,187.333,147.678,212.667,171.563,225.333C195.448,238,214.669,238,224.28,238L233.891,238" id="gdark2-L_P_L3_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_L3_0" data-points="W3sieCI6OTAuNTgxMDM1NTM5MjE1NjksInkiOjE2Mn0seyJ4IjoxNzYuMjI2NTYyNSwieSI6MjM4fSx7IngiOjIzNy44OTA2MjUsInkiOjIzOH1d" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M404.828,238L408.995,238C413.161,238,421.495,238,429.161,238C436.828,238,443.828,238,447.328,238L450.828,238" id="gdark2-L_L3_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_L3_N_0" data-points="W3sieCI6NDA0LjgyODEyNSwieSI6MjM4fSx7IngiOjQyOS44MjgxMjUsInkiOjIzOH0seyJ4Ijo0NTQuODI4MTI1LCJ5IjoyMzh9XQ==" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path><path d="M615.844,238L620.01,238C624.177,238,632.51,238,640.177,238C647.844,238,654.844,238,658.344,238L661.844,238" id="gdark2-L_N_R_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N_R_0" data-points="W3sieCI6NjE1Ljg0Mzc1LCJ5IjoyMzh9LHsieCI6NjQwLjg0Mzc1LCJ5IjoyMzh9LHsieCI6NjY1Ljg0Mzc1LCJ5IjoyMzh9XQ==" data-look="classic" marker-end="url(#gdark2_d2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_P_L1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(176.2265625, 136)"><g class="label" data-id="L_P_L2_0" transform="translate(-36.6640625, -12)"><foreignObject width="73.328125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>reconnect</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(176.2265625, 238)"><g class="label" data-id="L_P_L3_0" transform="translate(-36.6640625, -12)"><foreignObject width="73.328125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>reconnect</p></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_L3_N_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N_R_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark2-d2-flowchart-P-0" data-look="classic" transform="translate(61.28125, 136)"><rect class="basic label-container" style="" x="-53.28125" y="-26" width="106.5625" height="52"></rect><g class="label" style="" transform="translate(-25.28125, -12)"><rect></rect><foreignObject width="50.5625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Pane A</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-L1-1" data-look="classic" transform="translate(321.359375, 34)"><rect class="basic label-container" style="" x="-82.1640625" y="-26" width="164.328125" height="52"></rect><g class="label" style="" transform="translate(-54.1640625, -12)"><rect></rect><foreignObject width="108.328125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>lease → shell-1</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-L2-3" data-look="classic" transform="translate(321.359375, 136)"><rect class="basic label-container" style="" x="-83.28125" y="-26" width="166.5625" height="52"></rect><g class="label" style="" transform="translate(-55.28125, -12)"><rect></rect><foreignObject width="110.5625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>lease → shell-2</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-L3-5" data-look="classic" transform="translate(321.359375, 238)"><rect class="basic label-container" style="" x="-83.46875" y="-26" width="166.9375" height="52"></rect><g class="label" style="" transform="translate(-55.46875, -12)"><rect></rect><foreignObject width="110.9375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>lease → shell-3</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-N-7" data-look="classic" transform="translate(535.3359375, 238)"><rect class="basic label-container" style="fill:#4a1f22 !important;stroke:#f85149 !important" x="-80.5078125" y="-38" width="161.015625" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-52.5078125, -24)"><rect></rect><foreignObject width="105.015625" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>nothing retires<br/>the old notes</p></span></div></foreignObject></g></g><g class="node default  " id="gdark2-d2-flowchart-R-9" data-look="classic" transform="translate(779.9140625, 238)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-114.0703125" y="-38" width="228.140625" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-86.0703125, -24)"><rect></rect><foreignObject width="172.140625" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>next reconnect restores<br/><b>all three</b></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark2-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark2-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark2-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault2" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 901.984375 284" role="graphics-document document" aria-roledescription="l2-flowchart-v2"><style>#gdefault2{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault2 .error-icon{fill:#552222;}#gdefault2 .error-text{fill:#552222;stroke:#552222;}#gdefault2 .edge-thickness-normal{stroke-width:1px;}#gdefault2 .edge-thickness-thick{stroke-width:3.5px;}#gdefault2 .edge-pattern-solid{stroke-dasharray:0;}#gdefault2 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault2 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault2 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault2 .marker{fill:#333333;stroke:#333333;}#gdefault2 .marker.cross{stroke:#333333;}#gdefault2 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault2 p{margin:0;}#gdefault2 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault2 .cluster-label text{fill:#333;}#gdefault2 .cluster-label span{color:#333;}#gdefault2 .cluster-label span p{background-color:transparent;}#gdefault2 .label text,#gdefault2 span{fill:#333;color:#333;}#gdefault2 .node rect,#gdefault2 .node circle,#gdefault2 .node ellipse,#gdefault2 .node polygon,#gdefault2 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault2 .rough-node .label text,#gdefault2 .node .label text,#gdefault2 .image-shape .label,#gdefault2 .icon-shape .label{text-anchor:middle;}#gdefault2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault2 .rough-node .label,#gdefault2 .node .label,#gdefault2 .image-shape .label,#gdefault2 .icon-shape .label{text-align:center;}#gdefault2 .node.clickable{cursor:pointer;}#gdefault2 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault2 .arrowheadPath{fill:#333333;}#gdefault2 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault2 .l2-flowchart-link{stroke:#333333;fill:none;}#gdefault2 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault2 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault2 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault2 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault2 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault2 .cluster text{fill:#333;}#gdefault2 .cluster span{color:#333;}#gdefault2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault2 rect.text{fill:none;stroke-width:0;}#gdefault2 .icon-shape,#gdefault2 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault2 .icon-shape p,#gdefault2 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault2 .icon-shape .label rect,#gdefault2 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault2 .node .neo-node{stroke:#9370DB;}#gdefault2 [data-look="neo"].node rect,#gdefault2 [data-look="neo"].cluster rect,#gdefault2 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault2 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault2 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault2 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault2 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault2 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault2_l2-flowchart-v2-pointEnd" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointStart" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointEnd-margin" class="marker l2-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-pointStart-margin" class="marker l2-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault2_l2-flowchart-v2-circleEnd" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleStart" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleEnd-margin" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-circleStart-margin" class="marker l2-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault2_l2-flowchart-v2-crossEnd" class="marker cross l2-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossStart" class="marker cross l2-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossEnd-margin" class="marker cross l2-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault2_l2-flowchart-v2-crossStart-margin" class="marker cross l2-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M90.581,110L104.855,97.333C119.13,84.667,147.678,59.333,171.78,46.667C195.883,34,215.539,34,225.367,34L235.195,34" id="gdefault2-L_P_L1_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_L1_0" data-points="W3sieCI6OTAuNTgxMDM1NTM5MjE1NjksInkiOjExMH0seyJ4IjoxNzYuMjI2NTYyNSwieSI6MzR9LHsieCI6MjM5LjE5NTMxMjUsInkiOjM0fV0=" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M114.563,136L124.84,136C135.117,136,155.672,136,175.591,136C195.51,136,214.794,136,224.436,136L234.078,136" id="gdefault2-L_P_L2_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_L2_0" data-points="W3sieCI6MTE0LjU2MjUsInkiOjEzNn0seyJ4IjoxNzYuMjI2NTYyNSwieSI6MTM2fSx7IngiOjIzOC4wNzgxMjUsInkiOjEzNn1d" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M90.581,162L104.855,174.667C119.13,187.333,147.678,212.667,171.563,225.333C195.448,238,214.669,238,224.28,238L233.891,238" id="gdefault2-L_P_L3_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_L3_0" data-points="W3sieCI6OTAuNTgxMDM1NTM5MjE1NjksInkiOjE2Mn0seyJ4IjoxNzYuMjI2NTYyNSwieSI6MjM4fSx7IngiOjIzNy44OTA2MjUsInkiOjIzOH1d" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M404.828,238L408.995,238C413.161,238,421.495,238,429.161,238C436.828,238,443.828,238,447.328,238L450.828,238" id="gdefault2-L_L3_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_L3_N_0" data-points="W3sieCI6NDA0LjgyODEyNSwieSI6MjM4fSx7IngiOjQyOS44MjgxMjUsInkiOjIzOH0seyJ4Ijo0NTQuODI4MTI1LCJ5IjoyMzh9XQ==" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path><path d="M615.844,238L620.01,238C624.177,238,632.51,238,640.177,238C647.844,238,654.844,238,658.344,238L661.844,238" id="gdefault2-L_N_R_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l2-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_N_R_0" data-points="W3sieCI6NjE1Ljg0Mzc1LCJ5IjoyMzh9LHsieCI6NjQwLjg0Mzc1LCJ5IjoyMzh9LHsieCI6NjY1Ljg0Mzc1LCJ5IjoyMzh9XQ==" data-look="classic" marker-end="url(#gdefault2_l2-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_P_L1_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(176.2265625, 136)"><g class="label" data-id="L_P_L2_0" transform="translate(-36.6640625, -12)"><foreignObject width="73.328125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>reconnect</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(176.2265625, 238)"><g class="label" data-id="L_P_L3_0" transform="translate(-36.6640625, -12)"><foreignObject width="73.328125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>reconnect</p></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_L3_N_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_N_R_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault2-l2-flowchart-P-0" data-look="classic" transform="translate(61.28125, 136)"><rect class="basic label-container" style="" x="-53.28125" y="-26" width="106.5625" height="52"></rect><g class="label" style="" transform="translate(-25.28125, -12)"><rect></rect><foreignObject width="50.5625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>Pane A</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-L1-1" data-look="classic" transform="translate(321.359375, 34)"><rect class="basic label-container" style="" x="-82.1640625" y="-26" width="164.328125" height="52"></rect><g class="label" style="" transform="translate(-54.1640625, -12)"><rect></rect><foreignObject width="108.328125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>lease → shell-1</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-L2-3" data-look="classic" transform="translate(321.359375, 136)"><rect class="basic label-container" style="" x="-83.28125" y="-26" width="166.5625" height="52"></rect><g class="label" style="" transform="translate(-55.28125, -12)"><rect></rect><foreignObject width="110.5625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>lease → shell-2</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-L3-5" data-look="classic" transform="translate(321.359375, 238)"><rect class="basic label-container" style="" x="-83.46875" y="-26" width="166.9375" height="52"></rect><g class="label" style="" transform="translate(-55.46875, -12)"><rect></rect><foreignObject width="110.9375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>lease → shell-3</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-N-7" data-look="classic" transform="translate(535.3359375, 238)"><rect class="basic label-container" style="fill:#ffe3e6 !important;stroke:#cf222e !important" x="-80.5078125" y="-38" width="161.015625" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-52.5078125, -24)"><rect></rect><foreignObject width="105.015625" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>nothing retires<br/>the old notes</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault2-l2-flowchart-R-9" data-look="classic" transform="translate(779.9140625, 238)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-114.0703125" y="-38" width="228.140625" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-86.0703125, -24)"><rect></rect><foreignObject width="172.140625" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>next reconnect restores<br/><b>all three</b></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault2-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault2-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p><span class="pill ok">FIXED</span> A lease is identified by its pane. One pane, one live lease. Superseded leases are marked <em>expired</em>, <strong>not killed</strong> — the remote shell keeps running, because losing a note is not proof the shell died.</p>
+
+      <h3>Cause 2 — reconnecting could create panes</h3>
+      <figure>
+        <div class="bar"><span>Reattach decision</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark3" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 739.8125 440.796875" role="graphics-document document" aria-roledescription="d3-flowchart-v2"><style>#gdark3{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark3 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark3 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark3 .error-icon{fill:#a44141;}#gdark3 .error-text{fill:#ddd;stroke:#ddd;}#gdark3 .edge-thickness-normal{stroke-width:1px;}#gdark3 .edge-thickness-thick{stroke-width:3.5px;}#gdark3 .edge-pattern-solid{stroke-dasharray:0;}#gdark3 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark3 .edge-pattern-dashed{stroke-dasharray:3;}#gdark3 .edge-pattern-dotted{stroke-dasharray:2;}#gdark3 .marker{fill:lightgrey;stroke:lightgrey;}#gdark3 .marker.cross{stroke:lightgrey;}#gdark3 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark3 p{margin:0;}#gdark3 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark3 .cluster-label text{fill:#F9FFFE;}#gdark3 .cluster-label span{color:#F9FFFE;}#gdark3 .cluster-label span p{background-color:transparent;}#gdark3 .label text,#gdark3 span{fill:#ccc;color:#ccc;}#gdark3 .node rect,#gdark3 .node circle,#gdark3 .node ellipse,#gdark3 .node polygon,#gdark3 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark3 .rough-node .label text,#gdark3 .node .label text,#gdark3 .image-shape .label,#gdark3 .icon-shape .label{text-anchor:middle;}#gdark3 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark3 .rough-node .label,#gdark3 .node .label,#gdark3 .image-shape .label,#gdark3 .icon-shape .label{text-align:center;}#gdark3 .node.clickable{cursor:pointer;}#gdark3 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark3 .arrowheadPath{fill:lightgrey;}#gdark3 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark3 .d3-flowchart-link{stroke:lightgrey;fill:none;}#gdark3 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark3 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark3 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark3 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark3 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark3 .cluster text{fill:#F9FFFE;}#gdark3 .cluster span{color:#F9FFFE;}#gdark3 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark3 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark3 rect.text{fill:none;stroke-width:0;}#gdark3 .icon-shape,#gdark3 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark3 .icon-shape p,#gdark3 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark3 .icon-shape .label rect,#gdark3 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark3 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark3 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark3 .node .neo-node{stroke:#ccc;}#gdark3 [data-look="neo"].node rect,#gdark3 [data-look="neo"].cluster rect,#gdark3 [data-look="neo"].node polygon{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark3 [data-look="neo"].node path{stroke:url(#gdark3-gradient);stroke-width:1px;}#gdark3 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark3 [data-look="neo"].node circle{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark3 [data-look="neo"].icon-shape .icon{fill:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark3-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark3 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark3_d3-flowchart-v2-pointEnd" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointStart" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointEnd-margin" class="marker d3-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-pointStart-margin" class="marker d3-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark3_d3-flowchart-v2-circleEnd" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleStart" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleEnd-margin" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-circleStart-margin" class="marker d3-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark3_d3-flowchart-v2-crossEnd" class="marker cross d3-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossStart" class="marker cross d3-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossEnd-margin" class="marker cross d3-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark3_d3-flowchart-v2-crossStart-margin" class="marker cross d3-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M340.594,60L340.594,64.167C340.594,68.333,340.594,76.667,340.594,84.333C340.594,92,340.594,99,340.594,102.5L340.594,106" id="gdark3-L_R_Q_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R_Q_0" data-points="W3sieCI6MzQwLjU5Mzc1LCJ5Ijo2MH0seyJ4IjozNDAuNTkzNzUsInkiOjg1fSx7IngiOjM0MC41OTM3NSwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M283.753,225.956L253.677,241.597C223.601,257.237,163.449,288.517,133.373,311.657C103.297,334.797,103.297,349.797,103.297,357.297L103.297,364.797" id="gdark3-L_Q_OK_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_OK_0" data-points="W3sieCI6MjgzLjc1MzMxMjg5NjY0MDYsInkiOjIyNS45NTY0Mzc4OTY2NDA2fSx7IngiOjEwMy4yOTY4NzUsInkiOjMxOS43OTY4NzV9LHsieCI6MTAzLjI5Njg3NSwieSI6MzY4Ljc5Njg3NX1d" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M340.594,282.797L340.594,288.964C340.594,295.13,340.594,307.464,340.594,319.13C340.594,330.797,340.594,341.797,340.594,347.297L340.594,352.797" id="gdark3-L_Q_BAD_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_BAD_0" data-points="W3sieCI6MzQwLjU5Mzc1LCJ5IjoyODIuNzk2ODc1fSx7IngiOjM0MC41OTM3NSwieSI6MzE5Ljc5Njg3NX0seyJ4IjozNDAuNTkzNzUsInkiOjM1Ni43OTY4NzV9XQ==" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path><path d="M399.656,223.735L434.247,239.745C468.838,255.756,538.021,287.776,572.612,309.287C607.203,330.797,607.203,341.797,607.203,347.297L607.203,352.797" id="gdark3-L_Q_GOOD_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_GOOD_0" data-points="W3sieCI6Mzk5LjY1NTcyOTQ5MDA5NDM2LCJ5IjoyMjMuNzM0ODk1NTA5OTA1NjR9LHsieCI6NjA3LjIwMzEyNSwieSI6MzE5Ljc5Njg3NX0seyJ4Ijo2MDcuMjAzMTI1LCJ5IjozNTYuNzk2ODc1fV0=" data-look="classic" marker-end="url(#gdark3_d3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_R_Q_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(103.296875, 319.796875)"><g class="label" data-id="L_Q_OK_0" transform="translate(-12.4765625, -12)"><foreignObject width="24.953125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>yes</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(340.59375, 319.796875)"><g class="label" data-id="L_Q_BAD_0" transform="translate(-38.984375, -12)"><foreignObject width="77.96875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no · before</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(607.203125, 319.796875)"><g class="label" data-id="L_Q_GOOD_0" transform="translate(-32.484375, -12)"><foreignObject width="64.96875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no · after</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark3-d3-flowchart-R-0" data-look="classic" transform="translate(340.59375, 34)"><rect class="basic label-container" style="" x="-112.046875" y="-26" width="224.09375" height="52"></rect><g class="label" style="" transform="translate(-84.046875, -12)"><rect></rect><foreignObject width="168.09375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reconnect finds a lease</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-Q-1" data-look="classic" transform="translate(340.59375, 196.3984375)"><polygon points="86.3984375,0 172.796875,-86.3984375 86.3984375,-172.796875 0,-86.3984375" class="label-container" transform="translate(-85.8984375, 86.3984375)"></polygon><g class="label" style="" transform="translate(-48.3984375, -24)"><rect></rect><foreignObject width="96.796875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>does its pane<br/>still exist?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-OK-3" data-look="classic" transform="translate(103.296875, 394.796875)"><rect class="basic label-container" style="" x="-95.296875" y="-26" width="190.59375" height="52"></rect><g class="label" style="" transform="translate(-67.296875, -12)"><rect></rect><foreignObject width="134.59375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reattach — correct</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-BAD-5" data-look="classic" transform="translate(340.59375, 394.796875)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-92" y="-38" width="184" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-64, -24)"><rect></rect><foreignObject width="128" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>invent the pane<br/>👻 ghost appears</p></span></div></foreignObject></g></g><g class="node default  " id="gdark3-d3-flowchart-GOOD-7" data-look="classic" transform="translate(607.203125, 394.796875)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-124.609375" y="-38" width="249.21875" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-96.609375, -24)"><rect></rect><foreignObject width="193.21875" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>refuse<br/>shell left running, unbound</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark3-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark3-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark3-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault3" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 739.8125 440.796875" role="graphics-document document" aria-roledescription="l3-flowchart-v2"><style>#gdefault3{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault3 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault3 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault3 .error-icon{fill:#552222;}#gdefault3 .error-text{fill:#552222;stroke:#552222;}#gdefault3 .edge-thickness-normal{stroke-width:1px;}#gdefault3 .edge-thickness-thick{stroke-width:3.5px;}#gdefault3 .edge-pattern-solid{stroke-dasharray:0;}#gdefault3 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault3 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault3 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault3 .marker{fill:#333333;stroke:#333333;}#gdefault3 .marker.cross{stroke:#333333;}#gdefault3 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault3 p{margin:0;}#gdefault3 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault3 .cluster-label text{fill:#333;}#gdefault3 .cluster-label span{color:#333;}#gdefault3 .cluster-label span p{background-color:transparent;}#gdefault3 .label text,#gdefault3 span{fill:#333;color:#333;}#gdefault3 .node rect,#gdefault3 .node circle,#gdefault3 .node ellipse,#gdefault3 .node polygon,#gdefault3 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault3 .rough-node .label text,#gdefault3 .node .label text,#gdefault3 .image-shape .label,#gdefault3 .icon-shape .label{text-anchor:middle;}#gdefault3 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault3 .rough-node .label,#gdefault3 .node .label,#gdefault3 .image-shape .label,#gdefault3 .icon-shape .label{text-align:center;}#gdefault3 .node.clickable{cursor:pointer;}#gdefault3 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault3 .arrowheadPath{fill:#333333;}#gdefault3 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault3 .l3-flowchart-link{stroke:#333333;fill:none;}#gdefault3 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault3 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault3 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault3 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault3 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault3 .cluster text{fill:#333;}#gdefault3 .cluster span{color:#333;}#gdefault3 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault3 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault3 rect.text{fill:none;stroke-width:0;}#gdefault3 .icon-shape,#gdefault3 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault3 .icon-shape p,#gdefault3 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault3 .icon-shape .label rect,#gdefault3 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault3 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault3 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault3 .node .neo-node{stroke:#9370DB;}#gdefault3 [data-look="neo"].node rect,#gdefault3 [data-look="neo"].cluster rect,#gdefault3 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault3 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault3 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault3 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault3 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault3 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault3_l3-flowchart-v2-pointEnd" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointStart" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointEnd-margin" class="marker l3-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-pointStart-margin" class="marker l3-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault3_l3-flowchart-v2-circleEnd" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleStart" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleEnd-margin" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-circleStart-margin" class="marker l3-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault3_l3-flowchart-v2-crossEnd" class="marker cross l3-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossStart" class="marker cross l3-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossEnd-margin" class="marker cross l3-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault3_l3-flowchart-v2-crossStart-margin" class="marker cross l3-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M340.594,60L340.594,64.167C340.594,68.333,340.594,76.667,340.594,84.333C340.594,92,340.594,99,340.594,102.5L340.594,106" id="gdefault3-L_R_Q_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_R_Q_0" data-points="W3sieCI6MzQwLjU5Mzc1LCJ5Ijo2MH0seyJ4IjozNDAuNTkzNzUsInkiOjg1fSx7IngiOjM0MC41OTM3NSwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M283.753,225.956L253.677,241.597C223.601,257.237,163.449,288.517,133.373,311.657C103.297,334.797,103.297,349.797,103.297,357.297L103.297,364.797" id="gdefault3-L_Q_OK_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_OK_0" data-points="W3sieCI6MjgzLjc1MzMxMjg5NjY0MDYsInkiOjIyNS45NTY0Mzc4OTY2NDA2fSx7IngiOjEwMy4yOTY4NzUsInkiOjMxOS43OTY4NzV9LHsieCI6MTAzLjI5Njg3NSwieSI6MzY4Ljc5Njg3NX1d" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M340.594,282.797L340.594,288.964C340.594,295.13,340.594,307.464,340.594,319.13C340.594,330.797,340.594,341.797,340.594,347.297L340.594,352.797" id="gdefault3-L_Q_BAD_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_BAD_0" data-points="W3sieCI6MzQwLjU5Mzc1LCJ5IjoyODIuNzk2ODc1fSx7IngiOjM0MC41OTM3NSwieSI6MzE5Ljc5Njg3NX0seyJ4IjozNDAuNTkzNzUsInkiOjM1Ni43OTY4NzV9XQ==" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path><path d="M399.656,223.735L434.247,239.745C468.838,255.756,538.021,287.776,572.612,309.287C607.203,330.797,607.203,341.797,607.203,347.297L607.203,352.797" id="gdefault3-L_Q_GOOD_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l3-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_GOOD_0" data-points="W3sieCI6Mzk5LjY1NTcyOTQ5MDA5NDM2LCJ5IjoyMjMuNzM0ODk1NTA5OTA1NjR9LHsieCI6NjA3LjIwMzEyNSwieSI6MzE5Ljc5Njg3NX0seyJ4Ijo2MDcuMjAzMTI1LCJ5IjozNTYuNzk2ODc1fV0=" data-look="classic" marker-end="url(#gdefault3_l3-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_R_Q_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(103.296875, 319.796875)"><g class="label" data-id="L_Q_OK_0" transform="translate(-12.4765625, -12)"><foreignObject width="24.953125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>yes</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(340.59375, 319.796875)"><g class="label" data-id="L_Q_BAD_0" transform="translate(-38.984375, -12)"><foreignObject width="77.96875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no · before</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(607.203125, 319.796875)"><g class="label" data-id="L_Q_GOOD_0" transform="translate(-32.484375, -12)"><foreignObject width="64.96875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no · after</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault3-l3-flowchart-R-0" data-look="classic" transform="translate(340.59375, 34)"><rect class="basic label-container" style="" x="-112.046875" y="-26" width="224.09375" height="52"></rect><g class="label" style="" transform="translate(-84.046875, -12)"><rect></rect><foreignObject width="168.09375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reconnect finds a lease</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-Q-1" data-look="classic" transform="translate(340.59375, 196.3984375)"><polygon points="86.3984375,0 172.796875,-86.3984375 86.3984375,-172.796875 0,-86.3984375" class="label-container" transform="translate(-85.8984375, 86.3984375)"></polygon><g class="label" style="" transform="translate(-48.3984375, -24)"><rect></rect><foreignObject width="96.796875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>does its pane<br/>still exist?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-OK-3" data-look="classic" transform="translate(103.296875, 394.796875)"><rect class="basic label-container" style="" x="-95.296875" y="-26" width="190.59375" height="52"></rect><g class="label" style="" transform="translate(-67.296875, -12)"><rect></rect><foreignObject width="134.59375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>reattach — correct</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-BAD-5" data-look="classic" transform="translate(340.59375, 394.796875)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-92" y="-38" width="184" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-64, -24)"><rect></rect><foreignObject width="128" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>invent the pane<br/>👻 ghost appears</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault3-l3-flowchart-GOOD-7" data-look="classic" transform="translate(607.203125, 394.796875)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-124.609375" y="-38" width="249.21875" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-96.609375, -24)"><rect></rect><foreignObject width="193.21875" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>refuse<br/>shell left running, unbound</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault3-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault3-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p><span class="pill ok">FIXED</span> Reattach binds only. Opening a new terminal still creates, exactly as before.</p>
+
+      <h3>Cause 3 — a living shell reported as dead</h3>
+      <table>
+        <thead><tr><th>Real meaning</th><th>Reported as</th><th>Consequence</th></tr></thead>
+        <tbody>
+          <tr><td>This shell is gone</td><td><code>SESSION_EXPIRED</code></td><td><span class="pill ok">correct</span></td></tr>
+          <tr><td>Shell is fine — output pipe needs re-establishing</td><td><code>SESSION_EXPIRED</code></td><td><span class="pill no">respawn → agent resumed twice</span></td></tr>
+        </tbody>
+      </table>
+      <p><span class="pill ok">FIXED</span> The second case has its own message, and respawn now requires <strong>positive proof</strong>. Anything unrecognised is “unknown”, which never justifies a replacement.</p>
+
+      <h2>4 · The rule underneath all of it</h2>
+      <figure>
+        <div class="bar"><span>Unknown is not dead</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark4" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 974.546875 273.5234375" role="graphics-document document" aria-roledescription="d4-flowchart-v2"><style>#gdark4{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark4 .error-icon{fill:#a44141;}#gdark4 .error-text{fill:#ddd;stroke:#ddd;}#gdark4 .edge-thickness-normal{stroke-width:1px;}#gdark4 .edge-thickness-thick{stroke-width:3.5px;}#gdark4 .edge-pattern-solid{stroke-dasharray:0;}#gdark4 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark4 .edge-pattern-dashed{stroke-dasharray:3;}#gdark4 .edge-pattern-dotted{stroke-dasharray:2;}#gdark4 .marker{fill:lightgrey;stroke:lightgrey;}#gdark4 .marker.cross{stroke:lightgrey;}#gdark4 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark4 p{margin:0;}#gdark4 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark4 .cluster-label text{fill:#F9FFFE;}#gdark4 .cluster-label span{color:#F9FFFE;}#gdark4 .cluster-label span p{background-color:transparent;}#gdark4 .label text,#gdark4 span{fill:#ccc;color:#ccc;}#gdark4 .node rect,#gdark4 .node circle,#gdark4 .node ellipse,#gdark4 .node polygon,#gdark4 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark4 .rough-node .label text,#gdark4 .node .label text,#gdark4 .image-shape .label,#gdark4 .icon-shape .label{text-anchor:middle;}#gdark4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark4 .rough-node .label,#gdark4 .node .label,#gdark4 .image-shape .label,#gdark4 .icon-shape .label{text-align:center;}#gdark4 .node.clickable{cursor:pointer;}#gdark4 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark4 .arrowheadPath{fill:lightgrey;}#gdark4 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark4 .d4-flowchart-link{stroke:lightgrey;fill:none;}#gdark4 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark4 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark4 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark4 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark4 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark4 .cluster text{fill:#F9FFFE;}#gdark4 .cluster span{color:#F9FFFE;}#gdark4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark4 rect.text{fill:none;stroke-width:0;}#gdark4 .icon-shape,#gdark4 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark4 .icon-shape p,#gdark4 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark4 .icon-shape .label rect,#gdark4 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark4 .node .neo-node{stroke:#ccc;}#gdark4 [data-look="neo"].node rect,#gdark4 [data-look="neo"].cluster rect,#gdark4 [data-look="neo"].node polygon{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark4 [data-look="neo"].node path{stroke:url(#gdark4-gradient);stroke-width:1px;}#gdark4 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark4 [data-look="neo"].node circle{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark4 [data-look="neo"].icon-shape .icon{fill:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark4-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark4 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark4_d4-flowchart-v2-pointEnd" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointStart" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointEnd-margin" class="marker d4-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-pointStart-margin" class="marker d4-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark4_d4-flowchart-v2-circleEnd" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleStart" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleEnd-margin" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-circleStart-margin" class="marker d4-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark4_d4-flowchart-v2-crossEnd" class="marker cross d4-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossStart" class="marker cross d4-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossEnd-margin" class="marker cross d4-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark4_d4-flowchart-v2-crossStart-margin" class="marker cross d4-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M129.516,169L133.682,169C137.849,169,146.182,169,153.849,169C161.516,169,168.516,169,172.016,169L175.516,169" id="gdark4-L_E_A_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_E_A_0" data-points="W3sieCI6MTI5LjUxNTYyNSwieSI6MTY5fSx7IngiOjE1NC41MTU2MjUsInkiOjE2OX0seyJ4IjoxNzkuNTE1NjI1LCJ5IjoxNjl9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M333.903,130.341L354.943,116.284C375.982,102.227,418.061,74.114,453.031,60.057C488,46,515.859,46,529.789,46L543.719,46" id="gdark4-L_A_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_D_0" data-points="W3sieCI6MzMzLjkwMzAzMjcwMjQzNDUzLCJ5IjoxMzAuMzQwNTMyNzAyNDM0NTZ9LHsieCI6NDYwLjE0MDYyNSwieSI6NDZ9LHsieCI6NTQ3LjcxODc1LCJ5Ijo0Nn1d" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M347.091,143.528L365.932,136.773C384.774,130.019,422.457,116.509,458.225,116.185C493.994,115.86,527.847,128.72,544.773,135.15L561.7,141.58" id="gdark4-L_A_U_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_U_0" data-points="W3sieCI6MzQ3LjA5MDY2MDQzNDgyMzM1LCJ5IjoxNDMuNTI4MTYwNDM0ODIzMzV9LHsieCI6NDYwLjE0MDYyNSwieSI6MTAzfSx7IngiOjU2NS40Mzg5MjA0NTQ1NDU1LCJ5IjoxNDN9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M362.259,158.697L378.573,156.747C394.886,154.798,427.514,150.899,460.528,151.064C493.542,151.229,526.943,155.459,543.644,157.574L560.344,159.688" id="gdark4-L_A_U_2" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_U_2" data-points="W3sieCI6MzYyLjI1OTI1MTQ0OTkwNzE0LCJ5IjoxNTguNjk2NzUxNDQ5OTA3MTR9LHsieCI6NDYwLjE0MDYyNSwieSI6MTQ3fSx7IngiOjU2NC4zMTI1LCJ5IjoxNjAuMTkwNzAxMDIwNzI5MzZ9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M362.259,179.303L378.573,181.253C394.886,183.202,427.514,187.101,460.528,186.936C493.542,186.771,526.943,182.541,543.644,180.426L560.344,178.312" id="gdark4-L_A_U_3" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_U_3" data-points="W3sieCI6MzYyLjI1OTI1MTQ0OTkwNzE0LCJ5IjoxNzkuMzAzMjQ4NTUwMDkyODZ9LHsieCI6NDYwLjE0MDYyNSwieSI6MTkxfSx7IngiOjU2NC4zMTI1LCJ5IjoxNzcuODA5Mjk4OTc5MjcwNjR9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M347.091,194.472L365.932,201.227C384.774,207.981,422.457,221.491,458.225,221.815C493.994,222.14,527.847,209.28,544.773,202.85L561.7,196.42" id="gdark4-L_A_U_4" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_U_4" data-points="W3sieCI6MzQ3LjA5MDY2MDQzNDgyMzM1LCJ5IjoxOTQuNDcxODM5NTY1MTc2NjV9LHsieCI6NDYwLjE0MDYyNSwieSI6MjM1fSx7IngiOjU2NS40Mzg5MjA0NTQ1NDU1LCJ5IjoxOTV9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path><path d="M703.453,169L710.385,169C717.318,169,731.182,169,741.615,169C752.047,169,759.047,169,762.547,169L766.047,169" id="gdark4-L_U_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_U_N_0" data-points="W3sieCI6NzAzLjQ1MzEyNSwieSI6MTY5fSx7IngiOjc0NS4wNDY4NzUsInkiOjE2OX0seyJ4Ijo3NzAuMDQ2ODc1LCJ5IjoxNjl9XQ==" data-look="classic" marker-end="url(#gdark4_d4-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_E_A_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(460.140625, 46)"><g class="label" data-id="L_A_D_0" transform="translate(-40.8046875, -12)"><foreignObject width="81.609375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>shell exited</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(456.63168, 104.25795)"><g class="label" data-id="L_A_U_0" transform="translate(-47.1328125, -12)"><foreignObject width="94.265625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>can't reach it</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(463.32813, 147.40362)"><g class="label" data-id="L_A_U_2" transform="translate(-34.4765625, -12)"><foreignObject width="68.953125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>timed out</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(463.32813, 190.59638)"><g class="label" data-id="L_A_U_3" transform="translate(-62.578125, -12)"><foreignObject width="125.15625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>absent from a list</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(456.63168, 233.74205)"><g class="label" data-id="L_A_U_4" transform="translate(-51.8828125, -12)"><foreignObject width="103.765625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>3 failed retries</p></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_U_N_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark4-d4-flowchart-E-0" data-look="classic" transform="translate(68.7578125, 169)"><rect class="basic label-container" style="" x="-60.7578125" y="-26" width="121.515625" height="52"></rect><g class="label" style="" transform="translate(-32.7578125, -12)"><rect></rect><foreignObject width="65.515625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>evidence</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-A-1" data-look="classic" transform="translate(276.0390625, 169)"><polygon points="96.5234375,0 193.046875,-96.5234375 96.5234375,-193.046875 0,-96.5234375" class="label-container" transform="translate(-96.0234375, 96.5234375)"></polygon><g class="label" style="" transform="translate(-70.5234375, -12)"><rect></rect><foreignObject width="141.046875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>what does it prove?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-D-3" data-look="classic" transform="translate(633.8828125, 46)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-86.1640625" y="-38" width="172.328125" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-58.1640625, -24)"><rect></rect><foreignObject width="116.328125" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>DEAD<br/>cleanup allowed</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-U-5" data-look="classic" transform="translate(633.8828125, 169)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-69.5703125" y="-26" width="139.140625" height="52"></rect><g class="label" style="color:#fff !important" transform="translate(-41.5703125, -12)"><rect></rect><foreignObject width="83.140625" height="24"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>UNKNOWN</p></span></div></foreignObject></g></g><g class="node default  " id="gdark4-d4-flowchart-N-13" data-look="classic" transform="translate(868.296875, 169)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-98.25" y="-38" width="196.5" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-70.25, -24)"><rect></rect><foreignObject width="140.5" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>nothing destructive<br/>wait · retry · ask</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark4-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark4-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark4-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault4" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 974.546875 273.5234375" role="graphics-document document" aria-roledescription="l4-flowchart-v2"><style>#gdefault4{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault4 .error-icon{fill:#552222;}#gdefault4 .error-text{fill:#552222;stroke:#552222;}#gdefault4 .edge-thickness-normal{stroke-width:1px;}#gdefault4 .edge-thickness-thick{stroke-width:3.5px;}#gdefault4 .edge-pattern-solid{stroke-dasharray:0;}#gdefault4 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault4 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault4 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault4 .marker{fill:#333333;stroke:#333333;}#gdefault4 .marker.cross{stroke:#333333;}#gdefault4 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault4 p{margin:0;}#gdefault4 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault4 .cluster-label text{fill:#333;}#gdefault4 .cluster-label span{color:#333;}#gdefault4 .cluster-label span p{background-color:transparent;}#gdefault4 .label text,#gdefault4 span{fill:#333;color:#333;}#gdefault4 .node rect,#gdefault4 .node circle,#gdefault4 .node ellipse,#gdefault4 .node polygon,#gdefault4 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault4 .rough-node .label text,#gdefault4 .node .label text,#gdefault4 .image-shape .label,#gdefault4 .icon-shape .label{text-anchor:middle;}#gdefault4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault4 .rough-node .label,#gdefault4 .node .label,#gdefault4 .image-shape .label,#gdefault4 .icon-shape .label{text-align:center;}#gdefault4 .node.clickable{cursor:pointer;}#gdefault4 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault4 .arrowheadPath{fill:#333333;}#gdefault4 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault4 .l4-flowchart-link{stroke:#333333;fill:none;}#gdefault4 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault4 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault4 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault4 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault4 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault4 .cluster text{fill:#333;}#gdefault4 .cluster span{color:#333;}#gdefault4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault4 rect.text{fill:none;stroke-width:0;}#gdefault4 .icon-shape,#gdefault4 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault4 .icon-shape p,#gdefault4 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault4 .icon-shape .label rect,#gdefault4 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault4 .node .neo-node{stroke:#9370DB;}#gdefault4 [data-look="neo"].node rect,#gdefault4 [data-look="neo"].cluster rect,#gdefault4 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault4 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault4 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault4 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault4 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault4 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault4_l4-flowchart-v2-pointEnd" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointStart" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointEnd-margin" class="marker l4-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-pointStart-margin" class="marker l4-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault4_l4-flowchart-v2-circleEnd" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleStart" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleEnd-margin" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-circleStart-margin" class="marker l4-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault4_l4-flowchart-v2-crossEnd" class="marker cross l4-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossStart" class="marker cross l4-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossEnd-margin" class="marker cross l4-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault4_l4-flowchart-v2-crossStart-margin" class="marker cross l4-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M129.516,169L133.682,169C137.849,169,146.182,169,153.849,169C161.516,169,168.516,169,172.016,169L175.516,169" id="gdefault4-L_E_A_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_E_A_0" data-points="W3sieCI6MTI5LjUxNTYyNSwieSI6MTY5fSx7IngiOjE1NC41MTU2MjUsInkiOjE2OX0seyJ4IjoxNzkuNTE1NjI1LCJ5IjoxNjl9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M333.903,130.341L354.943,116.284C375.982,102.227,418.061,74.114,453.031,60.057C488,46,515.859,46,529.789,46L543.719,46" id="gdefault4-L_A_D_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_D_0" data-points="W3sieCI6MzMzLjkwMzAzMjcwMjQzNDUzLCJ5IjoxMzAuMzQwNTMyNzAyNDM0NTZ9LHsieCI6NDYwLjE0MDYyNSwieSI6NDZ9LHsieCI6NTQ3LjcxODc1LCJ5Ijo0Nn1d" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M347.091,143.528L365.932,136.773C384.774,130.019,422.457,116.509,458.225,116.185C493.994,115.86,527.847,128.72,544.773,135.15L561.7,141.58" id="gdefault4-L_A_U_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_U_0" data-points="W3sieCI6MzQ3LjA5MDY2MDQzNDgyMzM1LCJ5IjoxNDMuNTI4MTYwNDM0ODIzMzV9LHsieCI6NDYwLjE0MDYyNSwieSI6MTAzfSx7IngiOjU2NS40Mzg5MjA0NTQ1NDU1LCJ5IjoxNDN9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M362.259,158.697L378.573,156.747C394.886,154.798,427.514,150.899,460.528,151.064C493.542,151.229,526.943,155.459,543.644,157.574L560.344,159.688" id="gdefault4-L_A_U_2" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_U_2" data-points="W3sieCI6MzYyLjI1OTI1MTQ0OTkwNzE0LCJ5IjoxNTguNjk2NzUxNDQ5OTA3MTR9LHsieCI6NDYwLjE0MDYyNSwieSI6MTQ3fSx7IngiOjU2NC4zMTI1LCJ5IjoxNjAuMTkwNzAxMDIwNzI5MzZ9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M362.259,179.303L378.573,181.253C394.886,183.202,427.514,187.101,460.528,186.936C493.542,186.771,526.943,182.541,543.644,180.426L560.344,178.312" id="gdefault4-L_A_U_3" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_U_3" data-points="W3sieCI6MzYyLjI1OTI1MTQ0OTkwNzE0LCJ5IjoxNzkuMzAzMjQ4NTUwMDkyODZ9LHsieCI6NDYwLjE0MDYyNSwieSI6MTkxfSx7IngiOjU2NC4zMTI1LCJ5IjoxNzcuODA5Mjk4OTc5MjcwNjR9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M347.091,194.472L365.932,201.227C384.774,207.981,422.457,221.491,458.225,221.815C493.994,222.14,527.847,209.28,544.773,202.85L561.7,196.42" id="gdefault4-L_A_U_4" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_A_U_4" data-points="W3sieCI6MzQ3LjA5MDY2MDQzNDgyMzM1LCJ5IjoxOTQuNDcxODM5NTY1MTc2NjV9LHsieCI6NDYwLjE0MDYyNSwieSI6MjM1fSx7IngiOjU2NS40Mzg5MjA0NTQ1NDU1LCJ5IjoxOTV9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path><path d="M703.453,169L710.385,169C717.318,169,731.182,169,741.615,169C752.047,169,759.047,169,762.547,169L766.047,169" id="gdefault4-L_U_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l4-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_U_N_0" data-points="W3sieCI6NzAzLjQ1MzEyNSwieSI6MTY5fSx7IngiOjc0NS4wNDY4NzUsInkiOjE2OX0seyJ4Ijo3NzAuMDQ2ODc1LCJ5IjoxNjl9XQ==" data-look="classic" marker-end="url(#gdefault4_l4-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_E_A_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(460.140625, 46)"><g class="label" data-id="L_A_D_0" transform="translate(-40.8046875, -12)"><foreignObject width="81.609375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>shell exited</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(456.63168, 104.25795)"><g class="label" data-id="L_A_U_0" transform="translate(-47.1328125, -12)"><foreignObject width="94.265625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>can't reach it</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(463.32813, 147.40362)"><g class="label" data-id="L_A_U_2" transform="translate(-34.4765625, -12)"><foreignObject width="68.953125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>timed out</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(463.32813, 190.59638)"><g class="label" data-id="L_A_U_3" transform="translate(-62.578125, -12)"><foreignObject width="125.15625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>absent from a list</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(456.63168, 233.74205)"><g class="label" data-id="L_A_U_4" transform="translate(-51.8828125, -12)"><foreignObject width="103.765625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>3 failed retries</p></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_U_N_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault4-l4-flowchart-E-0" data-look="classic" transform="translate(68.7578125, 169)"><rect class="basic label-container" style="" x="-60.7578125" y="-26" width="121.515625" height="52"></rect><g class="label" style="" transform="translate(-32.7578125, -12)"><rect></rect><foreignObject width="65.515625" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>evidence</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-A-1" data-look="classic" transform="translate(276.0390625, 169)"><polygon points="96.5234375,0 193.046875,-96.5234375 96.5234375,-193.046875 0,-96.5234375" class="label-container" transform="translate(-96.0234375, 96.5234375)"></polygon><g class="label" style="" transform="translate(-70.5234375, -12)"><rect></rect><foreignObject width="141.046875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>what does it prove?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-D-3" data-look="classic" transform="translate(633.8828125, 46)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-86.1640625" y="-38" width="172.328125" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-58.1640625, -24)"><rect></rect><foreignObject width="116.328125" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>DEAD<br/>cleanup allowed</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-U-5" data-look="classic" transform="translate(633.8828125, 169)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-69.5703125" y="-26" width="139.140625" height="52"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-41.5703125, -12)"><rect></rect><foreignObject width="83.140625" height="24"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>UNKNOWN</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault4-l4-flowchart-N-13" data-look="classic" transform="translate(868.296875, 169)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-98.25" y="-38" width="196.5" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-70.25, -24)"><rect></rect><foreignObject width="140.5" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>nothing destructive<br/>wait · retry · ask</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault4-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault4-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p>The liveness check also became <strong>three-valued</strong>. It previously returned yes/no, so a provider whose socket was down could only answer “no” — meaning dead — when the honest answer was “I can’t see”.</p>
+
+      <h2>5 · What changed</h2>
+      <table>
+        <thead><tr><th>#</th><th>Change</th><th>Prevents</th></tr></thead>
+        <tbody>
+          <tr><td>1</td><td>Reattach binds, never creates</td><td>Ghost panes</td></tr>
+          <tr><td>2</td><td>Leases identified by pane</td><td>2 → 19 → 20 growth</td></tr>
+          <tr><td>3</td><td>Heal already-corrupted lease data</td><td>Existing installs stuck at 20</td></tr>
+          <tr><td>4</td><td>“Needs re-establishing” ≠ “expired”</td><td>Duplicate agent resume</td></tr>
+          <tr><td>5</td><td>Liveness can answer “unknown”</td><td>Live shells declared dead</td></tr>
+          <tr><td>6</td><td>One PTY’s failure can’t drop the shared channel</td><td>One bad pane killing every session on a host</td></tr>
+        </tbody>
+      </table>
+      <figure>
+        <div class="bar"><span>Change 6 — blast radius</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark5" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 2007.875 162" role="graphics-document document" aria-roledescription="d5-flowchart-v2"><style>#gdark5{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark5 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark5 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark5 .error-icon{fill:#a44141;}#gdark5 .error-text{fill:#ddd;stroke:#ddd;}#gdark5 .edge-thickness-normal{stroke-width:1px;}#gdark5 .edge-thickness-thick{stroke-width:3.5px;}#gdark5 .edge-pattern-solid{stroke-dasharray:0;}#gdark5 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark5 .edge-pattern-dashed{stroke-dasharray:3;}#gdark5 .edge-pattern-dotted{stroke-dasharray:2;}#gdark5 .marker{fill:lightgrey;stroke:lightgrey;}#gdark5 .marker.cross{stroke:lightgrey;}#gdark5 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark5 p{margin:0;}#gdark5 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark5 .cluster-label text{fill:#F9FFFE;}#gdark5 .cluster-label span{color:#F9FFFE;}#gdark5 .cluster-label span p{background-color:transparent;}#gdark5 .label text,#gdark5 span{fill:#ccc;color:#ccc;}#gdark5 .node rect,#gdark5 .node circle,#gdark5 .node ellipse,#gdark5 .node polygon,#gdark5 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark5 .rough-node .label text,#gdark5 .node .label text,#gdark5 .image-shape .label,#gdark5 .icon-shape .label{text-anchor:middle;}#gdark5 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark5 .rough-node .label,#gdark5 .node .label,#gdark5 .image-shape .label,#gdark5 .icon-shape .label{text-align:center;}#gdark5 .node.clickable{cursor:pointer;}#gdark5 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark5 .arrowheadPath{fill:lightgrey;}#gdark5 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark5 .d5-flowchart-link{stroke:lightgrey;fill:none;}#gdark5 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark5 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark5 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark5 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark5 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark5 .cluster text{fill:#F9FFFE;}#gdark5 .cluster span{color:#F9FFFE;}#gdark5 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark5 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark5 rect.text{fill:none;stroke-width:0;}#gdark5 .icon-shape,#gdark5 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark5 .icon-shape p,#gdark5 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark5 .icon-shape .label rect,#gdark5 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark5 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark5 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark5 .node .neo-node{stroke:#ccc;}#gdark5 [data-look="neo"].node rect,#gdark5 [data-look="neo"].cluster rect,#gdark5 [data-look="neo"].node polygon{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark5 [data-look="neo"].node path{stroke:url(#gdark5-gradient);stroke-width:1px;}#gdark5 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark5 [data-look="neo"].node circle{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark5 [data-look="neo"].icon-shape .icon{fill:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark5-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark5 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark5_d5-flowchart-v2-pointEnd" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointStart" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointEnd-margin" class="marker d5-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-pointStart-margin" class="marker d5-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark5_d5-flowchart-v2-circleEnd" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleStart" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleEnd-margin" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-circleStart-margin" class="marker d5-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark5_d5-flowchart-v2-crossEnd" class="marker cross d5-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossStart" class="marker cross d5-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossEnd-margin" class="marker cross d5-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark5_d5-flowchart-v2-crossStart-margin" class="marker cross d5-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"></g><g class="edgeLabels"></g><g class="nodes"><g class="root" transform="translate(0, 0)"><g class="clusters"><g class="cluster " id="gdark5-AFTER" data-look="classic"><rect style="" x="8" y="8" width="831.21875" height="146"></rect><g class="cluster-label " transform="translate(406.6171875, 8)"><foreignObject width="33.984375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>after</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M258.031,81L264.281,81C270.531,81,283.031,81,294.865,81C306.698,81,317.865,81,323.448,81L329.031,81" id="gdark5-L_Y1_Y2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Y1_Y2_0" data-points="W3sieCI6MjU4LjAzMTI1LCJ5Ijo4MX0seyJ4IjoyOTUuNTMxMjUsInkiOjgxfSx7IngiOjMzMy4wMzEyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path><path d="M509.531,81L515.781,81C522.031,81,534.531,81,546.365,81C558.198,81,569.365,81,574.948,81L580.531,81" id="gdark5-L_Y2_Y3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Y2_Y3_0" data-points="W3sieCI6NTA5LjUzMTI1LCJ5Ijo4MX0seyJ4Ijo1NDcuMDMxMjUsInkiOjgxfSx7IngiOjU4NC41MzEyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_Y1_Y2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Y2_Y3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark5-d5-flowchart-Y1-4" data-look="classic" transform="translate(151.765625, 81)"><rect class="basic label-container" style="" x="-106.265625" y="-38" width="212.53125" height="76"></rect><g class="label" style="" transform="translate(-78.265625, -24)"><rect></rect><foreignObject width="156.53125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pane 3 can't re-prove<br/>its output stream</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-Y2-5" data-look="classic" transform="translate(421.28125, 81)"><rect class="basic label-container" style="" x="-88.25" y="-26" width="176.5" height="52"></rect><g class="label" style="" transform="translate(-60.25, -12)"><rect></rect><foreignObject width="120.5" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>park pane 3 only</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-Y3-6" data-look="classic" transform="translate(693.125, 81)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-108.59375" y="-38" width="217.1875" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-80.59375, -24)"><rect></rect><foreignObject width="161.1875" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>its shell keeps running<br/>siblings untouched</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(881.21875, 0)"><g class="clusters"><g class="cluster " id="gdark5-BEFORE" data-look="classic"><rect style="" x="8" y="8" width="1110.65625" height="146"></rect><g class="cluster-label " transform="translate(539.8359375, 8)"><foreignObject width="46.984375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>before</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M258.031,81L264.281,81C270.531,81,283.031,81,294.865,81C306.698,81,317.865,81,323.448,81L329.031,81" id="gdark5-L_X1_X2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_X1_X2_0" data-points="W3sieCI6MjU4LjAzMTI1LCJ5Ijo4MX0seyJ4IjoyOTUuNTMxMjUsInkiOjgxfSx7IngiOjMzMy4wMzEyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path><path d="M531.578,81L537.828,81C544.078,81,556.578,81,568.411,81C580.245,81,591.411,81,596.995,81L602.578,81" id="gdark5-L_X2_X3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_X2_X3_0" data-points="W3sieCI6NTMxLjU3ODEyNSwieSI6ODF9LHsieCI6NTY5LjA3ODEyNSwieSI6ODF9LHsieCI6NjA2LjU3ODEyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path><path d="M779.25,81L785.5,81C791.75,81,804.25,81,816.083,81C827.917,81,839.083,81,844.667,81L850.25,81" id="gdark5-L_X3_X4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_X3_X4_0" data-points="W3sieCI6Nzc5LjI1LCJ5Ijo4MX0seyJ4Ijo4MTYuNzUsInkiOjgxfSx7IngiOjg1NC4yNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdark5_d5-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_X1_X2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_X2_X3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_X3_X4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark5-d5-flowchart-X1-0" data-look="classic" transform="translate(151.765625, 81)"><rect class="basic label-container" style="" x="-106.265625" y="-38" width="212.53125" height="76"></rect><g class="label" style="" transform="translate(-78.265625, -24)"><rect></rect><foreignObject width="156.53125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pane 3 can't re-prove<br/>its output stream</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-X2-1" data-look="classic" transform="translate(432.3046875, 81)"><rect class="basic label-container" style="" x="-99.2734375" y="-26" width="198.546875" height="52"></rect><g class="label" style="" transform="translate(-71.2734375, -12)"><rect></rect><foreignObject width="142.546875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>give up after N tries</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-X3-2" data-look="classic" transform="translate(692.9140625, 81)"><rect class="basic label-container" style="" x="-86.3359375" y="-38" width="172.671875" height="76"></rect><g class="label" style="" transform="translate(-58.3359375, -24)"><rect></rect><foreignObject width="116.671875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>drop the whole<br/>host connection</p></span></div></foreignObject></g></g><g class="node default  " id="gdark5-d5-flowchart-X4-3" data-look="classic" transform="translate(967.703125, 81)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-113.453125" y="-38" width="226.90625" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-85.453125, -24)"><rect></rect><foreignObject width="170.90625" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>every pane, file transfer<br/>and git command dies</p></span></div></foreignObject></g></g></g></g></g></g></g><defs><filter id="gdark5-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark5-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark5-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault5" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 2007.875 162" role="graphics-document document" aria-roledescription="l5-flowchart-v2"><style>#gdefault5{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault5 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault5 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault5 .error-icon{fill:#552222;}#gdefault5 .error-text{fill:#552222;stroke:#552222;}#gdefault5 .edge-thickness-normal{stroke-width:1px;}#gdefault5 .edge-thickness-thick{stroke-width:3.5px;}#gdefault5 .edge-pattern-solid{stroke-dasharray:0;}#gdefault5 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault5 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault5 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault5 .marker{fill:#333333;stroke:#333333;}#gdefault5 .marker.cross{stroke:#333333;}#gdefault5 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault5 p{margin:0;}#gdefault5 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault5 .cluster-label text{fill:#333;}#gdefault5 .cluster-label span{color:#333;}#gdefault5 .cluster-label span p{background-color:transparent;}#gdefault5 .label text,#gdefault5 span{fill:#333;color:#333;}#gdefault5 .node rect,#gdefault5 .node circle,#gdefault5 .node ellipse,#gdefault5 .node polygon,#gdefault5 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault5 .rough-node .label text,#gdefault5 .node .label text,#gdefault5 .image-shape .label,#gdefault5 .icon-shape .label{text-anchor:middle;}#gdefault5 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault5 .rough-node .label,#gdefault5 .node .label,#gdefault5 .image-shape .label,#gdefault5 .icon-shape .label{text-align:center;}#gdefault5 .node.clickable{cursor:pointer;}#gdefault5 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault5 .arrowheadPath{fill:#333333;}#gdefault5 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault5 .l5-flowchart-link{stroke:#333333;fill:none;}#gdefault5 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault5 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault5 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault5 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault5 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault5 .cluster text{fill:#333;}#gdefault5 .cluster span{color:#333;}#gdefault5 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault5 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault5 rect.text{fill:none;stroke-width:0;}#gdefault5 .icon-shape,#gdefault5 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault5 .icon-shape p,#gdefault5 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault5 .icon-shape .label rect,#gdefault5 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault5 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault5 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault5 .node .neo-node{stroke:#9370DB;}#gdefault5 [data-look="neo"].node rect,#gdefault5 [data-look="neo"].cluster rect,#gdefault5 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault5 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault5 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault5 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault5 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault5 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault5_l5-flowchart-v2-pointEnd" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointStart" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointEnd-margin" class="marker l5-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-pointStart-margin" class="marker l5-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault5_l5-flowchart-v2-circleEnd" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleStart" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleEnd-margin" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-circleStart-margin" class="marker l5-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault5_l5-flowchart-v2-crossEnd" class="marker cross l5-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossStart" class="marker cross l5-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossEnd-margin" class="marker cross l5-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault5_l5-flowchart-v2-crossStart-margin" class="marker cross l5-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"></g><g class="edgeLabels"></g><g class="nodes"><g class="root" transform="translate(0, 0)"><g class="clusters"><g class="cluster " id="gdefault5-AFTER" data-look="classic"><rect style="" x="8" y="8" width="831.21875" height="146"></rect><g class="cluster-label " transform="translate(406.6171875, 8)"><foreignObject width="33.984375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>after</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M258.031,81L264.281,81C270.531,81,283.031,81,294.865,81C306.698,81,317.865,81,323.448,81L329.031,81" id="gdefault5-L_Y1_Y2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Y1_Y2_0" data-points="W3sieCI6MjU4LjAzMTI1LCJ5Ijo4MX0seyJ4IjoyOTUuNTMxMjUsInkiOjgxfSx7IngiOjMzMy4wMzEyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path><path d="M509.531,81L515.781,81C522.031,81,534.531,81,546.365,81C558.198,81,569.365,81,574.948,81L580.531,81" id="gdefault5-L_Y2_Y3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Y2_Y3_0" data-points="W3sieCI6NTA5LjUzMTI1LCJ5Ijo4MX0seyJ4Ijo1NDcuMDMxMjUsInkiOjgxfSx7IngiOjU4NC41MzEyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_Y1_Y2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_Y2_Y3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault5-l5-flowchart-Y1-4" data-look="classic" transform="translate(151.765625, 81)"><rect class="basic label-container" style="" x="-106.265625" y="-38" width="212.53125" height="76"></rect><g class="label" style="" transform="translate(-78.265625, -24)"><rect></rect><foreignObject width="156.53125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pane 3 can't re-prove<br/>its output stream</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-Y2-5" data-look="classic" transform="translate(421.28125, 81)"><rect class="basic label-container" style="" x="-88.25" y="-26" width="176.5" height="52"></rect><g class="label" style="" transform="translate(-60.25, -12)"><rect></rect><foreignObject width="120.5" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>park pane 3 only</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-Y3-6" data-look="classic" transform="translate(693.125, 81)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-108.59375" y="-38" width="217.1875" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-80.59375, -24)"><rect></rect><foreignObject width="161.1875" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>its shell keeps running<br/>siblings untouched</p></span></div></foreignObject></g></g></g></g><g class="root" transform="translate(881.21875, 0)"><g class="clusters"><g class="cluster " id="gdefault5-BEFORE" data-look="classic"><rect style="" x="8" y="8" width="1110.65625" height="146"></rect><g class="cluster-label " transform="translate(539.8359375, 8)"><foreignObject width="46.984375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5;"><span class="nodeLabel "><p>before</p></span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M258.031,81L264.281,81C270.531,81,283.031,81,294.865,81C306.698,81,317.865,81,323.448,81L329.031,81" id="gdefault5-L_X1_X2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_X1_X2_0" data-points="W3sieCI6MjU4LjAzMTI1LCJ5Ijo4MX0seyJ4IjoyOTUuNTMxMjUsInkiOjgxfSx7IngiOjMzMy4wMzEyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path><path d="M531.578,81L537.828,81C544.078,81,556.578,81,568.411,81C580.245,81,591.411,81,596.995,81L602.578,81" id="gdefault5-L_X2_X3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_X2_X3_0" data-points="W3sieCI6NTMxLjU3ODEyNSwieSI6ODF9LHsieCI6NTY5LjA3ODEyNSwieSI6ODF9LHsieCI6NjA2LjU3ODEyNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path><path d="M779.25,81L785.5,81C791.75,81,804.25,81,816.083,81C827.917,81,839.083,81,844.667,81L850.25,81" id="gdefault5-L_X3_X4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l5-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_X3_X4_0" data-points="W3sieCI6Nzc5LjI1LCJ5Ijo4MX0seyJ4Ijo4MTYuNzUsInkiOjgxfSx7IngiOjg1NC4yNSwieSI6ODF9XQ==" data-look="classic" marker-end="url(#gdefault5_l5-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_X1_X2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_X2_X3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_X3_X4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault5-l5-flowchart-X1-0" data-look="classic" transform="translate(151.765625, 81)"><rect class="basic label-container" style="" x="-106.265625" y="-38" width="212.53125" height="76"></rect><g class="label" style="" transform="translate(-78.265625, -24)"><rect></rect><foreignObject width="156.53125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>pane 3 can't re-prove<br/>its output stream</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-X2-1" data-look="classic" transform="translate(432.3046875, 81)"><rect class="basic label-container" style="" x="-99.2734375" y="-26" width="198.546875" height="52"></rect><g class="label" style="" transform="translate(-71.2734375, -12)"><rect></rect><foreignObject width="142.546875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>give up after N tries</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-X3-2" data-look="classic" transform="translate(692.9140625, 81)"><rect class="basic label-container" style="" x="-86.3359375" y="-38" width="172.671875" height="76"></rect><g class="label" style="" transform="translate(-58.3359375, -24)"><rect></rect><foreignObject width="116.671875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>drop the whole<br/>host connection</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault5-l5-flowchart-X4-3" data-look="classic" transform="translate(967.703125, 81)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-113.453125" y="-38" width="226.90625" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-85.453125, -24)"><rect></rect><foreignObject width="170.90625" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>every pane, file transfer<br/>and git command dies</p></span></div></foreignObject></g></g></g></g></g></g></g><defs><filter id="gdefault5-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault5-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <div class="callout good">
+        <p><span class="k">No wire change</span></p>
+        <p>The keystroke guard adds nothing to the payload. Orca already keeps two lookup tables in lock-step, so when they disagree that <em>is</em> proof the id is stale — a purely server-side check.</p>
+      </div>
+
+      <h2>6 · How we decide a test is worth trusting</h2>
+      <div class="callout bad">
+        <p><span class="k">This happened to us twice</span></p>
+        <p>An end-to-end test was reported as proving the reconnect fix. It passed with the fix <strong>and</strong> with it removed — retracted. Separately, a guard shipped with <strong>no production caller at all</strong>; every test stayed green because they called the capability directly.</p>
+      </div>
+      <figure>
+        <div class="bar"><span>The four-step proof</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark6" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 906.828125 242" role="graphics-document document" aria-roledescription="d6-flowchart-v2"><style>#gdark6{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark6 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark6 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark6 .error-icon{fill:#a44141;}#gdark6 .error-text{fill:#ddd;stroke:#ddd;}#gdark6 .edge-thickness-normal{stroke-width:1px;}#gdark6 .edge-thickness-thick{stroke-width:3.5px;}#gdark6 .edge-pattern-solid{stroke-dasharray:0;}#gdark6 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark6 .edge-pattern-dashed{stroke-dasharray:3;}#gdark6 .edge-pattern-dotted{stroke-dasharray:2;}#gdark6 .marker{fill:lightgrey;stroke:lightgrey;}#gdark6 .marker.cross{stroke:lightgrey;}#gdark6 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark6 p{margin:0;}#gdark6 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark6 .cluster-label text{fill:#F9FFFE;}#gdark6 .cluster-label span{color:#F9FFFE;}#gdark6 .cluster-label span p{background-color:transparent;}#gdark6 .label text,#gdark6 span{fill:#ccc;color:#ccc;}#gdark6 .node rect,#gdark6 .node circle,#gdark6 .node ellipse,#gdark6 .node polygon,#gdark6 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark6 .rough-node .label text,#gdark6 .node .label text,#gdark6 .image-shape .label,#gdark6 .icon-shape .label{text-anchor:middle;}#gdark6 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark6 .rough-node .label,#gdark6 .node .label,#gdark6 .image-shape .label,#gdark6 .icon-shape .label{text-align:center;}#gdark6 .node.clickable{cursor:pointer;}#gdark6 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark6 .arrowheadPath{fill:lightgrey;}#gdark6 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark6 .d6-flowchart-link{stroke:lightgrey;fill:none;}#gdark6 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark6 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark6 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark6 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark6 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark6 .cluster text{fill:#F9FFFE;}#gdark6 .cluster span{color:#F9FFFE;}#gdark6 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark6 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark6 rect.text{fill:none;stroke-width:0;}#gdark6 .icon-shape,#gdark6 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark6 .icon-shape p,#gdark6 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark6 .icon-shape .label rect,#gdark6 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark6 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark6 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark6 .node .neo-node{stroke:#ccc;}#gdark6 [data-look="neo"].node rect,#gdark6 [data-look="neo"].cluster rect,#gdark6 [data-look="neo"].node polygon{stroke:url(#gdark6-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark6 [data-look="neo"].node path{stroke:url(#gdark6-gradient);stroke-width:1px;}#gdark6 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark6 [data-look="neo"].node circle{stroke:url(#gdark6-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark6 [data-look="neo"].icon-shape .icon{fill:url(#gdark6-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark6-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark6 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark6_d6-flowchart-v2-pointEnd" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-pointStart" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-pointEnd-margin" class="marker d6-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-pointStart-margin" class="marker d6-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark6_d6-flowchart-v2-circleEnd" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark6_d6-flowchart-v2-circleStart" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark6_d6-flowchart-v2-circleEnd-margin" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark6_d6-flowchart-v2-circleStart-margin" class="marker d6-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark6_d6-flowchart-v2-crossEnd" class="marker cross d6-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-crossStart" class="marker cross d6-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark6_d6-flowchart-v2-crossEnd-margin" class="marker cross d6-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark6_d6-flowchart-v2-crossStart-margin" class="marker cross d6-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M121.078,115L125.245,115C129.411,115,137.745,115,145.411,115C153.078,115,160.078,115,163.578,115L167.078,115" id="gdark6-L_S1_S2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S1_S2_0" data-points="W3sieCI6MTIxLjA3ODEyNSwieSI6MTE1fSx7IngiOjE0Ni4wNzgxMjUsInkiOjExNX0seyJ4IjoxNzEuMDc4MTI1LCJ5IjoxMTV9XQ==" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path><path d="M363.031,115L367.198,115C371.365,115,379.698,115,387.365,115C395.031,115,402.031,115,405.531,115L409.031,115" id="gdark6-L_S2_S3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S2_S3_0" data-points="W3sieCI6MzYzLjAzMTI1LCJ5IjoxMTV9LHsieCI6Mzg4LjAzMTI1LCJ5IjoxMTV9LHsieCI6NDEzLjAzMTI1LCJ5IjoxMTV9XQ==" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path><path d="M568.938,77.861L580.083,72.551C591.229,67.241,613.521,56.62,639.25,51.31C664.979,46,694.146,46,708.729,46L723.313,46" id="gdark6-L_S3_S4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S3_S4_0" data-points="W3sieCI6NTY4LjkzNzUsInkiOjc3Ljg2MTA0MjE4MzYyMjgzfSx7IngiOjYzNS44MTI1LCJ5Ijo0Nn0seyJ4Ijo3MjcuMzEyNSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path><path d="M568.938,152.139L580.083,157.449C591.229,162.759,613.521,173.38,635.146,178.69C656.771,184,677.729,184,688.208,184L698.688,184" id="gdark6-L_S3_F_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid d6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S3_F_0" data-points="W3sieCI6NTY4LjkzNzUsInkiOjE1Mi4xMzg5NTc4MTYzNzcxN30seyJ4Ijo2MzUuODEyNSwieSI6MTg0fSx7IngiOjcwMi42ODc1LCJ5IjoxODR9XQ==" data-look="classic" marker-end="url(#gdark6_d6-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_S1_S2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_S2_S3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_S3_S4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(635.8125, 184)"><g class="label" data-id="L_S3_F_0" transform="translate(-41.875, -12)"><foreignObject width="83.75" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>stays green</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark6-d6-flowchart-S1-0" data-look="classic" transform="translate(64.5390625, 115)"><rect class="basic label-container" style="" x="-56.5390625" y="-38" width="113.078125" height="76"></rect><g class="label" style="" transform="translate(-28.5390625, -24)"><rect></rect><foreignObject width="57.078125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>1 · run it<br/><b>green</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-S2-1" data-look="classic" transform="translate(267.0546875, 115)"><rect class="basic label-container" style="" x="-95.9765625" y="-38" width="191.953125" height="76"></rect><g class="label" style="" transform="translate(-67.9765625, -24)"><rect></rect><foreignObject width="135.953125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>2 · delete a guard<br/>in production code</p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-S3-3" data-look="classic" transform="translate(490.984375, 115)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-77.953125" y="-38" width="155.90625" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-49.953125, -24)"><rect></rect><foreignObject width="99.90625" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>3 · run it<br/><b>MUST go red</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-S4-4" data-look="classic" transform="translate(800.7578125, 46)"><rect class="basic label-container" style="" x="-73.4453125" y="-38" width="146.890625" height="76"></rect><g class="label" style="" transform="translate(-45.4453125, -24)"><rect></rect><foreignObject width="90.890625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>4 · restore<br/><b>green again</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark6-d6-flowchart-F-6" data-look="classic" transform="translate(800.7578125, 184)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-98.0703125" y="-50" width="196.140625" height="100"></rect><g class="label" style="color:#fff !important" transform="translate(-70.0703125, -36)"><rect></rect><foreignObject width="140.140625" height="72"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>worthless<br/>say so — don't ship<br/>it as proof</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark6-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark6-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark6-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault6" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 906.828125 242" role="graphics-document document" aria-roledescription="l6-flowchart-v2"><style>#gdefault6{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault6 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault6 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault6 .error-icon{fill:#552222;}#gdefault6 .error-text{fill:#552222;stroke:#552222;}#gdefault6 .edge-thickness-normal{stroke-width:1px;}#gdefault6 .edge-thickness-thick{stroke-width:3.5px;}#gdefault6 .edge-pattern-solid{stroke-dasharray:0;}#gdefault6 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault6 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault6 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault6 .marker{fill:#333333;stroke:#333333;}#gdefault6 .marker.cross{stroke:#333333;}#gdefault6 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault6 p{margin:0;}#gdefault6 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault6 .cluster-label text{fill:#333;}#gdefault6 .cluster-label span{color:#333;}#gdefault6 .cluster-label span p{background-color:transparent;}#gdefault6 .label text,#gdefault6 span{fill:#333;color:#333;}#gdefault6 .node rect,#gdefault6 .node circle,#gdefault6 .node ellipse,#gdefault6 .node polygon,#gdefault6 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault6 .rough-node .label text,#gdefault6 .node .label text,#gdefault6 .image-shape .label,#gdefault6 .icon-shape .label{text-anchor:middle;}#gdefault6 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault6 .rough-node .label,#gdefault6 .node .label,#gdefault6 .image-shape .label,#gdefault6 .icon-shape .label{text-align:center;}#gdefault6 .node.clickable{cursor:pointer;}#gdefault6 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault6 .arrowheadPath{fill:#333333;}#gdefault6 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault6 .l6-flowchart-link{stroke:#333333;fill:none;}#gdefault6 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault6 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault6 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault6 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault6 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault6 .cluster text{fill:#333;}#gdefault6 .cluster span{color:#333;}#gdefault6 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault6 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault6 rect.text{fill:none;stroke-width:0;}#gdefault6 .icon-shape,#gdefault6 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault6 .icon-shape p,#gdefault6 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault6 .icon-shape .label rect,#gdefault6 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault6 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault6 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault6 .node .neo-node{stroke:#9370DB;}#gdefault6 [data-look="neo"].node rect,#gdefault6 [data-look="neo"].cluster rect,#gdefault6 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault6 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault6 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault6 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault6 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault6 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault6_l6-flowchart-v2-pointEnd" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-pointStart" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-pointEnd-margin" class="marker l6-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-pointStart-margin" class="marker l6-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault6_l6-flowchart-v2-circleEnd" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault6_l6-flowchart-v2-circleStart" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault6_l6-flowchart-v2-circleEnd-margin" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault6_l6-flowchart-v2-circleStart-margin" class="marker l6-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault6_l6-flowchart-v2-crossEnd" class="marker cross l6-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-crossStart" class="marker cross l6-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault6_l6-flowchart-v2-crossEnd-margin" class="marker cross l6-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault6_l6-flowchart-v2-crossStart-margin" class="marker cross l6-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M121.078,115L125.245,115C129.411,115,137.745,115,145.411,115C153.078,115,160.078,115,163.578,115L167.078,115" id="gdefault6-L_S1_S2_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S1_S2_0" data-points="W3sieCI6MTIxLjA3ODEyNSwieSI6MTE1fSx7IngiOjE0Ni4wNzgxMjUsInkiOjExNX0seyJ4IjoxNzEuMDc4MTI1LCJ5IjoxMTV9XQ==" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path><path d="M363.031,115L367.198,115C371.365,115,379.698,115,387.365,115C395.031,115,402.031,115,405.531,115L409.031,115" id="gdefault6-L_S2_S3_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S2_S3_0" data-points="W3sieCI6MzYzLjAzMTI1LCJ5IjoxMTV9LHsieCI6Mzg4LjAzMTI1LCJ5IjoxMTV9LHsieCI6NDEzLjAzMTI1LCJ5IjoxMTV9XQ==" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path><path d="M568.938,77.861L580.083,72.551C591.229,67.241,613.521,56.62,639.25,51.31C664.979,46,694.146,46,708.729,46L723.313,46" id="gdefault6-L_S3_S4_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S3_S4_0" data-points="W3sieCI6NTY4LjkzNzUsInkiOjc3Ljg2MTA0MjE4MzYyMjgzfSx7IngiOjYzNS44MTI1LCJ5Ijo0Nn0seyJ4Ijo3MjcuMzEyNSwieSI6NDZ9XQ==" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path><path d="M568.938,152.139L580.083,157.449C591.229,162.759,613.521,173.38,635.146,178.69C656.771,184,677.729,184,688.208,184L698.688,184" id="gdefault6-L_S3_F_0" class=" edge-thickness-normal edge-pattern-dotted edge-thickness-normal edge-pattern-solid l6-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_S3_F_0" data-points="W3sieCI6NTY4LjkzNzUsInkiOjE1Mi4xMzg5NTc4MTYzNzcxN30seyJ4Ijo2MzUuODEyNSwieSI6MTg0fSx7IngiOjcwMi42ODc1LCJ5IjoxODR9XQ==" data-look="classic" marker-end="url(#gdefault6_l6-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_S1_S2_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_S2_S3_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" data-id="L_S3_S4_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(635.8125, 184)"><g class="label" data-id="L_S3_F_0" transform="translate(-41.875, -12)"><foreignObject width="83.75" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>stays green</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault6-l6-flowchart-S1-0" data-look="classic" transform="translate(64.5390625, 115)"><rect class="basic label-container" style="" x="-56.5390625" y="-38" width="113.078125" height="76"></rect><g class="label" style="" transform="translate(-28.5390625, -24)"><rect></rect><foreignObject width="57.078125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>1 · run it<br/><b>green</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-S2-1" data-look="classic" transform="translate(267.0546875, 115)"><rect class="basic label-container" style="" x="-95.9765625" y="-38" width="191.953125" height="76"></rect><g class="label" style="" transform="translate(-67.9765625, -24)"><rect></rect><foreignObject width="135.953125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>2 · delete a guard<br/>in production code</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-S3-3" data-look="classic" transform="translate(490.984375, 115)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-77.953125" y="-38" width="155.90625" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-49.953125, -24)"><rect></rect><foreignObject width="99.90625" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>3 · run it<br/><b>MUST go red</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-S4-4" data-look="classic" transform="translate(800.7578125, 46)"><rect class="basic label-container" style="" x="-73.4453125" y="-38" width="146.890625" height="76"></rect><g class="label" style="" transform="translate(-45.4453125, -24)"><rect></rect><foreignObject width="90.890625" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>4 · restore<br/><b>green again</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault6-l6-flowchart-F-6" data-look="classic" transform="translate(800.7578125, 184)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-98.0703125" y="-50" width="196.140625" height="100"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-70.0703125, -36)"><rect></rect><foreignObject width="140.140625" height="72"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>worthless<br/>say so — don't ship<br/>it as proof</p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault6-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault6-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <p><strong>Delete a real guard, not the test.</strong> <strong>Prefer one clause at a time</strong> — a mutation reddening exactly one claim proves the claims independently. <strong>Watch it fail yourself</strong>: six of twelve oracles were personally re-verified, and two of those re-checks overturned the original claim.</p>
+
+      <h2>7 · Why “same id” is not good enough</h2>
+      <p class="lede">The most valuable lesson here. Break the quit path so it destroys shells instead of detaching, then restart:</p>
+      <pre class="term"><span class="g">tab id    same ✓</span>
+<span class="g">pane id   same ✓</span>
+<span class="g">pty id    same ✓</span>
+<span class="r">OS pid    13756 → 8852   ✗</span>
+<span class="r">start     02:01:29.337 → 02:01:34.728   ✗</span>
+
+<span class="d">Every id-only restart test stays green here.
+Your shell is gone.</span></pre>
+      <figure>
+        <div class="bar"><span>Proving the process really survived</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark7" xmlns="http://www.w3.org/2000/svg" style="" viewBox="-50 -10 966 633" role="graphics-document document" aria-roledescription="sequence"><g><rect x="716" y="547" fill="#eaeaea" stroke="#666" width="150" height="65" name="K" rx="3" ry="3" class="actor actor-bottom"></rect><text x="791" y="579.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="791" dy="0">Kernel</tspan></text></g><g><rect x="516" y="547" fill="#eaeaea" stroke="#666" width="150" height="65" name="S" rx="3" ry="3" class="actor actor-bottom"></rect><text x="591" y="579.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="591" dy="0">Shell</tspan></text></g><g><rect x="254" y="547" fill="#eaeaea" stroke="#666" width="150" height="65" name="A" rx="3" ry="3" class="actor actor-bottom"></rect><text x="329" y="579.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="329" dy="0">Orca</tspan></text></g><g><rect x="0" y="547" fill="#eaeaea" stroke="#666" width="150" height="65" name="T" rx="3" ry="3" class="actor actor-bottom"></rect><text x="75" y="579.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="75" dy="0">Test</tspan></text></g><g><line id="actor3" x1="791" y1="65" x2="791" y2="547" class="actor-line 200" stroke-width="0.5px" stroke="#999" name="K" data-et="life-line" data-id="K"></line><g id="root-3" data-et="participant" data-type="participant" data-id="K"><rect x="716" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" name="K" rx="3" ry="3" class="actor actor-top"></rect><text x="791" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="791" dy="0">Kernel</tspan></text></g></g><g><line id="actor2" x1="591" y1="65" x2="591" y2="547" class="actor-line 200" stroke-width="0.5px" stroke="#999" name="S" data-et="life-line" data-id="S"></line><g id="root-2" data-et="participant" data-type="participant" data-id="S"><rect x="516" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" name="S" rx="3" ry="3" class="actor actor-top"></rect><text x="591" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="591" dy="0">Shell</tspan></text></g></g><g><line id="actor1" x1="329" y1="65" x2="329" y2="547" class="actor-line 200" stroke-width="0.5px" stroke="#999" name="A" data-et="life-line" data-id="A"></line><g id="root-1" data-et="participant" data-type="participant" data-id="A"><rect x="254" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" name="A" rx="3" ry="3" class="actor actor-top"></rect><text x="329" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="329" dy="0">Orca</tspan></text></g></g><g><line id="actor0" x1="75" y1="65" x2="75" y2="547" class="actor-line 200" stroke-width="0.5px" stroke="#999" name="T" data-et="life-line" data-id="T"></line><g id="root-0" data-et="participant" data-type="participant" data-id="T"><rect x="0" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" name="T" rx="3" ry="3" class="actor actor-top"></rect><text x="75" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="75" dy="0">Test</tspan></text></g></g><style>#gdark7{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark7 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark7 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark7 .error-icon{fill:#a44141;}#gdark7 .error-text{fill:#ddd;stroke:#ddd;}#gdark7 .edge-thickness-normal{stroke-width:1px;}#gdark7 .edge-thickness-thick{stroke-width:3.5px;}#gdark7 .edge-pattern-solid{stroke-dasharray:0;}#gdark7 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark7 .edge-pattern-dashed{stroke-dasharray:3;}#gdark7 .edge-pattern-dotted{stroke-dasharray:2;}#gdark7 .marker{fill:lightgrey;stroke:lightgrey;}#gdark7 .marker.cross{stroke:lightgrey;}#gdark7 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark7 p{margin:0;}#gdark7 .actor{stroke:#ccc;fill:#1f2020;stroke-width:1;}#gdark7 rect.actor.outer-path[data-look="neo"]{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark7 rect.note[data-look="neo"]{stroke:hsl(180, 0%, 18.3529411765%);fill:hsl(180, 1.5873015873%, 28.3529411765%);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark7 text.actor>tspan{fill:lightgrey;stroke:none;}#gdark7 .actor-line{stroke:#ccc;}#gdark7 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#gdark7 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:lightgrey;}#gdark7 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:lightgrey;}#gdark7 [id$="-arrowhead"] path{fill:lightgrey;stroke:lightgrey;}#gdark7 .sequenceNumber{fill:black;}#gdark7 [id$="-sequencenumber"]{fill:lightgrey;}#gdark7 [id$="-crosshead"] path{fill:lightgrey;stroke:lightgrey;}#gdark7 .messageText{fill:lightgrey;stroke:none;}#gdark7 .labelBox{stroke:#ccc;fill:#1f2020;filter:none;}#gdark7 .labelText,#gdark7 .labelText>tspan{fill:lightgrey;stroke:none;}#gdark7 .loopText,#gdark7 .loopText>tspan{fill:lightgrey;stroke:none;}#gdark7 .sectionTitle,#gdark7 .sectionTitle>tspan{fill:lightgrey;stroke:none;}#gdark7 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:#ccc;fill:#ccc;}#gdark7 .note{stroke:hsl(180, 0%, 18.3529411765%);fill:hsl(180, 1.5873015873%, 28.3529411765%);}#gdark7 .noteText,#gdark7 .noteText>tspan{fill:rgb(183.8476190475, 181.5523809523, 181.5523809523);stroke:none;font-weight:normal;}#gdark7 .activation0{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:#ccc;}#gdark7 .activation1{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:#ccc;}#gdark7 .activation2{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:#ccc;}#gdark7 .actorPopupMenu{position:absolute;}#gdark7 .actorPopupMenuPanel{position:absolute;fill:#1f2020;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#gdark7 .actor-man circle,#gdark7 line{fill:#1f2020;stroke-width:2px;}#gdark7 g rect.rect{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));stroke:#ccc;}#gdark7 .node .neo-node{stroke:#ccc;}#gdark7 [data-look="neo"].node rect,#gdark7 [data-look="neo"].cluster rect,#gdark7 [data-look="neo"].node polygon{stroke:url(#gdark7-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark7 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark7 [data-look="neo"].node path{stroke:url(#gdark7-gradient);stroke-width:1px;}#gdark7 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark7 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark7 [data-look="neo"].node circle{stroke:url(#gdark7-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark7 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark7 [data-look="neo"].icon-shape .icon{fill:url(#gdark7-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark7 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark7-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark7 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g></g><defs><symbol id="gdark7-computer" width="24" height="24"><path transform="scale(.5)" d="M2 2v13h20v-13h-20zm18 11h-16v-9h16v9zm-10.228 6l.466-1h3.524l.467 1h-4.457zm14.228 3h-24l2-6h2.104l-1.33 4h18.45l-1.297-4h2.073l2 6zm-5-10h-14v-7h14v7z"></path></symbol></defs><defs><symbol id="gdark7-database" fill-rule="evenodd" clip-rule="evenodd"><path transform="scale(.5)" d="M12.258.001l.256.004.255.005.253.008.251.01.249.012.247.015.246.016.242.019.241.02.239.023.236.024.233.027.231.028.229.031.225.032.223.034.22.036.217.038.214.04.211.041.208.043.205.045.201.046.198.048.194.05.191.051.187.053.183.054.18.056.175.057.172.059.168.06.163.061.16.063.155.064.15.066.074.033.073.033.071.034.07.034.069.035.068.035.067.035.066.035.064.036.064.036.062.036.06.036.06.037.058.037.058.037.055.038.055.038.053.038.052.038.051.039.05.039.048.039.047.039.045.04.044.04.043.04.041.04.04.041.039.041.037.041.036.041.034.041.033.042.032.042.03.042.029.042.027.042.026.043.024.043.023.043.021.043.02.043.018.044.017.043.015.044.013.044.012.044.011.045.009.044.007.045.006.045.004.045.002.045.001.045v17l-.001.045-.002.045-.004.045-.006.045-.007.045-.009.044-.011.045-.012.044-.013.044-.015.044-.017.043-.018.044-.02.043-.021.043-.023.043-.024.043-.026.043-.027.042-.029.042-.03.042-.032.042-.033.042-.034.041-.036.041-.037.041-.039.041-.04.041-.041.04-.043.04-.044.04-.045.04-.047.039-.048.039-.05.039-.051.039-.052.038-.053.038-.055.038-.055.038-.058.037-.058.037-.06.037-.06.036-.062.036-.064.036-.064.036-.066.035-.067.035-.068.035-.069.035-.07.034-.071.034-.073.033-.074.033-.15.066-.155.064-.16.063-.163.061-.168.06-.172.059-.175.057-.18.056-.183.054-.187.053-.191.051-.194.05-.198.048-.201.046-.205.045-.208.043-.211.041-.214.04-.217.038-.22.036-.223.034-.225.032-.229.031-.231.028-.233.027-.236.024-.239.023-.241.02-.242.019-.246.016-.247.015-.249.012-.251.01-.253.008-.255.005-.256.004-.258.001-.258-.001-.256-.004-.255-.005-.253-.008-.251-.01-.249-.012-.247-.015-.245-.016-.243-.019-.241-.02-.238-.023-.236-.024-.234-.027-.231-.028-.228-.031-.226-.032-.223-.034-.22-.036-.217-.038-.214-.04-.211-.041-.208-.043-.204-.045-.201-.046-.198-.048-.195-.05-.19-.051-.187-.053-.184-.054-.179-.056-.176-.057-.172-.059-.167-.06-.164-.061-.159-.063-.155-.064-.151-.066-.074-.033-.072-.033-.072-.034-.07-.034-.069-.035-.068-.035-.067-.035-.066-.035-.064-.036-.063-.036-.062-.036-.061-.036-.06-.037-.058-.037-.057-.037-.056-.038-.055-.038-.053-.038-.052-.038-.051-.039-.049-.039-.049-.039-.046-.039-.046-.04-.044-.04-.043-.04-.041-.04-.04-.041-.039-.041-.037-.041-.036-.041-.034-.041-.033-.042-.032-.042-.03-.042-.029-.042-.027-.042-.026-.043-.024-.043-.023-.043-.021-.043-.02-.043-.018-.044-.017-.043-.015-.044-.013-.044-.012-.044-.011-.045-.009-.044-.007-.045-.006-.045-.004-.045-.002-.045-.001-.045v-17l.001-.045.002-.045.004-.045.006-.045.007-.045.009-.044.011-.045.012-.044.013-.044.015-.044.017-.043.018-.044.02-.043.021-.043.023-.043.024-.043.026-.043.027-.042.029-.042.03-.042.032-.042.033-.042.034-.041.036-.041.037-.041.039-.041.04-.041.041-.04.043-.04.044-.04.046-.04.046-.039.049-.039.049-.039.051-.039.052-.038.053-.038.055-.038.056-.038.057-.037.058-.037.06-.037.061-.036.062-.036.063-.036.064-.036.066-.035.067-.035.068-.035.069-.035.07-.034.072-.034.072-.033.074-.033.151-.066.155-.064.159-.063.164-.061.167-.06.172-.059.176-.057.179-.056.184-.054.187-.053.19-.051.195-.05.198-.048.201-.046.204-.045.208-.043.211-.041.214-.04.217-.038.22-.036.223-.034.226-.032.228-.031.231-.028.234-.027.236-.024.238-.023.241-.02.243-.019.245-.016.247-.015.249-.012.251-.01.253-.008.255-.005.256-.004.258-.001.258.001zm-9.258 20.499v.01l.001.021.003.021.004.022.005.021.006.022.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.023.018.024.019.024.021.024.022.025.023.024.024.025.052.049.056.05.061.051.066.051.07.051.075.051.079.052.084.052.088.052.092.052.097.052.102.051.105.052.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.048.144.049.147.047.152.047.155.047.16.045.163.045.167.043.171.043.176.041.178.041.183.039.187.039.19.037.194.035.197.035.202.033.204.031.209.03.212.029.216.027.219.025.222.024.226.021.23.02.233.018.236.016.24.015.243.012.246.01.249.008.253.005.256.004.259.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.021.224-.024.22-.026.216-.027.212-.028.21-.031.205-.031.202-.034.198-.034.194-.036.191-.037.187-.039.183-.04.179-.04.175-.042.172-.043.168-.044.163-.045.16-.046.155-.046.152-.047.148-.048.143-.049.139-.049.136-.05.131-.05.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.053.083-.051.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.05.023-.024.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.023.01-.022.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.127l-.077.055-.08.053-.083.054-.085.053-.087.052-.09.052-.093.051-.095.05-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.045-.118.044-.12.043-.122.042-.124.042-.126.041-.128.04-.13.04-.132.038-.134.038-.135.037-.138.037-.139.035-.142.035-.143.034-.144.033-.147.032-.148.031-.15.03-.151.03-.153.029-.154.027-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.01-.179.008-.179.008-.181.006-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.006-.179-.008-.179-.008-.178-.01-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.027-.153-.029-.151-.03-.15-.03-.148-.031-.146-.032-.145-.033-.143-.034-.141-.035-.14-.035-.137-.037-.136-.037-.134-.038-.132-.038-.13-.04-.128-.04-.126-.041-.124-.042-.122-.042-.12-.044-.117-.043-.116-.045-.113-.045-.112-.046-.109-.047-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.05-.093-.052-.09-.051-.087-.052-.085-.053-.083-.054-.08-.054-.077-.054v4.127zm0-5.654v.011l.001.021.003.021.004.021.005.022.006.022.007.022.009.022.01.022.011.023.012.023.013.023.015.024.016.023.017.024.018.024.019.024.021.024.022.024.023.025.024.024.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.052.11.051.114.051.119.052.123.05.127.051.131.05.135.049.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.044.171.042.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.022.23.02.233.018.236.016.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.012.241-.015.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.048.139-.05.136-.049.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.051.051-.049.023-.025.023-.024.021-.025.02-.024.019-.024.018-.024.017-.024.015-.023.014-.023.013-.024.012-.022.01-.023.01-.023.008-.022.006-.022.006-.022.004-.021.004-.022.001-.021.001-.021v-4.139l-.077.054-.08.054-.083.054-.085.052-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.044-.118.044-.12.044-.122.042-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.035-.143.033-.144.033-.147.033-.148.031-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.009-.179.009-.179.007-.181.007-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.007-.179-.007-.179-.009-.178-.009-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.031-.146-.033-.145-.033-.143-.033-.141-.035-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.04-.126-.041-.124-.042-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.051-.093-.051-.09-.051-.087-.053-.085-.052-.083-.054-.08-.054-.077-.054v4.139zm0-5.666v.011l.001.02.003.022.004.021.005.022.006.021.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.024.018.023.019.024.021.025.022.024.023.024.024.025.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.051.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.043.171.043.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.021.23.02.233.018.236.017.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.013.241-.014.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.049.139-.049.136-.049.131-.051.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.049.023-.025.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.022.01-.023.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.153l-.077.054-.08.054-.083.053-.085.053-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.048-.105.048-.106.048-.109.046-.111.046-.114.046-.115.044-.118.044-.12.043-.122.043-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.034-.143.034-.144.033-.147.032-.148.032-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.024-.161.024-.162.023-.163.023-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.01-.178.01-.179.009-.179.007-.181.006-.182.006-.182.004-.184.003-.184.001-.185.001-.185-.001-.184-.001-.184-.003-.182-.004-.182-.006-.181-.006-.179-.007-.179-.009-.178-.01-.176-.01-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.023-.162-.023-.161-.024-.159-.024-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.032-.146-.032-.145-.033-.143-.034-.141-.034-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.041-.126-.041-.124-.041-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.048-.105-.048-.102-.048-.1-.05-.097-.049-.095-.051-.093-.051-.09-.052-.087-.052-.085-.053-.083-.053-.08-.054-.077-.054v4.153zm8.74-8.179l-.257.004-.254.005-.25.008-.247.011-.244.012-.241.014-.237.016-.233.018-.231.021-.226.022-.224.023-.22.026-.216.027-.212.028-.21.031-.205.032-.202.033-.198.034-.194.036-.191.038-.187.038-.183.04-.179.041-.175.042-.172.043-.168.043-.163.045-.16.046-.155.046-.152.048-.148.048-.143.048-.139.049-.136.05-.131.05-.126.051-.123.051-.118.051-.114.052-.11.052-.106.052-.101.052-.096.052-.092.052-.088.052-.083.052-.079.052-.074.051-.07.052-.065.051-.06.05-.056.05-.051.05-.023.025-.023.024-.021.024-.02.025-.019.024-.018.024-.017.023-.015.024-.014.023-.013.023-.012.023-.01.023-.01.022-.008.022-.006.023-.006.021-.004.022-.004.021-.001.021-.001.021.001.021.001.021.004.021.004.022.006.021.006.023.008.022.01.022.01.023.012.023.013.023.014.023.015.024.017.023.018.024.019.024.02.025.021.024.023.024.023.025.051.05.056.05.06.05.065.051.07.052.074.051.079.052.083.052.088.052.092.052.096.052.101.052.106.052.11.052.114.052.118.051.123.051.126.051.131.05.136.05.139.049.143.048.148.048.152.048.155.046.16.046.163.045.168.043.172.043.175.042.179.041.183.04.187.038.191.038.194.036.198.034.202.033.205.032.21.031.212.028.216.027.22.026.224.023.226.022.231.021.233.018.237.016.241.014.244.012.247.011.25.008.254.005.257.004.26.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.022.224-.023.22-.026.216-.027.212-.028.21-.031.205-.032.202-.033.198-.034.194-.036.191-.038.187-.038.183-.04.179-.041.175-.042.172-.043.168-.043.163-.045.16-.046.155-.046.152-.048.148-.048.143-.048.139-.049.136-.05.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.05.051-.05.023-.025.023-.024.021-.024.02-.025.019-.024.018-.024.017-.023.015-.024.014-.023.013-.023.012-.023.01-.023.01-.022.008-.022.006-.023.006-.021.004-.022.004-.021.001-.021.001-.021-.001-.021-.001-.021-.004-.021-.004-.022-.006-.021-.006-.023-.008-.022-.01-.022-.01-.023-.012-.023-.013-.023-.014-.023-.015-.024-.017-.023-.018-.024-.019-.024-.02-.025-.021-.024-.023-.024-.023-.025-.051-.05-.056-.05-.06-.05-.065-.051-.07-.052-.074-.051-.079-.052-.083-.052-.088-.052-.092-.052-.096-.052-.101-.052-.106-.052-.11-.052-.114-.052-.118-.051-.123-.051-.126-.051-.131-.05-.136-.05-.139-.049-.143-.048-.148-.048-.152-.048-.155-.046-.16-.046-.163-.045-.168-.043-.172-.043-.175-.042-.179-.041-.183-.04-.187-.038-.191-.038-.194-.036-.198-.034-.202-.033-.205-.032-.21-.031-.212-.028-.216-.027-.22-.026-.224-.023-.226-.022-.231-.021-.233-.018-.237-.016-.241-.014-.244-.012-.247-.011-.25-.008-.254-.005-.257-.004-.26-.001-.26.001z"></path></symbol></defs><defs><symbol id="gdark7-clock" width="24" height="24"><path transform="scale(.5)" d="M12 2c5.514 0 10 4.486 10 10s-4.486 10-10 10-10-4.486-10-10 4.486-10 10-10zm0-2c-6.627 0-12 5.373-12 12s5.373 12 12 12 12-5.373 12-12-5.373-12-12-12zm5.848 12.459c.202.038.202.333.001.372-1.907.361-6.045 1.111-6.547 1.111-.719 0-1.301-.582-1.301-1.301 0-.512.77-5.447 1.125-7.445.034-.192.312-.181.343.014l.985 6.238 5.394 1.011z"></path></symbol></defs><defs><marker id="gdark7-arrowhead" refX="7.9" refY="5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M -1 0 L 10 5 L 0 10 z"></path></marker></defs><defs><marker id="gdark7-crosshead" markerWidth="15" markerHeight="8" orient="auto" refX="4" refY="4.5"><path fill="none" stroke="#000000" stroke-width="1pt" d="M 1,2 L 6,7 M 6,2 L 1,7" style="stroke-dasharray: 0, 0;"></path></marker></defs><defs><marker id="gdark7-filled-head" refX="15.5" refY="7" markerWidth="20" markerHeight="28" orient="auto"><path d="M 18,7 L9,13 L14,7 L9,1 Z"></path></marker></defs><defs><marker id="gdark7-sequencenumber" refX="15" refY="15" markerWidth="60" markerHeight="40" orient="auto"><circle cx="15" cy="15" r="6"></circle></marker></defs><defs><marker id="gdark7-solidTopArrowHead" refX="7.9" refY="7.25" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M 0 0 L 10 8 L 0 8 z"></path></marker></defs><defs><marker id="gdark7-solidBottomArrowHead" refX="7.9" refY="0.75" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M 0 0 L 10 0 L 0 8 z"></path></marker></defs><defs><marker id="gdark7-stickTopArrowHead" refX="7.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M 0 0 L 7 7" stroke="black" stroke-width="1.5" fill="none"></path></marker></defs><defs><marker id="gdark7-stickBottomArrowHead" refX="7.5" refY="0" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M 0 7 L 7 0" stroke="black" stroke-width="1.5" fill="none"></path></marker></defs><g data-et="note" data-id="i5"><rect x="50" y="305" fill="#EDF2AE" stroke="#666" width="766" height="38" class="note"></rect><text x="433" y="310" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="noteText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;"><tspan x="433">restart the app</tspan></text></g><text x="201" y="80" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">type "echo MARKER=$$"</text><line x1="76" y1="111" x2="325" y2="111" class="messageLine0" data-et="message" data-id="i0" data-from="T" data-to="A" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="fill: none;"></line><text x="459" y="126" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">through the real write path</text><line x1="330" y1="157" x2="587" y2="157" class="messageLine0" data-et="message" data-id="i1" data-from="A" data-to="S" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="fill: none;"></line><text x="335" y="172" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">MARKER=13756</text><line x1="590" y1="203" x2="79" y2="203" class="messageLine1" data-et="message" data-id="i2" data-from="S" data-to="T" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="stroke-dasharray: 3, 3; fill: none;"></line><text x="432" y="218" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">start time of 13756?</text><line x1="76" y1="249" x2="787" y2="249" class="messageLine0" data-et="message" data-id="i3" data-from="T" data-to="K" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="fill: none;"></line><text x="435" y="264" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">02:01:29.337</text><line x1="790" y1="295" x2="79" y2="295" class="messageLine1" data-et="message" data-id="i4" data-from="K" data-to="T" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="stroke-dasharray: 3, 3; fill: none;"></line><text x="332" y="358" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">ask again</text><line x1="76" y1="389" x2="587" y2="389" class="messageLine0" data-et="message" data-id="i6" data-from="T" data-to="S" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="fill: none;"></line><text x="335" y="404" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">MARKER=13756</text><line x1="590" y1="435" x2="79" y2="435" class="messageLine1" data-et="message" data-id="i7" data-from="S" data-to="T" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="stroke-dasharray: 3, 3; fill: none;"></line><text x="432" y="450" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">start time of 13756?</text><line x1="76" y1="481" x2="787" y2="481" class="messageLine0" data-et="message" data-id="i8" data-from="T" data-to="K" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="fill: none;"></line><text x="435" y="496" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">02:01:29.337 — same process ✓</text><line x1="790" y1="527" x2="79" y2="527" class="messageLine1" data-et="message" data-id="i9" data-from="K" data-to="T" stroke-width="2" stroke="none" marker-end="url(#gdark7-arrowhead)" style="stroke-dasharray: 3, 3; fill: none;"></line></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault7" xmlns="http://www.w3.org/2000/svg" style="" viewBox="-50 -10 966 633" role="graphics-document document" aria-roledescription="sequence"><g><rect x="716" y="547" fill="#eaeaea" stroke="#666" width="150" height="65" name="K" rx="3" ry="3" class="actor actor-bottom"></rect><text x="791" y="579.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="791" dy="0">Kernel</tspan></text></g><g><rect x="516" y="547" fill="#eaeaea" stroke="#666" width="150" height="65" name="S" rx="3" ry="3" class="actor actor-bottom"></rect><text x="591" y="579.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="591" dy="0">Shell</tspan></text></g><g><rect x="254" y="547" fill="#eaeaea" stroke="#666" width="150" height="65" name="A" rx="3" ry="3" class="actor actor-bottom"></rect><text x="329" y="579.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="329" dy="0">Orca</tspan></text></g><g><rect x="0" y="547" fill="#eaeaea" stroke="#666" width="150" height="65" name="T" rx="3" ry="3" class="actor actor-bottom"></rect><text x="75" y="579.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="75" dy="0">Test</tspan></text></g><g><line id="actor7" x1="791" y1="65" x2="791" y2="547" class="actor-line 200" stroke-width="0.5px" stroke="#999" name="K" data-et="life-line" data-id="K"></line><g id="root-7" data-et="participant" data-type="participant" data-id="K"><rect x="716" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" name="K" rx="3" ry="3" class="actor actor-top"></rect><text x="791" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="791" dy="0">Kernel</tspan></text></g></g><g><line id="actor6" x1="591" y1="65" x2="591" y2="547" class="actor-line 200" stroke-width="0.5px" stroke="#999" name="S" data-et="life-line" data-id="S"></line><g id="root-6" data-et="participant" data-type="participant" data-id="S"><rect x="516" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" name="S" rx="3" ry="3" class="actor actor-top"></rect><text x="591" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="591" dy="0">Shell</tspan></text></g></g><g><line id="actor5" x1="329" y1="65" x2="329" y2="547" class="actor-line 200" stroke-width="0.5px" stroke="#999" name="A" data-et="life-line" data-id="A"></line><g id="root-5" data-et="participant" data-type="participant" data-id="A"><rect x="254" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" name="A" rx="3" ry="3" class="actor actor-top"></rect><text x="329" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="329" dy="0">Orca</tspan></text></g></g><g><line id="actor4" x1="75" y1="65" x2="75" y2="547" class="actor-line 200" stroke-width="0.5px" stroke="#999" name="T" data-et="life-line" data-id="T"></line><g id="root-4" data-et="participant" data-type="participant" data-id="T"><rect x="0" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" name="T" rx="3" ry="3" class="actor actor-top"></rect><text x="75" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor actor-box" style="text-anchor: middle; font-size: 16px; font-weight: 400; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif;"><tspan x="75" dy="0">Test</tspan></text></g></g><style>#gdefault7{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault7 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault7 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault7 .error-icon{fill:#552222;}#gdefault7 .error-text{fill:#552222;stroke:#552222;}#gdefault7 .edge-thickness-normal{stroke-width:1px;}#gdefault7 .edge-thickness-thick{stroke-width:3.5px;}#gdefault7 .edge-pattern-solid{stroke-dasharray:0;}#gdefault7 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault7 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault7 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault7 .marker{fill:#333333;stroke:#333333;}#gdefault7 .marker.cross{stroke:#333333;}#gdefault7 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault7 p{margin:0;}#gdefault7 .actor{stroke:#9370DB;fill:#ECECFF;stroke-width:1;}#gdefault7 rect.actor.outer-path[data-look="neo"]{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault7 rect.note[data-look="neo"]{stroke:#aaaa33;fill:#fff5ad;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault7 text.actor>tspan{fill:black;stroke:none;}#gdefault7 .actor-line{stroke:#9370DB;}#gdefault7 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#gdefault7 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#gdefault7 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#gdefault7 [id$="-arrowhead"] path{fill:#333;stroke:#333;}#gdefault7 .sequenceNumber{fill:white;}#gdefault7 [id$="-sequencenumber"]{fill:#333;}#gdefault7 [id$="-crosshead"] path{fill:#333;stroke:#333;}#gdefault7 .messageText{fill:#333;stroke:none;}#gdefault7 .labelBox{stroke:#9370DB;fill:#ECECFF;filter:none;}#gdefault7 .labelText,#gdefault7 .labelText>tspan{fill:black;stroke:none;}#gdefault7 .loopText,#gdefault7 .loopText>tspan{fill:black;stroke:none;}#gdefault7 .sectionTitle,#gdefault7 .sectionTitle>tspan{fill:black;stroke:none;}#gdefault7 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:#9370DB;fill:#9370DB;}#gdefault7 .note{stroke:#aaaa33;fill:#fff5ad;}#gdefault7 .noteText,#gdefault7 .noteText>tspan{fill:black;stroke:none;font-weight:normal;}#gdefault7 .activation0{fill:#f4f4f4;stroke:#666;}#gdefault7 .activation1{fill:#f4f4f4;stroke:#666;}#gdefault7 .activation2{fill:#f4f4f4;stroke:#666;}#gdefault7 .actorPopupMenu{position:absolute;}#gdefault7 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#gdefault7 .actor-man circle,#gdefault7 line{fill:#ECECFF;stroke-width:2px;}#gdefault7 g rect.rect{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));stroke:#9370DB;}#gdefault7 .node .neo-node{stroke:#9370DB;}#gdefault7 [data-look="neo"].node rect,#gdefault7 [data-look="neo"].cluster rect,#gdefault7 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault7 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault7 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault7 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault7 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault7 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault7 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault7 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault7 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault7 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g></g><defs><symbol id="gdefault7-computer" width="24" height="24"><path transform="scale(.5)" d="M2 2v13h20v-13h-20zm18 11h-16v-9h16v9zm-10.228 6l.466-1h3.524l.467 1h-4.457zm14.228 3h-24l2-6h2.104l-1.33 4h18.45l-1.297-4h2.073l2 6zm-5-10h-14v-7h14v7z"></path></symbol></defs><defs><symbol id="gdefault7-database" fill-rule="evenodd" clip-rule="evenodd"><path transform="scale(.5)" d="M12.258.001l.256.004.255.005.253.008.251.01.249.012.247.015.246.016.242.019.241.02.239.023.236.024.233.027.231.028.229.031.225.032.223.034.22.036.217.038.214.04.211.041.208.043.205.045.201.046.198.048.194.05.191.051.187.053.183.054.18.056.175.057.172.059.168.06.163.061.16.063.155.064.15.066.074.033.073.033.071.034.07.034.069.035.068.035.067.035.066.035.064.036.064.036.062.036.06.036.06.037.058.037.058.037.055.038.055.038.053.038.052.038.051.039.05.039.048.039.047.039.045.04.044.04.043.04.041.04.04.041.039.041.037.041.036.041.034.041.033.042.032.042.03.042.029.042.027.042.026.043.024.043.023.043.021.043.02.043.018.044.017.043.015.044.013.044.012.044.011.045.009.044.007.045.006.045.004.045.002.045.001.045v17l-.001.045-.002.045-.004.045-.006.045-.007.045-.009.044-.011.045-.012.044-.013.044-.015.044-.017.043-.018.044-.02.043-.021.043-.023.043-.024.043-.026.043-.027.042-.029.042-.03.042-.032.042-.033.042-.034.041-.036.041-.037.041-.039.041-.04.041-.041.04-.043.04-.044.04-.045.04-.047.039-.048.039-.05.039-.051.039-.052.038-.053.038-.055.038-.055.038-.058.037-.058.037-.06.037-.06.036-.062.036-.064.036-.064.036-.066.035-.067.035-.068.035-.069.035-.07.034-.071.034-.073.033-.074.033-.15.066-.155.064-.16.063-.163.061-.168.06-.172.059-.175.057-.18.056-.183.054-.187.053-.191.051-.194.05-.198.048-.201.046-.205.045-.208.043-.211.041-.214.04-.217.038-.22.036-.223.034-.225.032-.229.031-.231.028-.233.027-.236.024-.239.023-.241.02-.242.019-.246.016-.247.015-.249.012-.251.01-.253.008-.255.005-.256.004-.258.001-.258-.001-.256-.004-.255-.005-.253-.008-.251-.01-.249-.012-.247-.015-.245-.016-.243-.019-.241-.02-.238-.023-.236-.024-.234-.027-.231-.028-.228-.031-.226-.032-.223-.034-.22-.036-.217-.038-.214-.04-.211-.041-.208-.043-.204-.045-.201-.046-.198-.048-.195-.05-.19-.051-.187-.053-.184-.054-.179-.056-.176-.057-.172-.059-.167-.06-.164-.061-.159-.063-.155-.064-.151-.066-.074-.033-.072-.033-.072-.034-.07-.034-.069-.035-.068-.035-.067-.035-.066-.035-.064-.036-.063-.036-.062-.036-.061-.036-.06-.037-.058-.037-.057-.037-.056-.038-.055-.038-.053-.038-.052-.038-.051-.039-.049-.039-.049-.039-.046-.039-.046-.04-.044-.04-.043-.04-.041-.04-.04-.041-.039-.041-.037-.041-.036-.041-.034-.041-.033-.042-.032-.042-.03-.042-.029-.042-.027-.042-.026-.043-.024-.043-.023-.043-.021-.043-.02-.043-.018-.044-.017-.043-.015-.044-.013-.044-.012-.044-.011-.045-.009-.044-.007-.045-.006-.045-.004-.045-.002-.045-.001-.045v-17l.001-.045.002-.045.004-.045.006-.045.007-.045.009-.044.011-.045.012-.044.013-.044.015-.044.017-.043.018-.044.02-.043.021-.043.023-.043.024-.043.026-.043.027-.042.029-.042.03-.042.032-.042.033-.042.034-.041.036-.041.037-.041.039-.041.04-.041.041-.04.043-.04.044-.04.046-.04.046-.039.049-.039.049-.039.051-.039.052-.038.053-.038.055-.038.056-.038.057-.037.058-.037.06-.037.061-.036.062-.036.063-.036.064-.036.066-.035.067-.035.068-.035.069-.035.07-.034.072-.034.072-.033.074-.033.151-.066.155-.064.159-.063.164-.061.167-.06.172-.059.176-.057.179-.056.184-.054.187-.053.19-.051.195-.05.198-.048.201-.046.204-.045.208-.043.211-.041.214-.04.217-.038.22-.036.223-.034.226-.032.228-.031.231-.028.234-.027.236-.024.238-.023.241-.02.243-.019.245-.016.247-.015.249-.012.251-.01.253-.008.255-.005.256-.004.258-.001.258.001zm-9.258 20.499v.01l.001.021.003.021.004.022.005.021.006.022.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.023.018.024.019.024.021.024.022.025.023.024.024.025.052.049.056.05.061.051.066.051.07.051.075.051.079.052.084.052.088.052.092.052.097.052.102.051.105.052.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.048.144.049.147.047.152.047.155.047.16.045.163.045.167.043.171.043.176.041.178.041.183.039.187.039.19.037.194.035.197.035.202.033.204.031.209.03.212.029.216.027.219.025.222.024.226.021.23.02.233.018.236.016.24.015.243.012.246.01.249.008.253.005.256.004.259.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.021.224-.024.22-.026.216-.027.212-.028.21-.031.205-.031.202-.034.198-.034.194-.036.191-.037.187-.039.183-.04.179-.04.175-.042.172-.043.168-.044.163-.045.16-.046.155-.046.152-.047.148-.048.143-.049.139-.049.136-.05.131-.05.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.053.083-.051.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.05.023-.024.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.023.01-.022.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.127l-.077.055-.08.053-.083.054-.085.053-.087.052-.09.052-.093.051-.095.05-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.045-.118.044-.12.043-.122.042-.124.042-.126.041-.128.04-.13.04-.132.038-.134.038-.135.037-.138.037-.139.035-.142.035-.143.034-.144.033-.147.032-.148.031-.15.03-.151.03-.153.029-.154.027-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.01-.179.008-.179.008-.181.006-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.006-.179-.008-.179-.008-.178-.01-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.027-.153-.029-.151-.03-.15-.03-.148-.031-.146-.032-.145-.033-.143-.034-.141-.035-.14-.035-.137-.037-.136-.037-.134-.038-.132-.038-.13-.04-.128-.04-.126-.041-.124-.042-.122-.042-.12-.044-.117-.043-.116-.045-.113-.045-.112-.046-.109-.047-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.05-.093-.052-.09-.051-.087-.052-.085-.053-.083-.054-.08-.054-.077-.054v4.127zm0-5.654v.011l.001.021.003.021.004.021.005.022.006.022.007.022.009.022.01.022.011.023.012.023.013.023.015.024.016.023.017.024.018.024.019.024.021.024.022.024.023.025.024.024.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.052.11.051.114.051.119.052.123.05.127.051.131.05.135.049.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.044.171.042.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.022.23.02.233.018.236.016.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.012.241-.015.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.048.139-.05.136-.049.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.051.051-.049.023-.025.023-.024.021-.025.02-.024.019-.024.018-.024.017-.024.015-.023.014-.023.013-.024.012-.022.01-.023.01-.023.008-.022.006-.022.006-.022.004-.021.004-.022.001-.021.001-.021v-4.139l-.077.054-.08.054-.083.054-.085.052-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.044-.118.044-.12.044-.122.042-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.035-.143.033-.144.033-.147.033-.148.031-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.009-.179.009-.179.007-.181.007-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.007-.179-.007-.179-.009-.178-.009-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.031-.146-.033-.145-.033-.143-.033-.141-.035-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.04-.126-.041-.124-.042-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.051-.093-.051-.09-.051-.087-.053-.085-.052-.083-.054-.08-.054-.077-.054v4.139zm0-5.666v.011l.001.02.003.022.004.021.005.022.006.021.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.024.018.023.019.024.021.025.022.024.023.024.024.025.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.051.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.043.171.043.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.021.23.02.233.018.236.017.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.013.241-.014.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.049.139-.049.136-.049.131-.051.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.049.023-.025.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.022.01-.023.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.153l-.077.054-.08.054-.083.053-.085.053-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.048-.105.048-.106.048-.109.046-.111.046-.114.046-.115.044-.118.044-.12.043-.122.043-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.034-.143.034-.144.033-.147.032-.148.032-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.024-.161.024-.162.023-.163.023-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.01-.178.01-.179.009-.179.007-.181.006-.182.006-.182.004-.184.003-.184.001-.185.001-.185-.001-.184-.001-.184-.003-.182-.004-.182-.006-.181-.006-.179-.007-.179-.009-.178-.01-.176-.01-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.023-.162-.023-.161-.024-.159-.024-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.032-.146-.032-.145-.033-.143-.034-.141-.034-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.041-.126-.041-.124-.041-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.048-.105-.048-.102-.048-.1-.05-.097-.049-.095-.051-.093-.051-.09-.052-.087-.052-.085-.053-.083-.053-.08-.054-.077-.054v4.153zm8.74-8.179l-.257.004-.254.005-.25.008-.247.011-.244.012-.241.014-.237.016-.233.018-.231.021-.226.022-.224.023-.22.026-.216.027-.212.028-.21.031-.205.032-.202.033-.198.034-.194.036-.191.038-.187.038-.183.04-.179.041-.175.042-.172.043-.168.043-.163.045-.16.046-.155.046-.152.048-.148.048-.143.048-.139.049-.136.05-.131.05-.126.051-.123.051-.118.051-.114.052-.11.052-.106.052-.101.052-.096.052-.092.052-.088.052-.083.052-.079.052-.074.051-.07.052-.065.051-.06.05-.056.05-.051.05-.023.025-.023.024-.021.024-.02.025-.019.024-.018.024-.017.023-.015.024-.014.023-.013.023-.012.023-.01.023-.01.022-.008.022-.006.023-.006.021-.004.022-.004.021-.001.021-.001.021.001.021.001.021.004.021.004.022.006.021.006.023.008.022.01.022.01.023.012.023.013.023.014.023.015.024.017.023.018.024.019.024.02.025.021.024.023.024.023.025.051.05.056.05.06.05.065.051.07.052.074.051.079.052.083.052.088.052.092.052.096.052.101.052.106.052.11.052.114.052.118.051.123.051.126.051.131.05.136.05.139.049.143.048.148.048.152.048.155.046.16.046.163.045.168.043.172.043.175.042.179.041.183.04.187.038.191.038.194.036.198.034.202.033.205.032.21.031.212.028.216.027.22.026.224.023.226.022.231.021.233.018.237.016.241.014.244.012.247.011.25.008.254.005.257.004.26.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.022.224-.023.22-.026.216-.027.212-.028.21-.031.205-.032.202-.033.198-.034.194-.036.191-.038.187-.038.183-.04.179-.041.175-.042.172-.043.168-.043.163-.045.16-.046.155-.046.152-.048.148-.048.143-.048.139-.049.136-.05.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.05.051-.05.023-.025.023-.024.021-.024.02-.025.019-.024.018-.024.017-.023.015-.024.014-.023.013-.023.012-.023.01-.023.01-.022.008-.022.006-.023.006-.021.004-.022.004-.021.001-.021.001-.021-.001-.021-.001-.021-.004-.021-.004-.022-.006-.021-.006-.023-.008-.022-.01-.022-.01-.023-.012-.023-.013-.023-.014-.023-.015-.024-.017-.023-.018-.024-.019-.024-.02-.025-.021-.024-.023-.024-.023-.025-.051-.05-.056-.05-.06-.05-.065-.051-.07-.052-.074-.051-.079-.052-.083-.052-.088-.052-.092-.052-.096-.052-.101-.052-.106-.052-.11-.052-.114-.052-.118-.051-.123-.051-.126-.051-.131-.05-.136-.05-.139-.049-.143-.048-.148-.048-.152-.048-.155-.046-.16-.046-.163-.045-.168-.043-.172-.043-.175-.042-.179-.041-.183-.04-.187-.038-.191-.038-.194-.036-.198-.034-.202-.033-.205-.032-.21-.031-.212-.028-.216-.027-.22-.026-.224-.023-.226-.022-.231-.021-.233-.018-.237-.016-.241-.014-.244-.012-.247-.011-.25-.008-.254-.005-.257-.004-.26-.001-.26.001z"></path></symbol></defs><defs><symbol id="gdefault7-clock" width="24" height="24"><path transform="scale(.5)" d="M12 2c5.514 0 10 4.486 10 10s-4.486 10-10 10-10-4.486-10-10 4.486-10 10-10zm0-2c-6.627 0-12 5.373-12 12s5.373 12 12 12 12-5.373 12-12-5.373-12-12-12zm5.848 12.459c.202.038.202.333.001.372-1.907.361-6.045 1.111-6.547 1.111-.719 0-1.301-.582-1.301-1.301 0-.512.77-5.447 1.125-7.445.034-.192.312-.181.343.014l.985 6.238 5.394 1.011z"></path></symbol></defs><defs><marker id="gdefault7-arrowhead" refX="7.9" refY="5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M -1 0 L 10 5 L 0 10 z"></path></marker></defs><defs><marker id="gdefault7-crosshead" markerWidth="15" markerHeight="8" orient="auto" refX="4" refY="4.5"><path fill="none" stroke="#000000" stroke-width="1pt" d="M 1,2 L 6,7 M 6,2 L 1,7" style="stroke-dasharray: 0, 0;"></path></marker></defs><defs><marker id="gdefault7-filled-head" refX="15.5" refY="7" markerWidth="20" markerHeight="28" orient="auto"><path d="M 18,7 L9,13 L14,7 L9,1 Z"></path></marker></defs><defs><marker id="gdefault7-sequencenumber" refX="15" refY="15" markerWidth="60" markerHeight="40" orient="auto"><circle cx="15" cy="15" r="6"></circle></marker></defs><defs><marker id="gdefault7-solidTopArrowHead" refX="7.9" refY="7.25" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M 0 0 L 10 8 L 0 8 z"></path></marker></defs><defs><marker id="gdefault7-solidBottomArrowHead" refX="7.9" refY="0.75" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M 0 0 L 10 0 L 0 8 z"></path></marker></defs><defs><marker id="gdefault7-stickTopArrowHead" refX="7.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M 0 0 L 7 7" stroke="black" stroke-width="1.5" fill="none"></path></marker></defs><defs><marker id="gdefault7-stickBottomArrowHead" refX="7.5" refY="0" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto-start-reverse"><path d="M 0 7 L 7 0" stroke="black" stroke-width="1.5" fill="none"></path></marker></defs><g data-et="note" data-id="i5"><rect x="50" y="305" fill="#EDF2AE" stroke="#666" width="766" height="38" class="note"></rect><text x="433" y="310" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="noteText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;"><tspan x="433">restart the app</tspan></text></g><text x="201" y="80" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">type "echo MARKER=$$"</text><line x1="76" y1="111" x2="325" y2="111" class="messageLine0" data-et="message" data-id="i0" data-from="T" data-to="A" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="fill: none;"></line><text x="459" y="126" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">through the real write path</text><line x1="330" y1="157" x2="587" y2="157" class="messageLine0" data-et="message" data-id="i1" data-from="A" data-to="S" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="fill: none;"></line><text x="335" y="172" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">MARKER=13756</text><line x1="590" y1="203" x2="79" y2="203" class="messageLine1" data-et="message" data-id="i2" data-from="S" data-to="T" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="stroke-dasharray: 3, 3; fill: none;"></line><text x="432" y="218" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">start time of 13756?</text><line x1="76" y1="249" x2="787" y2="249" class="messageLine0" data-et="message" data-id="i3" data-from="T" data-to="K" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="fill: none;"></line><text x="435" y="264" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">02:01:29.337</text><line x1="790" y1="295" x2="79" y2="295" class="messageLine1" data-et="message" data-id="i4" data-from="K" data-to="T" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="stroke-dasharray: 3, 3; fill: none;"></line><text x="332" y="358" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">ask again</text><line x1="76" y1="389" x2="587" y2="389" class="messageLine0" data-et="message" data-id="i6" data-from="T" data-to="S" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="fill: none;"></line><text x="335" y="404" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">MARKER=13756</text><line x1="590" y1="435" x2="79" y2="435" class="messageLine1" data-et="message" data-id="i7" data-from="S" data-to="T" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="stroke-dasharray: 3, 3; fill: none;"></line><text x="432" y="450" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">start time of 13756?</text><line x1="76" y1="481" x2="787" y2="481" class="messageLine0" data-et="message" data-id="i8" data-from="T" data-to="K" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="fill: none;"></line><text x="435" y="496" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Inter, system-ui, sans-serif; font-size: 16px; font-weight: 400;">02:01:29.337 — same process ✓</text><line x1="790" y1="527" x2="79" y2="527" class="messageLine1" data-et="message" data-id="i9" data-from="K" data-to="T" stroke-width="2" stroke="none" marker-end="url(#gdefault7-arrowhead)" style="stroke-dasharray: 3, 3; fill: none;"></line></svg></div></div>
+      </figure>
+
+      <h2>8 · Journey status</h2>
+      <table>
+        <thead><tr><th>#</th><th>Journey</th><th>State</th><th>Why</th></tr></thead>
+        <tbody>
+          <tr><td>1</td><td>Local restart — macOS · Linux · Windows</td><td><span class="pill ok">PROVEN</span></td><td>Clause-selective on all three platforms</td></tr>
+          <tr><td>2</td><td>Daemon &amp; physical WSL</td><td><span class="pill ok">PROVEN</span></td><td>Clause-selective on macOS, Linux, WSL2</td></tr>
+          <tr><td>4</td><td>Concurrent multi-host</td><td><span class="pill mid">BY CONSTRUCTION</span></td><td>A mux is per-host — dispose <em>cannot</em> cross hosts, so there is nothing to break</td></tr>
+          <tr><td>3</td><td>Lazy discovery</td><td><span class="pill mid">NO SELECTIVE MUTATION</span></td><td>Removing the real guard breaks setup before the clause is reached</td></tr>
+          <tr><td>6</td><td>Docker <code>MaxSessions=1</code></td><td><span class="pill mid">PARTIAL</span></td><td>2 clauses redden; a third survived <strong>four</strong> guard removals</td></tr>
+          <tr><td>12</td><td>Mixed versions</td><td><span class="pill no">WITHDRAWN</span></td><td>The token never crosses a version boundary in production</td></tr>
+          <tr><td>13</td><td>Performance &amp; scale</td><td><span class="pill inf">IN PROGRESS</span></td><td>1 of 10 dimensions measured; rest running</td></tr>
+          <tr><td>5, 10, 11</td><td>Device proof · identity reset · namespace admission</td><td><span class="pill no">NO SUBJECT</span></td><td>The code does not exist. No oracle is writable at any effort.</td></tr>
+        </tbody>
+      </table>
+      <figure>
+        <div class="bar"><span>Why a property may resist proof</span><span class="zoom">⤢ zoom</span></div>
+        <div class="dia"><div class="d-dark"><svg preserveAspectRatio="xMidYMid meet" id="gdark8" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 696.0625 500.875" role="graphics-document document" aria-roledescription="d8-flowchart-v2"><style>#gdark8{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdark8 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdark8 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdark8 .error-icon{fill:#a44141;}#gdark8 .error-text{fill:#ddd;stroke:#ddd;}#gdark8 .edge-thickness-normal{stroke-width:1px;}#gdark8 .edge-thickness-thick{stroke-width:3.5px;}#gdark8 .edge-pattern-solid{stroke-dasharray:0;}#gdark8 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdark8 .edge-pattern-dashed{stroke-dasharray:3;}#gdark8 .edge-pattern-dotted{stroke-dasharray:2;}#gdark8 .marker{fill:lightgrey;stroke:lightgrey;}#gdark8 .marker.cross{stroke:lightgrey;}#gdark8 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdark8 p{margin:0;}#gdark8 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#ccc;}#gdark8 .cluster-label text{fill:#F9FFFE;}#gdark8 .cluster-label span{color:#F9FFFE;}#gdark8 .cluster-label span p{background-color:transparent;}#gdark8 .label text,#gdark8 span{fill:#ccc;color:#ccc;}#gdark8 .node rect,#gdark8 .node circle,#gdark8 .node ellipse,#gdark8 .node polygon,#gdark8 .node path{fill:#1f2020;stroke:#ccc;stroke-width:1px;}#gdark8 .rough-node .label text,#gdark8 .node .label text,#gdark8 .image-shape .label,#gdark8 .icon-shape .label{text-anchor:middle;}#gdark8 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdark8 .rough-node .label,#gdark8 .node .label,#gdark8 .image-shape .label,#gdark8 .icon-shape .label{text-align:center;}#gdark8 .node.clickable{cursor:pointer;}#gdark8 .root .anchor path{fill:lightgrey!important;stroke-width:0;stroke:lightgrey;}#gdark8 .arrowheadPath{fill:lightgrey;}#gdark8 .edgePath .path{stroke:lightgrey;stroke-width:1px;}#gdark8 .d8-flowchart-link{stroke:lightgrey;fill:none;}#gdark8 .edgeLabel{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark8 .edgeLabel p{background-color:hsl(0, 0%, 34.4117647059%);}#gdark8 .edgeLabel rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark8 .labelBkg{background-color:rgba(87.75, 87.75, 87.75, 0.5);}#gdark8 .cluster rect{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:rgba(255, 255, 255, 0.25);stroke-width:1px;}#gdark8 .cluster text{fill:#F9FFFE;}#gdark8 .cluster span{color:#F9FFFE;}#gdark8 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(20, 1.5873015873%, 12.3529411765%);border:1px solid rgba(255, 255, 255, 0.25);border-radius:2px;pointer-events:none;z-index:100;}#gdark8 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#ccc;}#gdark8 rect.text{fill:none;stroke-width:0;}#gdark8 .icon-shape,#gdark8 .image-shape{background-color:hsl(0, 0%, 34.4117647059%);text-align:center;}#gdark8 .icon-shape p,#gdark8 .image-shape p{background-color:hsl(0, 0%, 34.4117647059%);padding:2px;}#gdark8 .icon-shape .label rect,#gdark8 .image-shape .label rect{opacity:0.5;background-color:hsl(0, 0%, 34.4117647059%);fill:hsl(0, 0%, 34.4117647059%);}#gdark8 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdark8 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdark8 .node .neo-node{stroke:#ccc;}#gdark8 [data-look="neo"].node rect,#gdark8 [data-look="neo"].cluster rect,#gdark8 [data-look="neo"].node polygon{stroke:url(#gdark8-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark8 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdark8 [data-look="neo"].node path{stroke:url(#gdark8-gradient);stroke-width:1px;}#gdark8 [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark8 [data-look="neo"].node .neo-line path{stroke:#ccc;filter:none;}#gdark8 [data-look="neo"].node circle{stroke:url(#gdark8-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark8 [data-look="neo"].node circle .state-start{fill:#000000;}#gdark8 [data-look="neo"].icon-shape .icon{fill:url(#gdark8-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark8 [data-look="neo"].icon-shape .icon-neo path{stroke:url(#gdark8-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#gdark8 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdark8_d8-flowchart-v2-pointEnd" class="marker d8-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark8_d8-flowchart-v2-pointStart" class="marker d8-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark8_d8-flowchart-v2-pointEnd-margin" class="marker d8-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark8_d8-flowchart-v2-pointStart-margin" class="marker d8-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdark8_d8-flowchart-v2-circleEnd" class="marker d8-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark8_d8-flowchart-v2-circleStart" class="marker d8-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark8_d8-flowchart-v2-circleEnd-margin" class="marker d8-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark8_d8-flowchart-v2-circleStart-margin" class="marker d8-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdark8_d8-flowchart-v2-crossEnd" class="marker cross d8-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark8_d8-flowchart-v2-crossStart" class="marker cross d8-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdark8_d8-flowchart-v2-crossEnd-margin" class="marker cross d8-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdark8_d8-flowchart-v2-crossStart-margin" class="marker cross d8-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M352.031,60L352.031,64.167C352.031,68.333,352.031,76.667,352.031,84.333C352.031,92,352.031,99,352.031,102.5L352.031,106" id="gdark8-L_P_Q_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d8-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_Q_0" data-points="W3sieCI6MzUyLjAzMTI1LCJ5Ijo2MH0seyJ4IjozNTIuMDMxMjUsInkiOjg1fSx7IngiOjM1Mi4wMzEyNSwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdark8_d8-flowchart-v2-pointEnd)"></path><path d="M286.419,253.263L254.138,272.365C221.858,291.467,157.296,329.671,125.015,356.273C92.734,382.875,92.734,397.875,92.734,405.375L92.734,412.875" id="gdark8-L_Q_M_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d8-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_M_0" data-points="W3sieCI6Mjg2LjQxOTI3NTI2OTczMzEzLCJ5IjoyNTMuMjYzMDI1MjY5NzMzMX0seyJ4Ijo5Mi43MzQzNzUsInkiOjM2Ny44NzV9LHsieCI6OTIuNzM0Mzc1LCJ5Ijo0MTYuODc1fV0=" data-look="classic" marker-end="url(#gdark8_d8-flowchart-v2-pointEnd)"></path><path d="M352.031,318.875L352.031,327.042C352.031,335.208,352.031,351.542,352.031,367.208C352.031,382.875,352.031,397.875,352.031,405.375L352.031,412.875" id="gdark8-L_Q_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d8-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_C_0" data-points="W3sieCI6MzUyLjAzMTI1LCJ5IjozMTguODc1fSx7IngiOjM1Mi4wMzEyNSwieSI6MzY3Ljg3NX0seyJ4IjozNTIuMDMxMjUsInkiOjQxNi44NzV9XQ==" data-look="classic" marker-end="url(#gdark8_d8-flowchart-v2-pointEnd)"></path><path d="M417.263,253.643L448.941,272.682C480.618,291.72,543.973,329.798,575.651,356.336C607.328,382.875,607.328,397.875,607.328,405.375L607.328,412.875" id="gdark8-L_Q_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid d8-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N_0" data-points="W3sieCI6NDE3LjI2MzI2NjIyNzY4NDU0LCJ5IjoyNTMuNjQyOTgzNzcyMzE1NDZ9LHsieCI6NjA3LjMyODEyNSwieSI6MzY3Ljg3NX0seyJ4Ijo2MDcuMzI4MTI1LCJ5Ijo0MTYuODc1fV0=" data-look="classic" marker-end="url(#gdark8_d8-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_P_Q_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(92.734375, 367.875)"><g class="label" data-id="L_Q_M_0" transform="translate(-12.4765625, -12)"><foreignObject width="24.953125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>yes</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(352.03125, 367.875)"><g class="label" data-id="L_Q_C_0" transform="translate(-45.6015625, -24)"><foreignObject width="91.203125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no — true by<br/>construction</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(607.328125, 367.875)"><g class="label" data-id="L_Q_N_0" transform="translate(-52.1484375, -12)"><foreignObject width="104.296875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no code exists</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdark8-d8-flowchart-P-0" data-look="classic" transform="translate(352.03125, 34)"><rect class="basic label-container" style="" x="-90.921875" y="-26" width="181.84375" height="52"></rect><g class="label" style="" transform="translate(-62.921875, -12)"><rect></rect><foreignObject width="125.84375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>property to prove</p></span></div></foreignObject></g></g><g class="node default  " id="gdark8-d8-flowchart-Q-1" data-look="classic" transform="translate(352.03125, 214.4375)"><polygon points="104.4375,0 208.875,-104.4375 104.4375,-208.875 0,-104.4375" class="label-container" transform="translate(-103.9375, 104.4375)"></polygon><g class="label" style="" transform="translate(-66.4375, -24)"><rect></rect><foreignObject width="132.875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>is a shipped guard<br/>protecting it?</p></span></div></foreignObject></g></g><g class="node default  " id="gdark8-d8-flowchart-M-3" data-look="classic" transform="translate(92.734375, 454.875)"><rect class="basic label-container" style="fill:#12341c !important;stroke:#3fb950 !important" x="-84.734375" y="-38" width="169.46875" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-56.734375, -24)"><rect></rect><foreignObject width="113.46875" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>remove it → red<br/><b>provable</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark8-d8-flowchart-C-5" data-look="classic" transform="translate(352.03125, 454.875)"><rect class="basic label-container" style="fill:#4a3a12 !important;stroke:#d29922 !important" x="-124.5625" y="-38" width="249.125" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-96.5625, -24)"><rect></rect><foreignObject width="193.125" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>nothing to remove<br/><b>not provable by mutation</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdark8-d8-flowchart-N-7" data-look="classic" transform="translate(607.328125, 454.875)"><rect class="basic label-container" style="fill:#5c2226 !important;stroke:#f85149 !important" x="-80.734375" y="-38" width="161.46875" height="76"></rect><g class="label" style="color:#fff !important" transform="translate(-52.734375, -24)"><rect></rect><foreignObject width="105.46875" height="48"><div style="color: rgb(255, 255, 255) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#fff !important" class="nodeLabel "><p>nothing to test<br/><b>not writable</b></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdark8-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><defs><filter id="gdark8-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#FFFFFF"></feDropShadow></filter></defs><linearGradient id="gdark8-gradient" gradientUnits="objectBoundingBox" x1="0%" y1="0%" x2="100%" y2="0%"><stop offset="0%" stop-color="#cccccc" stop-opacity="1"></stop><stop offset="100%" stop-color="hsl(180, 0%, 18.3529411765%)" stop-opacity="1"></stop></linearGradient></svg></div><div class="d-light"><svg preserveAspectRatio="xMidYMid meet" id="gdefault8" xmlns="http://www.w3.org/2000/svg" class="flowchart" style="" viewBox="0 0 696.0625 500.875" role="graphics-document document" aria-roledescription="l8-flowchart-v2"><style>#gdefault8{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#gdefault8 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#gdefault8 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#gdefault8 .error-icon{fill:#552222;}#gdefault8 .error-text{fill:#552222;stroke:#552222;}#gdefault8 .edge-thickness-normal{stroke-width:1px;}#gdefault8 .edge-thickness-thick{stroke-width:3.5px;}#gdefault8 .edge-pattern-solid{stroke-dasharray:0;}#gdefault8 .edge-thickness-invisible{stroke-width:0;fill:none;}#gdefault8 .edge-pattern-dashed{stroke-dasharray:3;}#gdefault8 .edge-pattern-dotted{stroke-dasharray:2;}#gdefault8 .marker{fill:#333333;stroke:#333333;}#gdefault8 .marker.cross{stroke:#333333;}#gdefault8 svg{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:16px;}#gdefault8 p{margin:0;}#gdefault8 .label{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;color:#333;}#gdefault8 .cluster-label text{fill:#333;}#gdefault8 .cluster-label span{color:#333;}#gdefault8 .cluster-label span p{background-color:transparent;}#gdefault8 .label text,#gdefault8 span{fill:#333;color:#333;}#gdefault8 .node rect,#gdefault8 .node circle,#gdefault8 .node ellipse,#gdefault8 .node polygon,#gdefault8 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#gdefault8 .rough-node .label text,#gdefault8 .node .label text,#gdefault8 .image-shape .label,#gdefault8 .icon-shape .label{text-anchor:middle;}#gdefault8 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#gdefault8 .rough-node .label,#gdefault8 .node .label,#gdefault8 .image-shape .label,#gdefault8 .icon-shape .label{text-align:center;}#gdefault8 .node.clickable{cursor:pointer;}#gdefault8 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#gdefault8 .arrowheadPath{fill:#333333;}#gdefault8 .edgePath .path{stroke:#333333;stroke-width:1px;}#gdefault8 .l8-flowchart-link{stroke:#333333;fill:none;}#gdefault8 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault8 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#gdefault8 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault8 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#gdefault8 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#gdefault8 .cluster text{fill:#333;}#gdefault8 .cluster span{color:#333;}#gdefault8 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#gdefault8 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#gdefault8 rect.text{fill:none;stroke-width:0;}#gdefault8 .icon-shape,#gdefault8 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#gdefault8 .icon-shape p,#gdefault8 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#gdefault8 .icon-shape .label rect,#gdefault8 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#gdefault8 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#gdefault8 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#gdefault8 .node .neo-node{stroke:#9370DB;}#gdefault8 [data-look="neo"].node rect,#gdefault8 [data-look="neo"].cluster rect,#gdefault8 [data-look="neo"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault8 [data-look="neo"].swimlane.cluster rect{filter:none;}#gdefault8 [data-look="neo"].node path{stroke:#9370DB;stroke-width:1px;}#gdefault8 [data-look="neo"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault8 [data-look="neo"].node .neo-line path{stroke:#9370DB;filter:none;}#gdefault8 [data-look="neo"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault8 [data-look="neo"].node circle .state-start{fill:#000000;}#gdefault8 [data-look="neo"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault8 [data-look="neo"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#gdefault8 :root{--mermaid-font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;}</style><g><marker id="gdefault8_l8-flowchart-v2-pointEnd" class="marker l8-flowchart-v2" viewBox="0 0 10 10" refX="5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault8_l8-flowchart-v2-pointStart" class="marker l8-flowchart-v2" viewBox="0 0 10 10" refX="4.5" refY="5" markerUnits="userSpaceOnUse" markerWidth="8" markerHeight="8" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault8_l8-flowchart-v2-pointEnd-margin" class="marker l8-flowchart-v2" viewBox="0 0 11.5 14" refX="11.5" refY="7" markerUnits="userSpaceOnUse" markerWidth="10.5" markerHeight="14" orient="auto"><path d="M 0 0 L 11.5 7 L 0 14 z" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault8_l8-flowchart-v2-pointStart-margin" class="marker l8-flowchart-v2" viewBox="0 0 11.5 14" refX="1" refY="7" markerUnits="userSpaceOnUse" markerWidth="11.5" markerHeight="14" orient="auto"><polygon points="0,7 11.5,14 11.5,0" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></polygon></marker><marker id="gdefault8_l8-flowchart-v2-circleEnd" class="marker l8-flowchart-v2" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault8_l8-flowchart-v2-circleStart" class="marker l8-flowchart-v2" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault8_l8-flowchart-v2-circleEnd-margin" class="marker l8-flowchart-v2" viewBox="0 0 10 10" refY="5" refX="12.25" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault8_l8-flowchart-v2-circleStart-margin" class="marker l8-flowchart-v2" viewBox="0 0 10 10" refX="-2" refY="5" markerUnits="userSpaceOnUse" markerWidth="14" markerHeight="14" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 0; stroke-dasharray: 1, 0;"></circle></marker><marker id="gdefault8_l8-flowchart-v2-crossEnd" class="marker cross l8-flowchart-v2" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault8_l8-flowchart-v2-crossStart" class="marker cross l8-flowchart-v2" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="gdefault8_l8-flowchart-v2-crossEnd-margin" class="marker cross l8-flowchart-v2" viewBox="0 0 15 15" refX="17.7" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5;"></path></marker><marker id="gdefault8_l8-flowchart-v2-crossStart-margin" class="marker cross l8-flowchart-v2" viewBox="0 0 15 15" refX="-3.5" refY="7.5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 1,1 L 14,14 M 1,14 L 14,1" class="arrowMarkerPath" style="stroke-width: 2.5; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path d="M352.031,60L352.031,64.167C352.031,68.333,352.031,76.667,352.031,84.333C352.031,92,352.031,99,352.031,102.5L352.031,106" id="gdefault8-L_P_Q_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l8-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_P_Q_0" data-points="W3sieCI6MzUyLjAzMTI1LCJ5Ijo2MH0seyJ4IjozNTIuMDMxMjUsInkiOjg1fSx7IngiOjM1Mi4wMzEyNSwieSI6MTEwfV0=" data-look="classic" marker-end="url(#gdefault8_l8-flowchart-v2-pointEnd)"></path><path d="M286.419,253.263L254.138,272.365C221.858,291.467,157.296,329.671,125.015,356.273C92.734,382.875,92.734,397.875,92.734,405.375L92.734,412.875" id="gdefault8-L_Q_M_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l8-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_M_0" data-points="W3sieCI6Mjg2LjQxOTI3NTI2OTczMzEzLCJ5IjoyNTMuMjYzMDI1MjY5NzMzMX0seyJ4Ijo5Mi43MzQzNzUsInkiOjM2Ny44NzV9LHsieCI6OTIuNzM0Mzc1LCJ5Ijo0MTYuODc1fV0=" data-look="classic" marker-end="url(#gdefault8_l8-flowchart-v2-pointEnd)"></path><path d="M352.031,318.875L352.031,327.042C352.031,335.208,352.031,351.542,352.031,367.208C352.031,382.875,352.031,397.875,352.031,405.375L352.031,412.875" id="gdefault8-L_Q_C_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l8-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_C_0" data-points="W3sieCI6MzUyLjAzMTI1LCJ5IjozMTguODc1fSx7IngiOjM1Mi4wMzEyNSwieSI6MzY3Ljg3NX0seyJ4IjozNTIuMDMxMjUsInkiOjQxNi44NzV9XQ==" data-look="classic" marker-end="url(#gdefault8_l8-flowchart-v2-pointEnd)"></path><path d="M417.263,253.643L448.941,272.682C480.618,291.72,543.973,329.798,575.651,356.336C607.328,382.875,607.328,397.875,607.328,405.375L607.328,412.875" id="gdefault8-L_Q_N_0" class=" edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid l8-flowchart-link" style=";" data-edge="true" data-et="edge" data-id="L_Q_N_0" data-points="W3sieCI6NDE3LjI2MzI2NjIyNzY4NDU0LCJ5IjoyNTMuNjQyOTgzNzcyMzE1NDZ9LHsieCI6NjA3LjMyODEyNSwieSI6MzY3Ljg3NX0seyJ4Ijo2MDcuMzI4MTI1LCJ5Ijo0MTYuODc1fV0=" data-look="classic" marker-end="url(#gdefault8_l8-flowchart-v2-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" data-id="L_P_Q_0" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(92.734375, 367.875)"><g class="label" data-id="L_Q_M_0" transform="translate(-12.4765625, -12)"><foreignObject width="24.953125" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>yes</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(352.03125, 367.875)"><g class="label" data-id="L_Q_C_0" transform="translate(-45.6015625, -24)"><foreignObject width="91.203125" height="48"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no — true by<br/>construction</p></span></div></foreignObject></g></g><g class="edgeLabel" transform="translate(607.328125, 367.875)"><g class="label" data-id="L_Q_N_0" transform="translate(-52.1484375, -12)"><foreignObject width="104.296875" height="24"><div xmlns="http://www.w3.org/1999/xhtml" class="labelBkg" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="edgeLabel "><p>no code exists</p></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default  " id="gdefault8-l8-flowchart-P-0" data-look="classic" transform="translate(352.03125, 34)"><rect class="basic label-container" style="" x="-90.921875" y="-26" width="181.84375" height="52"></rect><g class="label" style="" transform="translate(-62.921875, -12)"><rect></rect><foreignObject width="125.84375" height="24"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>property to prove</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault8-l8-flowchart-Q-1" data-look="classic" transform="translate(352.03125, 214.4375)"><polygon points="104.4375,0 208.875,-104.4375 104.4375,-208.875 0,-104.4375" class="label-container" transform="translate(-103.9375, 104.4375)"></polygon><g class="label" style="" transform="translate(-66.4375, -24)"><rect></rect><foreignObject width="132.875" height="48"><div xmlns="http://www.w3.org/1999/xhtml" style="display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;"><span class="nodeLabel "><p>is a shipped guard<br/>protecting it?</p></span></div></foreignObject></g></g><g class="node default  " id="gdefault8-l8-flowchart-M-3" data-look="classic" transform="translate(92.734375, 454.875)"><rect class="basic label-container" style="fill:#e2fbe8 !important;stroke:#1a7f37 !important" x="-84.734375" y="-38" width="169.46875" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-56.734375, -24)"><rect></rect><foreignObject width="113.46875" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>remove it → red<br/><b>provable</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault8-l8-flowchart-C-5" data-look="classic" transform="translate(352.03125, 454.875)"><rect class="basic label-container" style="fill:#fff6c9 !important;stroke:#9a6700 !important" x="-124.5625" y="-38" width="249.125" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-96.5625, -24)"><rect></rect><foreignObject width="193.125" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>nothing to remove<br/><b>not provable by mutation</b></p></span></div></foreignObject></g></g><g class="node default  " id="gdefault8-l8-flowchart-N-7" data-look="classic" transform="translate(607.328125, 454.875)"><rect class="basic label-container" style="fill:#ffd0d5 !important;stroke:#cf222e !important" x="-80.734375" y="-38" width="161.46875" height="76"></rect><g class="label" style="color:#1c2128 !important" transform="translate(-52.734375, -24)"><rect></rect><foreignObject width="105.46875" height="48"><div style="color: rgb(28, 33, 40) !important; display: table-cell; white-space: nowrap; line-height: 1.5; max-width: 200px; text-align: center;" xmlns="http://www.w3.org/1999/xhtml"><span style="color:#1c2128 !important" class="nodeLabel "><p>nothing to test<br/><b>not writable</b></p></span></div></foreignObject></g></g></g></g></g><defs><filter id="gdefault8-drop-shadow" height="130%" width="130%"><feDropShadow dx="4" dy="4" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs><defs><filter id="gdefault8-drop-shadow-small" height="150%" width="150%"><feDropShadow dx="2" dy="2" stdDeviation="0" flood-opacity="0.06" flood-color="#000000"></feDropShadow></filter></defs></svg></div></div>
+      </figure>
+      <div class="callout warn">
+        <p><span class="k">Read this carefully</span></p>
+        <p>“True by construction” is a <em>good</em> outcome — the property holds because of how the code is shaped, not because a guard watches it. It simply cannot be demonstrated by breaking something. Reporting it as proven would be false.</p>
+      </div>
+
+      <h2>9 · Traps that can fake a result</h2>
+      <table>
+        <thead><tr><th>Trap</th><th>Effect</th><th>Mitigation</th></tr></thead>
+        <tbody>
+          <tr><td>Shared temp directory — the harness writes a pointer to a machine-wide path</td><td>Concurrent runs can <strong>fake a red and hide a real one</strong></td><td>Isolated <code>TMPDIR</code> per run</td></tr>
+          <tr><td>Stale build — e2e runs a built app</td><td>You tested the old code</td><td>Check build timestamp against source edit</td></tr>
+          <tr><td>Mutation silently didn’t apply</td><td>Test stays green, looks like “no teeth” — <strong>wrong conclusion</strong></td><td>Verify the mutation landed before believing the result</td></tr>
+          <tr><td>Serial mode reports “did not run”</td><td>A skip mistaken for a pass</td><td>Re-run the others alone under the same mutation</td></tr>
+        </tbody>
+      </table>
+      <p>Two of our own tests were broken in ways only real hardware revealed: one failed on <strong>every</strong> Linux run (a single unpolled read where its sibling polls for 15s), and one <strong>could not execute at all</strong> on Windows (<code>echo $$</code> and <code>ps</code> don’t exist there).</p>
+
+      <h2>10 · Open decisions</h2>
+      <table>
+        <thead><tr><th>ID</th><th>Decision</th><th>Blocks</th></tr></thead>
+        <tbody>
+          <tr><td><strong>D2</strong></td><td>Re-scope G4? It demands an architecture where <strong>0 of 394 files exist</strong>, measured at +62k LOC — the approach that already failed at 0/13.</td><td>G4, G1, G3</td></tr>
+          <tr><td><strong>D3</strong></td><td>Strike or defer J5 / J10 / J11? They have no production subject.</td><td>3 journeys</td></tr>
+          <tr><td><strong>D4</strong></td><td>Architectural gates need a “reviewed diff + file list” receipt; the doc’s red-SHA template makes them structurally unpromotable.</td><td>G0, G1, G4</td></tr>
+          <tr><td><strong>D5</strong></td><td>The input quarantine is <strong>load-bearing, not superseded</strong>. Deleting it re-opens a verified <code>rm -rf</code> hazard. Amend the clause, or accept something weaker on remote hosts?</td><td>G6</td></tr>
+        </tbody>
+      </table>
+      <div class="callout bad">
+        <p><span class="k">The hazard, verified</span></p>
+        <p>Disable the quarantine and the oracle reproduces it exactly: <code>echo hi; rm&nbsp;-rf&nbsp;x</code> arrives as <code>cho hi; rm&nbsp;-rf&nbsp;x</code>. The shell rejects <code>cho</code> and then runs <code>rm -rf x</code>. The replacement was <em>built</em> and costed at roughly +140 lines to delete 88 — and it does not work on remote hosts at all, because old hosts never publish the incarnation it needs.</p>
+      </div>
+
+      <h2>11 · Corrections made along the way</h2>
+      <p class="lede">Included because a report without them is not trustworthy.</p>
+      <table>
+        <thead><tr><th>Claim</th><th>Outcome</th></tr></thead>
+        <tbody>
+          <tr><td>“The reconnect e2e proves the fix”</td><td><span class="pill no">Retracted</span> — passed with the fix removed, twice, isolated</td></tr>
+          <tr><td>“Cross-version tests confirm old clients are safe”</td><td><span class="pill no">Withdrawn</span> — they exercise a route production never takes</td></tr>
+          <tr><td>“<code>mayCreate</code> fixes reattach”</td><td><span class="pill no">Was inert</span> — no production caller for several commits</td></tr>
+          <tr><td>“A branded binding type is the fix”</td><td><span class="pill no">Rejected</span> — three claims false; would have added a second identity system</td></tr>
+          <tr><td>“Fixtures compile as production”</td><td><span class="pill mid">Corrected</span> — none ship; the sweep was stopped</td></tr>
+          <tr><td>“bash 5.3.9 causes the WSL failure”</td><td><span class="pill mid">Corrected</span> — macOS runs the same version and passes</td></tr>
+        </tbody>
+      </table>
+
+      <div class="foot">
+        Generated for review alongside <code>design-overview.md</code>, <code>test-overview.md</code> and <code>goalposts.md</code>.
+        Click any diagram to zoom · scroll to scale · drag to pan.
+      </div>
+    </div>
+
+    <div id="ov">
+      <span class="x">×</span>
+      <div class="inner"></div>
+      <div class="hint">scroll to zoom · drag to pan · Esc to close</div>
+    </div>
+
+    <script>
+
+      const ov = document.getElementById('ov')
+      const inner = ov.querySelector('.inner')
+      let scale = 1, tx = 0, ty = 0, dragging = false, sx = 0, sy = 0
+
+      function apply() {
+        inner.style.transform = `translate(${tx}px, ${ty}px) scale(${scale})`
+      }
+      function open(svgHtml) {
+        inner.innerHTML = svgHtml
+        const svg = inner.querySelector('svg')
+        if (svg) {
+          svg.style.maxWidth = 'none'
+          svg.removeAttribute('width')
+          svg.removeAttribute('height')
+          svg.style.width = Math.min(window.innerWidth * 0.9, 1500) + 'px'
+        }
+        scale = 1
+        tx = 0
+        ty = 0
+        apply()
+        // Must be visible before measuring; a display:none overlay measures zero.
+        ov.classList.add('on')
+        const b = inner.getBoundingClientRect()
+        tx = Math.max(16, (window.innerWidth - b.width) / 2)
+        ty = Math.max(16, (window.innerHeight - b.height) / 2)
+        apply()
+      }
+      function close() { ov.classList.remove('on'); inner.innerHTML = '' }
+
+      document.addEventListener('click', (e) => {
+        const fig = e.target.closest('figure')
+        if (fig && !ov.classList.contains('on')) {
+          // Two themed copies are inlined; take whichever the OS is showing.
+          const svg = [...fig.querySelectorAll('.dia > div')].find((d) => d.offsetParent !== null)
+          if (svg) open(svg.innerHTML)
+        }
+      })
+      ov.querySelector('.x').addEventListener('click', (e) => { e.stopPropagation(); close() })
+      document.addEventListener('keydown', (e) => { if (e.key === 'Escape') close() })
+      ov.addEventListener('wheel', (e) => {
+        e.preventDefault()
+        const f = e.deltaY < 0 ? 1.12 : 1 / 1.12
+        const nx = e.clientX - (e.clientX - tx) * f
+        const ny = e.clientY - (e.clientY - ty) * f
+        scale *= f; tx = nx; ty = ny
+        apply()
+      }, { passive: false })
+      ov.addEventListener('mousedown', (e) => { dragging = true; sx = e.clientX - tx; sy = e.clientY - ty; ov.style.cursor = 'grabbing' })
+      window.addEventListener('mousemove', (e) => { if (!dragging) return; tx = e.clientX - sx; ty = e.clientY - sy; apply() })
+      window.addEventListener('mouseup', () => { dragging = false; ov.style.cursor = 'grab' })
+    </script>
+  </body>
+</html>
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/resume-plan.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/resume-plan.md
new file mode 100644
index 00000000000..62c4274d5ea
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/resume-plan.md
@@ -0,0 +1,275 @@
+# Resume plan and validation record
+
+This plan preserves the comprehensive objective while allowing independently
+safe stacks. It does not require reviving the 814-path construction snapshot.
+
+## First safe commands
+
+Run from the primary worktree before editing:
+
+```bash
+pwd
+git status --short --branch --untracked-files=all
+git rev-parse HEAD origin/main
+git rev-list --left-right --count HEAD...origin/main
+git branch --list 'nwparker/react185-authority-snapshot'
+git show --stat --oneline fddb19f6977
+gh pr view 13111 --repo stablyai/orca --json state,isDraft,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,headRefOid,baseRefOid,url
+```
+
+Expected handoff checkpoint before other changes:
+
+- branch `nwparker/sta-3077-reattach-pane-cardinality`;
+- HEAD `5369479be2953f45cea9ab5cfcde756dd9660548`;
+- snapshot branch and commit present;
+- only this handoff folder and its `.gitignore` allow-list are new handoff work.
+
+If the branch, HEAD, or dirty paths differ, inventory and preserve them before
+continuing. Never reset, clean, overwrite, or switch away from unknown user work.
+
+## Phase 0 — Reconcile reality before design or code
+
+1. Refresh `origin/main` with `git fetch origin main`—never `git pull`—and
+   refresh the live state/reviews of every PR in
+   [`related-open-work.md`](./related-open-work.md) that touches the intended
+   slice.
+2. Recalculate the candidate merge base, categorized LOC, changed-file overlap,
+   and failing/obsolete tests.
+3. Freeze the program accounting baseline before implementation. The default is
+   `5ed45739e94bdf6460364e033bfcec9b32c0b42a` (the base of #12600). Build an
+   aggregate carry-in ledger for every program-attributable PR already merged
+   after it; do not measure only the last PR in a stack.
+4. Read the final diff of #13111, #12264, and #12743 with `gh pr view` and
+   `gh pr diff`, or in disposable isolated worktrees. Never use `gh pr checkout`
+   or switch branches in the primary worktree. Select or design one coherent
+   lease/reattach model; do not combine mutually inconsistent quarantine, kill,
+   and non-kill policies.
+5. Reconcile #12882 before overlapping daemon-endpoint integration and #12760
+   before overlapping relay-generation cleanup. Neither blocks unrelated SSH
+   proof work by declaration.
+6. Treat the preserved snapshot as a local-only mine, not a branch to finish.
+   Inspect it with `git show fddb19f6977:<path>` or in a disposable isolated
+   worktree; never switch the primary worktree to it.
+
+Decision output required before implementation:
+
+- exact incident mechanisms being eliminated;
+- exact authority/identity semantics retained or changed;
+- explicit remote-shell lifecycle and user recovery behavior;
+- explicit lost-consumer liveness/compaction behavior;
+- PR/stack boundaries and dependency order;
+- production modules expected to be deleted; and
+- tests that will discriminate the baseline from the candidate; and
+- a predeclared performance protocol with fixed workloads, samples,
+  statistical/noise bounds, deterministic counters, and raw-data locations.
+
+## Phase 1 — Build discriminating journeys first
+
+Before relying on a code change, create or repair oracles that reproduce the
+failure on an unfixed baseline.
+
+### STA-3077 Docker SSH oracle
+
+The Docker journey must:
+
+- run a real OpenSSH server with `MaxSessions=1` verified from the server;
+- create a known pane and record tab, leaf, binding, relay PTY, and remote PID;
+- seed or naturally reproduce duplicate/stale lease state from the field;
+- exercise disconnect, client restart, reconnect, and authority/relay restart;
+- wait an explicit settle interval after successful reattach;
+- recensus visible panes, tabs, exact bindings, persisted leases, relay PTYs,
+  and actual remote processes/PIDs;
+- prove no pane or shell is created, rebound, lost, or silently killed;
+- prove explicit unresolved recovery for state that cannot be established; and
+- exercise explicit close, lost shutdown response, reconnect retry, and
+  worktree teardown; prove exact remote PID/session-slot reclamation while an
+  uncertain sibling survives; and
+- fail for the intended reason on the unfixed baseline.
+
+A clean reconnect that passes on both revisions is not this oracle.
+
+### Duplicate-agent oracle family
+
+Cover transient SSH loss, `restoreRequired`, sleeping-agent wake, worktree
+switch, and closed-tab restart. Assert process count and transcript/session
+ownership, not just pane/store state. No path may start a second `--resume`
+process while the first process is live or unknown.
+
+### Daemon and remote oracles
+
+Cover unknown inventory, endpoint handover, daemon restart, relay generation
+reuse, client sleep/wake, remote-runtime restart, and stale subscription repair.
+A retry limit may end an attempt or surface a failure; it may not itself prove a
+session dead or authorize destructive replacement.
+
+## Phase 2 — Reconcile and approve the long-term design
+
+The implementation design must explicitly settle:
+
+- final-host identity versus client routing aliases;
+- canonical host-local namespace for worktree, folder, floating, drive, and UNC
+  forms;
+- structural one-active-binding/lease ownership rather than optional metadata
+  plus repair scans;
+- exact operation fencing across every transport;
+- explicit detach, close, retirement, orphan recovery, and process-reclamation
+  operations;
+- durable outcome/replay semantics across app, renderer, host, and transport
+  restarts;
+- mixed-version capability and isolated legacy behavior;
+- lost-device consumer retirement and compaction liveness;
+- one-way migration/cutover; and
+- the four-role deletion oracle and minimised, justified production-code target.
+
+Reuse existing pane, PTY, incarnation, CAS, and three-valued liveness primitives
+where their semantics match. Do not equate client routing IDs with host identity
+or namespace without proving the full semantics.
+
+If the chosen design differs from the preserved normative design, write an
+explicit mapping for every invariant and every journey, identify what changes,
+show equal or stronger safety/liveness, and obtain the user's approval. A
+handoff author or implementation agent cannot approve that scope change alone.
+
+## Phase 3 — Implement as a convergent stack
+
+Stacks are allowed for reviewability. Temporary production stopgaps are not the
+end state.
+
+A sensible dependency shape is:
+
+1. discriminating journey harnesses and behavior oracles;
+2. final shared identity, liveness, and exact-binding primitives;
+3. local/daemon/WSL/SSH/relay/paired/remote adapters using those primitives;
+4. durable outcome, projection, reset, and recovery lifecycle;
+5. one-way migration and capability cutover;
+6. deletion of superseded writers, ledgers, repair scans, timers used as verdicts,
+   and duplicate state machines; retain `terminal-input-quarantine.ts` until a
+   replacement passes its destructive-input oracle; and
+7. full platform, skew, performance, packaging, and independent review proof.
+
+Each stack layer must be safe and tested, but the comprehensive status remains
+0/8 until the final integrated candidate satisfies the complete gates. Do not
+advertise the authoritative capability or claim program completion mid-stack.
+
+## Phase 4 — Run the complete proof matrix
+
+Use [`goalposts.md`](./goalposts.md) as the checklist. All thirteen production
+journeys and every row in the mandatory
+[`issue-to-journey matrix`](./related-open-work.md#mandatory-issue-to-journey-matrix)
+are required. At minimum the final matrix must include:
+
+- real macOS, Linux floor, Windows, and WSL;
+- local, daemon, direct SSH, nested SSH, paired runtime, and remote server;
+- one Docker host with `MaxSessions=1` and two simultaneous Docker hosts;
+- git worktree, folder, floating, drive, and UNC workspaces;
+- old/new peers in both directions at every changed app/daemon, SSH relay,
+  paired-runtime, remote-server, and mobile/E2EE boundary;
+- app, renderer, daemon, relay, and remote-runtime restart;
+- crash cuts around durable operations and identity reset;
+- unknown/timeout/disconnect/lost-response/concurrent-replacement cases;
+- actual remote PID and process accounting; and
+- A/B performance and memory results under the predeclared protocol, including
+  raw samples, confidence intervals, deterministic counters, and leak slopes.
+
+## Phase 5 — Delete, census, rebase, and review
+
+1. Trace every new production module from a real entrypoint.
+2. Delete unreachable modules and fixtures in production trees.
+3. Delete all superseded legacy writers and reconciliation state machines after
+   cutover.
+4. Rebase onto the actual PR base.
+5. Rerun all journeys and static/package checks on the rebased SHA.
+6. Report production, tests, docs, CI/runner, generated, and vendored LOC
+   separately.
+7. Minimise aggregate production source net LOC against the frozen pre-program
+   baseline, including all program-attributable carry-in and stack layers, and
+   justify every net addition as required by D1.
+8. Run an independent repository review and the release-readiness checklist.
+9. Resolve every P0–P2 finding.
+10. Only then prepare the comprehensive PR and ask the user to approve any
+    deliberate design change.
+
+## Validation status at this handoff
+
+This was a documentation and read-only audit turn. No product test command was
+rerun, so this handoff claims no fresh local product-test pass.
+
+Exact validation commands run for this handoff:
+
+```bash
+git status --short --branch --untracked-files=all
+git rev-parse HEAD origin/main
+git rev-list --left-right --count HEAD...origin/main
+git merge-base HEAD origin/main
+git diff --numstat --no-renames "$(git merge-base HEAD origin/main)"..HEAD
+gh pr view 13111 --repo stablyai/orca --json state,isDraft,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,headRefOid,baseRefOid,url
+handoff_query_text="$(tr '\n' ' ' < docs/reference/terminal-session-correctness-handoff-2026-08-07/github-overlap-query.graphql)"
+gh api graphql -f query="$handoff_query_text"
+pnpm exec oxfmt --check docs/reference/terminal-session-correctness-handoff-2026-08-07/*.md docs/reference/terminal-session-correctness-handoff-2026-08-07/*.graphql
+git diff --check
+```
+
+Outcomes:
+
+- repository commands exited 0 and produced the branch/SHA/distance recorded in
+  `README.md`;
+- the current-HEAD numstat reproduced `+309` production, `+914` tests/E2E,
+  `+146` docs, `+43` CI/config, and `+1,412` total net LOC;
+- the reproducible GraphQL catalog returned all 65 referenced items and one
+  unresolved, non-outdated review thread on each of #13110 and #13111;
+- all 30 linked issues appear in the mandatory issue-to-journey matrix and the
+  reusable GraphQL query;
+- #13111 was open, non-draft, mergeable/clean, with 47 successful and 5 skipped
+  checks and no approval decision; and
+- formatting and whitespace checks exited 0 after documentation formatting.
+
+Verified in this worktree:
+
+- repository branch, HEAD, merge base, local `origin/main`, branch distance,
+  and clean pre-documentation status;
+- snapshot branch/commit presence and the 814-path preservation claim;
+- current source implementation of the narrow #13111 behavior and gaps;
+- current categorized #13111 diff census;
+- original G0–G7, thirteen journeys, and PR proof contract; and
+- live GitHub PR/issue state through batched GraphQL queries.
+
+Live GitHub verification at the time of writing showed:
+
+- #13111: open, non-draft, mergeable/clean, checks successful, no approval, one
+  unresolved major review thread;
+- #13110: open, non-draft, checks successful, no approval, one unresolved major
+  review thread;
+- #12264 and #12743: open competing STA-3077 implementations;
+- #12474, #12477, and #12600: merged; and
+- the other items in `related-open-work.md`: open unless explicitly labeled
+  merged or draft.
+
+These states are ephemeral and must be refreshed.
+
+Historical pause receipts from the 60,903-line construction snapshot remain
+construction evidence only. They do not prove the current branch, G0–G7, or any
+required journey.
+
+## Stop conditions
+
+Stop and return to the user before:
+
+- narrowing or replacing a named goalpost;
+- accepting a correctness/performance tradeoff;
+- deciding that remote orphan shells may be killed or leaked permanently;
+- changing wire semantics without a compatibility design;
+- shipping a positive-production-LOC comprehensive stack;
+- merging, closing, commenting on, or force-updating external PRs; or
+- deleting preserved user work.
+
+## Short takeover prompt
+
+> Continue the comprehensive terminal-session correctness program from
+> [`README.md`](./README.md). Preserve the fixed status of **0/8 proven gates
+> and 0/13 proven journeys** until every proof in
+> [`goalposts.md`](./goalposts.md) passes on one rebased candidate. Reconcile the
+> conflicting open work in [`related-open-work.md`](./related-open-work.md),
+> build discriminating real SSH/daemon/paired/remote/cross-platform journeys,
+> remove root causes and superseded reconciliation, minimise and justify every
+> production-code addition per D1, and finish with no correctness or performance
+> regression.
diff --git a/docs/reference/terminal-session-correctness-handoff-2026-08-07/test-overview.md b/docs/reference/terminal-session-correctness-handoff-2026-08-07/test-overview.md
new file mode 100644
index 00000000000..29083dfbb2a
--- /dev/null
+++ b/docs/reference/terminal-session-correctness-handoff-2026-08-07/test-overview.md
@@ -0,0 +1,277 @@
+# Terminal session correctness — test design
+
+How we decide a test is worth trusting, what we built, and what we could not
+prove. Read [`design-overview.md`](./design-overview.md) first.
+
+---
+
+## 1. The problem with "the tests pass"
+
+A green test proves nothing on its own. It might pass because the code is
+correct, or because the test never looked.
+
+```mermaid
+flowchart TD
+    T["Test is green"] --> Q{"Would it go red if<br/>we broke the code?"}
+    Q -->|"Yes"| G["Real evidence"]
+    Q -->|"No"| W["Worthless.<br/>Green either way."]
+    Q -->|"Never checked"| U["Unknown.<br/>Treat as worthless."]
+
+    style G fill:#e6ffe6,stroke:#00aa00
+    style W fill:#ffcccc,stroke:#cc0000
+    style U fill:#fff4e6,stroke:#dd8800
+```
+
+This is not hypothetical. **It happened to us twice:**
+
+- An end-to-end test was reported as proving the reconnect fix. It passed with
+  the fix **and** with the fix removed. Retracted.
+- A guard was added, every test stayed green, and the guard had **no production
+  caller at all**. The capability existed; nothing used it. Tests passed the
+  whole time because they called the capability directly.
+
+---
+
+## 2. The rule we adopted: the four-step proof
+
+Nothing counts as evidence until it has been through this loop.
+
+```mermaid
+flowchart LR
+    S1["1. Run it<br/><b>green</b>"] --> S2["2. Delete the guard<br/>from production code"]
+    S2 --> S3["3. Run it<br/><b>MUST go red</b>"]
+    S3 --> S4["4. Put the guard back<br/><b>green again</b>"]
+    S3 -.->|"stays green"| F["Test is worthless.<br/>Say so. Don't ship it<br/>as proof."]
+
+    style S3 fill:#e6ffe6,stroke:#00aa00
+    style F fill:#ffcccc,stroke:#cc0000
+```
+
+Three rules that make this honest rather than theatre:
+
+**Delete a real guard, not the test.** The mutation goes in _production_ code. If
+you tweak the test until it fails, you have proved nothing.
+
+**Prefer one clause at a time.** If a test has three claims, a good mutation
+reddens exactly one and leaves the other two green. That proves the claims
+_independently_ rather than as a bundle.
+
+**Watch it fail yourself.** A report saying "it went red" is not the same as
+seeing it. Of the twelve oracles here, six were personally re-verified, and two
+of those re-checks overturned the original claim.
+
+### The trap that nearly fooled us twice
+
+```mermaid
+flowchart TD
+    M["Apply mutation"] --> C{"Did the mutation<br/>actually land?"}
+    C -->|"No — silent no-op"| X["Test stays green.<br/>You conclude 'no teeth'.<br/><b>Wrong conclusion.</b>"]
+    C -->|"Yes"| R["Now the result<br/>means something"]
+
+    style X fill:#ffcccc,stroke:#cc0000
+```
+
+Twice a search-and-replace matched the wrong line and changed nothing. The test
+stayed green and looked like a failed oracle. **Always verify the mutation landed
+before believing the result.**
+
+---
+
+## 3. The three layers of test
+
+```mermaid
+flowchart TD
+    subgraph L1["Unit — milliseconds"]
+        U1["Pure logic.<br/>Does the rule compute<br/>the right answer?"]
+    end
+    subgraph L2["Integration — seconds"]
+        I1["Real Electron app.<br/>Real restarts.<br/>Real shell processes."]
+    end
+    subgraph L3["End-to-end — minutes"]
+        E1["Real Docker container<br/>running real OpenSSH.<br/>Real network faults."]
+    end
+    L1 --> L2 --> L3
+    L1 -.->|"fast, narrow"| N1[" "]
+    L3 -.->|"slow, real"| N2[" "]
+    style N1 fill:none,stroke:none
+    style N2 fill:none,stroke:none
+```
+
+The rule of thumb: **assert the strongest thing you can actually observe.**
+
+---
+
+## 4. Why "same id" is not good enough
+
+The most valuable lesson from this work.
+
+A restart test naturally asks: _is it the same terminal?_ The easy check is
+whether the ids match. That check is **too weak**, and we can prove it.
+
+```mermaid
+flowchart TD
+    B["Break the quit path so it<br/>destroys shells instead of<br/>detaching from them"] --> R["Restart the app"]
+    R --> C1["tab id: same ✅"]
+    R --> C2["pane id: same ✅"]
+    R --> C3["pty id: same ✅"]
+    R --> C4["<b>OS process: DIFFERENT</b> ❌<br/>pid 13756 → 8852"]
+    C3 --> W["A weak test passes here.<br/>Your shell is gone."]
+    C4 --> S["Our test fails here."]
+
+    style W fill:#ffcccc,stroke:#cc0000
+    style S fill:#e6ffe6,stroke:#00aa00
+```
+
+So the test asks the shell to report its **own process id** through the real
+input path, then reads that process's **kernel start time**. Same id _and_ same
+start time means the same process really survived — a recycled pid cannot pass.
+
+```mermaid
+sequenceDiagram
+    participant T as Test
+    participant A as Orca
+    participant S as Shell
+    participant K as Kernel
+    T->>A: type "echo MARKER=$$"
+    A->>S: (through the real write path)
+    S-->>T: MARKER=13756
+    T->>K: start time of 13756?
+    K-->>T: 02:01:29.337
+    Note over T: restart the app
+    T->>S: ask again
+    S-->>T: MARKER=13756
+    T->>K: start time of 13756?
+    K-->>T: 02:01:29.337 ✅ same process
+```
+
+---
+
+## 5. What is covered
+
+### Journey 1 — a terminal survives restart · **PROVEN**
+
+Two claims: the same pane, binding and **OS process** survive a reload and an app
+restart; and a stale operation is refused.
+
+| Platform           | Result | Mutation A<br/>(destructive quit) | Mutation B<br/>(remove stale-write guard) |
+| ------------------ | ------ | --------------------------------- | ----------------------------------------- |
+| macOS              | 2 pass | red                               | red                                       |
+| Linux, native      | 2 pass | red                               | red                                       |
+| Windows 11, native | 2 pass | **red — only claim 1**            | **red — only claim 2**                    |
+
+The two mutations hit **different claims**, which is what proves them separately.
+
+### Journey 2 — daemon and WSL · **PROVEN**
+
+| Environment     | Result | Mutation A<br/>(liveness can't say "unknown") | Mutation B<br/>(widen owner fallback) |
+| --------------- | ------ | --------------------------------------------- | ------------------------------------- |
+| macOS           | 3 pass | red — claim 1 only                            | red — claim 3 only                    |
+| Linux, native   | 3 pass | red — claim 1 only                            | red — claim 3 only                    |
+| WSL2 on Windows | 3 pass | red — claim 1 only                            | —                                     |
+
+> **A subtlety worth knowing.** These tests run in order, so when the first one
+> fails the others report "did not run" — that is a _skip_, not a pass. To prove
+> the mutation really only hit claim 1, we re-ran claims 2 and 3 **alone, with
+> the mutation still applied**, and watched them stay green.
+
+### Other oracles that bite
+
+| Oracle                       | Mutation that reddens it                         |
+| ---------------------------- | ------------------------------------------------ |
+| Reconnect grafts no pane     | Remove "bind, never create"                      |
+| Superseded-keystroke fence   | Remove the guard from the handlers               |
+| Guard is actually wired up   | Remove the call sites, keep the function         |
+| Workspace ids don't collide  | Restore the suffix-stripping comparison          |
+| Wire compatibility           | Restore the wrong "expired" message              |
+| `rm -rf` hazard stays closed | Disable the quarantine → `cho hi; rm -rf x` runs |
+
+That last one is why we did **not** delete the quarantine module.
+
+---
+
+## 6. What we could not prove, and why
+
+This is the honest half.
+
+```mermaid
+flowchart TD
+    P["Property we want<br/>to prove"] --> Q{"Is there a shipped<br/>guard protecting it?"}
+    Q -->|"Yes"| M["Remove it → test reddens.<br/><b>Provable</b>"]
+    Q -->|"No — it's true<br/>by construction"| C["Nothing to remove.<br/><b>Not provable by mutation</b>"]
+    Q -->|"No code exists<br/>at all"| N["Nothing to test.<br/><b>Not writable</b>"]
+
+    style M fill:#e6ffe6,stroke:#00aa00
+    style C fill:#fff4e6,stroke:#dd8800
+    style N fill:#ffcccc,stroke:#cc0000
+```
+
+| Journey                   | Why not proven                                                                                                                                  |
+| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| Two hosts don't interfere | True **by construction** — each host has its own channel, so there is no shared thing to break. Four attempts to redden it failed, correctly.   |
+| Lazy host discovery       | One claim has no mutation that hits it alone; removing the real guard breaks setup before the claim is reached.                                 |
+| `MaxSessions=1` reconnect | Two claims redden. A third survived **four** different guard removals — nothing shipped protects it.                                            |
+| Mixed versions, live      | The new message **never crosses a version boundary** in production. Our in-process tests exercise a route the real app doesn't take. Withdrawn. |
+| Performance               | 1 of 10 required dimensions measured. The keystroke guard costs ~14ns, but measured outside the real app.                                       |
+| Three others              | The features they test **do not exist** in the code. No test can be written.                                                                    |
+
+**"True by construction" is a good outcome, not a failure** — it means the
+property holds because of how the code is shaped, not because a guard is
+watching. It just can't be demonstrated by breaking something.
+
+---
+
+## 7. Environment traps that can fake a result
+
+Real problems we hit, worth knowing before trusting any run.
+
+```mermaid
+flowchart TD
+    subgraph T1["Shared temp directory"]
+        A1["Test harness writes a pointer<br/>to a machine-wide temp path"] --> A2["Two runs at once<br/>overwrite each other"]
+        A2 --> A3["Can fake a red<br/><b>and</b> hide a real one"]
+    end
+    subgraph T2["Stale build"]
+        B1["e2e runs a built app"] --> B2["Edit source, forget rebuild"]
+        B2 --> B3["You tested the old code"]
+    end
+    style A3 fill:#ffcccc,stroke:#cc0000
+    style B3 fill:#ffcccc,stroke:#cc0000
+```
+
+So every run isolates its temp directory, and we check build timestamps against
+source edits before believing a result.
+
+Two more, found by running on machines we don't develop on:
+
+- A test failed on **every** Linux run. Not a product bug: it read a value once,
+  immediately after a reload, where its sibling helper polls for 15 seconds.
+- A test could not run on **Windows at all** — it used `echo $$` and `ps`, which
+  don't exist there. The Windows claim wasn't unproven, it was _unprovable_.
+
+Both were bugs in tests we wrote, found only by running on the real platform.
+
+---
+
+## 8. Scoreboard
+
+```mermaid
+pie showData
+    title Journeys
+    "Proven with discrimination" : 2
+    "Oracle exists, cannot discriminate" : 5
+    "No code exists to test" : 3
+    "Not yet attempted" : 3
+```
+
+| Measure                         | Value       |
+| ------------------------------- | ----------- |
+| Journeys proven                 | **2 of 13** |
+| Gates proven                    | **0 of 8**  |
+| Oracles that bite               | 12          |
+| …personally re-verified         | 6           |
+| Claims retracted after checking | 2           |
+| Production code added           | +214 lines  |
+
+The retraction count is the number to look at. Two claims that looked green were
+withdrawn after checking. That is the process working — and the reason to trust
+the two journeys that survived it.
diff --git a/docs/reference/worktree-scan-fingerprint.md b/docs/reference/worktree-scan-fingerprint.md
new file mode 100644
index 00000000000..f82d453a82c
--- /dev/null
+++ b/docs/reference/worktree-scan-fingerprint.md
@@ -0,0 +1,274 @@
+# Steady-state worktree rescan: Git-admin fingerprint gate
+
+## Status
+
+Adopted for the main-process worktree resolution cache
+(`OrcaRuntimeService.listRepoWorktreesForResolution`). It keeps the existing
+30-second freshness contract for externally created, removed, moved, locked, and
+re-checked-out worktrees while removing the `git worktree list` subprocess that
+previously ran for every registered repository every 30 seconds.
+
+## Context
+
+A production trace (10 registered repositories, 3 h 27 min) recorded 4,272
+`git worktree` invocations and 8,663 total Git subprocesses. The invocations
+arrived in full-fleet sweeps roughly every 30.5 s — one sweep per repository per
+`WORKTREE_SCAN_CACHE_TTL_MS`.
+
+### What actually expires the cache
+
+The originating report assumed some specific terminal/status/orchestration
+request was invalidating the 30-second cache. That is not what happens, and the
+distinction changes the fix:
+
+- `resolvedWorktreeCache` (the whole-fleet snapshot) has a **1-second** TTL
+  (`RESOLVED_WORKTREE_CACHE_TTL_MS`). Any caller polling faster than 1 Hz
+  recomputes the snapshot.
+- `computeResolvedWorktrees` fans out over **every** registered repo
+  (`src/main/runtime/orca-runtime.ts`), calling
+  `listRepoWorktreesForResolution` per repo.
+- That per-repo call is backed by `worktreeScanCache` with a **30-second** TTL.
+  When it expires, the next poll shells out.
+
+So no request "expires" the 30-second cache. It expires on wall-clock time, and
+whichever poller arrives first afterwards pays a full-fleet `git worktree list`
+fan-out. The many high-frequency callers — `listTerminals` without a selector,
+`showTerminal`, `getWorktreePs`, `listManagedWorktrees`,
+`resolveWorktreeSelector`, orchestration authority refresh — only determine
+*who* pays, not *how often*. Steady-state subprocess volume is therefore
+`repos / 30 s`, independent of poll rate, which is exactly the observed
+~1 sweep / 30.5 s.
+
+The in-Orca mutation surface is already event-driven: create, remove, rename,
+folder-rename, sparse edits, repo add/update/remove, SSH reconnect, and
+mixed-version remote invalidation all call
+`invalidateWorktreeScanCacheForRepo` / `invalidateResolvedWorktreeCache`
+(≈40 call sites). The 30-second TTL exists for exactly one reason: discovering
+worktree changes made **outside** Orca (`git worktree add/remove/move/prune`,
+`git checkout` in another worktree, `rm -rf` of a worktree directory).
+
+That is a filesystem question, and the filesystem can answer it without a
+subprocess.
+
+## Goals
+
+- Remove the periodic all-repository `git worktree list` fan-out in steady
+  state.
+- Preserve the current ≈30 s discovery latency for externally created, removed,
+  moved, pruned, locked/unlocked, and re-checked-out worktrees.
+- Keep a bounded reconciliation so anything the cheap probe cannot observe still
+  converges.
+- Change nothing for SSH repos, WSL-routed repos, folder workspaces, bare repos,
+  or hosts where the probe cannot resolve Git's admin layout.
+- Fail open: any probe error must behave exactly like today (run the real scan).
+
+## Non-goals
+
+- Changing `RESOLVED_WORKTREE_CACHE_TTL_MS` or the whole-fleet snapshot shape.
+- Changing the renderer-facing `worktrees:list` / `worktrees:listAll` IPC scan
+  cache in `src/main/ipc/worktrees.ts` (separate 5 s cache, invalidated by
+  `registerWorktreeChangeInvalidator`, not a polling source in the trace).
+- Scoping `resolveWorktreeSelector` to a single repository. See
+  "Rejected alternatives".
+- Adding a filesystem watcher per repository.
+- Any wire/RPC/persisted-schema change.
+
+## Design
+
+Introduce a cheap, subprocess-free **Git worktree admin fingerprint** for a
+local repository, and consult it before re-running a scan whose TTL has expired.
+
+### Fingerprint inputs
+
+`readRepoWorktreeAdminFingerprint(repoPath)` in
+`src/main/runtime/repo-worktree-admin-fingerprint.ts` resolves the repo's Git
+common directory without a subprocess (read `.git`; if it is a `gitdir:` file,
+follow it and then its `commondir`; if `.git` is absent, treat `repoPath` as a
+bare gitdir), then records:
+
+| Input | External change it catches |
+| --- | --- |
+| sorted entry names of `<commonDir>/worktrees` | `worktree add`, `worktree remove`, `worktree prune` |
+| existence of `repoPath` | main checkout deleted |
+| `<commonDir>/packed-refs` mtime + size | a tip moved while its loose ref is packed away |
+| `<commonDir>/reftable` mtime + size | a tip moved under the reftable backend |
+| per checkout: `HEAD` contents | branch switch, detach (the detached oid is in HEAD itself) |
+| per checkout: contents of the ref HEAD names | a plain `git commit`, `reset`, or `fetch` that moves the tip |
+| per entry: `gitdir` contents | `worktree move`, `worktree repair` |
+| per entry: `locked` presence | `worktree lock` / `unlock` |
+| per entry: existence of the path named by `gitdir` | a worktree directory deleted with `rm -rf` (flips `prunable`) |
+
+"per checkout" covers the main worktree and each linked worktree. Reading the
+ref HEAD names is what makes an ordinary commit visible: committing rewrites
+`refs/heads/<branch>` and leaves `HEAD` untouched, but moves the oid
+`git worktree list --porcelain` prints. A symref target is only followed when it
+is a relative path under `refs/`, so a hand-edited `HEAD` cannot steer the probe
+outside the ref store.
+
+Every input is a `stat`, `readdir`, or small `readFile` on an already-hot inode,
+and the fingerprint depends on nothing but the repo path — no prior scan result
+is threaded in. Per-repo fan-out is capped at 8 concurrent linked-worktree
+probes, mirroring `SPARSE_CHECKOUT_DETECTION_CONCURRENCY`. A 10-repo fleet with
+10 worktrees each costs a few hundred filesystem calls per 30 s window versus 10
+process spawns; the spawns dominate by orders of magnitude, and process-table
+churn was the reported symptom.
+
+The fingerprint is a NUL-delimited string; any read failure yields `null`, which
+the caller treats as "cannot prove unchanged".
+
+### Cache decision
+
+`listRepoWorktreesForResolution` gains one branch on the expired-TTL path:
+
+```text
+cached entry exists, same generation + runtimeKey, TTL expired
+  └─ probe eligible? (no connectionId, no wslDistro, fingerprint recorded)
+       ├─ no  → real scan (today's behaviour)
+       └─ yes → read fingerprint now
+            ├─ null or different              → real scan
+            ├─ equal, last real scan < 5 min  → extend TTL, no subprocess
+            └─ equal, last real scan ≥ 5 min  → real scan (bounded reconcile)
+```
+
+`WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS` is 5 min, matching the existing
+`WORKTREE_SCAN_AGENT_SCRATCH_TTL_MS` precedent. A cached result whose scan
+failed (`ok: false`) is never extended, so a transient Git failure still retries
+on the 30 s TTL.
+
+### Git version compatibility
+
+Every path the probe reads is part of Git's on-disk layout well before the 2.25
+baseline in [`git-compatibility.md`](./git-compatibility.md): `.git` as a
+directory or `gitdir:` file, `commondir`, `worktrees/<name>/{HEAD,gitdir,locked}`,
+`packed-refs`, and loose `refs/`. `reftable` arrived in 2.45; on older Git it
+simply stats as missing, which is a stable value and therefore harmless. No new
+Git command is introduced — this change only skips one.
+
+Agent-scratch repos already carry a 5-minute scan TTL
+(`WORKTREE_SCAN_AGENT_SCRATCH_TTL_MS`), which equals the reconciliation
+interval, so the gate never fires for them and their behaviour is unchanged.
+
+### Ordering
+
+The fingerprint stored with a scan result is captured **before** the scan runs.
+A mutation landing while the scan is in flight therefore leaves the stored
+fingerprint stale-by-construction, so the next probe sees a difference and
+rescans. Capturing after the scan would let that mutation be masked forever.
+
+### Interaction with existing invalidation
+
+Untouched. `invalidateWorktreeScanCacheForRepo` deletes the entry (fingerprint
+included) and bumps the generation, so every event-driven path still forces a
+real scan on the next read. The fingerprint only ever *extends* an entry that
+the TTL alone would have refreshed.
+
+## Freshness budget
+
+| Change | Before | After |
+| --- | --- | --- |
+| Orca-initiated create/remove/rename/sparse/repo edit | immediate (event) | immediate (event) |
+| SSH reconnect / provider generation bump | immediate (event) | immediate (event) |
+| External `worktree add/remove/move/prune/lock` | ≤ 30 s | ≤ 30 s |
+| External `git checkout` / `commit` / `reset` in any worktree | ≤ 30 s | ≤ 30 s |
+| External `rm -rf <worktree>` | ≤ 30 s | ≤ 30 s |
+| External sparse-checkout pattern edit | ≤ 30 s | ≤ 5 min |
+| Packed/reftable tip moved within one mtime tick at an equal file size | ≤ 30 s | ≤ 5 min |
+| SSH / WSL repos, folder workspaces | unchanged | unchanged |
+
+The two regressions are bounded by the reconciliation interval and are both
+changes Orca does not make itself.
+
+### Main-thread cost
+
+Both the scan and the probe are asynchronous, so neither "runs on the main
+thread" in the naive sense — but they are not equally free there. Measured on
+macOS with a 1 ms interval sampling event-loop lag while each ran 30 times
+against a repo with 20 linked worktrees:
+
+| | wall per call | main-thread stall per call | worst single stall |
+| --- | --- | --- | --- |
+| `git worktree list` | 18.66 ms | 2.69 ms | 3.02 ms |
+| fingerprint probe | 1.66 ms | 0.01 ms | 0.04 ms |
+
+`fs/promises` dispatches to libuv's threadpool, so ~99 % of the probe's latency
+is off-thread. Spawning Git does not: `uv_spawn`, fd and pipe setup, and stdout
+collection and decoding are real synchronous main-process work. Ten repos
+refreshing together therefore cost ≈27 ms of event-loop stall per sweep before
+this change and ≈0.1 ms after — this reduces main-thread pressure rather than
+adding to it, which is why moving either side onto a worker thread would not
+help.
+
+### Residual risk
+
+A repo registered at a UNC path (`\\wsl$\...`) but executed by the local Windows
+Git runtime is still probed, because it is not WSL-routed from Orca's point of
+view. The probe is correct there and strictly cheaper than the subprocess it
+replaces, but its filesystem calls cross the 9p boundary like the existing
+sparse-checkout probes already do.
+
+## Measured effect
+
+`src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts` drives the
+reported steady state — 10 idle local repos, a caller polling at 1 Hz for 30
+simulated minutes — and counts `git worktree list` invocations:
+
+| | `git worktree list` per 30 min | per hour |
+| --- | --- | --- |
+| TTL only (before) | 600 | 1,200 |
+| fingerprint gate (after) | 60 | 120 |
+
+A 90 % reduction, with the remainder being the bounded reconciliation. Repos
+with genuine external activity keep rescanning at the 30 s cadence because the
+fingerprint flips.
+
+Extrapolating to the original trace's shape (10 repos, 3 h 27 min): 4,272
+`git worktree` invocations would become ≈427.
+
+## Rejected alternatives
+
+**Raise `WORKTREE_SCAN_CACHE_TTL_MS` to 5 min.** One line, same subprocess
+reduction, but it degrades *every* external-change latency to 5 min, including
+the common "I ran `git worktree add` in a terminal" case. The fingerprint buys
+the same reduction without that regression.
+
+**Per-repo `fs.watch` on `<commonDir>/worktrees`.** Lower latency, but adds
+persistent watcher handles per repo, inherits recursive-watch platform
+differences, and would need its own dormancy/rearm story. The existing watcher
+infrastructure is scoped to workspace files; extending it to Git admin dirs is a
+larger change with a worse risk profile for the same steady-state win.
+
+**Scope `resolveWorktreeSelector` to the owning repository.** The original brief
+asks for this. `listTerminals` already avoids the fan-out for explicit worktree
+ids via `buildResolvedWorktreeFromId` +
+`listKnownResolvedWorktreesForExplicitTarget`. Extending that to
+`resolveWorktreeSelector` means splitting the highest-fan-in method in the
+runtime (38 call sites) and rebuilding lineage projection for a repo subset —
+material regression risk. Once the fingerprint gate lands, the remaining
+fan-out cost for a targeted call is a batch of stats, not a subprocess, so the
+gain no longer justifies the risk. Tracked as follow-up, not in this change.
+
+## Test plan
+
+`src/main/runtime/repo-worktree-admin-fingerprint.test.ts` (real temp dirs, real
+`git` binary — a mocked filesystem would only restate the assumptions):
+
+- stable across repeated reads with no change
+- changes after `worktree add`, `worktree remove`, `worktree move`,
+  `worktree lock`, `checkout` in a linked worktree, `checkout` in the main
+  worktree, a commit in either, and `rm -rf` of a worktree directory
+- still tracks a tip whose loose ref has been packed away by `git pack-refs`
+- a linked worktree path and the main repo path produce the same fingerprint
+- a bare repo resolves through its own gitdir and still tracks `worktree add`
+- `null` for a non-Git directory and for a missing path
+
+`src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts`:
+
+- unchanged fingerprint suppresses the rescan past the 30 s TTL and re-arms it
+- changed fingerprint rescans at the 30 s TTL
+- the 5-minute reconciliation forces a rescan while the fingerprint is unchanged
+- `notifyBranchRenamed` (event invalidation) still forces an immediate rescan
+- a `null` fingerprint (probe failure) falls back to scanning
+- SSH repos never consult the probe
+- a failed scan is never extended
+- concurrent callers share one probe and one scan
+- the 1 Hz / 10-repo workload measurement above
diff --git a/mobile/app/h/[hostId]/files/preview/[worktreeId].tsx b/mobile/app/h/[hostId]/files/preview/[worktreeId].tsx
index 65412d51958..df60f8fc117 100644
--- a/mobile/app/h/[hostId]/files/preview/[worktreeId].tsx
+++ b/mobile/app/h/[hostId]/files/preview/[worktreeId].tsx
@@ -10,6 +10,11 @@ export default function MobileFilePreviewRoute() {
     source?: string | string[]
     absolutePath?: string | string[]
     grantId?: string | string[]
+    terminal?: string | string[]
+    pathText?: string | string[]
+    cwd?: string | string[]
+    nativeChatTab?: string | string[]
+    nativeChatSession?: string | string[]
     line?: string | string[]
     column?: string | string[]
     name?: string | string[]
diff --git a/mobile/app/h/[hostId]/session/[worktreeId].tsx b/mobile/app/h/[hostId]/session/[worktreeId].tsx
index cf0f1dd7edb..123a1212eb0 100644
--- a/mobile/app/h/[hostId]/session/[worktreeId].tsx
+++ b/mobile/app/h/[hostId]/session/[worktreeId].tsx
@@ -127,6 +127,15 @@ import type { TerminalLiveInputSender } from '../../../../src/terminal/terminal-
 import { isTerminalSendRpcAccepted } from '../../../../src/terminal/terminal-send-rpc-response'
 import { sendMobileTerminalQueryReply } from '../../../../src/terminal/mobile-terminal-query-reply'
 import { TERMINAL_QUERY_REPLY_INPUT_RUNTIME_CAPABILITY } from '../../../../../src/shared/protocol-version'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE,
+  withLegacyTerminalAttributionDisabledEnv
+} from '../../../../../src/shared/legacy-terminal-attribution-env'
+import {
+  assertMobileTerminalAttributionDisableSupported,
+  MOBILE_TERMINAL_CREATE_RPC_OPTIONS
+} from '../../../../src/session/mobile-terminal-attribution-compat'
 import { useTerminalLiveInputCommit } from '../../../../src/terminal/use-terminal-live-input-commit'
 import { resolveMobileTerminalInputGate } from '../../../../src/terminal/terminal-input-connection-gate'
 import {
@@ -917,6 +926,9 @@ export default function SessionScreen() {
   } | null>(null)
   const terminalUnsubsRef = useRef<Map<string, () => void>>(new Map())
   const subscribingHandlesRef = useRef<Set<string>>(new Set())
+  // Why: a lease-only subscribe never renders, so the reconciler needs to tell it apart
+  // from a stream that does — an uncovered handle holding one is a blank terminal.
+  const leaseOnlyHandlesRef = useRef<Set<string>>(new Set())
   const initializedHandlesRef = useRef<Set<string>>(new Set())
   const terminalDiagnosticsRef = useRef(new MobileTerminalDiagnostics())
   // Why: bounds the scrollback→resubscribe fit loop per handle (STA-3337).
@@ -1233,6 +1245,7 @@ export default function SessionScreen() {
       terminalUnsubsRef.current.get(handle)?.()
       terminalUnsubsRef.current.delete(handle)
       subscribingHandlesRef.current.delete(handle)
+      leaseOnlyHandlesRef.current.delete(handle)
       terminalDiagnosticsRef.current.terminalUnsubscribed(handle)
       subscribeSeqRef.current.set(handle, (subscribeSeqRef.current.get(handle) ?? 0) + 1)
       // Why: reset the high-water mark so a fresh subscription's first scrollback isn't dropped as stale.
@@ -1265,6 +1278,7 @@ export default function SessionScreen() {
     clearNativeChatInputLease()
     terminalUnsubsRef.current.clear()
     subscribingHandlesRef.current.clear()
+    leaseOnlyHandlesRef.current.clear()
     initializedHandlesRef.current.clear()
     terminalDiagnosticsRef.current.clearTerminalCache()
     viewportResubscribeBudgetRef.current.clear()
@@ -1331,6 +1345,11 @@ export default function SessionScreen() {
       }
 
       subscribingHandlesRef.current.add(handle)
+      if (covered) {
+        leaseOnlyHandlesRef.current.add(handle)
+      } else {
+        leaseOnlyHandlesRef.current.delete(handle)
+      }
       const seq = (subscribeSeqRef.current.get(handle) ?? 0) + 1
       subscribeSeqRef.current.set(handle, seq)
       diagnostics.streamArmed(handle, seq, viewportRef.current)
@@ -1519,6 +1538,7 @@ export default function SessionScreen() {
     streamRevision: coveredStreamRevision,
     subscriptionsRef: terminalUnsubsRef,
     subscribingRef: subscribingHandlesRef,
+    leaseOnlyRef: leaseOnlyHandlesRef,
     webReadyRef: webReadyHandlesRef,
     initializedRef: initializedHandlesRef,
     subscribe: subscribeToTerminal,
@@ -3085,6 +3105,10 @@ export default function SessionScreen() {
     hostId,
     worktreeId,
     worktreeName: routeWorktreeName,
+    nativeChatSessionId:
+      activeSessionTab?.type === 'terminal'
+        ? (activeSessionTab.agentStatus?.providerSession?.id ?? null)
+        : null,
     activeHandleRef,
     terminalCwdRef,
     openBrowser: (url) => void handleCreateBrowserRef.current?.(url),
@@ -3650,20 +3674,27 @@ export default function SessionScreen() {
       .slice(2, 10)}`
 
     try {
-      const response = await client.sendRequest('session.tabs.createTerminal', {
-        worktree: `id:${worktreeId}`,
-        afterTabId: activeSessionTabId ?? undefined,
-        clientMutationId,
-        ...(options?.startupCommand ? { command: options.startupCommand } : {}),
-        ...(options?.startupCommandDelivery
-          ? { startupCommandDelivery: options.startupCommandDelivery }
-          : {}),
-        ...(options?.agentPrompt ? { agentPrompt: options.agentPrompt } : {}),
-        ...(agent ? { agent } : {}),
-        activate: false,
-        select: true,
-        navigation: 'caller'
-      })
+      const authority = await assertMobileTerminalAttributionDisableSupported(client)
+      const response = await client.sendRequest(
+        'session.tabs.createTerminal',
+        {
+          worktree: `id:${worktreeId}`,
+          afterTabId: activeSessionTabId ?? undefined,
+          clientMutationId,
+          ...(options?.startupCommand ? { command: options.startupCommand } : {}),
+          ...(options?.startupCommandDelivery
+            ? { startupCommandDelivery: options.startupCommandDelivery }
+            : {}),
+          env: withLegacyTerminalAttributionDisabledEnv(undefined),
+          envToDelete: addLegacyTerminalAttributionDisableRequest(undefined),
+          ...(options?.agentPrompt ? { agentPrompt: options.agentPrompt } : {}),
+          ...(agent ? { agent } : {}),
+          activate: false,
+          select: true,
+          navigation: 'caller'
+        },
+        { ...MOBILE_TERMINAL_CREATE_RPC_OPTIONS, expectedRuntimeId: authority.runtimeId }
+      )
       if (response.ok) {
         const result = (response as RpcSuccess).result as TerminalCreateResult
         const created = result.tab
@@ -3763,10 +3794,17 @@ export default function SessionScreen() {
           showToast(message, 1800)
         }
       }
-    } catch {
-      const message = options?.errorToast ?? 'Failed to create terminal'
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : null
+      const message =
+        errorMessage === MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE
+          ? errorMessage
+          : (options?.errorToast ?? errorMessage ?? 'Failed to create terminal')
       setCreateError(message)
-      if (options?.errorToast) {
+      if (
+        options?.errorToast ||
+        errorMessage === MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE
+      ) {
         triggerError()
         showToast(message, 1800)
       }
diff --git a/mobile/fastlane/Fastfile b/mobile/fastlane/Fastfile
index 6e66a72bada..204c14672b6 100644
--- a/mobile/fastlane/Fastfile
+++ b/mobile/fastlane/Fastfile
@@ -253,6 +253,9 @@ platform :ios do
     upload_to_testflight(
       api_key: api_key,
       app_identifier: BUNDLE_ID,
+      # distribute_only means there is no local .ipa to sniff, so fastlane would
+      # otherwise fall through to an interactive platform prompt and crash in CI.
+      app_platform: "ios",
       app_version: version,
       build_number: build_number,
       distribute_only: true,
diff --git a/mobile/src/components/markdown-file-path-detection.ts b/mobile/src/components/markdown-file-path-detection.ts
index 5e320a3f10c..c51151b9ebf 100644
--- a/mobile/src/components/markdown-file-path-detection.ts
+++ b/mobile/src/components/markdown-file-path-detection.ts
@@ -3,6 +3,8 @@
 // viewer). We deliberately favor precision over recall: a missed path is a minor
 // annoyance, but a false positive on prose or a version number is a broken tap.
 
+import { parseFileLinkLocation } from '../../../src/shared/file-link-location'
+
 export type FilePathSegment =
   | { type: 'text'; value: string }
   | { type: 'file'; value: string; path: string }
@@ -101,8 +103,6 @@ function hasMidTokenAt(candidate: string): boolean {
   return /[^\\/]@/.test(candidate)
 }
 
-const LINE_SUFFIX_PATTERN = /^(.+?):([1-9]\d*)(?::([1-9]\d*))?$/
-
 /**
  * Split an agent-style `path:line(:col)` citation into its parts. Windows drive
  * colons are safe: only a trailing all-digit suffix is treated as a line ref.
@@ -112,14 +112,14 @@ export function splitFilePathLineSuffix(pathText: string): {
   line: number | null
   column: number | null
 } {
-  const match = LINE_SUFFIX_PATTERN.exec(pathText)
-  if (!match) {
+  const parsed = parseFileLinkLocation(pathText)
+  if (!parsed || (parsed.line === null && parsed.column === null)) {
     return { path: pathText, line: null, column: null }
   }
   return {
-    path: match[1]!,
-    line: Number.parseInt(match[2]!, 10),
-    column: match[3] ? Number.parseInt(match[3], 10) : null
+    path: parsed.pathText,
+    line: parsed.line,
+    column: parsed.column
   }
 }
 
diff --git a/mobile/src/components/mobile-markdown-preview-html.ts b/mobile/src/components/mobile-markdown-preview-html.ts
index 8b2d247f8f2..8bb5fca0934 100644
--- a/mobile/src/components/mobile-markdown-preview-html.ts
+++ b/mobile/src/components/mobile-markdown-preview-html.ts
@@ -97,7 +97,7 @@ function attrValue(tag: string, name: string): string {
     const valueStart = cursor
     if (quote) {
       const valueEnd = tag.indexOf(quote, cursor)
-      if (valueEnd < 0) {
+      if (valueEnd === -1) {
         return ''
       }
       cursor = valueEnd + 1
diff --git a/mobile/src/components/mobile-markdown-preview-tag-stripper.ts b/mobile/src/components/mobile-markdown-preview-tag-stripper.ts
index 90e3c3cc3cc..6eeca2aa612 100644
--- a/mobile/src/components/mobile-markdown-preview-tag-stripper.ts
+++ b/mobile/src/components/mobile-markdown-preview-tag-stripper.ts
@@ -191,7 +191,7 @@ function closingMarkupTagNames(value: string): Set<string> {
   let cursor = 0
   while (cursor < value.length) {
     const start = value.indexOf('<', cursor)
-    if (start < 0) {
+    if (start === -1) {
       return names
     }
     const end = findMobileMarkdownMarkupTagEnd(value, start + 1)
@@ -228,7 +228,7 @@ export function stripMobileMarkdownMarkupTags(value: string): string {
   const closingTagNames = closingMarkupTagNames(value)
   while (cursor < value.length) {
     const start = value.indexOf('<', cursor)
-    if (start < 0) {
+    if (start === -1) {
       return output + value.slice(cursor)
     }
     output += value.slice(cursor, start)
@@ -261,7 +261,7 @@ export function stripMobileMarkdownMarkupTags(value: string): string {
         !/[-:]/.test(name) &&
         !knownMarkupTagNames.has(lowerName) &&
         !closingTagNames.has(lowerName)
-      if (isNestedGeneric && nestedStart >= 0) {
+      if (isNestedGeneric && nestedStart !== -1) {
         output += value.slice(start, nestedStart)
         cursor = nestedStart
         continue
diff --git a/mobile/src/files/MobileFilePreviewScreen.test.ts b/mobile/src/files/MobileFilePreviewScreen.test.ts
index 1595454a12a..fa61f7351c6 100644
--- a/mobile/src/files/MobileFilePreviewScreen.test.ts
+++ b/mobile/src/files/MobileFilePreviewScreen.test.ts
@@ -39,6 +39,21 @@ describe('MobileFilePreviewScreen', () => {
     ).toBe(false)
   })
 
+  it('treats native-chat artifact grants as read-only', () => {
+    expect(
+      isEditableMobileTerminalArtifactPreview(
+        {
+          status: 'ready',
+          kind: 'text',
+          content: '<h1>Result</h1>',
+          truncated: false,
+          byteLength: 15
+        },
+        true
+      )
+    ).toBe(false)
+  })
+
   it('keeps dirty terminal artifact drafts protected while preview is waiting for reconnect', () => {
     const sourceKey = sourceKeyForPreview({
       source: 'terminalArtifact',
diff --git a/mobile/src/files/MobileFilePreviewScreen.tsx b/mobile/src/files/MobileFilePreviewScreen.tsx
index 0879e02ec7e..3f56890243a 100644
--- a/mobile/src/files/MobileFilePreviewScreen.tsx
+++ b/mobile/src/files/MobileFilePreviewScreen.tsx
@@ -181,7 +181,8 @@ export function MobileFilePreviewScreen({ route }: Props) {
   )
   const meta = previewParams ? `${worktreeLabel} - ${displayPath}` : 'Preview'
   const isEditableTerminalArtifact =
-    previewSource?.source === 'terminalArtifact' && isEditableMobileTerminalArtifactPreview(preview)
+    previewSource?.source === 'terminalArtifact' &&
+    isEditableMobileTerminalArtifactPreview(preview, previewSource.readOnly === true)
   const canSaveArtifact =
     isEditableTerminalArtifact &&
     draftSourceKeyRef.current === previewSourceKey &&
diff --git a/mobile/src/files/file-tree.ts b/mobile/src/files/file-tree.ts
index 71f26ca155b..8a3e795ac2d 100644
--- a/mobile/src/files/file-tree.ts
+++ b/mobile/src/files/file-tree.ts
@@ -132,7 +132,7 @@ export function getDirectoryCacheState(
 ): DirectoryState | undefined {
   // Why: repository paths are arbitrary object keys; inherited keys like
   // "constructor" must not masquerade as loaded directory state.
-  return Object.prototype.hasOwnProperty.call(cache, relativePath) ? cache[relativePath] : undefined
+  return Object.hasOwn(cache, relativePath) ? cache[relativePath] : undefined
 }
 
 export function joinRelativePath(parentPath: string, name: string): string {
diff --git a/mobile/src/files/mobile-file-preview-editability.ts b/mobile/src/files/mobile-file-preview-editability.ts
index ff0fa18d3cb..d8ed196e5cb 100644
--- a/mobile/src/files/mobile-file-preview-editability.ts
+++ b/mobile/src/files/mobile-file-preview-editability.ts
@@ -3,7 +3,13 @@ import type {
   MobileFilePreviewSource
 } from './mobile-file-preview-request'
 
-export function isEditableMobileTerminalArtifactPreview(preview: MobileFilePreviewResult): boolean {
+export function isEditableMobileTerminalArtifactPreview(
+  preview: MobileFilePreviewResult,
+  readOnly = false
+): boolean {
+  if (readOnly) {
+    return false
+  }
   return (
     (preview.status === 'ready' && preview.kind !== 'image' && !preview.truncated) ||
     preview.status === 'empty'
diff --git a/mobile/src/files/mobile-file-preview-request.test.ts b/mobile/src/files/mobile-file-preview-request.test.ts
index f7f77fabd19..fe15cad0b07 100644
--- a/mobile/src/files/mobile-file-preview-request.test.ts
+++ b/mobile/src/files/mobile-file-preview-request.test.ts
@@ -179,6 +179,47 @@ describe('mobile-file-preview-request', () => {
     })
   })
 
+  it('refreshes a native-chat artifact grant with the same transcript provenance', async () => {
+    const client = clientWithResponses([
+      fail('terminal_file_grant_expired'),
+      ok({
+        exists: true,
+        isDirectory: false,
+        openTarget: {
+          kind: 'absolute-file',
+          absolutePath: '/Users/ada/orca-plans/result.html',
+          grantId: 'grant-2',
+          readOnly: true
+        }
+      }),
+      ok({ content: '<h1>Result</h1>', truncated: false, byteLength: 15 })
+    ])
+
+    const onTerminalArtifactSourceRefreshed = vi.fn()
+    await loadMobileFilePreview(
+      client,
+      {
+        source: 'terminalArtifact',
+        worktreeId: 'wt-1',
+        absolutePath: '/Users/ada/orca-plans/result.html',
+        grantId: 'grant-1',
+        pathText: '~/orca-plans/result.html',
+        nativeChatContext: { tabId: 'tab-1', sessionId: 'session-1' }
+      },
+      undefined,
+      { onTerminalArtifactSourceRefreshed }
+    )
+
+    expect(client.sendRequest).toHaveBeenNthCalledWith(2, 'files.resolveTerminalPath', {
+      worktree: 'id:wt-1',
+      pathText: '~/orca-plans/result.html',
+      nativeChatContext: { tabId: 'tab-1', sessionId: 'session-1' }
+    })
+    expect(onTerminalArtifactSourceRefreshed).toHaveBeenCalledWith(
+      expect.objectContaining({ grantId: 'grant-2', readOnly: true })
+    )
+  })
+
   it.each([
     ['terminal_file_grant_expired'],
     ['terminal_file_grant_mismatch'],
@@ -242,6 +283,25 @@ describe('mobile-file-preview-request', () => {
     })
   })
 
+  it('does not send writes for read-only native-chat artifacts', async () => {
+    const client = clientWith(ok({ ok: true }))
+
+    await expect(
+      saveMobileTerminalArtifactPreview(
+        client,
+        {
+          source: 'terminalArtifact',
+          worktreeId: 'wt-1',
+          absolutePath: '/Users/ada/orca-plans/result.html',
+          grantId: 'grant-1',
+          readOnly: true
+        },
+        '<h1>Changed</h1>'
+      )
+    ).resolves.toMatchObject({ status: 'error' })
+    expect(client.sendRequest).not.toHaveBeenCalled()
+  })
+
   it('does not refresh and retry a failed terminal artifact save without a base content check', async () => {
     const client = clientWithResponses([fail('terminal_file_grant_mismatch')])
 
diff --git a/mobile/src/files/mobile-file-preview-request.ts b/mobile/src/files/mobile-file-preview-request.ts
index ff6cd755c50..63b61326654 100644
--- a/mobile/src/files/mobile-file-preview-request.ts
+++ b/mobile/src/files/mobile-file-preview-request.ts
@@ -116,6 +116,9 @@ export async function saveMobileTerminalArtifactPreview(
   content: string,
   options: TerminalArtifactSaveOptions = {}
 ): Promise<MobileFilePreviewResult | { status: 'saved' }> {
+  if (source.readOnly) {
+    return previewError('This file is read-only')
+  }
   let writeSource = source
   if (typeof options.baseContent === 'string') {
     const verified = await verifyTerminalArtifactBaseContent(
diff --git a/mobile/src/files/mobile-file-preview-route.test.ts b/mobile/src/files/mobile-file-preview-route.test.ts
index ac1888ed46f..784313464ee 100644
--- a/mobile/src/files/mobile-file-preview-route.test.ts
+++ b/mobile/src/files/mobile-file-preview-route.test.ts
@@ -65,6 +65,8 @@ describe('mobile-file-preview-route', () => {
       terminal: 'term-1',
       pathText: 'result.json',
       cwd: '/tmp/run',
+      nativeChatTab: 'tab-1',
+      nativeChatSession: 'session-1',
       line: '12',
       column: '3'
     })
@@ -80,6 +82,8 @@ describe('mobile-file-preview-route', () => {
         terminal: 'term-1',
         pathText: 'result.json',
         cwd: '/tmp/run',
+        nativeChatTab: 'tab-1',
+        nativeChatSession: 'session-1',
         line: '12',
         column: '3'
       }
diff --git a/mobile/src/files/mobile-file-preview-route.ts b/mobile/src/files/mobile-file-preview-route.ts
index 1b277de7faa..f0e7dfbbf49 100644
--- a/mobile/src/files/mobile-file-preview-route.ts
+++ b/mobile/src/files/mobile-file-preview-route.ts
@@ -10,6 +10,8 @@ export type MobileFilePreviewRouteParams = {
   terminal?: string
   pathText?: string
   cwd?: string
+  nativeChatTab?: string
+  nativeChatSession?: string
   line?: string
   column?: string
   name?: string
@@ -35,6 +37,8 @@ type RawPreviewRouteParams = {
   terminal?: MobileFilePreviewParamValue
   pathText?: MobileFilePreviewParamValue
   cwd?: MobileFilePreviewParamValue
+  nativeChatTab?: MobileFilePreviewParamValue
+  nativeChatSession?: MobileFilePreviewParamValue
   line?: MobileFilePreviewParamValue
   column?: MobileFilePreviewParamValue
   name?: MobileFilePreviewParamValue
@@ -76,6 +80,8 @@ export function normalizeMobileFilePreviewRouteParams(
         terminal: optionalSingleParam(params.terminal),
         pathText: optionalSingleParam(params.pathText),
         cwd: optionalSingleParam(params.cwd),
+        nativeChatTab: optionalSingleParam(params.nativeChatTab),
+        nativeChatSession: optionalSingleParam(params.nativeChatSession),
         line: optionalSingleParam(params.line),
         column: optionalSingleParam(params.column),
         name: optionalSingleParam(params.name),
diff --git a/mobile/src/files/mobile-file-preview-source.test.ts b/mobile/src/files/mobile-file-preview-source.test.ts
index b5fec782cfc..9c326fd0278 100644
--- a/mobile/src/files/mobile-file-preview-source.test.ts
+++ b/mobile/src/files/mobile-file-preview-source.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { sourceKeyForPreview } from './mobile-file-preview-source'
+import { previewSourceFromRoute, sourceKeyForPreview } from './mobile-file-preview-source'
 
 describe('mobile-file-preview-source', () => {
   it('uses structured preview keys so colons in paths cannot collide', () => {
@@ -25,4 +25,21 @@ describe('mobile-file-preview-source', () => {
       sourceKeyForPreview({ source: 'worktree', worktreeId: 'wt:1', relativePath: 'a:b.ts' })
     ).toBe(JSON.stringify(['worktree', 'wt:1', 'a:b.ts']))
   })
+
+  it('makes native-chat artifact previews read-only', () => {
+    expect(
+      previewSourceFromRoute({
+        hostId: 'host-1',
+        worktreeId: 'wt-1',
+        source: 'terminalArtifact',
+        absolutePath: '/tmp/result.html',
+        grantId: 'grant-1',
+        nativeChatTab: 'tab-1',
+        nativeChatSession: 'session-1'
+      })
+    ).toMatchObject({
+      nativeChatContext: { tabId: 'tab-1', sessionId: 'session-1' },
+      readOnly: true
+    })
+  })
 })
diff --git a/mobile/src/files/mobile-file-preview-source.ts b/mobile/src/files/mobile-file-preview-source.ts
index b1b23757a6e..2c1f01631e6 100644
--- a/mobile/src/files/mobile-file-preview-source.ts
+++ b/mobile/src/files/mobile-file-preview-source.ts
@@ -15,7 +15,16 @@ export function previewSourceFromRoute(
       grantId: params.grantId,
       ...(params.terminal ? { terminalHandle: params.terminal } : {}),
       ...(params.pathText ? { pathText: params.pathText } : {}),
-      ...(params.cwd ? { cwd: params.cwd } : {})
+      ...(params.cwd ? { cwd: params.cwd } : {}),
+      ...(params.nativeChatTab && params.nativeChatSession
+        ? {
+            nativeChatContext: {
+              tabId: params.nativeChatTab,
+              sessionId: params.nativeChatSession
+            },
+            readOnly: true as const
+          }
+        : {})
     }
   }
   if (!params.relativePath) {
@@ -28,12 +37,12 @@ export function sourceKeyForPreview(source: MobileFilePreviewSource | null): str
   if (!source) {
     return null
   }
-  return source.source === 'terminalArtifact'
-    ? JSON.stringify([
-        'terminal',
-        source.worktreeId,
-        source.absolutePath,
-        source.terminalHandle ?? ''
-      ])
-    : JSON.stringify(['worktree', source.worktreeId, source.relativePath])
+  if (source.source !== 'terminalArtifact') {
+    return JSON.stringify(['worktree', source.worktreeId, source.relativePath])
+  }
+  const key = ['terminal', source.worktreeId, source.absolutePath, source.terminalHandle ?? '']
+  if (source.nativeChatContext) {
+    key.push(source.nativeChatContext.tabId, source.nativeChatContext.sessionId)
+  }
+  return JSON.stringify(key)
 }
diff --git a/mobile/src/files/mobile-terminal-artifact-grant-refresh.ts b/mobile/src/files/mobile-terminal-artifact-grant-refresh.ts
index a8864119be4..cbe5ffdebd8 100644
--- a/mobile/src/files/mobile-terminal-artifact-grant-refresh.ts
+++ b/mobile/src/files/mobile-terminal-artifact-grant-refresh.ts
@@ -1,3 +1,4 @@
+import type { RuntimeNativeChatFileContext } from '../../../src/shared/runtime-types'
 import type { RpcClient } from '../transport/rpc-client'
 import type { RpcFailure, RpcResponse, RpcSuccess } from '../transport/types'
 import { isTerminalArtifactGrantError } from './terminal-artifact-grant-error'
@@ -12,6 +13,8 @@ export type MobileTerminalArtifactPreviewSource = {
   terminalHandle?: string
   pathText?: string
   cwd?: string
+  nativeChatContext?: RuntimeNativeChatFileContext
+  readOnly?: true
 }
 
 export type TerminalArtifactRetryOptions = {
@@ -32,7 +35,8 @@ export async function refreshTerminalArtifactSourceAfterGrantFailure(
     worktree: `id:${source.worktreeId}`,
     pathText: source.pathText ?? source.absolutePath,
     ...(source.cwd ? { cwd: source.cwd } : {}),
-    ...(source.terminalHandle ? { terminal: source.terminalHandle } : {})
+    ...(source.terminalHandle ? { terminal: source.terminalHandle } : {}),
+    ...(source.nativeChatContext ? { nativeChatContext: source.nativeChatContext } : {})
   })
   if (!refreshed.ok) {
     return null
@@ -51,7 +55,9 @@ export async function refreshTerminalArtifactSourceAfterGrantFailure(
     grantId: result.openTarget.grantId,
     ...(source.terminalHandle ? { terminalHandle: source.terminalHandle } : {}),
     ...(source.pathText ? { pathText: source.pathText } : {}),
-    ...(source.cwd ? { cwd: source.cwd } : {})
+    ...(source.cwd ? { cwd: source.cwd } : {}),
+    ...(source.nativeChatContext ? { nativeChatContext: source.nativeChatContext } : {}),
+    ...(source.readOnly || result.openTarget.readOnly === true ? { readOnly: true as const } : {})
   }
 }
 
@@ -68,7 +74,7 @@ function isTerminalArtifactGrantFailure(
 function isTerminalArtifactResolution(result: unknown): result is {
   exists: true
   isDirectory: false
-  openTarget: { kind: 'absolute-file'; absolutePath: string; grantId: string }
+  openTarget: { kind: 'absolute-file'; absolutePath: string; grantId: string; readOnly?: true }
 } {
   if (!result || typeof result !== 'object') {
     return false
diff --git a/mobile/src/hooks/use-active-worktree-scroll.ts b/mobile/src/hooks/use-active-worktree-scroll.ts
index 7600f3ceafe..ff0441c85a8 100644
--- a/mobile/src/hooks/use-active-worktree-scroll.ts
+++ b/mobile/src/hooks/use-active-worktree-scroll.ts
@@ -37,7 +37,7 @@ export function useActiveWorktreeScroll<T extends WithId, S>(
     (worktreeId: string): boolean => {
       for (let sectionIndex = 0; sectionIndex < sections.length; sectionIndex++) {
         const itemIndex = sections[sectionIndex].data.findIndex((w) => w.worktreeId === worktreeId)
-        if (itemIndex >= 0) {
+        if (itemIndex !== -1) {
           sectionListRef.current?.scrollToLocation({
             sectionIndex,
             itemIndex,
diff --git a/mobile/src/session/ai-vault-resume-launch.test.ts b/mobile/src/session/ai-vault-resume-launch.test.ts
index 9efc0e50f1a..3e9af99191c 100644
--- a/mobile/src/session/ai-vault-resume-launch.test.ts
+++ b/mobile/src/session/ai-vault-resume-launch.test.ts
@@ -226,6 +226,13 @@ describe('resumeAiVaultSessionInTerminal', () => {
   it('creates a fresh terminal and sends the command with Enter', async () => {
     const sendRequest = vi
       .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        result: {
+          runtimeId: 'runtime',
+          capabilities: ['terminal.attribution-removed.v1']
+        }
+      })
       .mockResolvedValueOnce({
         ok: true,
         result: { tab: { type: 'terminal', id: 'tab-1', terminal: 'pty-1', title: 'Terminal' } }
@@ -249,13 +256,20 @@ describe('resumeAiVaultSessionInTerminal', () => {
         navigation: 'caller'
       })
     ).resolves.toMatchObject({ id: 'tab-1', terminal: 'pty-1' })
+    expect(sendRequest).toHaveBeenNthCalledWith(1, 'status.get', undefined, {
+      timeoutMs: 30_000,
+      budgetSpansConnect: true
+    })
     expect(sendRequest).toHaveBeenNthCalledWith(
-      1,
+      2,
       'session.tabs.createTerminal',
       {
         worktree: 'id:worktree-1',
-        env: { ANTHROPIC_BASE_URL: 'http://localhost:3000' },
-        envToDelete: ['CODEX_HOME', 'ORCA_CODEX_HOME'],
+        env: {
+          ANTHROPIC_BASE_URL: 'http://localhost:3000',
+          ORCA_ATTRIBUTION_BYPASS: '1'
+        },
+        envToDelete: ['CODEX_HOME', 'ORCA_CODEX_HOME', 'ORCA_ENABLE_GIT_ATTRIBUTION'],
         launchConfig: {
           agentCommand: 'claude',
           agentArgs: '',
@@ -269,10 +283,14 @@ describe('resumeAiVaultSessionInTerminal', () => {
       },
       // Why: a socket drop mid-resume must reject within the request timeout
       // instead of parking on the reconnect waiter with the spinner pinned.
-      { timeoutMs: RESUME_RPC_TIMEOUT_MS }
+      {
+        timeoutMs: RESUME_RPC_TIMEOUT_MS,
+        budgetSpansConnect: true,
+        expectedRuntimeId: 'runtime'
+      }
     )
     expect(sendRequest).toHaveBeenNthCalledWith(
-      2,
+      3,
       'terminal.send',
       {
         terminal: 'pty-1',
@@ -284,17 +302,35 @@ describe('resumeAiVaultSessionInTerminal', () => {
   })
 
   it('throws when terminal creation fails', async () => {
-    const sendRequest = vi.fn().mockResolvedValueOnce({
-      ok: false,
-      error: { message: 'no terminal' }
-    })
+    const sendRequest = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        result: {
+          runtimeId: 'runtime',
+          capabilities: ['terminal.attribution-removed.v1']
+        }
+      })
+      .mockResolvedValueOnce({
+        ok: false,
+        error: { message: 'no terminal' }
+      })
     await expect(
       resumeAiVaultSessionInTerminal({ sendRequest }, 'worktree-1', { command: 'command' })
     ).rejects.toThrow('no terminal')
   })
 
   it('throws when the created terminal response is malformed', async () => {
-    const sendRequest = vi.fn().mockResolvedValueOnce({ ok: true, result: { tab: { id: 'x' } } })
+    const sendRequest = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        result: {
+          runtimeId: 'runtime',
+          capabilities: ['terminal.attribution-removed.v1']
+        }
+      })
+      .mockResolvedValueOnce({ ok: true, result: { tab: { id: 'x' } } })
     await expect(
       resumeAiVaultSessionInTerminal({ sendRequest }, 'worktree-1', { command: 'command' })
     ).rejects.toThrow('Created terminal response was invalid')
@@ -303,6 +339,13 @@ describe('resumeAiVaultSessionInTerminal', () => {
   it('throws when terminal send fails or is locked', async () => {
     const failedSend = vi
       .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        result: {
+          runtimeId: 'runtime',
+          capabilities: ['terminal.attribution-removed.v1']
+        }
+      })
       .mockResolvedValueOnce({
         ok: true,
         result: { tab: { type: 'terminal', id: 'tab-1', terminal: 'pty-1' } }
@@ -316,6 +359,13 @@ describe('resumeAiVaultSessionInTerminal', () => {
 
     const lockedSend = vi
       .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        result: {
+          runtimeId: 'runtime',
+          capabilities: ['terminal.attribution-removed.v1']
+        }
+      })
       .mockResolvedValueOnce({
         ok: true,
         result: { tab: { type: 'terminal', id: 'tab-1', terminal: 'pty-1' } }
@@ -327,6 +377,17 @@ describe('resumeAiVaultSessionInTerminal', () => {
       })
     ).rejects.toThrow('Terminal input is locked')
   })
+
+  it('refuses an old host before creating a resume terminal', async () => {
+    const sendRequest = vi
+      .fn()
+      .mockResolvedValueOnce({ ok: true, result: { appVersion: '1.4.89' } })
+
+    await expect(
+      resumeAiVaultSessionInTerminal({ sendRequest }, 'worktree-1', { command: 'command' })
+    ).rejects.toThrow('Update the host and try again')
+    expect(sendRequest).toHaveBeenCalledTimes(1)
+  })
 })
 
 describe('createMobileAiVaultResumeMutationRegistry', () => {
diff --git a/mobile/src/session/ai-vault-resume-launch.ts b/mobile/src/session/ai-vault-resume-launch.ts
index aa8c1bf98a6..6975b6f355d 100644
--- a/mobile/src/session/ai-vault-resume-launch.ts
+++ b/mobile/src/session/ai-vault-resume-launch.ts
@@ -16,6 +16,10 @@ import { normalizeAiVaultResumeFilePath } from '../../../src/shared/ai-vault-res
 import type { TuiAgent } from '../../../src/shared/types'
 import { parseWslUncPath } from '../../../src/shared/wsl-paths'
 import { resolveWindowsShellStartupFamily } from '../../../src/shared/windows-terminal-shell'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  withLegacyTerminalAttributionDisabledEnv
+} from '../../../src/shared/legacy-terminal-attribution-env'
 import type { RpcClient } from '../transport/rpc-client'
 import {
   readMobileReviewCreatedTerminal,
@@ -23,6 +27,7 @@ import {
   type MobileReviewTerminalTab
 } from './mobile-diff-review-rpc'
 import type { MobileAiVaultResumeTargetStatus } from '../agent-history/agent-history-resume-target'
+import { assertMobileTerminalAttributionDisableSupported } from './mobile-terminal-attribution-compat'
 
 const NODE_PLATFORMS = new Set<NodeJS.Platform>([
   'aix',
@@ -169,12 +174,13 @@ export async function resumeAiVaultSessionInTerminal(
   worktreeId: string,
   launch: MobileAiVaultResumeLaunch & { clientMutationId?: string }
 ): Promise<MobileReviewTerminalTab> {
+  const authority = await assertMobileTerminalAttributionDisableSupported(client)
   const created = await client.sendRequest(
     'session.tabs.createTerminal',
     {
       worktree: `id:${worktreeId}`,
-      ...(launch.env ? { env: launch.env } : {}),
-      ...(launch.envToDelete ? { envToDelete: launch.envToDelete } : {}),
+      env: withLegacyTerminalAttributionDisabledEnv(launch.env),
+      envToDelete: addLegacyTerminalAttributionDisableRequest(launch.envToDelete),
       ...(launch.launchConfig ? { launchConfig: launch.launchConfig } : {}),
       ...(launch.launchAgent ? { launchAgent: launch.launchAgent } : {}),
       ...(launch.clientMutationId ? { clientMutationId: launch.clientMutationId } : {}),
@@ -182,7 +188,11 @@ export async function resumeAiVaultSessionInTerminal(
       select: true,
       navigation: 'caller'
     },
-    { timeoutMs: RESUME_RPC_TIMEOUT_MS }
+    {
+      timeoutMs: RESUME_RPC_TIMEOUT_MS,
+      budgetSpansConnect: true,
+      expectedRuntimeId: authority.runtimeId
+    }
   )
   if (!created.ok) {
     throw new Error(created.error?.message || 'Failed to create terminal')
diff --git a/mobile/src/session/ai-vault-resume-preparation.test.ts b/mobile/src/session/ai-vault-resume-preparation.test.ts
index a0eed5515c6..3e64a06a0f8 100644
--- a/mobile/src/session/ai-vault-resume-preparation.test.ts
+++ b/mobile/src/session/ai-vault-resume-preparation.test.ts
@@ -53,6 +53,14 @@ describe('prepareMobileAiVaultSessionResume', () => {
     const sendRequest = vi
       .fn()
       .mockResolvedValueOnce({ ok: false, error })
+      .mockResolvedValueOnce({
+        ok: true,
+        result: {
+          runtimeId: 'runtime-1',
+          appVersion: '1.4.90',
+          capabilities: ['terminal.attribution-removed.v1']
+        }
+      })
       .mockResolvedValueOnce({
         ok: true,
         result: { tab: { type: 'terminal', id: 'tab-1', terminal: 'pty-1', title: 'Terminal' } }
@@ -64,9 +72,12 @@ describe('prepareMobileAiVaultSessionResume', () => {
     await resumeAiVaultSessionInTerminal({ sendRequest }, 'worktree-1', launch)
 
     expect(prepared).toBe(legacy)
-    expect(sendRequest.mock.calls[1]?.[1]).not.toHaveProperty('envToDelete')
+    expect(sendRequest.mock.calls[2]?.[1]).toMatchObject({
+      env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+      envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION']
+    })
     expect(sendRequest).toHaveBeenNthCalledWith(
-      3,
+      4,
       'terminal.send',
       {
         terminal: 'pty-1',
diff --git a/mobile/src/session/mobile-diff-review-screen-model.ts b/mobile/src/session/mobile-diff-review-screen-model.ts
index 3dcaed35716..f8f1ceedf99 100644
--- a/mobile/src/session/mobile-diff-review-screen-model.ts
+++ b/mobile/src/session/mobile-diff-review-screen-model.ts
@@ -100,7 +100,7 @@ export function nextReviewIndexAfterMarkReviewed({
   const wrappedIndex = filteredQueue.findIndex(
     (item) => item.key !== currentItemKey && !item.isReviewed
   )
-  const targetIndex = nextIndex >= 0 ? nextIndex : wrappedIndex >= 0 ? wrappedIndex : null
+  const targetIndex = nextIndex !== -1 ? nextIndex : wrappedIndex !== -1 ? wrappedIndex : null
   if (targetIndex === null) {
     return null
   }
diff --git a/mobile/src/session/mobile-file-tap-open.ts b/mobile/src/session/mobile-file-tap-open.ts
index 627d9a5ff39..13c306af649 100644
--- a/mobile/src/session/mobile-file-tap-open.ts
+++ b/mobile/src/session/mobile-file-tap-open.ts
@@ -1,5 +1,6 @@
 import type {
   RuntimeFileOpenResult,
+  RuntimeNativeChatFileContext,
   RuntimeTerminalPathResolution
 } from '../../../src/shared/runtime-types'
 import { filesystemPathToFileUri } from '../../../src/shared/file-uri-path'
@@ -22,6 +23,7 @@ export type OpenMobileFileTapOptions<T extends FileTapSessionTab> = {
   terminalHandle?: string | null
   pathText: string
   cwd?: string | null
+  nativeChatContext?: RuntimeNativeChatFileContext | null
   line: number | null
   column: number | null
   pushPreviewRoute: (href: ReturnType<typeof createMobileFilePreviewHref>) => void
@@ -80,7 +82,8 @@ async function openMobileFileTapAsync<T extends FileTapSessionTab>(
       ...(options.terminalHandle && options.terminalHandle.trim().length > 0
         ? { terminal: options.terminalHandle }
         : {}),
-      ...(options.cwd && options.cwd.trim().length > 0 ? { cwd: options.cwd } : {})
+      ...(options.cwd && options.cwd.trim().length > 0 ? { cwd: options.cwd } : {}),
+      ...(options.nativeChatContext ? { nativeChatContext: options.nativeChatContext } : {})
     },
     { timeoutMs: 10_000 }
   )
@@ -116,6 +119,12 @@ async function openMobileFileTapAsync<T extends FileTapSessionTab>(
         ...(options.terminalHandle && options.terminalHandle.trim().length > 0
           ? { terminal: options.terminalHandle }
           : {}),
+        ...(options.nativeChatContext
+          ? {
+              nativeChatTab: options.nativeChatContext.tabId,
+              nativeChatSession: options.nativeChatContext.sessionId
+            }
+          : {}),
         name: displayNameFromPath(resolved.openTarget.absolutePath),
         ...(options.line !== null ? { line: String(options.line) } : {}),
         ...(options.column !== null ? { column: String(options.column) } : {}),
diff --git a/mobile/src/session/mobile-native-chat-draft-reconcile.test.ts b/mobile/src/session/mobile-native-chat-draft-reconcile.test.ts
index 4c0cee804c1..b7453e7a67d 100644
--- a/mobile/src/session/mobile-native-chat-draft-reconcile.test.ts
+++ b/mobile/src/session/mobile-native-chat-draft-reconcile.test.ts
@@ -2,8 +2,10 @@ import { describe, expect, it } from 'vitest'
 import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
 import {
   findLandedImagePreviewEchoes,
+  findLandedUnconfirmedSends,
   migrateImagePreviewMessageIds,
-  type PendingImagePreviewEcho
+  type PendingImagePreviewEcho,
+  type UnconfirmedSend
 } from './mobile-native-chat-draft-reconcile'
 
 function userText(id: string, text: string): NativeChatMessage {
@@ -21,6 +23,67 @@ function pending(id: string, images: string[], expectedOccurrence = 1): PendingI
 }
 
 describe('mobile native chat image preview reconciliation', () => {
+  it('reconciles a trailing-marker echo and hands its preview to that echo', () => {
+    const messages = [
+      userText('source', '[Image: source: /tmp/a.png]'),
+      userText('prompt', 'look at this[Image #1]')
+    ]
+    const preview = {
+      ...pending('pending', ['file:///a.jpg']),
+      text: 'look at this'
+    }
+    const unconfirmed: UnconfirmedSend = {
+      draftKey: 'draft',
+      pendingKey: 'pending-key',
+      text: 'look at this',
+      normalizedText: 'look at this',
+      baselineTailMessageId: null,
+      deadline: null
+    }
+
+    expect(findLandedUnconfirmedSends(messages, [unconfirmed])).toEqual([unconfirmed])
+    expect(findLandedImagePreviewEchoes(messages, [preview])).toEqual([
+      { pendingId: 'pending', messageId: 'prompt', images: ['file:///a.jpg'] }
+    ])
+  })
+
+  it('reconciles a middle-marker echo without changing its rendered whitespace', () => {
+    const messages = [
+      userText('source', '[Image: source: /tmp/a.png]'),
+      userText('prompt', 'look [Image #1] here')
+    ]
+    const preview = { ...pending('pending', ['file:///a.jpg']), text: 'look here' }
+    const unconfirmed: UnconfirmedSend = {
+      draftKey: 'draft',
+      pendingKey: 'pending-key',
+      text: 'look here',
+      normalizedText: 'look here',
+      baselineTailMessageId: null,
+      deadline: null
+    }
+
+    expect(findLandedUnconfirmedSends(messages, [unconfirmed])).toEqual([unconfirmed])
+    expect(findLandedImagePreviewEchoes(messages, [preview])).toEqual([
+      { pendingId: 'pending', messageId: 'prompt', images: ['file:///a.jpg'] }
+    ])
+  })
+
+  it('reconciles multiple transcript text blocks with desktop separators', () => {
+    const prompt: NativeChatMessage = {
+      ...userText('prompt', 'unused'),
+      blocks: [
+        { type: 'text', text: 'look' },
+        { type: 'image-ref', path: '/tmp/a.png' },
+        { type: 'text', text: '[Image #1] here' }
+      ]
+    }
+    const preview = { ...pending('pending', ['file:///a.jpg']), text: 'look here' }
+
+    expect(findLandedImagePreviewEchoes([prompt], [preview])).toEqual([
+      { pendingId: 'pending', messageId: 'prompt', images: ['file:///a.jpg'] }
+    ])
+  })
+
   it('keeps separate adjacent image-only sends independently reconcilable', () => {
     const landed = findLandedImagePreviewEchoes(
       [
@@ -69,4 +132,36 @@ describe('mobile native chat image preview reconciliation', () => {
       [sessionKey]: { prompt: ['file:///a.jpg'] }
     })
   })
+
+  it('moves an early standalone preview to a trailing-marker prompt id', () => {
+    const sessionKey = 'host\0worktree\0tab\0session'
+    const previous = { [sessionKey]: { source: ['file:///a.jpg'] } }
+    const messages = [
+      userText('source', '[Image: source: /tmp/a.png]'),
+      userText('prompt', 'look[Image #1]')
+    ]
+
+    expect(migrateImagePreviewMessageIds(previous, sessionKey, messages)).toEqual({
+      [sessionKey]: { prompt: ['file:///a.jpg'] }
+    })
+  })
+
+  it('moves a preview when the prompt marker is in a later text block', () => {
+    const sessionKey = 'host\0worktree\0tab\0session'
+    const previous = { [sessionKey]: { source: ['file:///a.jpg'] } }
+    const prompt: NativeChatMessage = {
+      ...userText('prompt', 'unused'),
+      blocks: [
+        { type: 'text', text: 'look' },
+        { type: 'text', text: '[Image #1] here' }
+      ]
+    }
+
+    expect(
+      migrateImagePreviewMessageIds(previous, sessionKey, [
+        userText('source', '[Image: source: /tmp/a.png]'),
+        prompt
+      ])
+    ).toEqual({ [sessionKey]: { prompt: ['file:///a.jpg'] } })
+  })
 })
diff --git a/mobile/src/session/mobile-native-chat-draft-reconcile.ts b/mobile/src/session/mobile-native-chat-draft-reconcile.ts
index 360fd22587b..a68fe5bcf32 100644
--- a/mobile/src/session/mobile-native-chat-draft-reconcile.ts
+++ b/mobile/src/session/mobile-native-chat-draft-reconcile.ts
@@ -1,9 +1,12 @@
 import { isImageRefBlock, type NativeChatMessage } from '../../../src/shared/native-chat-types'
 import {
+  hasImagePromptMarker,
   isImageSourceUserTurn,
   normalizeImageTranscriptMessages,
-  stripImagePromptMarker
+  normalizeNativeChatUserText,
+  normalizedNativeChatUserMessageText
 } from './mobile-native-chat-image-transcript-markers'
+export { normalizeNativeChatUserText as normalizeReconcileText } from './mobile-native-chat-image-transcript-markers'
 
 /** An ack-lost ('unknown' outcome) send held until its transcript echo lands or
  *  the deadline surfaces the uncertainty. */
@@ -17,17 +20,7 @@ export type UnconfirmedSend = {
 }
 
 export function normalizedUserText(message: NativeChatMessage): string | null {
-  if (message.role !== 'user') {
-    return null
-  }
-  const text = message.blocks
-    .filter((block) => block.type === 'text')
-    .map((block) => (block.type === 'text' ? block.text : ''))
-    .join('')
-  // Claude echoes a captioned image send as `[Image #1] caption` — the sent
-  // text must still match its echo, so strip the marker before comparing.
-  const stripped = stripImagePromptMarker(text).trim()
-  return stripped || null
+  return normalizedNativeChatUserMessageText(message)
 }
 
 export function countUserTextOccurrences(
@@ -87,7 +80,7 @@ export function mergeLandedImagePreviewEchoes(
   const entries = Object.entries(previous[sessionKey] ?? {})
   for (const preview of landed) {
     const existingIndex = entries.findIndex(([messageId]) => messageId === preview.messageId)
-    if (existingIndex >= 0) {
+    if (existingIndex !== -1) {
       entries.splice(existingIndex, 1)
     }
     entries.push([preview.messageId, preview.images])
@@ -117,17 +110,13 @@ function imagePreviewReplacementMessageId(
     nextIndex++
   }
   const prompt = messages[nextIndex]
-  const firstText = prompt?.blocks.find((block) => block.type === 'text')
-  return prompt?.role === 'user' &&
-    prompt.source === source.source &&
-    firstText?.type === 'text' &&
-    stripImagePromptMarker(firstText.text) !== firstText.text
+  return prompt?.role === 'user' && prompt.source === source.source && hasImagePromptMarker(prompt)
     ? prompt.id
     : null
 }
 
 /** Moves previews forward when a progressive source-only transcript frame later
- *  folds into the marker-prefixed prompt with a different authoritative id. */
+ *  folds into the marker-bearing prompt with a different authoritative id. */
 export function migrateImagePreviewMessageIds(
   previous: Record<string, Record<string, string[]>>,
   sessionKey: string,
@@ -171,7 +160,7 @@ export function findLandedImagePreviewEchoes(
     if (!entry.images?.length) {
       continue
     }
-    const targetText = entry.text.trim()
+    const targetText = normalizeNativeChatUserText(entry.text)
     const candidates = normalized.filter((message) => {
       if (message.role !== 'user') {
         return false
diff --git a/mobile/src/session/mobile-native-chat-image-transcript-markers.ts b/mobile/src/session/mobile-native-chat-image-transcript-markers.ts
index 2c1ecc291ff..3c3998349ee 100644
--- a/mobile/src/session/mobile-native-chat-image-transcript-markers.ts
+++ b/mobile/src/session/mobile-native-chat-image-transcript-markers.ts
@@ -1,21 +1,13 @@
 // Single-sources the marker logic (pure functions over shared types):
 // Claude records an attached image as `[Image: source: /path]` (+ `[Image #N]`
-// prefix on the caption turn), and both render and echo reconciliation must
+// on the caption turn), and both render and echo reconciliation must
 // agree with desktop on how those marker turns are interpreted.
 export {
   imageSourcePathFromText,
+  hasImagePromptMarker,
+  isImageSourceUserTurn,
   normalizeImageTranscriptMessages,
+  normalizeNativeChatUserText,
+  normalizedNativeChatUserMessageText,
   stripImagePromptMarker
 } from '../../../src/shared/native-chat-image-transcript-markers'
-import { imageSourcePathFromText } from '../../../src/shared/native-chat-image-transcript-markers'
-import { isTextBlock, type NativeChatMessage } from '../../../src/shared/native-chat-types'
-
-/** A raw (un-normalized) transcript user turn that is an image-source marker —
- *  the echo shape of an image riding along on a send. */
-export function isImageSourceUserTurn(message: NativeChatMessage): boolean {
-  if (message.role !== 'user' || message.blocks.length !== 1) {
-    return false
-  }
-  const block = message.blocks[0]
-  return block !== undefined && isTextBlock(block) && imageSourcePathFromText(block.text) !== null
-}
diff --git a/mobile/src/session/mobile-native-chat-open-file.test.ts b/mobile/src/session/mobile-native-chat-open-file.test.ts
index d44530e5cd0..bef222721ac 100644
--- a/mobile/src/session/mobile-native-chat-open-file.test.ts
+++ b/mobile/src/session/mobile-native-chat-open-file.test.ts
@@ -65,6 +65,54 @@ describe('openMobileNativeChatFileTap', () => {
     )
   })
 
+  it('carries the native-chat session identity into resolution and grant refresh', async () => {
+    const sendRequest = vi.fn(async () =>
+      ok({
+        worktree: 'wt-1',
+        relativePath: null,
+        absolutePath: '/Users/ada/orca-plans/result.html',
+        exists: true,
+        isDirectory: false,
+        openTarget: {
+          kind: 'absolute-file',
+          provider: 'local',
+          absolutePath: '/Users/ada/orca-plans/result.html',
+          grantId: 'grant-1',
+          readOnly: true
+        }
+      })
+    )
+    const options = baseOptions({ sendRequest })
+
+    openMobileNativeChatFileTap({
+      ...options,
+      pathText: '~/orca-plans/result.html',
+      nativeChatContext: { tabId: 'tab-1', sessionId: 'session-1' }
+    })
+    await Promise.resolve()
+
+    expect(sendRequest).toHaveBeenCalledWith(
+      'files.resolveTerminalPath',
+      {
+        worktree: 'id:wt-1',
+        pathText: '~/orca-plans/result.html',
+        crossWorkspace: true,
+        nativeChatContext: { tabId: 'tab-1', sessionId: 'session-1' }
+      },
+      { timeoutMs: 10_000 }
+    )
+    expect(options.pushPreviewRoute).toHaveBeenCalledWith({
+      pathname: '/h/[hostId]/files/preview/[worktreeId]',
+      params: expect.objectContaining({
+        source: 'terminalArtifact',
+        absolutePath: '/Users/ada/orca-plans/result.html',
+        grantId: 'grant-1',
+        nativeChatTab: 'tab-1',
+        nativeChatSession: 'session-1'
+      })
+    })
+  })
+
   it('parses a :line:col citation and opens the mobile preview route', async () => {
     const sendRequest = vi.fn(async () => worktreeFileResolution('src/app.ts'))
     const options = baseOptions({ sendRequest })
diff --git a/mobile/src/session/mobile-native-chat-render-data.test.ts b/mobile/src/session/mobile-native-chat-render-data.test.ts
index c67257ec24d..1a1811f808d 100644
--- a/mobile/src/session/mobile-native-chat-render-data.test.ts
+++ b/mobile/src/session/mobile-native-chat-render-data.test.ts
@@ -92,8 +92,8 @@ describe('buildMobileNativeChatTransientData', () => {
   })
 
   it('folds transcript image marker turns into image-ref blocks (desktop parity)', () => {
-    // Claude records an attached image as `[Image: source: /path]` + an
-    // `[Image #1] `-prefixed caption turn; the fold must merge them into one
+    // Claude records an attached image as `[Image: source: /path]` plus a
+    // caption turn carrying `[Image #1]`; the fold must merge them into one
     // user turn with an image-ref block instead of showing raw marker text.
     const data = build(
       [
@@ -111,6 +111,20 @@ describe('buildMobileNativeChatTransientData', () => {
     ])
   })
 
+  it('folds a trailing-marker image echo into one user bubble', () => {
+    const data = build(
+      [user('u1', '[Image: source: /tmp/a.png]'), user('u2', 'look at this[Image #1]')],
+      null,
+      []
+    )
+
+    expect(data).toHaveLength(1)
+    expect(data[0]?.blocks).toEqual([
+      { type: 'image-ref', path: '/tmp/a.png' },
+      { type: 'text', text: 'look at this' }
+    ])
+  })
+
   it('renders a lone image marker turn (no caption) as an image-ref block', () => {
     const data = build([user('u1', '[Image: source: /tmp/a.png]')], null, [])
     expect(data[0]?.blocks).toEqual([{ type: 'image-ref', path: '/tmp/a.png' }])
diff --git a/mobile/src/session/mobile-native-chat-terminal-stream.test.ts b/mobile/src/session/mobile-native-chat-terminal-stream.test.ts
index df860efc6b1..99c4c47cbcd 100644
--- a/mobile/src/session/mobile-native-chat-terminal-stream.test.ts
+++ b/mobile/src/session/mobile-native-chat-terminal-stream.test.ts
@@ -12,6 +12,7 @@ const base = {
   activeTabType: 'terminal',
   streamActive: true,
   streamCovered: false,
+  streamIsLeaseOnly: false,
   webViewReady: true
 }
 
@@ -93,8 +94,40 @@ describe('mobile native-chat terminal stream lifecycle', () => {
     ).toBe('rearm')
   })
 
+  it('resumes an uncovered handle still holding a lease-only stream', () => {
+    // Leaving a chat tab for a terminal tab subscribes the incoming handle before the
+    // route learns chat is gone, so the terminal streams nothing but its input lease.
+    expect(resolveMobileNativeChatTerminalStreamAction({ ...base, streamIsLeaseOnly: true })).toBe(
+      'resume'
+    )
+    // Same wait the other resume paths take — never init a WebView that cannot receive it.
+    expect(
+      resolveMobileNativeChatTerminalStreamAction({
+        ...base,
+        streamIsLeaseOnly: true,
+        webViewReady: false
+      })
+    ).toBe('none')
+  })
+
+  it('leaves a lease-only stream alone while chat still covers it (#10681)', () => {
+    // Lease-only is the correct shape under chat; trading it for output here would
+    // drop the input floor the composer depends on.
+    expect(
+      resolveMobileNativeChatTerminalStreamAction({
+        ...base,
+        showNativeChat: true,
+        streamCovered: true,
+        streamIsLeaseOnly: true
+      })
+    ).toBe('none')
+  })
+
   it('does nothing for non-terminal tabs, missing handles, or settled states', () => {
-    expect(resolveMobileNativeChatTerminalStreamAction(base)).toBe('none')
+    // A full stream on an uncovered handle is the one genuinely settled shape.
+    expect(resolveMobileNativeChatTerminalStreamAction({ ...base, streamIsLeaseOnly: false })).toBe(
+      'none'
+    )
     expect(
       resolveMobileNativeChatTerminalStreamAction({
         ...base,
diff --git a/mobile/src/session/mobile-native-chat-terminal-stream.ts b/mobile/src/session/mobile-native-chat-terminal-stream.ts
index b9b58448113..9d2727f2c30 100644
--- a/mobile/src/session/mobile-native-chat-terminal-stream.ts
+++ b/mobile/src/session/mobile-native-chat-terminal-stream.ts
@@ -8,6 +8,10 @@ export function resolveMobileNativeChatTerminalStreamAction(args: {
   activeTabType: string | null
   streamActive: boolean
   streamCovered: boolean
+  /** The active stream was opened as an input lease, so the host sends `subscribed`
+   *  and nothing else — no scrollback, no data. Distinguishes a stream that renders
+   *  from one that only holds the input floor. */
+  streamIsLeaseOnly: boolean
   webViewReady: boolean
 }): MobileNativeChatTerminalStreamAction {
   if (!args.activeHandle || args.activeTabType !== 'terminal') {
@@ -22,7 +26,13 @@ export function resolveMobileNativeChatTerminalStreamAction(args: {
     // the composer locked forever — nothing else re-subscribes a covered handle.
     return args.streamActive ? 'none' : 'rearm'
   }
-  return (args.streamCovered || !args.streamActive) && args.webViewReady ? 'resume' : 'none'
+  // Why `streamIsLeaseOnly`: switching from a chat tab to a terminal tab subscribes the
+  // incoming handle before the route learns chat is gone, so it lands a lease-only stream
+  // on an uncovered handle. Without this input that is indistinguishable from a healthy
+  // stream and the terminal renders blank until restart.
+  return (args.streamCovered || args.streamIsLeaseOnly || !args.streamActive) && args.webViewReady
+    ? 'resume'
+    : 'none'
 }
 
 export function isTerminalCoveredByNativeChat(
diff --git a/mobile/src/session/mobile-terminal-attribution-compat.test.ts b/mobile/src/session/mobile-terminal-attribution-compat.test.ts
new file mode 100644
index 00000000000..9f0ebf873bd
--- /dev/null
+++ b/mobile/src/session/mobile-terminal-attribution-compat.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it, vi } from 'vitest'
+import { MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE } from '../../../src/shared/legacy-terminal-attribution-env'
+import { assertMobileTerminalAttributionDisableSupported } from './mobile-terminal-attribution-compat'
+
+function status(result: unknown) {
+  return {
+    id: 'status',
+    ok: true as const,
+    result: { runtimeId: 'runtime', ...(result as object) },
+    _meta: { runtimeId: 'runtime' }
+  }
+}
+
+describe('mobile terminal attribution compatibility', () => {
+  it('refuses hosts before terminal creation environment forwarding', async () => {
+    const sendRequest = vi.fn().mockResolvedValue(
+      status({
+        capabilities: [
+          'runtime.status.compat.v1',
+          'runtime.environments.v1',
+          'mobile.tasks.v1',
+          'workspace-run-context.v1'
+        ]
+      })
+    )
+
+    await expect(assertMobileTerminalAttributionDisableSupported({ sendRequest })).rejects.toThrow(
+      MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE
+    )
+    expect(sendRequest).toHaveBeenCalledWith('status.get', undefined, {
+      timeoutMs: 30_000,
+      budgetSpansConnect: true
+    })
+  })
+
+  it('rejects historical hosts without explicit removal capability', async () => {
+    const sendRequest = vi.fn().mockResolvedValue(status({ appVersion: '1.4.90' }))
+
+    await expect(assertMobileTerminalAttributionDisableSupported({ sendRequest })).rejects.toThrow(
+      MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE
+    )
+  })
+
+  it('accepts capability-proven current development hosts', async () => {
+    const sendRequest = vi
+      .fn()
+      .mockResolvedValue(
+        status({ appVersion: '0.0.0-dev', capabilities: ['terminal.attribution-removed.v1'] })
+      )
+
+    await expect(assertMobileTerminalAttributionDisableSupported({ sendRequest })).resolves.toEqual(
+      { runtimeId: 'runtime' }
+    )
+  })
+
+  it('fails closed when host status cannot be verified', async () => {
+    const sendRequest = vi.fn().mockResolvedValue({
+      id: 'status',
+      ok: false,
+      error: { code: 'offline', message: 'Host is offline' },
+      _meta: { runtimeId: 'runtime' }
+    })
+
+    await expect(assertMobileTerminalAttributionDisableSupported({ sendRequest })).rejects.toThrow(
+      'Host is offline'
+    )
+  })
+
+  it('fails closed with an actionable error for malformed host status', async () => {
+    const sendRequest = vi.fn().mockResolvedValue(
+      status({
+        appVersion: 1.49,
+        capabilities: 'terminal.attribution-removed.v1'
+      })
+    )
+
+    await expect(assertMobileTerminalAttributionDisableSupported({ sendRequest })).rejects.toThrow(
+      'Update the host and try again'
+    )
+  })
+})
diff --git a/mobile/src/session/mobile-terminal-attribution-compat.ts b/mobile/src/session/mobile-terminal-attribution-compat.ts
new file mode 100644
index 00000000000..ceb2d3f694e
--- /dev/null
+++ b/mobile/src/session/mobile-terminal-attribution-compat.ts
@@ -0,0 +1,34 @@
+import {
+  hostSupportsSessionTabTerminalCreateAttributionDisable,
+  MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE
+} from '../../../src/shared/legacy-terminal-attribution-env'
+import type { RpcClient } from '../transport/rpc-client'
+
+export const MOBILE_TERMINAL_CREATE_RPC_TIMEOUT_MS = 30_000
+export const MOBILE_TERMINAL_CREATE_RPC_OPTIONS = {
+  timeoutMs: MOBILE_TERMINAL_CREATE_RPC_TIMEOUT_MS,
+  budgetSpansConnect: true
+} as const
+
+export type MobileTerminalAttributionAuthority = Readonly<{ runtimeId: string }>
+
+export async function assertMobileTerminalAttributionDisableSupported(
+  client: Pick<RpcClient, 'sendRequest'>
+): Promise<MobileTerminalAttributionAuthority> {
+  const response = await client.sendRequest(
+    'status.get',
+    undefined,
+    MOBILE_TERMINAL_CREATE_RPC_OPTIONS
+  )
+  if (!response.ok) {
+    throw new Error(response.error?.message || 'Unable to verify the workspace host version.')
+  }
+  if (!hostSupportsSessionTabTerminalCreateAttributionDisable(response.result)) {
+    throw new Error(MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE)
+  }
+  const runtimeId = Reflect.get(response.result as object, 'runtimeId')
+  if (typeof runtimeId !== 'string' || !runtimeId) {
+    throw new Error(MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE)
+  }
+  return Object.freeze({ runtimeId })
+}
diff --git a/mobile/src/session/pr-ai-triage-launch.test.ts b/mobile/src/session/pr-ai-triage-launch.test.ts
index c2273c9046e..fe9271f5e4d 100644
--- a/mobile/src/session/pr-ai-triage-launch.test.ts
+++ b/mobile/src/session/pr-ai-triage-launch.test.ts
@@ -12,6 +12,10 @@ function failure(message: string): RpcResponse {
 
 const createdTerminal = success({ tab: { type: 'terminal', id: 't1', terminal: 'term-1' } })
 const sendAccepted = success({ send: { accepted: true } })
+const safeHost = success({
+  runtimeId: 'r',
+  capabilities: ['terminal.attribution-removed.v1']
+})
 
 function clientReturning(...responses: RpcResponse[]) {
   const sendRequest = vi.fn(async () => responses[sendRequest.mock.calls.length - 1])
@@ -20,16 +24,27 @@ function clientReturning(...responses: RpcResponse[]) {
 
 describe('createTerminalAndSendPrompt', () => {
   it('creates a terminal then sends the prompt with enter', async () => {
-    const client = clientReturning(createdTerminal, sendAccepted)
+    const client = clientReturning(safeHost, createdTerminal, sendAccepted)
     await createTerminalAndSendPrompt(client, 'wt-1', 'do the thing')
 
-    expect(client.sendRequest).toHaveBeenNthCalledWith(1, 'session.tabs.createTerminal', {
-      worktree: 'id:wt-1',
-      activate: false,
-      select: true,
-      navigation: 'caller'
+    expect(client.sendRequest).toHaveBeenNthCalledWith(1, 'status.get', undefined, {
+      timeoutMs: 30_000,
+      budgetSpansConnect: true
     })
-    expect(client.sendRequest).toHaveBeenNthCalledWith(2, 'terminal.send', {
+    expect(client.sendRequest).toHaveBeenNthCalledWith(
+      2,
+      'session.tabs.createTerminal',
+      {
+        worktree: 'id:wt-1',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        activate: false,
+        select: true,
+        navigation: 'caller'
+      },
+      { timeoutMs: 30_000, budgetSpansConnect: true, expectedRuntimeId: 'r' }
+    )
+    expect(client.sendRequest).toHaveBeenNthCalledWith(3, 'terminal.send', {
       terminal: 'term-1',
       text: 'do the thing',
       enter: true
@@ -37,28 +52,41 @@ describe('createTerminalAndSendPrompt', () => {
   })
 
   it('throws and skips terminal.send when createTerminal fails', async () => {
-    const client = clientReturning(failure('boom'))
+    const client = clientReturning(safeHost, failure('boom'))
     await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow('boom')
-    expect(client.sendRequest).toHaveBeenCalledTimes(1)
+    expect(client.sendRequest).toHaveBeenCalledTimes(2)
   })
 
   it('throws when the created-terminal response is malformed', async () => {
-    const client = clientReturning(success({ tab: { type: 'terminal' } }))
+    const client = clientReturning(safeHost, success({ tab: { type: 'terminal' } }))
     await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow(
       'Created terminal response was invalid'
     )
-    expect(client.sendRequest).toHaveBeenCalledTimes(1)
+    expect(client.sendRequest).toHaveBeenCalledTimes(2)
   })
 
   it('throws when terminal.send returns a failure', async () => {
-    const client = clientReturning(createdTerminal, failure('send failed'))
+    const client = clientReturning(safeHost, createdTerminal, failure('send failed'))
     await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow('send failed')
   })
 
   it('throws when terminal input is locked', async () => {
-    const client = clientReturning(createdTerminal, success({ send: { accepted: false } }))
+    const client = clientReturning(
+      safeHost,
+      createdTerminal,
+      success({ send: { accepted: false } })
+    )
     await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow(
       'Terminal input is locked'
     )
   })
+
+  it('refuses an old host before terminal creation', async () => {
+    const client = clientReturning(success({ appVersion: '1.4.89' }))
+
+    await expect(createTerminalAndSendPrompt(client, 'wt-1', 'p')).rejects.toThrow(
+      'Update the host and try again'
+    )
+    expect(client.sendRequest).toHaveBeenCalledTimes(1)
+  })
 })
diff --git a/mobile/src/session/pr-ai-triage-launch.ts b/mobile/src/session/pr-ai-triage-launch.ts
index 6d6c0bbc8b2..1f764be1789 100644
--- a/mobile/src/session/pr-ai-triage-launch.ts
+++ b/mobile/src/session/pr-ai-triage-launch.ts
@@ -3,6 +3,14 @@ import {
   readMobileReviewCreatedTerminal,
   readMobileReviewTerminalSendAccepted
 } from './mobile-diff-review-rpc'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  withLegacyTerminalAttributionDisabledEnv
+} from '../../../src/shared/legacy-terminal-attribution-env'
+import {
+  assertMobileTerminalAttributionDisableSupported,
+  MOBILE_TERMINAL_CREATE_RPC_OPTIONS
+} from './mobile-terminal-attribution-compat'
 
 // Pure launch path for the PR triage actions ("Fix checks with AI" / "Resolve
 // conflicts with AI"). Reuses the same two RPCs the diff-review send flow uses —
@@ -15,12 +23,19 @@ export async function createTerminalAndSendPrompt(
   worktreeId: string,
   prompt: string
 ): Promise<void> {
-  const created = await client.sendRequest('session.tabs.createTerminal', {
-    worktree: `id:${worktreeId}`,
-    activate: false,
-    select: true,
-    navigation: 'caller'
-  })
+  const authority = await assertMobileTerminalAttributionDisableSupported(client)
+  const created = await client.sendRequest(
+    'session.tabs.createTerminal',
+    {
+      worktree: `id:${worktreeId}`,
+      env: withLegacyTerminalAttributionDisabledEnv(undefined),
+      envToDelete: addLegacyTerminalAttributionDisableRequest(undefined),
+      activate: false,
+      select: true,
+      navigation: 'caller'
+    },
+    { ...MOBILE_TERMINAL_CREATE_RPC_OPTIONS, expectedRuntimeId: authority.runtimeId }
+  )
   if (!created.ok) {
     throw new Error(created.error?.message || 'Failed to create terminal')
   }
diff --git a/mobile/src/session/use-mobile-diff-review-send-actions.test.ts b/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
index 1d06190948c..9ae2749412b 100644
--- a/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
+++ b/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
@@ -163,6 +163,74 @@ describe('useMobileDiffReviewSendActions', () => {
     expect(setSendSheet).toHaveBeenCalledWith(null)
   })
 
+  it('creates an unattributed terminal before sending review notes', async () => {
+    const sendRequest = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'status',
+        ok: true,
+        result: {
+          runtimeId: 'runtime',
+          capabilities: ['terminal.attribution-removed.v1']
+        },
+        _meta: { runtimeId: 'runtime' }
+      })
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { tab: { type: 'terminal', id: 'tab-1', terminal: 'terminal-1' } },
+        _meta: { runtimeId: 'runtime' }
+      })
+      .mockResolvedValueOnce(sendResponse(true))
+    await mount({ sendRequest } as unknown as RpcClient)
+
+    await act(async () => {
+      await actions?.createTerminalAndSend([COMMENT])
+    })
+
+    expect(sendRequest).toHaveBeenNthCalledWith(1, 'status.get', undefined, {
+      timeoutMs: 30_000,
+      budgetSpansConnect: true
+    })
+    expect(sendRequest).toHaveBeenNthCalledWith(
+      2,
+      'session.tabs.createTerminal',
+      {
+        worktree: 'id:wt-1',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        activate: false,
+        select: true,
+        navigation: 'caller'
+      },
+      { timeoutMs: 30_000, budgetSpansConnect: true, expectedRuntimeId: 'runtime' }
+    )
+    expect(sendRequest).toHaveBeenNthCalledWith(
+      3,
+      'terminal.send',
+      expect.objectContaining({ terminal: 'terminal-1', enter: true })
+    )
+  })
+
+  it('refuses to create review terminals on hosts that strip the bypass', async () => {
+    const sendRequest = vi.fn().mockResolvedValue({
+      id: 'status',
+      ok: true,
+      result: { appVersion: '1.4.89' },
+      _meta: { runtimeId: 'runtime' }
+    })
+    await mount({ sendRequest } as unknown as RpcClient)
+
+    let error: unknown
+    await act(async () => {
+      error = await actions?.createTerminalAndSend([COMMENT]).catch((err) => err)
+    })
+
+    expect((error as Error).message).toContain('Update the host and try again')
+    expect(sendRequest).toHaveBeenCalledTimes(1)
+    expect(sendRequest).not.toHaveBeenCalledWith('terminal.send', expect.anything())
+  })
+
   it('only heals the terminal that was marked', async () => {
     const sendRequest = vi.fn().mockResolvedValue(sendResponse(true))
     await mount({ sendRequest } as unknown as RpcClient)
diff --git a/mobile/src/session/use-mobile-diff-review-send-actions.ts b/mobile/src/session/use-mobile-diff-review-send-actions.ts
index 0867a3884b3..266caaf6879 100644
--- a/mobile/src/session/use-mobile-diff-review-send-actions.ts
+++ b/mobile/src/session/use-mobile-diff-review-send-actions.ts
@@ -13,6 +13,14 @@ import {
 } from './mobile-diff-review-rpc'
 import { healMobileNativeChatStaleInput } from './mobile-native-chat-stale-input'
 import type { ReviewScreenState, SendSheetState } from './mobile-diff-review-screen-model'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  withLegacyTerminalAttributionDisabledEnv
+} from '../../../src/shared/legacy-terminal-attribution-env'
+import {
+  assertMobileTerminalAttributionDisableSupported,
+  MOBILE_TERMINAL_CREATE_RPC_OPTIONS
+} from './mobile-terminal-attribution-compat'
 
 type SendActionsInput = {
   client: RpcClient | null
@@ -104,12 +112,19 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
       if (!client || connState !== 'connected') {
         throw new Error('Waiting for desktop...')
       }
-      const response = await client.sendRequest('session.tabs.createTerminal', {
-        worktree: `id:${worktreeId}`,
-        activate: false,
-        select: true,
-        navigation: 'caller'
-      })
+      const authority = await assertMobileTerminalAttributionDisableSupported(client)
+      const response = await client.sendRequest(
+        'session.tabs.createTerminal',
+        {
+          worktree: `id:${worktreeId}`,
+          env: withLegacyTerminalAttributionDisabledEnv(undefined),
+          envToDelete: addLegacyTerminalAttributionDisableRequest(undefined),
+          activate: false,
+          select: true,
+          navigation: 'caller'
+        },
+        { ...MOBILE_TERMINAL_CREATE_RPC_OPTIONS, expectedRuntimeId: authority.runtimeId }
+      )
       if (!response.ok) {
         throw new Error(response.error?.message || 'Failed to create terminal')
       }
diff --git a/mobile/src/session/use-mobile-file-tap-handlers.test.ts b/mobile/src/session/use-mobile-file-tap-handlers.test.ts
index 0cfa617f269..21f07562459 100644
--- a/mobile/src/session/use-mobile-file-tap-handlers.test.ts
+++ b/mobile/src/session/use-mobile-file-tap-handlers.test.ts
@@ -34,12 +34,13 @@ describe('useMobileFileTapHandlers', () => {
       hostId: 'host-1',
       worktreeId: 'wt-1',
       worktreeName: 'Orca',
+      nativeChatSessionId: 'session-1',
       activeHandleRef: { current: 'terminal-1' as string | null },
       terminalCwdRef: { current: new Map([['terminal-1', '/repo/sub']]) },
       openBrowser: vi.fn(),
       fetchSessionTabs: vi.fn(async () => {}),
       getSessionTabs: () => [],
-      getActiveSessionTabId: () => null,
+      getActiveSessionTabId: () => 'terminal-tab',
       getActiveSessionTabType: () => 'terminal',
       switchSessionTab: vi.fn(),
       scheduleDelayedAction: vi.fn(),
@@ -131,7 +132,12 @@ describe('useMobileFileTapHandlers', () => {
 
     expect(sendRequest).toHaveBeenCalledWith(
       'files.resolveTerminalPath',
-      { worktree: 'id:wt-1', pathText: 'mobile/src/x.ts', crossWorkspace: true },
+      {
+        worktree: 'id:wt-1',
+        pathText: 'mobile/src/x.ts',
+        crossWorkspace: true,
+        nativeChatContext: { tabId: 'terminal-tab', sessionId: 'session-1' }
+      },
       { timeoutMs: 10_000 }
     )
     expect(options.reportChatTapFailure).toHaveBeenCalledWith("Couldn't open mobile/src/x.ts:12")
diff --git a/mobile/src/session/use-mobile-file-tap-handlers.ts b/mobile/src/session/use-mobile-file-tap-handlers.ts
index 276be5b566f..67995115f45 100644
--- a/mobile/src/session/use-mobile-file-tap-handlers.ts
+++ b/mobile/src/session/use-mobile-file-tap-handlers.ts
@@ -10,6 +10,7 @@ type MobileFileTapHandlerOptions<T extends FileTapSessionTab> = {
   hostId: string
   worktreeId: string
   worktreeName?: string
+  nativeChatSessionId: string | null
   activeHandleRef: MutableRefObject<string | null>
   terminalCwdRef: MutableRefObject<Map<string, string>>
   openBrowser: (url: string) => void
@@ -48,6 +49,7 @@ export function useMobileFileTapHandlers<T extends FileTapSessionTab>(
     getActiveSessionTabType,
     getSessionTabs,
     hostId,
+    nativeChatSessionId,
     openBrowser,
     scheduleDelayedAction,
     reportChatTapFailure,
@@ -71,6 +73,7 @@ export function useMobileFileTapHandlers<T extends FileTapSessionTab>(
       getActiveSessionTabType,
       getSessionTabs,
       hostId,
+      nativeChatSessionId,
       openBrowser,
       scheduleDelayedAction,
       reportChatTapFailure,
@@ -87,6 +90,7 @@ export function useMobileFileTapHandlers<T extends FileTapSessionTab>(
     getActiveSessionTabType,
     getSessionTabs,
     hostId,
+    nativeChatSessionId,
     openBrowser,
     router,
     scheduleDelayedAction,
@@ -144,12 +148,18 @@ export function useMobileFileTapHandlers<T extends FileTapSessionTab>(
       return
     }
     const activationSeq = ++activationSeqRef.current
+    const nativeChatSessionId = current.nativeChatSessionId
+    const nativeChatTabId = current.getActiveSessionTabId()
     openMobileNativeChatFileTap<T>({
       client: current.client,
       hostId: current.hostId,
       worktreeId: current.worktreeId,
       worktreeName: current.worktreeName,
       pathText,
+      nativeChatContext:
+        nativeChatSessionId && nativeChatTabId
+          ? { tabId: nativeChatTabId, sessionId: nativeChatSessionId }
+          : null,
       pushPreviewRoute: (href) => routerRef.current.push(href),
       openBrowser: current.openBrowser,
       triggerOpenFeedback: triggerSelection,
diff --git a/mobile/src/session/use-mobile-native-chat-drafts.test.ts b/mobile/src/session/use-mobile-native-chat-drafts.test.ts
index db8e76696d0..daf451e53f9 100644
--- a/mobile/src/session/use-mobile-native-chat-drafts.test.ts
+++ b/mobile/src/session/use-mobile-native-chat-drafts.test.ts
@@ -316,8 +316,8 @@ describe('useMobileNativeChatDrafts', () => {
     })
     expect(state?.pending).toHaveLength(1)
 
-    // Claude echoes a captioned image send as two turns: the source marker and
-    // the caption prefixed with `[Image #1] ` — the pending must still match.
+    // Claude echoes a captioned image send as a source turn plus a caption
+    // carrying `[Image #1]`; the pending must still match.
     await act(async () =>
       renderer?.update(
         createElement(Harness, {
@@ -334,6 +334,37 @@ describe('useMobileNativeChatDrafts', () => {
     expect(state?.imagePreviewsByMessageId).toEqual({ u2: ['file:///a.jpg'] })
   })
 
+  it('reconciles a captioned image echo with a trailing [Image #N] marker', async () => {
+    await mount('a')
+    await act(async () =>
+      renderer?.update(
+        createElement(Harness, { tabId: 'a', messages: [assistantTextMessage('a1', 'hi')] })
+      )
+    )
+    const origin = state?.captureSendOrigin('look at this')
+    act(() => {
+      if (origin) {
+        state?.acceptSend(origin, 'look at this', ['file:///a.jpg'])
+      }
+    })
+    expect(state?.pending).toHaveLength(1)
+
+    await act(async () =>
+      renderer?.update(
+        createElement(Harness, {
+          tabId: 'a',
+          messages: [
+            assistantTextMessage('a1', 'hi'),
+            userTextMessage('u1', '[Image: source: /tmp/a.png]'),
+            userTextMessage('u2', 'look at this[Image #1]')
+          ]
+        })
+      )
+    )
+    expect(state?.pending).toEqual([])
+    expect(state?.imagePreviewsByMessageId).toEqual({ u2: ['file:///a.jpg'] })
+  })
+
   it('hands a marker-only image preview to the authoritative user bubble', async () => {
     await mount('a')
     const origin = state?.captureSendOrigin('')
diff --git a/mobile/src/session/use-mobile-native-chat-drafts.ts b/mobile/src/session/use-mobile-native-chat-drafts.ts
index 9da4dea6a9b..55fff5b42e3 100644
--- a/mobile/src/session/use-mobile-native-chat-drafts.ts
+++ b/mobile/src/session/use-mobile-native-chat-drafts.ts
@@ -7,6 +7,7 @@ import {
   findLandedUnconfirmedSends,
   mergeLandedImagePreviewEchoes,
   migrateImagePreviewMessageIds,
+  normalizeReconcileText,
   normalizedUserText,
   type UnconfirmedSend
 } from './mobile-native-chat-draft-reconcile'
@@ -27,8 +28,7 @@ export type { MobileNativeChatPendingMessage, MobileNativeChatSendOrigin }
 const NO_PENDING_MESSAGES: MobileNativeChatPendingMessage[] = []
 const NO_IMAGE_PREVIEWS: Record<string, string[]> = {}
 
-// How long an ack-lost send waits for its transcript echo before the UI surfaces
-// that delivery remains unconfirmed.
+// Ack-lost sends wait for a transcript echo before surfacing as unconfirmed.
 const UNCONFIRMED_SEND_DEADLINE_MS = 20_000
 
 export function useMobileNativeChatDrafts(args: {
@@ -132,14 +132,13 @@ export function useMobileNativeChatDrafts(args: {
       if (!draftKey) {
         return null
       }
-      const normalizedText = text.trim()
-      const currentMessages = messagesRef.current
+      const normalizedText = normalizeReconcileText(text)
       return {
         draftKey,
         pendingKey,
         normalizedText,
-        baselineOccurrences: countUserTextOccurrences(currentMessages, normalizedText),
-        baselineTailMessageId: currentMessages[currentMessages.length - 1]?.id ?? null
+        baselineOccurrences: countUserTextOccurrences(messagesRef.current, normalizedText),
+        baselineTailMessageId: messagesRef.current.at(-1)?.id ?? null
       }
     },
     [draftKey, pendingKey]
@@ -299,26 +298,19 @@ export function useMobileNativeChatDrafts(args: {
           landedCounts.set(text, (landedCounts.get(text) ?? 0) + 1)
         }
       }
-      // Why: compare against the count captured before send; historical equal
-      // turns cannot clear a new echo, while duplicates land one occurrence each.
-      // An image-only echo has no text to match, so it reconciles by ORDINAL
-      // against the count of new `[Image: source: …]` echo turns after its
-      // baseline tail — text echoes are excluded so an unrelated outstanding
-      // text send cannot clear it. Ordinal-vs-count stays stable when the effect
-      // re-runs on the shrunken list, and ignores paginated-in history.
+      // Image-only source-turn counts stay stable across reruns and ignore paginated history.
       const next = current.filter((item) => {
         if (landedImagePendingIds.has(item.id)) {
           return false
         }
-        // Image echoes hand their local URIs to the authoritative message above;
-        // never drop them through the text-only fallback before that handoff.
+        // Keep image echoes until their local preview reaches the authoritative message.
         if (item.images?.length) {
           return true
         }
         return item.text.trim() === ''
           ? countImageSourceTurnsAfter(messages, item.baselineTailMessageId) <
               item.expectedOccurrence
-          : (landedCounts.get(item.text.trim()) ?? 0) < item.expectedOccurrence
+          : (landedCounts.get(normalizeReconcileText(item.text)) ?? 0) < item.expectedOccurrence
       })
       if (next.length === current.length) {
         return previous
diff --git a/mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts b/mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts
index ce282fcd5b1..47b3d982095 100644
--- a/mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts
+++ b/mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts
@@ -8,10 +8,25 @@ describe('useMobileNativeChatTerminalStream', () => {
   let harnessRenderCount = 0
   const subscriptionsRef = { current: new Map<string, () => void>() }
   const subscribingRef = { current: new Set<string>() }
+  const leaseOnlyRef = { current: new Set<string>() }
   const webReadyRef = { current: new Set(['terminal-1']) }
   const initializedRef = { current: new Set(['terminal-1']) }
-  const subscribe = vi.fn((handle: string) => subscriptionsRef.current.set(handle, () => {}))
-  const unsubscribe = vi.fn((handle: string) => subscriptionsRef.current.delete(handle))
+  /** Mirrors the route's subscribe-time coverage guess, which is what decides whether
+   *  the host opens a lease-only stream or a streaming one. */
+  let subscribeOpensLeaseOnly = false
+  const registerSubscription = (handle: string): void => {
+    subscriptionsRef.current.set(handle, () => {})
+    if (subscribeOpensLeaseOnly) {
+      leaseOnlyRef.current.add(handle)
+    } else {
+      leaseOnlyRef.current.delete(handle)
+    }
+  }
+  const subscribe = vi.fn(registerSubscription)
+  const unsubscribe = vi.fn((handle: string) => {
+    subscriptionsRef.current.delete(handle)
+    leaseOnlyRef.current.delete(handle)
+  })
   const notifyWebReadyRef = { current: (_handle: string, _wasAlreadyReady: boolean): void => {} }
   const notifyListedHandlesRef = { current: (_liveHandles: ReadonlySet<string>): void => {} }
   const hasTabsRecoveryNeedRef = { current: (): boolean => false }
@@ -19,6 +34,8 @@ describe('useMobileNativeChatTerminalStream', () => {
   beforeEach(() => {
     subscriptionsRef.current = new Map([['terminal-1', () => {}]])
     subscribingRef.current = new Set()
+    leaseOnlyRef.current = new Set()
+    subscribeOpensLeaseOnly = false
     webReadyRef.current = new Set(['terminal-1'])
     initializedRef.current = new Set(['terminal-1'])
     harnessRenderCount = 0
@@ -51,6 +68,7 @@ describe('useMobileNativeChatTerminalStream', () => {
       streamRevision,
       subscriptionsRef,
       subscribingRef,
+      leaseOnlyRef,
       webReadyRef,
       initializedRef,
       subscribe,
@@ -107,6 +125,111 @@ describe('useMobileNativeChatTerminalStream', () => {
     expect(subscribe).toHaveBeenNthCalledWith(2, 'terminal-1')
   })
 
+  /** What switchTab does synchronously on the tap, before the route re-renders: the
+   *  coverage it reads still describes the chat tab being left, so the incoming
+   *  terminal gets a lease-only subscribe — the shape that renders nothing. */
+  function handOffToTerminalTwo(): void {
+    subscribeOpensLeaseOnly = true
+    subscribe('terminal-2')
+    subscribeOpensLeaseOnly = false
+    subscribe.mockClear()
+    unsubscribe.mockClear()
+  }
+
+  it('trades a lease-only stream for output when a chat tab hands off to a terminal tab', async () => {
+    webReadyRef.current.add('terminal-2')
+    initializedRef.current.add('terminal-2')
+    await act(async () => {
+      renderer = create(createElement(Harness, { showNativeChat: true }))
+    })
+    handOffToTerminalTwo()
+
+    await act(async () => {
+      renderer?.update(
+        createElement(Harness, { showNativeChat: false, activeHandle: 'terminal-2' })
+      )
+    })
+
+    expect(unsubscribe).toHaveBeenCalledWith('terminal-2')
+    expect(subscribe).toHaveBeenCalledWith('terminal-2')
+    expect(leaseOnlyRef.current.has('terminal-2')).toBe(false)
+    // The lease-only stream carried no scrollback, so xterm is empty — a stale
+    // initialized mark would drop the replacement snapshot and keep the tab blank.
+    expect(initializedRef.current.has('terminal-2')).toBe(false)
+  })
+
+  it('settles once a lease-only stream has been replaced by a full one', async () => {
+    webReadyRef.current.add('terminal-2')
+    await act(async () => {
+      renderer = create(createElement(Harness, { showNativeChat: true }))
+    })
+    handOffToTerminalTwo()
+    await act(async () => {
+      renderer?.update(
+        createElement(Harness, { showNativeChat: false, activeHandle: 'terminal-2' })
+      )
+    })
+    subscribe.mockClear()
+    unsubscribe.mockClear()
+
+    await act(async () => {
+      renderer?.update(
+        createElement(Harness, {
+          showNativeChat: false,
+          activeHandle: 'terminal-2',
+          streamRevision: 1
+        })
+      )
+    })
+
+    // A stream that renders is settled — resubscribing it again would be a loop.
+    expect(subscribe).not.toHaveBeenCalled()
+    expect(unsubscribe).not.toHaveBeenCalled()
+  })
+
+  it('repairs a lease-only stream once its WebView reports ready', async () => {
+    await act(async () => {
+      renderer = create(createElement(Harness, { showNativeChat: true }))
+    })
+    handOffToTerminalTwo()
+    await act(async () => {
+      renderer?.update(
+        createElement(Harness, { showNativeChat: false, activeHandle: 'terminal-2' })
+      )
+    })
+
+    // Cold WebView: the resume must wait, and the route's own web-ready path bails
+    // because the lease-only subscription already counts as live.
+    expect(subscribe).not.toHaveBeenCalled()
+
+    await act(async () => {
+      webReadyRef.current.add('terminal-2')
+      notifyWebReadyRef.current('terminal-2', false)
+    })
+
+    expect(unsubscribe).toHaveBeenCalledWith('terminal-2')
+    expect(subscribe).toHaveBeenCalledWith('terminal-2')
+  })
+
+  it('keeps a covered lease-only stream instead of trading it for output (#10681)', async () => {
+    subscribeOpensLeaseOnly = true
+    await act(async () => {
+      renderer = create(createElement(Harness, { showNativeChat: true }))
+    })
+    subscribe.mockClear()
+    unsubscribe.mockClear()
+
+    await act(async () => {
+      renderer?.update(createElement(Harness, { showNativeChat: true, streamRevision: 1 }))
+    })
+
+    // Lease-only is the correct shape under chat; swapping it for output would drop
+    // the input floor the composer holds.
+    expect(subscribe).not.toHaveBeenCalled()
+    expect(unsubscribe).not.toHaveBeenCalled()
+    expect(leaseOnlyRef.current.has('terminal-1')).toBe(true)
+  })
+
   it('re-subscribes a covered stream torn down under chat (#10681)', async () => {
     await act(async () => {
       renderer = create(createElement(Harness, { showNativeChat: true }))
@@ -174,9 +297,7 @@ describe('useMobileNativeChatTerminalStream', () => {
 
       expect(subscribe).toHaveBeenCalledTimes(5)
     } finally {
-      subscribe.mockImplementation((handle: string) =>
-        subscriptionsRef.current.set(handle, () => {})
-      )
+      subscribe.mockImplementation(registerSubscription)
     }
   })
 
diff --git a/mobile/src/session/use-mobile-native-chat-terminal-stream.ts b/mobile/src/session/use-mobile-native-chat-terminal-stream.ts
index 0f0a642a149..b5663b8dc8a 100644
--- a/mobile/src/session/use-mobile-native-chat-terminal-stream.ts
+++ b/mobile/src/session/use-mobile-native-chat-terminal-stream.ts
@@ -23,6 +23,8 @@ export function useMobileNativeChatTerminalStream(args: {
   streamRevision: number
   subscriptionsRef: MutableRefObject<Map<string, () => void>>
   subscribingRef: MutableRefObject<Set<string>>
+  /** Handles whose current subscribe went out as an input lease only. */
+  leaseOnlyRef: MutableRefObject<Set<string>>
   webReadyRef: MutableRefObject<Set<string>>
   initializedRef: MutableRefObject<Set<string>>
   subscribe: (handle: string) => void
@@ -55,13 +57,21 @@ export function useMobileNativeChatTerminalStream(args: {
       healthyStreamProofRef.current = null
     }
   }, [])
-  const notifyWebReady = useCallback((handle: string, wasAlreadyReady: boolean) => {
-    // Why: ordinary WebView startups must not rerender the large session route;
-    // only readiness that can release a native-chat lease needs reconciliation.
-    if (!wasAlreadyReady && coveredHandleRef.current === handle) {
-      setWebReadyRevision((revision) => revision + 1)
-    }
-  }, [])
+  const notifyWebReady = useCallback(
+    (handle: string, wasAlreadyReady: boolean) => {
+      // Why: ordinary WebView startups must not rerender the large session route;
+      // only readiness that can release a native-chat lease needs reconciliation.
+      // A lease-only stream counts: the route's own web-ready path bails on any live
+      // subscription, so nothing else would ever trade that lease for output.
+      if (
+        !wasAlreadyReady &&
+        (coveredHandleRef.current === handle || args.leaseOnlyRef.current.has(handle))
+      ) {
+        setWebReadyRevision((revision) => revision + 1)
+      }
+    },
+    [args.leaseOnlyRef]
+  )
   const notifyListedHandles = useCallback(
     (liveHandles: ReadonlySet<string>) => {
       // Why: the rearm budget bounds one teardown, not the handle's lifetime. A covered
@@ -106,7 +116,7 @@ export function useMobileNativeChatTerminalStream(args: {
       (rearmAttemptsRef.current.get(handle) ?? 0) >= MAX_REARM_ATTEMPTS
     )
   }, [])
-  useEffect(() => {
+  const reconcileStream = useCallback(() => {
     const handle = args.activeHandle
     if (coveredHandleRef.current && coveredHandleRef.current !== handle) {
       forgetRearmState(coveredHandleRef.current)
@@ -115,12 +125,15 @@ export function useMobileNativeChatTerminalStream(args: {
     const streamActive =
       handle != null &&
       (args.subscriptionsRef.current.has(handle) || args.subscribingRef.current.has(handle))
+    const streamIsLeaseOnly =
+      streamActive && handle != null && args.leaseOnlyRef.current.has(handle)
     const action = resolveMobileNativeChatTerminalStreamAction({
       showNativeChat: args.showNativeChat,
       activeHandle: handle,
       activeTabType: args.activeTabType,
       streamActive,
       streamCovered: coveredHandleRef.current === handle,
+      streamIsLeaseOnly,
       webViewReady: handle != null && args.webReadyRef.current.has(handle)
     })
     const streamHolding = action === 'none' && streamActive && coveredHandleRef.current === handle
@@ -181,7 +194,11 @@ export function useMobileNativeChatTerminalStream(args: {
       args.subscribe(handle)
       return
     }
-    if (coveredHandleRef.current === handle) {
+    if (coveredHandleRef.current === handle || streamIsLeaseOnly) {
+      // Why clear `initialized`: a lease-only stream delivered no scrollback, so xterm
+      // holds nothing — a stale mark would drop the replacement snapshot and the
+      // terminal would stay blank through the resubscribe.
+      args.initializedRef.current.delete(handle)
       args.unsubscribe(handle)
       coveredHandleRef.current = null
     }
@@ -190,6 +207,7 @@ export function useMobileNativeChatTerminalStream(args: {
     args.activeHandle,
     args.activeTabType,
     args.initializedRef,
+    args.leaseOnlyRef,
     args.leaseReady,
     args.showNativeChat,
     args.streamRevision,
@@ -203,6 +221,7 @@ export function useMobileNativeChatTerminalStream(args: {
     rearmBudgetRevision,
     webReadyRevision
   ])
+  useEffect(() => reconcileStream(), [reconcileStream])
   useEffect(() => cancelHealthyStreamProof, [cancelHealthyStreamProof])
   // Why memoized: the session route keeps this object in callback dep arrays, and a
   // fresh literal per render would rebuild them on every keystroke. All three members
diff --git a/mobile/src/source-control/mobile-create-pr-action.test.ts b/mobile/src/source-control/mobile-create-pr-action.test.ts
index c665b034f7f..ec399b45913 100644
--- a/mobile/src/source-control/mobile-create-pr-action.test.ts
+++ b/mobile/src/source-control/mobile-create-pr-action.test.ts
@@ -1,8 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import type {
   HostedReviewCreationBlockedReason,
-  HostedReviewCreationEligibility,
-  HostedReviewProvider
+  HostedReviewCreationEligibility
 } from '../../../src/shared/hosted-review'
 import {
   buildMobileCreatePrAction,
@@ -146,7 +145,7 @@ describe('buildMobileCreatePrAction', () => {
 
   it('keeps a disabled status row for providers without review creation', () => {
     const { descriptor } = action({
-      eligibility: eligibility({ provider: 'bitbucket' as HostedReviewProvider })
+      eligibility: eligibility({ provider: 'unsupported' })
     })
 
     expect(descriptor).toMatchObject({
@@ -211,7 +210,7 @@ describe('cold-mount layout stability (issue #8411)', () => {
       'unsupported provider',
       {
         kind: 'ready',
-        eligibility: eligibility({ provider: 'bitbucket' as HostedReviewProvider })
+        eligibility: eligibility({ provider: 'unsupported' })
       } satisfies MobileCreatePrEligibilityState
     ],
     ['eligibility error', { kind: 'error' } satisfies MobileCreatePrEligibilityState]
diff --git a/mobile/src/source-control/mobile-create-pr-action.ts b/mobile/src/source-control/mobile-create-pr-action.ts
index fe75cc60a58..3268a1796c3 100644
--- a/mobile/src/source-control/mobile-create-pr-action.ts
+++ b/mobile/src/source-control/mobile-create-pr-action.ts
@@ -72,7 +72,7 @@ export function buildMobileCreatePrAction({
   }
   // Why: mirror desktop's structural provider gate (supportsHostedReviewCreation)
   // instead of relying on the host always emitting a hidden blockedReason for
-  // non-creatable providers like bitbucket.
+  // non-creatable providers.
   if (!supportsHostedReviewCreation(eligibility.provider)) {
     return {
       visible: true,
diff --git a/mobile/src/terminal/terminal-path-tap.ts b/mobile/src/terminal/terminal-path-tap.ts
index ac2a8ea0ff3..8e7545a4cfb 100644
--- a/mobile/src/terminal/terminal-path-tap.ts
+++ b/mobile/src/terminal/terminal-path-tap.ts
@@ -3,11 +3,12 @@
 // one path span containing the tapped column — mobile opens a tapped path, it
 // does not render hover links over the whole line.
 
-export type TappedFilePath = {
-  pathText: string
-  line: number | null
-  column: number | null
-}
+import {
+  parseFileLinkLocation,
+  type ParsedFileLinkLocation
+} from '../../../src/shared/file-link-location'
+
+export type TappedFilePath = ParsedFileLinkLocation
 
 // Separator-anchored path tokens (absolute, relative, ~/, drive-letter, UNC) OR
 // a bare filename with an extension (README.md, index.ts), optionally suffixed
@@ -47,18 +48,13 @@ function trimBoundaryPunctuation(
 }
 
 export function parsePathWithOptionalLineColumn(value: string): TappedFilePath | null {
-  const match = /^(.*?)(?::(\d+))?(?::(\d+))?$/.exec(value)
-  if (!match) {
+  const parsed = parseFileLinkLocation(value)
+  if (!parsed) {
     return null
   }
-  const pathText = match[1]
+  const { pathText, line, column } = parsed
   // Reject a directory-only token (trailing separator) for either slash style.
-  if (!pathText || pathText.endsWith('/') || pathText.endsWith('\\')) {
-    return null
-  }
-  const line = match[2] ? Number.parseInt(match[2], 10) : null
-  const column = match[3] ? Number.parseInt(match[3], 10) : null
-  if ((line !== null && line < 1) || (column !== null && column < 1)) {
+  if (pathText.endsWith('/') || pathText.endsWith('\\')) {
     return null
   }
   return { pathText, line, column }
diff --git a/mobile/src/transport/host-store.ts b/mobile/src/transport/host-store.ts
index 99421ffd192..c32ac44ac77 100644
--- a/mobile/src/transport/host-store.ts
+++ b/mobile/src/transport/host-store.ts
@@ -182,7 +182,7 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
         }
       }
       let next: StoredHostProfile[]
-      if (index >= 0) {
+      if (index !== -1) {
         updatedExistingHost = true
         // Why: an authoritative save is the safe point to collapse pre-existing duplicate rows to the preserved host id.
         next = hosts
@@ -195,7 +195,7 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
         next = [...hosts.filter(({ id }) => !duplicateHostIds.has(id)), stored]
       }
       if (duplicateHostIds.size > 0) {
-        if (index < 0) {
+        if (index === -1) {
           // Why: process death between the early token write and metadata publication must leave cleanup discoverable.
           await recordHostCredentialCleanupIntent(stored.id)
           cleanupIntentRecordedBeforeMetadata = true
@@ -304,7 +304,7 @@ export async function updateHostNameAndEndpoint(
 ): Promise<void> {
   await mutateStoredHosts((hosts) => {
     const index = hosts.findIndex((host) => host.id === hostId)
-    if (index < 0) {
+    if (index === -1) {
       throw new Error('Host not found')
     }
     const next = hosts.slice()
@@ -321,7 +321,7 @@ export async function updateLastConnected(hostId: string): Promise<void> {
   try {
     await mutateStoredHosts((hosts) => {
       const index = hosts.findIndex((h) => h.id === hostId)
-      if (index < 0) {
+      if (index === -1) {
         return hosts
       }
       const next = hosts.slice()
diff --git a/mobile/src/transport/mobile-relay-host-overlay-store.ts b/mobile/src/transport/mobile-relay-host-overlay-store.ts
index 7f1519eb5c9..4960fbec3f0 100644
--- a/mobile/src/transport/mobile-relay-host-overlay-store.ts
+++ b/mobile/src/transport/mobile-relay-host-overlay-store.ts
@@ -80,7 +80,7 @@ export async function saveMobileRelayHostOverlay(overlay: MobileRelayHostOverlay
   const validated = MobileRelayHostOverlaySchema.parse(overlay)
   return mutateOverlays((overlays) => {
     const index = overlays.findIndex(({ hostId }) => hostId === validated.hostId)
-    if (index < 0) {
+    if (index === -1) {
       return [...overlays, validated]
     }
     const next = overlays.slice()
diff --git a/mobile/src/transport/rpc-client.ts b/mobile/src/transport/rpc-client.ts
index 9b0afe937f3..f316f8c2b76 100644
--- a/mobile/src/transport/rpc-client.ts
+++ b/mobile/src/transport/rpc-client.ts
@@ -54,6 +54,7 @@ type ConnectWaiter = {
 
 export type SendRequestOptions = {
   timeoutMs?: number
+  expectedRuntimeId?: string
   /** Spend `timeoutMs` across connect-wait AND the request instead of giving each
    *  phase its own. Interactive chat writes need it: they run as sequential loops
    *  under one shared budget, so a per-phase clock lets the composer sit `sending`
@@ -1013,7 +1014,15 @@ export function connect(
           }
         })
 
-        if (!sendEncrypted({ id, deviceToken, method, params })) {
+        if (
+          !sendEncrypted({
+            id,
+            deviceToken,
+            method,
+            params,
+            ...(options?.expectedRuntimeId ? { expectedRuntimeId: options.expectedRuntimeId } : {})
+          })
+        ) {
           pending.delete(id)
           clearTimeout(timeout)
           reject(new Error('Connection interrupted'))
diff --git a/mobile/src/transport/rpc-response-shape.ts b/mobile/src/transport/rpc-response-shape.ts
index 54903f5f3e1..61ecaf57362 100644
--- a/mobile/src/transport/rpc-response-shape.ts
+++ b/mobile/src/transport/rpc-response-shape.ts
@@ -13,7 +13,7 @@ export function isRpcResponse(value: unknown): value is RpcResponse {
     return false
   }
   if (response.ok === true) {
-    return Object.prototype.hasOwnProperty.call(response, 'result')
+    return Object.hasOwn(response, 'result')
   }
   return (
     response.ok === false &&
diff --git a/mobile/src/transport/types.ts b/mobile/src/transport/types.ts
index 9d96f0561ad..8fe2bdd78f9 100644
--- a/mobile/src/transport/types.ts
+++ b/mobile/src/transport/types.ts
@@ -18,6 +18,7 @@ export type RpcRequest = {
   deviceToken: string
   method: string
   params?: unknown
+  expectedRuntimeId?: string
 }
 
 export type RpcSuccess = {
diff --git a/package.json b/package.json
index a599fb6d3f8..6f7be4e6f4b 100644
--- a/package.json
+++ b/package.json
@@ -88,6 +88,8 @@
     "test:e2e:multi-client-navigation": "node config/scripts/run-multi-client-navigation-e2e.mjs",
     "test:e2e:floating-mobile-emulator": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/floating-mobile-emulator-tab.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
     "test:e2e:terminal-rendering-golden": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts tests/e2e/terminal-webgl-atlas-budget.spec.ts --grep @terminal-rendering-golden --config tests/playwright.config.ts --project electron-headless --workers=1",
+    "test:e2e:posix-profile-index-golden": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/golden-posix-fresh-startup.spec.ts tests/e2e/golden-posix-profile-index-fsync.spec.ts --grep @posix-profile-index-golden --config tests/playwright.config.ts --project electron-headless --workers=1",
+    "test:e2e:windows-fresh-startup-golden": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/golden-windows-fresh-startup.spec.ts --grep @windows-fresh-startup-golden --config tests/playwright.config.ts --project electron-headless --workers=1",
     "test:e2e:terminal-rendering-release-evidence": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/terminal-opencode-emoji-table-rendering.spec.ts tests/e2e/terminal-long-table-scroll-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=2",
     "test:e2e:terminal-perf": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/terminal-typing-latency.spec.ts tests/e2e/terminal-foreground-redraw-freeze.spec.ts tests/e2e/terminal-output-scheduler.spec.ts tests/e2e/terminal-hidden-tui-visual-restore.spec.ts tests/e2e/artificial-opencode-terminal-load.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=2",
     "test:e2e:terminal-perf:scale": "pnpm run ensure:electron-runtime && node config/scripts/run-terminal-scale-perf-e2e.mjs",
@@ -98,6 +100,9 @@
     "test:e2e:ssh-docker-perf": "node config/scripts/run-ssh-docker-perf-e2e.mjs",
     "test:e2e:ssh-docker-watcher-isolation": "node config/scripts/run-ssh-docker-watcher-isolation-e2e.mjs",
     "test:e2e:ssh-docker-terminal-parking": "node config/scripts/run-ssh-docker-terminal-parking-e2e.mjs",
+    "test:e2e:ssh-docker-reconnect-pane-cardinality": "node config/scripts/run-ssh-docker-reconnect-pane-cardinality-e2e.mjs",
+    "test:e2e:ssh-docker-maxsessions-identity": "node config/scripts/run-ssh-docker-maxsessions-identity-e2e.mjs",
+    "test:e2e:ssh-docker-two-hosts-isolation": "node config/scripts/run-ssh-docker-two-hosts-isolation-e2e.mjs",
     "test:e2e:nested-runtime-ssh": "node config/scripts/run-nested-runtime-ssh-e2e.mjs",
     "test:e2e:source-control-scale": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/source-control-large-file-count.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
     "win-update-e2e": "node tests/tools/win-update-e2e/run.mjs",
@@ -123,6 +128,7 @@
     "bench:cold-park-resource": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/terminal-cold-park-resource-bench.mjs",
     "bench:compare": "node config/scripts/compare-benchmark-artifacts.mjs",
     "test:e2e:remote-bulk-open-freeze": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/remote-session-bulk-open-freeze-repro.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+    "test:e2e:daemon-session-liveness": "pnpm run ensure:electron-runtime && pnpm exec playwright test --config tests/playwright.daemon-liveness.local.config.ts",
     "test:e2e:ssh-docker-bulk-open-freeze": "node config/scripts/run-ssh-docker-bulk-open-freeze-e2e.mjs",
     "repro:live-remote-bulk-open-freeze": "node config/scripts/live-remote-bulk-open-freeze-repro.mjs",
     "repro:live-remote-realistic-freeze": "node config/scripts/live-remote-realistic-freeze-repro.mjs"
@@ -218,7 +224,7 @@
     "mermaid": "^11.16.1",
     "monaco-editor": "^0.55.1",
     "oxfmt": "^0.52.0",
-    "oxlint": "^1.75.0",
+    "oxlint": "^1.77.0",
     "oxlint-plugin-react-doctor": "0.9.1",
     "oxlint-tsgolint": "7.0.2001",
     "pdfjs-dist": "^6.2.108",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1872f9860e8..57885d16e25 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -294,8 +294,8 @@ importers:
         specifier: ^0.52.0
         version: 0.52.0
       oxlint:
-        specifier: ^1.75.0
-        version: 1.75.0(oxlint-tsgolint@7.0.2001)
+        specifier: ^1.77.0
+        version: 1.77.0(oxlint-tsgolint@7.0.2001)
       oxlint-plugin-react-doctor:
         specifier: 0.9.1
         version: 0.9.1
@@ -1488,124 +1488,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.75.0':
-    resolution: {integrity: sha512-lutovtFzJqlRaqpZrCqSSGaHZzl9nIxxpjLzhSRLunN6dCLylj0uzlCyQGaQDIys7rrv8kVXiFO+R4Zpn0bX7g==}
+  '@oxlint/binding-android-arm-eabi@1.77.0':
+    resolution: {integrity: sha512-E06sKWS6PiI6HRxS1wyQg22HvApt01hI7fV+T3wUk3OSbaaP4a3hYGY/MIQDmASqCiRjBdpRQYkgMkqH82cWmQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.75.0':
-    resolution: {integrity: sha512-hXI0hDgHkw4w5nfru72aG7y+2iQJmC4waH/KV6H/hbgA6yAP5jYNx0P9yug15Hs0tWl/+mda3Jjn/2gmDT48tw==}
+  '@oxlint/binding-android-arm64@1.77.0':
+    resolution: {integrity: sha512-NvsKz0KZxTp9cYWPLf+FXaSZwB3oO3peAjtukpOMBgse2vhQSoIIVqeO1yR0lEo/UcdZIDL18uq+kL0LzQ0ytA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.75.0':
-    resolution: {integrity: sha512-D91BWbK/dMYfCcrghspPIuKs2D9LF4Z/OabVSQjw1AO6PWxArD7teDA48bm0ySFqWDaPVqmQRl5GMWNglTXyrQ==}
+  '@oxlint/binding-darwin-arm64@1.77.0':
+    resolution: {integrity: sha512-bgjTn6nW4bQCFBvSvuHCpDD+sONvmpo4lGI4PxzMt1quBA+xYxhczk6RiCn3GZ9gY8uhaBbwhj9MdKGfu6T9DA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.75.0':
-    resolution: {integrity: sha512-02mpwzf12BonZ6PT0TuQoomvEh2kVl2WGBIKWezCyToIS+rYkQZ6GXnARBAl9A4Ovm2V+Xe7M4KretyqmmcnJQ==}
+  '@oxlint/binding-darwin-x64@1.77.0':
+    resolution: {integrity: sha512-aotaIttH1R6j1Rwhx0M0htgeZyGtVQqYNTVEYMN/UcgHPquGA6kmk9OyuDc3a2GKUQBC+3C3GVQCcrRPMYqAFA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.75.0':
-    resolution: {integrity: sha512-qZJgLnDaBsiL5YESx2t/TZ8eXkL9fEkKoXEdzegROhlz9A0lgyGnZ0dAzJrh7LJAHQl2K9RdRueN2s/9N7+odg==}
+  '@oxlint/binding-freebsd-x64@1.77.0':
+    resolution: {integrity: sha512-nNx/wta7ksRAdYvq+l4AWjXkLxEXHALhENxjj2cYbQAIR4ybaA5L+hCbE63HOmft5czQ6ks+hb8vmEAnn7YGPg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.75.0':
-    resolution: {integrity: sha512-7XlaWA5BJD3XpCfrEqjEe6Zseeb14S7QGa304XfwKignRaKQ+eIj775BQ7nIslggWickl4IsPUFqJ+/gAyNHVg==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.77.0':
+    resolution: {integrity: sha512-tMLLjM7xXtzXisVCzkOTXNCy9bZVId2wteNwjohlFDR/jY6WagpEDA1c1wu4xRc20Hojaxj+V6DSR7gbKxijWA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.75.0':
-    resolution: {integrity: sha512-av6Tpv8yrcMMMOadOqENBhlsLRcGFXXwoQ0hzHhsmS9FJ4Wioy8we427GbcMe2XTxmL2e60T67H1Dyr3up+tAA==}
+  '@oxlint/binding-linux-arm-musleabihf@1.77.0':
+    resolution: {integrity: sha512-MiAFDFaqR0tmHTAyo0YDcZ5hyLREdYw/RQhc2R3cbT+8O3tB+zqPM2th9TTQ+Uo3jn/embS+DO+HyX9ztCPkOQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.75.0':
-    resolution: {integrity: sha512-WcUhd8fHT5plrA14lANevl+hOl815mVI5t2hU21oFWrZKFXIVV/Sr4rWQV0NzSvzBupbMLNc5ErEA6Ehxh5jMg==}
+  '@oxlint/binding-linux-arm64-gnu@1.77.0':
+    resolution: {integrity: sha512-/xqQ3B16i1T4cyt/9Mn+4CpzhUXoBXp7kVpIwzOXNFLj5JmK1bIjsbSnX296Gg8A/o7oDtKWikFgBx0SLwztkw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.75.0':
-    resolution: {integrity: sha512-UWzp5wRHFe/ESO3+eEaxXsTkYTGLYjnTsi/I5neEacXSItQ6WNleapfOAeA4x2b8nyhJ4uQxqvtv9pHv8kWJtQ==}
+  '@oxlint/binding-linux-arm64-musl@1.77.0':
+    resolution: {integrity: sha512-LSbwuRKiNCenPDcbARqAZ5RfBy7gmj7vOvfJRLeCDU3gFtSxWbhv/+VTlaUqzUhNj1gFLHB8h7ALnxa/Az6z6g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.75.0':
-    resolution: {integrity: sha512-XEVRwGMLKCUKrvhLAz4F6AIh8MJrQVdSZtAmPpRZt9tGPsUnamPOcl3dS/ZQzJnar/Ymgc//+xho0L60Emzuxg==}
+  '@oxlint/binding-linux-ppc64-gnu@1.77.0':
+    resolution: {integrity: sha512-QWdcH31mXEUe5Nq1s0CfCpceaKjIo9uZtwDjAuL681g1axf+5x8xrg/eXWaw//4NCxYZ4V4e5Hu5tvdR+pTBlg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.75.0':
-    resolution: {integrity: sha512-mAG4DUXqfLC8cTjMD2kt3jDmVzFREYtDyeLNdLdsCcBc4Zbl2EMuiFektGBilQwkNjYnMvCqJs55U+Hyb+b+jw==}
+  '@oxlint/binding-linux-riscv64-gnu@1.77.0':
+    resolution: {integrity: sha512-GnOfYgJxbcElOiPZaDFDl406ONddwvOWk2jvAAAEjwAl4GofNoHF+/HHUIBYa6bFCArlcGPi0XjC4cU1pkgF/Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.75.0':
-    resolution: {integrity: sha512-95hrAvriAlI+pekSomTFIn0+bawMDlDwTNVmdjsFusTHyL2JWh7TWvRNG/Lkim72uN8OiCcO9wcaC6omLP5E3w==}
+  '@oxlint/binding-linux-riscv64-musl@1.77.0':
+    resolution: {integrity: sha512-AyEMTUCf0xY+hHF+IxqXFQIX0yQOIR8ykpY0lJNOw9xYqOzUX8dyZfRvlG0RfXwuQn2eonf/8NrMmDSZJjdqsA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.75.0':
-    resolution: {integrity: sha512-4b6f2+FrtruAESrCqIKcrarzfrSx+wk2QNcp+RT91/Prc+pMQMAfyZ1rG1c3tFQNl8Bc616tx40uNXyxNBRPbQ==}
+  '@oxlint/binding-linux-s390x-gnu@1.77.0':
+    resolution: {integrity: sha512-sPLzEcNvxd/oyVQ5oZo92CiHkFkpBeRop13E/P3TPY+hZfXHKCOWKI70TE2RYwMKFJDc20EMjH16L7NZICtKTw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.75.0':
-    resolution: {integrity: sha512-nshAhrUvXFUWOvqQ2soIw7HFNWvpvEV4o0cYSqPtzLiPF5gKyYTDOOTJ6Rn8g8K/iGvPIrbDA4v8+5MvnjJrrg==}
+  '@oxlint/binding-linux-x64-gnu@1.77.0':
+    resolution: {integrity: sha512-1Oh2ssH2L7lwyvkdSqaMUfsGfwU2Wfvew+obBUYjRVqhpBcUpwnsPSEr1IzVi9XqkuY10geiLsNKecqaZC34Dw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.75.0':
-    resolution: {integrity: sha512-e4jNxLKnxLC6sYBQRxrI2pgIIxnmMtF8U/VwNYcjTT/CLS+spH624cYVnj07bTKwaEWT37/e025isOs6j/0xqA==}
+  '@oxlint/binding-linux-x64-musl@1.77.0':
+    resolution: {integrity: sha512-0j/2wRgNGO+Qj/M1uu/p57h/hFTTWWcfie0ufkbabeus2s5+/QqkCflnMOwLLN5m2GsNeWp4xdl4cPa4n7QCOQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.75.0':
-    resolution: {integrity: sha512-hZ2lH+1qLf/DiEP9UWuQTK2JWj/BgvMB4jhIV4SmNU1wfEiYYX4TynQyAZXx0j9X4qRYizAL042SKaV+8ynh4w==}
+  '@oxlint/binding-openharmony-arm64@1.77.0':
+    resolution: {integrity: sha512-BJ/j54qS0usEnyDkLYURMj2iiD9h5Cyy+ppzeMSXBGRXaGRNWnj1Mw14NqWMR5E/PzdgB30OOCCzLzbRoduafw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.75.0':
-    resolution: {integrity: sha512-Ilj6PNzGDS3bCU0MSJH7Msh0NhH+T/mRp2shwg+q+GHeVlPwP5LEboW96aW+3kVKFk6zYZy1Xi5pZkqZh6X8KQ==}
+  '@oxlint/binding-win32-arm64-msvc@1.77.0':
+    resolution: {integrity: sha512-Yh8w+g2Lpx7StrvtYkoz9JJvXjB9wxgFChFNb85nrXm/wj/XTwGWS1hve9+900HL7llrntYB3YP+y32E3tRqzA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.75.0':
-    resolution: {integrity: sha512-QVit2nOEOiPhkmsrksPSkoGCdnZRNkspt8fwoYyP09te1VEbnSj4LAxua4rc8FKTmWkySVe05j8iz9GXYfF1AQ==}
+  '@oxlint/binding-win32-ia32-msvc@1.77.0':
+    resolution: {integrity: sha512-zja5b7+6a7UsRFgAQSrnax5vrzliEyNPLCjfXONu/vTWswaIVZGFajJZptaeRvPE4LghtFdAzVFlexTm7MVTGA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.75.0':
-    resolution: {integrity: sha512-DSxnNkBUAYARPwJtR12Ig3deWr8w0H997xP6jy33i+e0SyYJw8FKuz4+cZtpmPEhQmvlPJE3X/2vNxDmLkd/rA==}
+  '@oxlint/binding-win32-x64-msvc@1.77.0':
+    resolution: {integrity: sha512-+teyvPDZ2RjUvo+SuCqS/UhaJl1QtdW5fWT5NJTV61V5MIuIS90Db9LixmtEGvXixyttiK62P96MSu3UlpviBw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -5541,8 +5541,8 @@ packages:
     resolution: {integrity: sha512-KjK/XLcXr1DSyonKhsuFqJRiuKqcyG9j3LJ8nkOsrLzGvodBPqzHOKauy10asLMDI0sUpvb+1sxlzff3udZvfg==}
     hasBin: true
 
-  oxlint@1.75.0:
-    resolution: {integrity: sha512-m9WzjRcRYA/uqIZDa9tclrieoPJ/ln1QYTKdFx6NUOs8uY5DiHlIwRQoCrHT6OM6O3ww3l2skY5gO7G7ZphE7g==}
+  oxlint@1.77.0:
+    resolution: {integrity: sha512-qnGh8XJHaQ0dprrDXNQZgS0FgjI6v+V3+X8DwmaV++5Aamy6jGKfDdQ1TUvhUxtmKFAbEf4/WeO5QZX+5WSngg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -7809,61 +7809,61 @@ snapshots:
   '@oxlint-tsgolint/win32-x64@7.0.2001':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.75.0':
+  '@oxlint/binding-android-arm-eabi@1.77.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.75.0':
+  '@oxlint/binding-android-arm64@1.77.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.75.0':
+  '@oxlint/binding-darwin-arm64@1.77.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.75.0':
+  '@oxlint/binding-darwin-x64@1.77.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.75.0':
+  '@oxlint/binding-freebsd-x64@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.75.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.75.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.75.0':
+  '@oxlint/binding-linux-arm64-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.75.0':
+  '@oxlint/binding-linux-arm64-musl@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.75.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.75.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.75.0':
+  '@oxlint/binding-linux-riscv64-musl@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.75.0':
+  '@oxlint/binding-linux-s390x-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.75.0':
+  '@oxlint/binding-linux-x64-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.75.0':
+  '@oxlint/binding-linux-x64-musl@1.77.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.75.0':
+  '@oxlint/binding-openharmony-arm64@1.77.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.75.0':
+  '@oxlint/binding-win32-arm64-msvc@1.77.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.75.0':
+  '@oxlint/binding-win32-ia32-msvc@1.77.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.75.0':
+  '@oxlint/binding-win32-x64-msvc@1.77.0':
     optional: true
 
   '@parcel/watcher-android-arm64@2.5.6':
@@ -12174,27 +12174,27 @@ snapshots:
       '@oxlint-tsgolint/win32-arm64': 7.0.2001
       '@oxlint-tsgolint/win32-x64': 7.0.2001
 
-  oxlint@1.75.0(oxlint-tsgolint@7.0.2001):
+  oxlint@1.77.0(oxlint-tsgolint@7.0.2001):
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.75.0
-      '@oxlint/binding-android-arm64': 1.75.0
-      '@oxlint/binding-darwin-arm64': 1.75.0
-      '@oxlint/binding-darwin-x64': 1.75.0
-      '@oxlint/binding-freebsd-x64': 1.75.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.75.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.75.0
-      '@oxlint/binding-linux-arm64-gnu': 1.75.0
-      '@oxlint/binding-linux-arm64-musl': 1.75.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.75.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.75.0
-      '@oxlint/binding-linux-riscv64-musl': 1.75.0
-      '@oxlint/binding-linux-s390x-gnu': 1.75.0
-      '@oxlint/binding-linux-x64-gnu': 1.75.0
-      '@oxlint/binding-linux-x64-musl': 1.75.0
-      '@oxlint/binding-openharmony-arm64': 1.75.0
-      '@oxlint/binding-win32-arm64-msvc': 1.75.0
-      '@oxlint/binding-win32-ia32-msvc': 1.75.0
-      '@oxlint/binding-win32-x64-msvc': 1.75.0
+      '@oxlint/binding-android-arm-eabi': 1.77.0
+      '@oxlint/binding-android-arm64': 1.77.0
+      '@oxlint/binding-darwin-arm64': 1.77.0
+      '@oxlint/binding-darwin-x64': 1.77.0
+      '@oxlint/binding-freebsd-x64': 1.77.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.77.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.77.0
+      '@oxlint/binding-linux-arm64-gnu': 1.77.0
+      '@oxlint/binding-linux-arm64-musl': 1.77.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.77.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.77.0
+      '@oxlint/binding-linux-riscv64-musl': 1.77.0
+      '@oxlint/binding-linux-s390x-gnu': 1.77.0
+      '@oxlint/binding-linux-x64-gnu': 1.77.0
+      '@oxlint/binding-linux-x64-musl': 1.77.0
+      '@oxlint/binding-openharmony-arm64': 1.77.0
+      '@oxlint/binding-win32-arm64-msvc': 1.77.0
+      '@oxlint/binding-win32-ia32-msvc': 1.77.0
+      '@oxlint/binding-win32-x64-msvc': 1.77.0
       oxlint-tsgolint: 7.0.2001
 
   p-cancelable@2.1.1: {}
diff --git a/skill-guides/orchestration.md b/skill-guides/orchestration.md
index bc7b1cbbe3e..20b70a15b63 100644
--- a/skill-guides/orchestration.md
+++ b/skill-guides/orchestration.md
@@ -195,7 +195,7 @@ orca orchestration worker-start --task <task_b> --worktree current --agent claud
 For a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:
 
 ```bash
-orca orchestration worker-start --task <task_id> --worktree current --agent claude --model aws-bedrock-opus-5 --effort high --json
+orca orchestration worker-start --task <task_id> --worktree current --agent claude --model opus --effort high --json
 ```
 
 `--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.
diff --git a/src/cli/bundled-skill-guides.ts b/src/cli/bundled-skill-guides.ts
index 487c9152b89..e0a65fc876f 100644
--- a/src/cli/bundled-skill-guides.ts
+++ b/src/cli/bundled-skill-guides.ts
@@ -30,7 +30,7 @@ const ORCA_LINEAR_MARKDOWN = "---\nname: orca-linear\ndescription: >-\n  Use Orc
 const ORCA_PER_WORKSPACE_ENV_MARKDOWN = "---\nname: orca-per-workspace-env\ndescription: >-\n  Set up, review, debug, or validate Orca per-workspace environment recipes —\n  on-demand, disposable runtimes (cloud sandboxes, VMs, or local) created fresh\n  for each workspace. Covers first-time setup (provider prerequisites, the\n  reusable base snapshot, the coding-agent auth snapshot, credentials, and\n  state), not just the per-workspace lifecycle scripts. Use to stand up\n  per-workspace environments, fix an `environmentRecipes` entry in `orca.yaml`, scaffold\n  provider lifecycle scripts, or resolve an `orca vm recipe doctor` failure.\n---\n\n# Per-Workspace Environments\n\nHelp a user stand up and maintain a repo-owned per-workspace environment recipe end to end. Each\nworkspace gets its own on-demand, disposable runtime (a cloud sandbox, a VM, or a local one),\ncreated fresh and torn down after.\n\nOrca is a **thin wrapper**: you guide, detect, and scaffold; you never own the user's cloud account,\nbilling, images, or credentials.\n\n- **You DO:** sequence the setup, detect what's detectable (provider CLI present/logged-in? recipe\n  present? `doctor` passing?), scaffold provider-templated scripts the user fills in, drive the slow\n  snapshot/auth phases with the user, and always show the next action.\n- **You DO NOT:** create accounts, choose plans/regions, invent org/project/scope ids, store or print\n  secrets, or run anything that spends money without an explicit user OK.\n\nFirst-time setup has **four phases before the per-workspace recipe runs** — easy to miss, so walk\nthem in order:\n\n1. **Prerequisites** — cloud account, provider CLI, scope/project, plan limits, git token (§2).\n2. **Base snapshot** — reusable image: tools + repo + headless build, snapshotted once (§3).\n3. **Agent-auth snapshot** — boot the base, run interactive device-auth, re-snapshot (§4).\n4. **State** — thread snapshot id / scope / project / port between phases via a state file (§6).\n\nThen the **per-workspace contract** (create/suspend/resume/destroy) runs fast (§8).\n\n**The one branch that shapes everything — connection mode:** **Orca-server** (`create` runs `orca serve`\nin the env and emits a `pairingCode`; §7c/§7f) vs **SSH** (`create` runs no server and emits a\n`connection.type:\"ssh\"` block Orca dials into; §7g/§7h). Settle this first — it changes the `create`\noutput shape and half the templates.\n\n**Quick-start (happy path):** interview the user (connection mode Orca-server vs SSH, provider, agent CLI,\ngit auth — §1.2) + read the provider's CLI docs → scaffold `scripts/orca-vm/` from §7 → run the\nbase-snapshot script, then the auth script (you invoke these by hand; not via `orca.yaml`) → wire\n`environmentRecipes` in `orca.yaml` → `orca vm recipe doctor <id> --json` (free) → then the `--provision`\nself-test loop (§9) until it passes.\n\n---\n\n## 1. Setup workflow\n\nDrive these with the user. **[CHECKPOINT]** steps need explicit confirmation — they spend money, take\na long time, or need the user at the keyboard. Never create an Orca workspace or commit unless asked.\n\n1. **Inspect the repo** for an existing `environmentRecipes` entry, `scripts/orca-vm/`, a state file, or setup\n   notes. If a working recipe exists, jump to Doctor (§9) instead of rebuilding.\n2. **Interview the user up front** — gather these choices and confirm them back before scaffolding\n   anything. Don't pick for them (§11); don't guess.\n   - **Connection mode:** how Orca attaches to the environment — an **Orca server** (the VM runs\n     `orca serve` and Orca pairs over its pairing URL; worked example §7f) or **SSH** (Orca connects to\n     the host over SSH; §7g). This decides the recipe's connection shape, so settle it first.\n   - **Provider:** Vercel Sandbox, Fly, Modal, an existing SSH host, … For non-obvious providers, also\n     ask scope/project/region and plan limits (§2). Then **read that provider's CLI/SDK docs** (or\n     `<cli> --help`) before scaffolding — you need its exact create/exec/snapshot/remove verbs.\n     If a provider advertises `ssh`, verify whether it exposes a real dialable SSH target\n     (host/port/user/key or proxy command) or only a provider-mediated interactive shell; Orca SSH mode\n     needs the former.\n   - **Coding-agent CLI + account:** which agent runs in the VM (`codex`, `claude`, …) and that the user\n     has an account for it — it gets logged in during the Phase-3 auth snapshot (§4).\n   - **Git auth:** the token source for cloning a private repo (`GH_TOKEN`/`GITHUB_TOKEN` or `gh auth\n     token`; §5).\n3. **Check prerequisites (§2)** — detect the provider CLI + auth and confirm the items above are in\n   place before any paid step.\n4. **Scaffold scripts + state file** from §7 (worked Vercel example: §7f; SSH host: §7g; Docker SSH:\n   §7h; Windows: §7i), filling in the provider's real commands. Make them executable.\n5. **[CHECKPOINT] Build the base snapshot (§3)** — paid, slow.\n6. **[CHECKPOINT] Authenticate the agent (§4)** — interactive; the user follows a URL/code. **You cannot\n   drive this step** — you run commands non-interactively, so there's no TTY for `docker exec -it` /\n   `ssh -t` to prompt against. The **user** runs the Phase-3 login in their own terminal (or via the\n   Claude Code harness bang-prefix — `! <cmd>`, with the required space after `!`); you scaffold and drive\n   the non-interactive phases around it. After kicking it off, **ask the user to report back once the login\n   finishes** — you can't observe it completing, and you need that confirmation before resuming the\n   non-interactive steps (base/auth commit, doctor, provision).\n7. **Wire the recipe** so `orca.yaml` points create/suspend/resume/destroy at the scripts (§8). The\n   workspace composer reads `environmentRecipes` from the project's primary checkout of `orca.yaml`, **not** from\n   a feature branch or worktree. So a recipe added only on a branch won't appear as a \"Run on\" option\n   until that `orca.yaml` change is committed and merged to the project's primary branch. Tell the user\n   this up front: `doctor`/`--provision` validate the scripts from the working copy on any branch, but\n   creating a workspace from the recipe in the picker needs it on primary.\n8. **Dry-run doctor** — `orca vm recipe doctor <recipe-id> --repo-path <repo> --json` (free, static; §9).\n   Fix every failure before going live.\n9. **[CHECKPOINT] Live self-test** — get the user's OK once, then run\n   `orca vm recipe doctor <recipe-id> --provision --json` as a loop: it runs create → validates →\n   destroys, and on failure returns a full transcript. Read it, fix the scripts, and re-run yourself until\n   it passes (§9). Spends cloud money; the one approval covers the loop.\n10. **[CHECKPOINT] Optional workspace test** — only if asked: create a workspace via the picker, then\n    verify sleep/wake/delete.\n\n---\n\n## 2. Phase 1 — Prerequisites\n\nThe user's responsibility; verify what's verifiable, ask for the rest, invent nothing. State which\nitems you verified vs. which the user asserted.\n\n- **Connection mode** (Orca server vs SSH) confirmed with the user — see §1 step 2; it shapes the recipe.\n- **Cloud account + plan** that allows sandboxes/VMs. Ask.\n- **Provider CLI installed + authenticated** — detect (`command -v <cli>`), check auth (e.g.\n  `vercel whoami`). If missing, point at the provider's docs; don't log them in.\n- **Scope / project / region** the sandboxes live under. Ask; flows into every script via state.\n- **Plan / timeout / RAM caps.** Record them — e.g. Vercel Hobby caps sandbox timeout at **45m**,\n  which limits both the base build and per-workspace runtime (see §10).\n- **Git token for private repos** (`GH_TOKEN`/`GITHUB_TOKEN`, or the provider's git auth; can fall back\n  to `gh auth token`). See §5.\n- **Coding-agent CLI choice** (`codex`, `claude`…) and that the user has an account — it gets\n  authenticated into the VM in Phase 3.\n\n---\n\n## 3. Phase 2 — Base snapshot (the reusable image)\n\nBuild **once**, snapshot, and every workspace boots from it in seconds instead of rebuilding.\nProvisioning + building takes a while (often ~20–30 min), so it runs behind a checkpoint. The script\nshape is §7a; key points:\n\n- Build the **headless Electron main only** (not the renderer) so it fits in plan RAM.\n- Use the VM image's package manager (`apt`/`dnf`/`apk`, per the base distro — not the provider brand).\n- Clone with the git token via `GIT_ASKPASS` (§5).\n- **Trap errors and remove the half-built sandbox** so a crash doesn't leave a paid resource running.\n- Snapshot the stopped sandbox, parse the snapshot id, and write it + scope/project/port/repo to state.\n\n---\n\n## 4. Phase 3 — Agent-auth snapshot (interactive)\n\nThe base snapshot has the agent CLI installed but **not logged in**, and per-workspace VMs are\nephemeral — so authenticate once and bake it into a second snapshot layer. Script shape is §7b:\n\n1. Boot a sandbox from the base `snapshotId` (from state).\n2. Run the agent's login **interactively** (`--interactive --tty`); the user completes the URL/code in\n   their browser. On a **headless VM this must be the device-auth flow** (e.g. `codex login --device-auth`),\n   **not** plain `codex login`: the default OAuth login starts a loopback callback server on a container\n   port the host browser can't reach, so it hangs. Device-auth instead prints a URL + code the user opens\n   on the **host**.\n3. Verify login; **refuse to snapshot an unauthenticated VM.** Prefer the status command's **exit code**\n   (most agent CLIs exit non-zero when unauthenticated). If you grep instead, agent status often goes to\n   **stderr** (e.g. `codex login status` prints \"Logged in using ChatGPT\" there), so **fold stderr first**\n   (`... 2>&1 | grep …`) and match the agent's **exact success line** — never `grep -qi 'logged in'`, which\n   also matches \"**not** logged in\" and would commit an unauthenticated image.\n4. Re-snapshot, parse the new id, and overwrite `snapshotId` in state to the authenticated image\n   (recording `authSourceSnapshotId`). Remove the auth sandbox.\n\n**You can't drive step 2 yourself** (you run commands non-interactively — no TTY). The **user** runs it in\ntheir own terminal, or via the Claude Code harness bang-prefix (`! <cmd>`, with the required space after\n`!`). You scaffold/boot the sandbox and run steps 3–4, but **you cannot observe the interactive login\nfinishing** — so **ask the user to tell you when it's done** before you verify and re-snapshot.\n\nIf the agent's credentials are short-lived, warn that the snapshot may need periodic re-auth (§10).\n\nFor disposable runtimes, do **not** treat a host agent config directory (for example `~/.codex`) as the\nauth snapshot by bind-mounting or copying it wholesale. Agent homes often contain sqlite state, hook\napproval state, caches, logs, and host-specific env/config. Instead, authenticate/configure the agent\ninside the disposable runtime and snapshot/commit that runtime layer.\n\n---\n\n## 5. Credentials\n\n- **Never** commit secrets or put them in `userData`, recipe JSON, comments, docs, or the state file.\n- **Git token:** read from env (`GH_TOKEN`/`GITHUB_TOKEN`), falling back to `gh auth token`. Pass to the\n  VM only via the provider's ephemeral `--env`. Inside the VM, use a `GIT_ASKPASS` helper with\n  `x-access-token` (not the token in the clone URL) and `GIT_TERMINAL_PROMPT=0` so a missing token fails\n  fast instead of hanging. When you write the helper from inside `bash -lc` under `set -u`, escape the\n  positional arg and the token (`\\$1`, `\\$GH_TOKEN`) so they land **literally** and resolve at git-runtime\n  — an unescaped `$1` aborts with \"unbound variable\", and a literal `$GH_TOKEN` keeps the real token out of\n  the written file. `rm -f` the helper after the clone/fetch.\n- **Provider auth:** rely on the provider CLI's logged-in session, not checked-in keys.\n- **Agent auth:** lives in the authenticated snapshot (Phase 3) — never a file you write or commit.\n- State holds only **non-secret** wiring (snapshot ids, scope, project, port, repo url/ref).\n\n---\n\n## 6. State file\n\nA repo-local JSON file (e.g. `scripts/orca-vm/<provider>-state.json`) threads non-secret values between\nphases. Each script resolves values as **env var → state → built-in fallback**, and merges its outputs\nback. Phase 2 writes the base `snapshotId`; Phase 3 overwrites it with the authenticated snapshot;\nper-workspace `create` boots from `snapshotId`.\n\n```json\n{\n  \"baseName\": \"orca-base\",\n  \"snapshotId\": \"snap_authenticated_image_id\",\n  \"authSourceSnapshotId\": \"snap_base_image_id\",\n  \"scope\": \"<provider-scope>\",\n  \"project\": \"<provider-project>\",\n  \"port\": 7331,\n  \"repoUrl\": \"https://host/org/repo.git\",\n  \"repoRef\": \"main\",\n  \"projectRoot\": \"/abs/path/on/remote/repo\"\n}\n```\n\n---\n\n## 7. Script templates (provider-agnostic shapes)\n\nScaffold under `scripts/orca-vm/`. These are **shapes** — fill in the provider's real commands. All\nreserve stdout for the final JSON and log progress to stderr. Include a shared `json_value <key>` /\n`env_value <NAME>` reader (env → state → fallback) in each.\n\n**Where each script runs:**\n\n- **Local-side** (`create`/`suspend`/`resume`/`destroy` + the base-snapshot/auth scripts the user\n  invokes) runs **on the user's desktop**, so it must run on their OS. macOS/Linux: `#!/usr/bin/env\n  bash`, `set -euo pipefail`, quoted paths. **Windows:** a bare `.sh` won't run — scaffold `.ps1`/`.cmd`\n  or require WSL/Git-Bash and point `orca.yaml` at the right launcher.\n- **Remote-side** (commands you `exec` *inside* the Linux VM) always runs in the VM's Linux shell, so\n  bash is fine there regardless of the user's OS.\n\n### 7a. Base-snapshot (`<provider>-base-snapshot.sh`) — Phase 2\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve base_name/repo_url/repo_ref/project_root/port/scope/project/timeout (env→state→fallback)\n# resolve gh token: GH_TOKEN | GITHUB_TOKEN | `gh auth token`\n# 1. provision a sandbox (timeout/vcpus/published port/snapshot retention); trap: remove on error\n# 2. remote exec (long timeout): install pkgs + gh + corepack/pnpm + agent CLI;\n#    clone with GIT_ASKPASS(token); write headless main-only build config;\n#    dev setup; pnpm install; build CLI; build headless electron main; smoke-check tools\n# 3. snapshot stopped sandbox; parse snapshot id (fail if unparseable)\n# 4. merge { baseName, snapshotId, projectRoot, repoUrl, repoRef, port, scope, project } into state\n# print only the state JSON to stdout\n```\n\nWorked Vercel commands for this phase are in §7f. You run this script by hand (not via `orca.yaml`),\nafter exporting the first-run inputs the state file doesn't have yet — e.g. provider scope/project, the\nrepo URL/ref, and a git token (`GH_TOKEN`); later runs read them back from state.\n\n### 7b. Auth (`<provider>-base-auth.sh`) — Phase 3\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read source snapshot from state.snapshotId (fail if absent); auth_name=\"${base_name}-auth\"\n# 1. boot sandbox from source snapshot; trap: remove on error\n# 2. INTERACTIVE/TTY remote exec: agent login — user completes URL/code. Headless VM: MUST use the\n#    device-auth flow (e.g. `codex login --device-auth`) — plain OAuth login binds a loopback callback\n#    port the host can't reach and hangs. User runs this themselves (you have no interactive TTY); ask\n#    them to report back when it's done before continuing.\n# 3. verify login, then refuse to snapshot if not logged in. Prefer the status command's EXIT CODE (most\n#    agent CLIs exit non-zero when unauthenticated) over string-matching. If you must grep, fold stderr\n#    first (`status 2>&1 | grep …` — many agents print the success line there) and match the agent's exact\n#    success line; never `grep -qi 'logged in'`, which also matches \"not logged in\". Codex example: §7f.\n# 4. snapshot; parse new id\n# 5. merge { snapshotId:<new>, authSourceSnapshotId:<source> } into state; remove auth sandbox\n# print only the state JSON to stdout\n```\n\n### 7c. Create (`<provider>-create.sh`) — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read authenticated snapshotId/scope/project/port/repo*/project_root (env→state→fallback)\n# fail clearly if snapshotId is missing (point back to Phases 2–3)\n# name = orca-${ORCA_VM_RECIPE_ID}-${ORCA_VM_INSTANCE_ID} (sanitized, length-capped)\n# 1. boot sandbox from snapshotId with a published port; capture the public URL → pairing address\n#    (an externally reachable wss:// URL); trap: remove sandbox on error\n# 2. remote exec: ensure repo at desired commit; rebuild only if commit changed (cache marker)\n# 3. remote exec: start orca serve in the background and read the recipe JSON it writes (see below)\n# 4. print serve's JSON to stdout, optionally enriched with userData:\n#    { schemaVersion:1, pairingCode, projectRoot, userData:{ provider, resourceId:name, snapshotId } }\n```\n\n**The exact `orca serve` invocation and its output (verified — do not improvise the flags).** Inside the\nVM, run:\n\n```bash\norca serve \\\n  --port \"$PORT\" \\\n  --project-root \"$ABS_REPO_PATH_ON_REMOTE\" \\\n  --pairing-address \"$EXTERNAL_WSS_URL\" \\\n  --recipe-json\n```\n\n**Binary name:** in a VM built from source (the Phase-2 flow), run it as `pnpm exec orca-dev serve …`\nfrom the repo root — `orca-dev` is the in-repo entrypoint and is what the §7f example uses. Plain\n`orca serve …` is the same command when the built CLI is installed on the VM's PATH. The flags/output\nare identical either way.\n\nThere is **no `--host` flag**. `--project-root` must be an absolute directory on the remote. With\n`--recipe-json` the server **stays running** and prints exactly this single object to **stdout**, then\nkeeps serving:\n\n```json\n{ \"schemaVersion\": 1, \"pairingCode\": \"<orca pairing URL>\", \"projectRoot\": \"<the --project-root you passed>\" }\n```\n\n`pairingCode` is the pairing URL, already pointing at whatever you passed as `--pairing-address` — so set\n`--pairing-address` to the externally reachable address and **pass `pairingCode` through unchanged; never\nhand-rewrite it**. Because serve runs in the foreground and doesn't exit, redirect its stdout to a file\nand poll until that file parses as JSON (and bail if the process dies — dump its stderr log). Your\n`create` script then prints that JSON (optionally merging `userData`). Concrete pattern: §7f.\n\n### 7d. Suspend / resume / destroy — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\npayload=\"$(cat)\"                       # Orca passes lifecycle JSON on stdin\nresource_id=\"$(node -e 'const d=JSON.parse(process.argv[1]); process.stdout.write(d.recipeResult?.userData?.resourceId ?? \"\")' \"$payload\")\"\n[ -n \"$resource_id\" ] || { echo \"No resource id in lifecycle payload\" >&2; exit 1; }\n# suspend: provider suspend \"$resource_id\"\n# resume:  provider resume \"$resource_id\"; then RE-EMIT fresh recipe JSON (pairing may change)\n# destroy: provider remove \"$resource_id\"   (or set destroy: none in orca.yaml)\n```\n\n### 7e. State file — scaffold with scope/project/repo filled in and snapshot ids empty (§6).\n\n### 7f. Worked example — Vercel Sandbox (all three phases)\n\nA real, working shape (the Vercel surface is a CLI: `vercel sandbox create|exec|snapshot|remove`). Adapt\nnames; verify flags against `vercel sandbox --help` for the user's CLI version before relying on them.\nThese ground §7a (base snapshot) and §7b (auth), which are otherwise generic skeletons.\n\n**Phase 2 — base snapshot (§7a):** provision → install tools + clone + headless build → snapshot.\n\n```bash\n# provision a fresh build sandbox (retain a couple of snapshots); trap-remove on error\nvercel sandbox create --name \"$base\" --runtime node24 --timeout 30m --vcpus 4 --publish-port \"$port\" \\\n  --snapshot-expiration 30d --keep-last-snapshots 2 \"${vercel_args[@]}\" >&2\n# remote build (long timeout): install pkgs+gh+pnpm+agent CLI, clone with GIT_ASKPASS (write the helper\n# with LITERAL \\$1/\\$GH_TOKEN so they resolve at git-runtime, not write-time — see §5/§7f create — then\n# `rm -f /tmp/askpass.sh`), write the headless main-only build config (drop the renderer), dev setup,\n# build CLI + headless main, smoke-check\nvercel sandbox exec \"$base\" \"${vercel_args[@]}\" --timeout 25m --env \"GH_TOKEN=$gh_token\" … -- bash -lc '…build…' >&2\n# snapshot the STOPPED sandbox and parse the id from CLI output (fail if unparseable)\nout=\"$(vercel sandbox snapshot \"$base\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nsnapshot_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# merge { baseName, snapshotId, scope, project, port, repoUrl, repoRef, projectRoot } into state; print state JSON\n```\n\n**Phase 3 — agent-auth snapshot (§7b):** boot the base, log the agent in interactively, re-snapshot.\n(`codex` below is an example — substitute the user's chosen agent's login/status verbs, e.g. `claude`.)\n\n```bash\nvercel sandbox create --name \"$auth\" --snapshot \"$snapshot_id\" --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" >&2\n# INTERACTIVE — the USER runs this in their own terminal (you have no interactive TTY) and completes the\n# URL/code on the HOST. --device-auth is MANDATORY on a headless VM: plain `codex login` binds a loopback\n# callback port the host browser can't reach and hangs. Ask the user to report back when login finishes.\nvercel sandbox exec --interactive --tty \"$auth\" \"${vercel_args[@]}\" -- bash -lc 'codex login --device-auth'\n# refuse to snapshot an unauthenticated VM — fold stderr, match codex's exact success line (§4)\nvercel sandbox exec \"$auth\" \"${vercel_args[@]}\" --timeout 30s -- bash -lc 'codex login status 2>&1' | grep -Eqi 'Logged in using ChatGPT|Logged in via device' \\\n  || { echo \"agent not logged in; not snapshotting\" >&2; exit 1; }\nout=\"$(vercel sandbox snapshot \"$auth\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nnew_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# overwrite state.snapshotId = new_id, record authSourceSnapshotId = snapshot_id; remove the auth sandbox\n```\n\n**Per-workspace `create`** (the fast path):\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback: snapshot_id, scope, project, port, repo_url, repo_ref, project_root\nvercel_args=(); [ -n \"$scope\" ] && vercel_args+=(--scope \"$scope\"); [ -n \"$project\" ] && vercel_args+=(--project \"$project\")\n[ -n \"$snapshot_id\" ] || { echo \"snapshotId missing — run Phases 2–3 first\" >&2; exit 1; }\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nname=\"orca-${ORCA_VM_RECIPE_ID:-vercel-sandbox}-${ORCA_VM_INSTANCE_ID:-$(date +%s)}\"  # sanitize+cap to 63 chars\n\n# Arm cleanup BEFORE create so a failing create can't leak a half-built paid sandbox.\ncleanup_on_error() { [ \"$?\" -ne 0 ] && vercel sandbox remove \"$name\" \"${vercel_args[@]}\" >/dev/null 2>&1 || true; }\ntrap cleanup_on_error EXIT\n\n# 1. boot from the authenticated snapshot, publish the serve port\ncreate_output=\"$(vercel sandbox create --name \"$name\" --snapshot \"$snapshot_id\" \\\n  --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$create_output\" >&2\n# Vercel prints the published https URL; derive the external wss:// pairing address from it\npublic_url=\"$(printf '%s\\n' \"$create_output\" | sed -nE 's#.*(https://[^[:space:]]+\\.vercel\\.run).*#\\1#p' | head -1)\"\n[ -n \"$public_url\" ] || { echo \"no published URL in create output\" >&2; exit 1; }\npairing_ws=\"${public_url/https:\\/\\//wss://}\"\n\n# 2. (remote) ensure the repo is at the right commit; rebuild only if the commit changed (cache marker)\nvercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 20m \\\n  --env \"GH_TOKEN=$gh_token\" --env \"ORCA_PROJECT_ROOT=$project_root\" \\\n  --env \"ORCA_REPO_URL=$repo_url\" --env \"ORCA_REPO_REF=$repo_ref\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; \\\n    # Re-establish git auth for the private-repo fetch (why + full rationale: §5); else it hangs on a prompt.\n    # Load-bearing escaping: \\$1 and \\$GH_TOKEN must land LITERALLY and resolve at git-runtime. Test after\n    # any edit here — reformatting the nested printf/node quoting silently breaks the fetch or leaks the token.\n    if [ -n \"${GH_TOKEN:-}\" ]; then \\\n      printf \"%s\\n\" \"#!/usr/bin/env bash\" \"case \\\"\\$1\\\" in *Username*) echo x-access-token;; *Password*) echo \\\"\\$GH_TOKEN\\\";; esac\" > /tmp/askpass.sh; \\\n      chmod 700 /tmp/askpass.sh; export GIT_ASKPASS=/tmp/askpass.sh GIT_TERMINAL_PROMPT=0; fi; \\\n    git fetch origin \"$ORCA_REPO_REF\"; \\\n    git checkout -B \"$ORCA_REPO_REF\" FETCH_HEAD; \\\n    rm -f /tmp/askpass.sh; \\\n    c=\"$(git rev-parse HEAD)\"; [ -f .orca-built ] && [ \"$(cat .orca-built)\" = \"$c\" ] || { \\\n      pnpm install --prefer-offline && pnpm run build:cli && \\\n      node config/scripts/run-electron-vite-build.mjs --config config/electron-vite.vm-serve.config.ts && \\\n      printf \"%s\" \"$c\" > .orca-built; }' >&2\n\n# 3. (remote) start orca serve in the background, writing recipe JSON to a file; poll until it parses\nrecipe_json=\"$(vercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 60s \\\n  --env \"ORCA_PORT=$port\" --env \"ORCA_PROJECT_ROOT=$project_root\" --env \"ORCA_PAIRING_ADDRESS=$pairing_ws\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; rm -f /tmp/orca-recipe.json /tmp/orca-serve.log; \\\n    nohup pnpm exec orca-dev serve --port \"$ORCA_PORT\" --project-root \"$ORCA_PROJECT_ROOT\" \\\n      --pairing-address \"$ORCA_PAIRING_ADDRESS\" --recipe-json >/tmp/orca-recipe.json 2>/tmp/orca-serve.log </dev/null & \\\n    pid=$!; for _ in $(seq 1 80); do \\\n      node -e \"JSON.parse(require(\\\"node:fs\\\").readFileSync(\\\"/tmp/orca-recipe.json\\\",\\\"utf8\\\"))\" >/dev/null 2>&1 && { cat /tmp/orca-recipe.json; exit 0; }; \\\n      kill -0 \"$pid\" 2>/dev/null || { cat /tmp/orca-serve.log >&2; exit 1; }; sleep 0.25; \\\n    done; cat /tmp/orca-serve.log >&2; echo \"serve recipe JSON timed out\" >&2; exit 1')\"\n\n# 4. print serve's JSON enriched with userData (single object on stdout)\nnode -e 'const p=JSON.parse(process.argv[1]); console.log(JSON.stringify({...p, schemaVersion:1,\n  userData:{...p.userData, provider:\"vercel-sandbox\", resourceId:process.argv[2], snapshotId:process.argv[3]}}))' \\\n  \"$recipe_json\" \"$name\" \"$snapshot_id\"\ntrap - EXIT\n```\n\n`suspend`/`resume`/`destroy` use `vercel sandbox stop|...|remove \"$resource_id\"` reading\n`userData.resourceId` from stdin (§7d). This is the **Orca-server** connection mode (the recipe emits a\npairing URL). If the user chose **SSH** in the §1 interview, use §7g instead.\n\n### 7g. Worked example — existing SSH host (SSH connection mode)\n\nSSH mode is **fundamentally different from §7c/§7f**, not a relabeling of them:\n\n- **`create` does NOT run `orca serve` and does NOT emit a `pairingCode`.** Orca itself connects to the\n  host over its SSH relay, brings up the git + filesystem providers, and imports the repo. The script's\n  only job is to make the host ready and **print SSH connection details** Orca will dial.\n- The result uses a `connection` block with `type: \"ssh\"` and a `target`, **not** the flat\n  `pairingCode`/`projectRoot` shape. Exact shape (Orca rejects anything else):\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"connection\": {\n    \"type\": \"ssh\",\n    \"projectRoot\": \"/abs/path/to/repo/on/host\",\n    \"target\": {\n      \"label\": \"my-box\",\n      \"host\": \"192.0.2.10\",\n      \"port\": 22,\n      \"username\": \"ubuntu\",\n      \"identityFile\": \"~/.ssh/id_ed25519\",\n      \"jumpHost\": \"bastion.example.com\",\n      \"proxyCommand\": \"cloudflared access ssh --hostname %h\",\n      \"relayGracePeriodSeconds\": 0,\n      \"portForwards\": []\n    }\n  }\n}\n```\n\n`label`, `host`, `port`, `username` are required; the rest are optional — omit any you don't need.\n\n**Networking → which `target` fields to set** (how *your desktop* reaches the box — there is no\n`orca serve` URL in SSH mode):\n\n- Public IP / DNS, or a Tailscale/VPN address → `host`; SSH port → `port` (usually 22).\n- Key auth → `identityFile` (add `identitiesOnly: true` if the agent has many keys).\n- Through a bastion → `jumpHost` (a `user@host` ProxyJump) **or** a full `proxyCommand` (e.g. an access\n  proxy). Use one, not both.\n- A service port the workspace needs → add entries to `portForwards`.\n- `relayGracePeriodSeconds` (optional): how long Orca keeps the SSH relay alive after the workspace\n  detaches before tearing it down; `0` = tear down immediately. Leave it off unless the user wants a\n  reconnect grace window.\n\n**Toolchain & agent auth on a persistent (no-snapshot) host — do this ONCE, by hand, before wiring the\nrecipe** (there's no base image to bake; the host *is* the base). Run the §7f Phase-2 install steps and\nthe §7f Phase-3 `<agent> login --device-auth` **directly over SSH on the host** (interactive, e.g.\n`ssh -t user@host '<agent> login --device-auth'`). After that the host stays ready across workspaces.\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback (default unset optionals to \"\"): ssh_username, host,\n#   ssh_port (default 22), identity_file, jump_host, proxy_command, project_root, repo_url, repo_ref\n: \"${identity_file:=}\"; : \"${jump_host:=}\"; : \"${proxy_command:=}\"   # avoid set -u aborts on optionals\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nssh_target=\"${ssh_username}@${host}\"\nssh_opts=(-p \"$ssh_port\"); [ -n \"$identity_file\" ] && ssh_opts+=(-i \"$identity_file\")\n# Why: a fresh host's key isn't in known_hosts; a StrictHostKeyChecking prompt would HANG a\n# non-interactive create. Pre-add the key (or set the option) so it can't block.\nssh-keyscan -p \"$ssh_port\" \"$host\" >> \"$HOME/.ssh/known_hosts\" 2>/dev/null || true\n\n# 1. ensure the repo is present and at the right commit on the host (NO orca serve here)\nssh \"${ssh_opts[@]}\" \"$ssh_target\" \\\n  \"GH_TOKEN='$gh_token' GIT_TERMINAL_PROMPT=0 bash -lc '\n     set -euo pipefail\n     [ -d \\\"$project_root/.git\\\" ] || git clone \\\"$repo_url\\\" \\\"$project_root\\\"\n     cd \\\"$project_root\\\" && git fetch origin \\\"$repo_ref\\\" && git checkout -B \\\"$repo_ref\\\" FETCH_HEAD\n   '\" >&2\n\n# 2. print the SSH connection block (NO pairingCode, NO orca serve). host/port/username tell Orca's\n#    relay how to dial in; identityFile/jumpHost/proxyCommand/portForwards are emitted when set.\nnode -e 'const [host,port,user,idf,jh,pc,root]=process.argv.slice(1);\n  const target={ label:\"per-workspace-host\", host, port:Number(port), username:user };\n  if(idf) target.identityFile=idf; if(jh) target.jumpHost=jh; if(pc) target.proxyCommand=pc;\n  // add target.portForwards=[...] here if the workspace needs forwarded service ports\n  console.log(JSON.stringify({ schemaVersion:1, connection:{ type:\"ssh\", projectRoot:root, target } }))' \\\n  \"$host\" \"$ssh_port\" \"$ssh_username\" \"$identity_file\" \"$jump_host\" \"$proxy_command\" \"$project_root\"\n```\n\n`suspend`/`resume`/`destroy`: on a persistent host there's usually nothing to tear down — set\n`destroy: none` and omit suspend/resume. (Orca still disconnects/reconnects its own SSH relay on\nsleep/wake/delete — that's separate from these scripts.)\n\nIf the SSH host is instead an **ephemeral/snapshot-capable VM** (your hypervisor, or a cloud VM with\nimage support), keep the §7f Phase-2/3 base-image model for provisioning, but still emit the\n`connection.type:\"ssh\"` block above instead of starting `orca serve`.\n\n### 7h. Worked example — local Docker SSH (SSH connection mode)\n\nLocal Docker can model an ephemeral SSH VM without cloud cost: build a base image with `sshd`, tools,\nrepo prerequisites, and the agent CLI; run an **interactive auth container** once; then `docker commit`\nthat container as the authenticated image used by per-workspace `create`.\n\nKey points:\n\n- Publish container SSH to a random localhost port (`-p 127.0.0.1::22`) and emit\n  `connection.type:\"ssh\"` with `host:\"127.0.0.1\"`, that port, `username`, `identityFile`, and\n  `identitiesOnly:true`.\n- Generate a repo-local SSH key if needed, but gitignore the private/public key files.\n- **Bake SSH host keys into the base image** (`ssh-keygen -A` at **build** time; at runtime only generate\n  if absent). Ephemeral containers all present the **same** host key, so `known_hosts` on `127.0.0.1`\n  doesn't churn as the published port rotates across workspaces (otherwise every container's freshly\n  generated key collides on `localhost` and trips host-key-changed warnings).\n- The auth image is the Docker equivalent of Phase 3: the **user** runs the agent login **inside** the\n  container (you can't drive it — you have no interactive TTY), configures proxy env/config, approves\n  hooks, and you commit once they report it's done. On a headless container use the **device-auth** flow\n  (§4). Verify login before committing — exit code, or fold stderr and match the exact success line (§4).\n- Do not bind-mount or copy the host's full agent home into the image. Let each container have writable\n  agent state; only the committed auth image should carry reusable authenticated state.\n- If committing from an interactive shell, force the runtime entrypoint back to `sshd`:\n  `docker commit --change='ENTRYPOINT [\"/usr/local/bin/orca-docker-ssh-entrypoint\"]' …`.\n- `destroy` should read `recipeResult.userData.resourceId` and run `docker rm -f \"$resource_id\"`.\n\nValidation before wiring/live use:\n\n```bash\ndocker image inspect \"$auth_image\" --format '{{json .Config.Entrypoint}}'\ndocker run -d --name \"$name\" -p 127.0.0.1::22 -e \"ORCA_SSH_PUBLIC_KEY=$pubkey\" \"$auth_image\"\ndocker ps -a --filter \"name=$name\"\ndocker logs \"$name\"\nssh -i \"$key\" -p \"$port\" -o IdentitiesOnly=yes user@127.0.0.1 'codex --version'\n```\n\nIf the container exits immediately, inspect logs before the cleanup trap removes it; a committed\ninteractive image with `ENTRYPOINT [\"bash\"]` is a common cause.\n\nAlso confirm the **host key is stable** across containers: the SSH `ssh -i … 127.0.0.1` dial should not\ntrigger a host-key-changed warning when a second container reuses the port. If it does, the host keys\nweren't baked into the base image (see the `ssh-keygen -A` point above).\n\n### 7i. Windows local-side scripts\n\nThe local-side scripts run on the user's desktop. On **Windows**, a bare `.sh` won't execute. Either\nrequire WSL/Git-Bash (and point `orca.yaml` at e.g. `bash ./scripts/orca-vm/<name>.sh` via a `.cmd`\nlauncher), or scaffold PowerShell equivalents. Minimal PowerShell shape:\n\n```powershell\n#requires -Version 5\n$ErrorActionPreference = 'Stop'\n# resolve env→state→fallback; run the provider CLI / ssh the same way;\n# capture provider output; build the result object for the chosen mode and write ONE line of JSON to stdout.\n# Orca-server mode: @{ schemaVersion=1; pairingCode=$pairingCode; projectRoot=$projectRoot; userData=@{...} }\n# SSH mode:        @{ schemaVersion=1; connection=@{ type=\"ssh\"; projectRoot=$projectRoot;\n#                     target=@{ label=$label; host=$host; port=$port; username=$user } } }  (see §7g/§7h)\n($result | ConvertTo-Json -Compress -Depth 6)\n# progress/errors → Write-Error / the error stream, never stdout.\n```\n\nThe remote-side commands you run *inside* the Linux VM stay bash regardless of the desktop OS.\n\n---\n\n## 8. Per-workspace recipe contract (the fast path)\n\nOnce the authenticated snapshot exists, this runs on every workspace create. Define recipes in\n`orca.yaml`:\n\n```yaml\nenvironmentRecipes:\n  - id: cloud-sandbox\n    name: Cloud Sandbox\n    create: ./scripts/orca-vm/cloud-sandbox-create.sh\n    suspend: ./scripts/orca-vm/cloud-sandbox-suspend.sh\n    resume: ./scripts/orca-vm/cloud-sandbox-resume.sh\n    destroy: ./scripts/orca-vm/cloud-sandbox-destroy.sh\n```\n\n`create` runs **locally from the repo root** and prints **one** JSON object to stdout. Its shape depends\non the connection mode chosen in §1:\n\n**Orca-server mode** — boot the env, start `orca serve` in it, and print serve's result:\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"pairingCode\": \"orca-pairing-code-or-url\",\n  \"projectRoot\": \"/absolute/path/to/repo/on/remote\",\n  \"userData\": { \"provider\": \"example\", \"resourceId\": \"provider-resource-id\" }\n}\n```\n\nHere `pairingCode` (from `orca serve --recipe-json`) and `projectRoot` are required; `schemaVersion` (`1`)\nand `userData` are optional.\n\n**SSH mode** — do **not** run `orca serve`; print the `connection.type:\"ssh\"` block instead (full shape +\nworked script in §7g). `pairingCode` is **not** used in SSH mode.\n\nLifecycle hooks (all run locally):\n\n- `create`: required. Prints recipe result JSON.\n- `suspend`: optional. Sleep; reads lifecycle payload on stdin.\n- `resume`: optional. Wake; reads payload on stdin and **prints fresh recipe JSON** (pairing may change).\n- `destroy`: optional unless `destroy: none`. Delete/cleanup; reads payload on stdin.\n\nStart Orca remotely with `orca serve --port \"$PORT\" --project-root \"$ABS_ROOT\" --pairing-address\n\"$EXTERNAL_WSS_URL\" --recipe-json` (exact flags + output in §7c). Set `--pairing-address` to the\nexternally reachable address so the emitted `pairingCode` is reachable; tunneling/port mapping is the\nscript's job.\n\nBackward compatibility: `command`→`create`, `cleanup`→`destroy`, `cleanup: none`→`destroy: none`.\nPrefer the lifecycle names.\n\n---\n\n## 9. Doctor and validation\n\nValidate in two stages — the cheap dry run first, then the live self-test.\n\n### Dry run (free, non-destructive) — always do this first\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --json` validates **static wiring only** — it does\n**not** boot anything. It checks: local-host execution (v1), repo path, recipe id exists,\ncreate/destroy/suspend/resume command paths resolve, suspend/resume are paired, and each script is\nexecutable (POSIX exec bit; skipped on Windows). Fix every failure here before spending any cloud money.\n\n### Live self-test (`--provision`) — diagnose and iterate yourself\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --provision --json` actually runs the recipe end\nto end: it executes `create`, validates the returned recipe JSON, then runs `destroy` to **tear the\nenvironment back down** (so the test leaves nothing running, as long as `destroy` works). It spends real\ncloud money, so get the user's OK **once** before starting — that one approval covers the whole loop\nbelow; do not re-ask before each run.\n\nOn failure, the JSON result includes a `provisionTranscript` with the **complete** captured output of\neach stage so you can self-diagnose without asking the user to relay logs:\n\n```json\n{\n  \"ok\": false,\n  \"checks\": [ { \"id\": \"recipe.provision\", \"status\": \"fail\", \"message\": \"…\" } ],\n  \"provisionTranscript\": {\n    \"provision\": { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\", \"parseError\": \"…\" },\n    \"destroy\":   { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\" }\n  }\n}\n```\n\n**Run it as a loop:** read `provisionTranscript.provision.stderr` / `.stdout` / `.parseError` (and\n`destroy.*`), fix the script, and re-run `--provision` until `ok` is `true` — iterating on your own\nrather than waiting for the user to paste errors. Common reads: a non-empty `stderr` with `exitCode 0`\nplus a `parseError` means `create` ran but printed something other than the single recipe-result JSON on\nstdout (often a stray `echo` — route it to stderr, see §10); a non-zero `exitCode` is a provider/script\nfailure described in `stderr`. Each stream is redacted and capped (head+tail) — large logs keep both the\nsetup context and the failure.\n\nThe self-test cannot see provider-side truth beyond what the scripts print, so still confirm: state has a\npopulated **authenticated** `snapshotId` (Phases 2–3 done), and `destroy` is implemented/tested (or\nexplicitly `none` — in which case the self-test won't tear down, so clean up manually).\n\nFor SSH recipes, also smoke-test the exact emitted target before declaring success: dial the host/port\nwith the identity/proxy settings, run `pwd`, verify the repo path, check the agent binary, and confirm\n`destroy` removes the provider resource/container. For Docker, inspect the auth image entrypoint and do a\nstartup-only `docker run` before the full clone/install path.\n\n---\n\n## 10. Failure modes\n\n- **Build exceeds plan timeout (e.g. Hobby 45m).** Use enough vCPUs and a timeout covering the build;\n  else split work or use a higher plan. The cap also limits per-workspace runtime — surface it.\n- **Build exceeds plan RAM.** Build the **headless main only** (drop the renderer) — the biggest fitter.\n- **Private-repo clone hangs/fails.** Wrong/missing token. Use `GIT_ASKPASS` + `GIT_TERMINAL_PROMPT=0`\n  so it fails fast instead of prompting.\n- **`GIT_ASKPASS` helper aborts the clone with \"`$1: unbound variable`\".** The `printf`/heredoc that writes\n  the helper inside `bash -lc` under `set -u` expanded `$1`/`$GH_TOKEN` at **write** time. Escape them\n  (`\\$1`, `\\$GH_TOKEN`) so they land literally and resolve at git-runtime; this also keeps the real token\n  out of the file. `rm -f` the helper afterward (§5, §7f).\n- **Agent verified as \"not logged in\" despite a good login.** `codex login status` (and similar) print\n  \"Logged in …\" to **stderr**; an stdout-only `grep` misses it. Prefer the status **exit code**; if you\n  grep, fold stderr first (`status 2>&1 | grep …`) and match the exact success line — not `grep -qi\n  'logged in'`, which also matches \"not logged in\".\n- **Headless agent login hangs.** Plain OAuth `login` starts a loopback callback server on a VM/container\n  port the host browser can't reach. Use the **device-auth** flow (`login --device-auth`) — it prints a\n  URL + code the user opens on the host.\n- **`known_hosts` host-key churn on local Docker.** Each ephemeral container regenerating its SSH host key\n  collides on `127.0.0.1` as the published port rotates. Bake host keys into the base image at build time\n  (`ssh-keygen -A`; runtime generates only if absent) so all containers share one stable key (§7h).\n- **Snapshot expired/evicted.** If `create` hits an unknown snapshot id, rerun Phases 2–3 and update\n  `snapshotId`.\n- **Agent auth didn't persist.** Confirm `snapshotId` points at the **authenticated** snapshot; re-run\n  Phase 3. Warn that short-lived tokens may need periodic re-auth.\n- **Agent auth copied from the host breaks.** Do not bind-mount/copy a full host agent home; sqlite\n  files can be unwritable or host-specific, hooks may need approval again, and config may reference\n  local-only env vars. Authenticate inside the runtime and snapshot/commit that layer.\n- **Docker auth image exits immediately.** Inspect `docker image inspect … .Config.Entrypoint` and\n  `docker logs`. If the image was committed from an interactive shell, reset the entrypoint to the SSH\n  entrypoint during `docker commit`.\n- **Leaked paid resource.** Every long script must trap errors and remove the sandbox it created.\n- **`create` emits non-JSON on stdout.** A stray `echo` corrupts the result — stdout is for the final\n  JSON only; everything else to stderr. The `--provision` self-test surfaces this as `exitCode 0` + a\n  `parseError` with the offending stdout in `provisionTranscript` (§9).\n\n---\n\n## 11. Boundaries\n\n- Don't create accounts, choose plans/regions, or invent scope/project/org/image/billing ids.\n- Don't invent or store credentials; no secrets in `userData`, state, comments, docs, or commits.\n- Don't run paid/long phases (base snapshot, auth, live test) without an explicit OK.\n- Don't hide provider errors behind generic messages — preserve actionable stderr.\n- Don't make Orca own provider lifecycle beyond invoking the configured scripts.\n- Don't commit or create an Orca workspace unless asked.\n"
 
 // oxfmt-ignore
-const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, coordinator loops, or decomposing work\n  across agents. Use `orca-cli` instead for full ownership handoffs, including\n  requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another\n  agent\", or \"another worktree\" when the user did not explicitly ask to\n  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for\n  ordinary terminal control, lightweight terminal prompts, shell commands, Orca\n  worktree management, reading or waiting on terminals, and automation of the\n  browser embedded inside Orca. Use Computer Use for browser windows, webviews,\n  Orca app UI, or desktop UI outside Orca's embedded browser.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model aws-bedrock-opus-5 --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end your turn and idle at the agent prompt. The coordinator may reuse or release this terminal after it processes your report; do not start more work, poll, or attempt to close the terminal yourself. If it reuses you, it re-engages you with a fresh preamble + TASK block delivered as new terminal input.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
+const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, coordinator loops, or decomposing work\n  across agents. Use `orca-cli` instead for full ownership handoffs, including\n  requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another\n  agent\", or \"another worktree\" when the user did not explicitly ask to\n  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for\n  ordinary terminal control, lightweight terminal prompts, shell commands, Orca\n  worktree management, reading or waiting on terminals, and automation of the\n  browser embedded inside Orca. Use Computer Use for browser windows, webviews,\n  Orca app UI, or desktop UI outside Orca's embedded browser.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model opus --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end your turn and idle at the agent prompt. The coordinator may reuse or release this terminal after it processes your report; do not start more work, poll, or attempt to close the terminal yourself. If it reuses you, it re-engages you with a fresh preamble + TASK block delivered as new terminal input.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
 
 // Why: no current guide has bundled reference documents, so --full is byte-identical for now.
 // oxfmt-ignore
diff --git a/src/cli/handlers/emulator.test.ts b/src/cli/handlers/emulator.test.ts
index 07bdd51e2f5..ff0dc5f141a 100644
--- a/src/cli/handlers/emulator.test.ts
+++ b/src/cli/handlers/emulator.test.ts
@@ -1,5 +1,5 @@
 import path from 'node:path'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { callMock, remoteMock } = vi.hoisted(() => ({
   callMock: vi.fn(),
@@ -29,6 +29,9 @@ import { main } from '../index'
 import { okFixture, queueFixtures } from '../test-fixtures'
 
 describe('orca emulator CLI handlers', () => {
+  const originalWorkspaceId = process.env.ORCA_WORKSPACE_ID
+  const originalWorktreeId = process.env.ORCA_WORKTREE_ID
+
   beforeEach(() => {
     vi.restoreAllMocks()
     callMock.mockReset()
@@ -38,6 +41,19 @@ describe('orca emulator CLI handlers', () => {
     process.exitCode = undefined
   })
 
+  afterEach(() => {
+    if (originalWorkspaceId === undefined) {
+      delete process.env.ORCA_WORKSPACE_ID
+    } else {
+      process.env.ORCA_WORKSPACE_ID = originalWorkspaceId
+    }
+    if (originalWorktreeId === undefined) {
+      delete process.env.ORCA_WORKTREE_ID
+    } else {
+      process.env.ORCA_WORKTREE_ID = originalWorktreeId
+    }
+  })
+
   it('resolves relative APK paths before calling the runtime', async () => {
     queueFixtures(callMock, okFixture('req_install', { ok: true }))
 
@@ -73,6 +89,46 @@ describe('orca emulator CLI handlers', () => {
     )
   })
 
+  it('uses the folder workspace exported by the current Orca terminal', async () => {
+    process.env.ORCA_WORKSPACE_ID = 'folder:folder-1'
+    delete process.env.ORCA_WORKTREE_ID
+    callMock.mockResolvedValue(
+      okFixture('req_attach', {
+        attached: true,
+        info: { deviceUdid: 'device-1', streamUrl: 'scrcpy://device-1' }
+      })
+    )
+
+    await main(['emulator', 'attach', 'device-1'], '/folder/project')
+
+    expect(callMock).toHaveBeenCalledOnce()
+    expect(callMock).toHaveBeenCalledWith(
+      'emulator.attach',
+      { device: 'device-1', worktree: 'folder:folder-1', focus: false },
+      { timeoutMs: 180_000 }
+    )
+  })
+
+  it('uses the current git worktree exported by the Orca terminal', async () => {
+    process.env.ORCA_WORKSPACE_ID = 'folder:stale-parent'
+    process.env.ORCA_WORKTREE_ID = 'repo-1::/repo/project '
+    callMock.mockResolvedValue(
+      okFixture('req_attach', {
+        attached: true,
+        info: { deviceUdid: 'device-1', streamUrl: 'scrcpy://device-1' }
+      })
+    )
+
+    await main(['emulator', 'attach', 'device-1'], '/repo/project')
+
+    expect(callMock).toHaveBeenCalledOnce()
+    expect(callMock).toHaveBeenCalledWith(
+      'emulator.attach',
+      { device: 'device-1', worktree: 'repo-1::/repo/project ', focus: false },
+      { timeoutMs: 180_000 }
+    )
+  })
+
   it('rejects relative APK paths for remote runtimes', async () => {
     remoteMock.mockReturnValue(true)
 
diff --git a/src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts b/src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts
new file mode 100644
index 00000000000..a7b1766437e
--- /dev/null
+++ b/src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts
@@ -0,0 +1,51 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { reportCliError } from '../format'
+import { ORCHESTRATION_HANDLERS } from './orchestration'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+it('prints a rejected lifecycle verdict as a JSON failure envelope', async () => {
+  const log = vi.spyOn(console, 'log').mockImplementation(() => {})
+  const client = {
+    call: vi.fn().mockResolvedValue({
+      result: {
+        message: { id: 'msg_rejected' },
+        lifecycle: {
+          action: 'rejected',
+          code: 'sender_not_assignee',
+          reason: 'dispatch ctx_1 expected the assigned pane'
+        }
+      }
+    })
+  }
+  let rejection: unknown
+  try {
+    await ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_foreign'],
+        ['to', 'term_coord'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['outcome', 'succeeded']
+      ]),
+      client,
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  } catch (error) {
+    rejection = error
+  }
+
+  expect(rejection).toBeDefined()
+  reportCliError(rejection, true, { commandPath: ['orchestration', 'send'] })
+
+  expect(JSON.parse(String(log.mock.calls[0]?.[0]))).toMatchObject({
+    ok: false,
+    error: {
+      code: 'sender_not_assignee',
+      message: 'dispatch ctx_1 expected the assigned pane'
+    }
+  })
+})
diff --git a/src/cli/handlers/orchestration-lifecycle-rejection.test.ts b/src/cli/handlers/orchestration-lifecycle-rejection.test.ts
index c55eed4391d..369edf9c4f6 100644
--- a/src/cli/handlers/orchestration-lifecycle-rejection.test.ts
+++ b/src/cli/handlers/orchestration-lifecycle-rejection.test.ts
@@ -10,9 +10,11 @@ import { ORCHESTRATION_HANDLERS } from './orchestration'
 
 afterEach(() => {
   process.exitCode = originalExitCode
+  vi.clearAllMocks()
+  callMock.mockReset()
 })
 
-it('prints a lifecycle rejection and exits unsuccessfully', async () => {
+it('raises a lifecycle rejection for the CLI error boundary', async () => {
   const response = {
     result: {
       message: { id: 'msg_rejected' },
@@ -25,22 +27,328 @@ it('prints a lifecycle rejection and exits unsuccessfully', async () => {
   }
   callMock.mockResolvedValueOnce(response)
 
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_foreign'],
+        ['to', 'term_coord'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: false
+    } as never)
+  ).rejects.toMatchObject({
+    code: 'sender_not_assignee',
+    message: 'dispatch ctx_1 expected the assigned pane'
+  })
+  expect(printResult).not.toHaveBeenCalled()
+})
+
+it('raises a Run-home relay rejection for the CLI error boundary', async () => {
+  callMock.mockResolvedValueOnce({
+    result: {
+      relay: {
+        messageId: 'relay_rejected',
+        sequence: 1,
+        dispatchId: 'ctx_1',
+        destination: 'run_home',
+        accepted: true
+      },
+      lifecycle: {
+        action: 'rejected',
+        code: 'task_dispatch_mismatch',
+        reason: 'wrong task',
+        authority: 'run_home'
+      }
+    }
+  })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_worker'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_wrong'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'task_dispatch_mismatch', message: 'wrong task' })
+  expect(printResult).not.toHaveBeenCalled()
+})
+
+it('accepts an explicit current settlement without a compatibility read', async () => {
+  callMock.mockResolvedValueOnce({
+    result: { message: { id: 'msg_done' }, lifecycle: { action: 'completed' } }
+  })
+
   await ORCHESTRATION_HANDLERS['orchestration send']({
     flags: new Map([
-      ['from', 'term_foreign'],
-      ['to', 'term_coord'],
+      ['from', 'term_worker'],
       ['subject', 'done'],
       ['type', 'worker_done'],
+      ['task-id', 'task_1'],
+      ['dispatch-id', 'ctx_1'],
       ['outcome', 'succeeded']
     ]),
     client: { call: callMock },
     cwd: '/tmp/repo',
-    json: false
+    json: true
   } as never)
 
-  expect(process.exitCode).toBe(1)
-  const formatter = vi.mocked(printResult).mock.calls[0]?.[2]
-  expect(formatter?.(response.result)).toBe(
-    'Rejected msg_rejected: dispatch ctx_1 expected the assigned pane'
-  )
+  expect(callMock).toHaveBeenCalledOnce()
+})
+
+it('fails closed when an older runtime leaves worker_done dispatched without a verdict', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_unconfirmed', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({
+      result: { dispatch: { id: 'ctx_1', status: 'dispatched' } }
+    })
+    .mockResolvedValueOnce({ result: { tasks: [] } })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_foreign'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_1'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'operation_unknown' })
+
+  expect(callMock).toHaveBeenNthCalledWith(2, 'orchestration.dispatchShow', { task: 'task_1' })
+  expect(callMock).toHaveBeenNthCalledWith(3, 'orchestration.taskList', {
+    status: 'completed',
+    run: 'run_1'
+  })
+})
+
+it('normalizes compatibility-read failures to operation_unknown', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_unconfirmed', run_id: 'run_1' } }
+    })
+    .mockRejectedValueOnce(new Error('runtime disconnected'))
+    .mockResolvedValueOnce({ result: { tasks: [] } })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_worker'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_1'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'operation_unknown' })
+})
+
+it('accepts a legacy response only after the authoritative dispatch is terminal', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_legacy_completed', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({
+      result: { dispatch: { id: 'ctx_1', status: 'completed' } }
+    })
+    .mockResolvedValueOnce({
+      result: {
+        tasks: [
+          {
+            id: 'task_1',
+            status: 'completed',
+            result: JSON.stringify({
+              provenance: 'worker_report',
+              messageId: 'msg_legacy_completed',
+              outcome: 'succeeded'
+            })
+          }
+        ]
+      }
+    })
+
+  await ORCHESTRATION_HANDLERS['orchestration send']({
+    flags: new Map([
+      ['from', 'term_worker'],
+      ['subject', 'done'],
+      ['type', 'worker_done'],
+      ['task-id', 'task_1'],
+      ['dispatch-id', 'ctx_1'],
+      ['outcome', 'succeeded']
+    ]),
+    client: { call: callMock },
+    cwd: '/tmp/repo',
+    json: true
+  } as never)
+
+  expect(callMock).toHaveBeenCalledTimes(3)
+  expect(callMock).toHaveBeenNthCalledWith(2, 'orchestration.dispatchShow', { task: 'task_1' })
+})
+
+it('accepts a legacy failed report only after the authoritative dispatch failed', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_legacy_failed', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({ result: { dispatch: { id: 'ctx_1', status: 'failed' } } })
+    .mockResolvedValueOnce({
+      result: {
+        tasks: [
+          {
+            id: 'task_1',
+            status: 'failed',
+            result: JSON.stringify({
+              provenance: 'worker_report',
+              messageId: 'msg_legacy_failed',
+              outcome: 'failed'
+            })
+          }
+        ]
+      }
+    })
+
+  await ORCHESTRATION_HANDLERS['orchestration send']({
+    flags: new Map([
+      ['from', 'term_worker'],
+      ['subject', 'failed'],
+      ['type', 'worker_done'],
+      ['task-id', 'task_1'],
+      ['dispatch-id', 'ctx_1'],
+      ['outcome', 'failed']
+    ]),
+    client: { call: callMock },
+    cwd: '/tmp/repo',
+    json: true
+  } as never)
+
+  expect(callMock).toHaveBeenCalledTimes(3)
+})
+
+it('accepts an idempotent retry whose first report already settled', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: {
+        message: { id: 'msg_retry', run_id: 'run_1', from_handle: 'term_worker' }
+      }
+    })
+    .mockResolvedValueOnce({ result: { dispatch: { id: 'ctx_1', status: 'completed' } } })
+    .mockResolvedValueOnce({
+      result: {
+        tasks: [
+          {
+            id: 'task_1',
+            status: 'completed',
+            result: JSON.stringify({
+              provenance: 'worker_report',
+              messageId: 'msg_first',
+              reportedBy: 'term_worker',
+              outcome: 'succeeded'
+            })
+          }
+        ]
+      }
+    })
+
+  await ORCHESTRATION_HANDLERS['orchestration send']({
+    flags: new Map([
+      ['from', 'term_worker'],
+      ['subject', 'done'],
+      ['type', 'worker_done'],
+      ['task-id', 'task_1'],
+      ['dispatch-id', 'ctx_1'],
+      ['outcome', 'succeeded']
+    ]),
+    client: { call: callMock },
+    cwd: '/tmp/repo',
+    json: true
+  } as never)
+
+  expect(callMock).toHaveBeenCalledTimes(3)
+})
+
+it('rejects an unrelated failed Dispatch that left its Task blocked', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_after_stop', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({ result: { dispatch: { id: 'ctx_1', status: 'failed' } } })
+    .mockResolvedValueOnce({ result: { tasks: [] } })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_worker'],
+        ['subject', 'failed'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_1'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'failed']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'operation_unknown' })
+})
+
+it('rejects a terminal Dispatch with the wrong identity', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_stale', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({
+      result: { dispatch: { id: 'ctx_replacement', status: 'completed' } }
+    })
+    .mockResolvedValueOnce({
+      result: {
+        tasks: [
+          {
+            id: 'task_1',
+            status: 'completed',
+            result: JSON.stringify({
+              provenance: 'worker_report',
+              messageId: 'msg_stale',
+              outcome: 'succeeded'
+            })
+          }
+        ]
+      }
+    })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_worker'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_1'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'operation_unknown' })
 })
diff --git a/src/cli/handlers/orchestration-migration.test.ts b/src/cli/handlers/orchestration-migration.test.ts
index a1a117b90b3..863720eaab1 100644
--- a/src/cli/handlers/orchestration-migration.test.ts
+++ b/src/cli/handlers/orchestration-migration.test.ts
@@ -12,33 +12,43 @@ afterEach(() => {
 })
 
 describe('orchestration CLI migration recovery', () => {
-  it('forwards legacy worker_done without inventing a completion outcome', async () => {
-    process.env.ORCA_PANE_KEY = 'tab-worker:leaf-worker'
-    const call = vi.fn().mockResolvedValue({ result: { message: { id: 'msg_done' } } })
+  it.each([false, true])(
+    'accepts an attested legacy worker_done settlement (replayed: %s)',
+    async (replayed) => {
+      process.env.ORCA_PANE_KEY = 'tab-worker:leaf-worker'
+      const call = vi.fn().mockResolvedValue({
+        result: {
+          message: { id: 'msg_done' },
+          lifecycle: { action: 'settled', outcome: 'succeeded', duplicate: replayed }
+        }
+      })
 
-    await ORCHESTRATION_HANDLERS['orchestration send']({
-      flags: new Map<string, string | boolean>([
-        ['from', 'term_worker'],
-        ['subject', 'Done'],
-        ['type', 'worker_done']
-      ]),
-      client: { call },
-      cwd: '/tmp/repo',
-      json: true
-    } as never)
+      await ORCHESTRATION_HANDLERS['orchestration send']({
+        flags: new Map<string, string | boolean>([
+          ['from', 'term_worker'],
+          ['subject', 'Done'],
+          ['type', 'worker_done']
+        ]),
+        client: { call },
+        cwd: '/tmp/repo',
+        json: true
+      } as never)
 
-    expect(call).toHaveBeenCalledWith('orchestration.send', {
-      from: 'term_worker',
-      to: undefined,
-      run: undefined,
-      subject: 'Done',
-      body: undefined,
-      type: 'worker_done',
-      priority: undefined,
-      threadId: undefined,
-      payload: undefined,
-      senderPaneKey: 'tab-worker:leaf-worker',
-      devMode: false
-    })
-  })
+      expect(call).toHaveBeenCalledWith('orchestration.send', {
+        from: 'term_worker',
+        to: undefined,
+        run: undefined,
+        subject: 'Done',
+        body: undefined,
+        type: 'worker_done',
+        priority: undefined,
+        threadId: undefined,
+        payload: undefined,
+        senderPaneKey: 'tab-worker:leaf-worker',
+        waitForLifecycleSettlement: true,
+        devMode: false
+      })
+      expect(call).toHaveBeenCalledOnce()
+    }
+  )
 })
diff --git a/src/cli/handlers/orchestration-worker-settlement.ts b/src/cli/handlers/orchestration-worker-settlement.ts
new file mode 100644
index 00000000000..8b9425391ee
--- /dev/null
+++ b/src/cli/handlers/orchestration-worker-settlement.ts
@@ -0,0 +1,147 @@
+import type { RuntimeClient } from '../runtime-client'
+import { RuntimeClientError } from '../runtime-client'
+
+export async function requireWorkerDoneSettlement(
+  client: RuntimeClient,
+  type: string | undefined,
+  payload: string | undefined,
+  result: unknown
+): Promise<void> {
+  if (type !== 'worker_done' || hasLifecycleVerdict(result)) {
+    return
+  }
+  const target = parseWorkerDoneTarget(payload)
+  const receipt = parseWorkerDoneReceipt(result)
+  if (target && receipt) {
+    const [dispatchVerification, taskVerification] = await Promise.all([
+      client.call<{ dispatch: { id: string; status: string } | null }>(
+        'orchestration.dispatchShow',
+        { task: target.taskId }
+      ),
+      client.call<{
+        tasks: { id: string; status: string; result: string | null }[]
+      }>('orchestration.taskList', { status: target.expectedStatus, run: receipt.runId })
+    ]).catch(() => {
+      throw workerDoneSettlementUnknown()
+    })
+    const task = taskVerification.result.tasks.find((candidate) => candidate.id === target.taskId)
+    if (
+      dispatchVerification.result.dispatch?.id === target.dispatchId &&
+      dispatchVerification.result.dispatch.status === target.expectedStatus &&
+      task?.status === target.expectedStatus &&
+      isExactWorkerReport(task.result, receipt, target.outcome)
+    ) {
+      return
+    }
+  }
+  throw workerDoneSettlementUnknown()
+}
+
+function workerDoneSettlementUnknown(): RuntimeClientError {
+  return new RuntimeClientError(
+    'operation_unknown',
+    'The runtime accepted worker_done but did not confirm that the exact report settled its Task and Dispatch. Retry from the assigned worker after verifying its active Dispatch.'
+  )
+}
+
+function parseWorkerDoneReceipt(
+  result: unknown
+): { messageId: string; runId: string; fromHandle?: string } | undefined {
+  if (!result || typeof result !== 'object' || !('message' in result)) {
+    return undefined
+  }
+  const message = (result as { message?: unknown }).message
+  if (!message || typeof message !== 'object') {
+    return undefined
+  }
+  const {
+    id,
+    run_id: runId,
+    from_handle: fromHandle
+  } = message as {
+    id?: unknown
+    run_id?: unknown
+    from_handle?: unknown
+  }
+  return typeof id === 'string' && typeof runId === 'string'
+    ? {
+        messageId: id,
+        runId,
+        ...(typeof fromHandle === 'string' ? { fromHandle } : {})
+      }
+    : undefined
+}
+
+function isExactWorkerReport(
+  result: string | null | undefined,
+  receipt: { messageId: string; fromHandle?: string },
+  outcome: 'succeeded' | 'failed'
+): boolean {
+  if (!result) {
+    return false
+  }
+  try {
+    const parsed = JSON.parse(result) as Record<string, unknown>
+    return (
+      parsed.provenance === 'worker_report' &&
+      parsed.outcome === outcome &&
+      (parsed.messageId === receipt.messageId ||
+        (receipt.fromHandle !== undefined && parsed.reportedBy === receipt.fromHandle))
+    )
+  } catch {
+    return false
+  }
+}
+
+function hasLifecycleVerdict(result: unknown): boolean {
+  if (!result || typeof result !== 'object' || !('lifecycle' in result)) {
+    return false
+  }
+  const lifecycle = (result as { lifecycle?: unknown }).lifecycle
+  if (!lifecycle || typeof lifecycle !== 'object') {
+    return false
+  }
+  const action = (lifecycle as { action?: unknown }).action
+  if ('relay' in result) {
+    return (
+      (lifecycle as { authority?: unknown }).authority === 'run_home' &&
+      (action === 'completed' || action === 'failed' || action === 'rejected')
+    )
+  }
+  if (action === 'settled') {
+    const outcome = (lifecycle as { outcome?: unknown }).outcome
+    return outcome === 'succeeded' || outcome === 'failed'
+  }
+  return action === 'completed' || action === 'failed' || action === 'rejected'
+}
+
+function parseWorkerDoneTarget(payload: string | undefined):
+  | {
+      taskId: string
+      dispatchId: string
+      outcome: 'succeeded' | 'failed'
+      expectedStatus: 'completed' | 'failed'
+    }
+  | undefined {
+  if (!payload) {
+    return undefined
+  }
+  try {
+    const parsed = JSON.parse(payload) as Record<string, unknown>
+    if (
+      typeof parsed.taskId !== 'string' ||
+      typeof parsed.dispatchId !== 'string' ||
+      (parsed.outcome !== 'succeeded' && parsed.outcome !== 'failed')
+    ) {
+      return undefined
+    }
+    return {
+      taskId: parsed.taskId,
+      dispatchId: parsed.dispatchId,
+      outcome: parsed.outcome,
+      expectedStatus: parsed.outcome === 'succeeded' ? 'completed' : 'failed'
+    }
+  } catch {
+    return undefined
+  }
+}
diff --git a/src/cli/handlers/orchestration.test.ts b/src/cli/handlers/orchestration.test.ts
index ef7299efb43..c43f7b45b62 100644
--- a/src/cli/handlers/orchestration.test.ts
+++ b/src/cli/handlers/orchestration.test.ts
@@ -50,7 +50,7 @@ afterEach(() => {
 
 describe('orchestration send structured payload flags', () => {
   beforeEach(() => {
-    callMock.mockReset().mockResolvedValue({ result: { message: { id: 'msg_1' } } })
+    callMock.mockReset().mockResolvedValue({ result: { lifecycle: { action: 'completed' } } })
     getTerminalHandleMock.mockReset()
     delete process.env.ORCA_TERMINAL_HANDLE
     delete process.env.ORCA_PANE_KEY
@@ -94,6 +94,7 @@ describe('orchestration send structured payload flags', () => {
         filesModified: ['src/a.ts', 'src/b.ts'],
         reportPath: 'reports/done.md'
       }),
+      waitForLifecycleSettlement: true,
       devMode: false
     })
   })
@@ -207,6 +208,7 @@ describe('orchestration send structured payload flags', () => {
       priority: undefined,
       threadId: undefined,
       payload: JSON.stringify({ outcome: 'succeeded' }),
+      waitForLifecycleSettlement: true,
       devMode: false
     })
   })
@@ -233,6 +235,7 @@ describe('orchestration send structured payload flags', () => {
       priority: undefined,
       threadId: undefined,
       payload: JSON.stringify({ outcome: 'succeeded' }),
+      waitForLifecycleSettlement: true,
       devMode: false
     })
   })
diff --git a/src/cli/handlers/orchestration.ts b/src/cli/handlers/orchestration.ts
index 5be6e62394d..771b8367b88 100644
--- a/src/cli/handlers/orchestration.ts
+++ b/src/cli/handlers/orchestration.ts
@@ -8,6 +8,7 @@ import {
   getRequiredStringFlag
 } from '../flags'
 import { RuntimeClientError } from '../runtime-client'
+import { requireWorkerDoneSettlement } from './orchestration-worker-settlement'
 import { getTerminalHandle } from '../selectors'
 import {
   clampOrchestrationAskTimeoutMs,
@@ -90,14 +91,13 @@ const WORKER_TERMINAL_LIST_STATES = [
   'released'
 ] as const
 
-type LifecycleSendRejection = {
-  action: 'rejected'
-  code: string
-  reason: string
-}
+type LifecycleSendResult =
+  | { action: 'completed' | 'failed'; authority?: 'run_home' }
+  | { action: 'settled'; outcome: 'succeeded' | 'failed'; duplicate?: boolean }
+  | { action: 'rejected'; code: string; reason: string }
 
 type OrchestrationSendResult =
-  | { message: { id: string }; lifecycle?: LifecycleSendRejection }
+  | { message: { id: string; run_id?: string }; lifecycle?: LifecycleSendResult }
   | { messages: { id: string }[]; recipients: number }
   | {
       relay: {
@@ -107,7 +107,7 @@ type OrchestrationSendResult =
         destination?: 'run_home' | 'worker'
         accepted: true
       }
-      lifecycle?: { action: 'completed' | 'failed' }
+      lifecycle?: LifecycleSendResult
     }
 
 function resolveCompatibilityCliCommand(): 'orca' | 'orca-ide' | 'orca-dev' {
@@ -579,6 +579,7 @@ export const ORCHESTRATION_HANDLERS: Record<string, CommandHandler> = {
       payload: getOptionalStructuredMessagePayload(flags),
       // Why: pane key is the remint-stable sender identity the runtime verifies lifecycle ownership against; older runtimes strip it.
       senderPaneKey: process.env.ORCA_PANE_KEY || undefined,
+      waitForLifecycleSettlement: type === 'worker_done' ? true : undefined,
       devMode: isDevCliInvocation()
     }
     const dispatchCapability = getOptionalStringFlag(flags, 'dispatch-capability')
@@ -589,15 +590,12 @@ export const ORCHESTRATION_HANDLERS: Record<string, CommandHandler> = {
       sendParams,
       dispatchCapability ? { orchestrationCapability: dispatchCapability } : undefined
     )
-    if ('message' in result.result && result.result.lifecycle?.action === 'rejected') {
-      // Why: a rejected lifecycle signal isn't completion; non-zero exit stops workers from treating it as such.
-      process.exitCode = 1
+    await requireWorkerDoneSettlement(client, type, sendParams.payload, result.result)
+    if ('lifecycle' in result.result && result.result.lifecycle?.action === 'rejected') {
+      throw new RuntimeClientError(result.result.lifecycle.code, result.result.lifecycle.reason)
     }
     printResult(result, json, (r) => {
       if ('message' in r) {
-        if (r.lifecycle?.action === 'rejected') {
-          return `Rejected ${r.message.id}: ${r.lifecycle.reason}`
-        }
         return `Sent ${r.message.id}`
       }
       if ('relay' in r) {
diff --git a/src/cli/handlers/terminal.test.ts b/src/cli/handlers/terminal.test.ts
index 7dadf41c2d3..8c5ff460c77 100644
--- a/src/cli/handlers/terminal.test.ts
+++ b/src/cli/handlers/terminal.test.ts
@@ -61,3 +61,67 @@ describe('terminal close CLI', () => {
     expect(help).toContain('durable persistence')
   })
 })
+
+describe('terminal split CLI', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('sends the old-host attribution bypass through the legacy-compatible env field', async () => {
+    const call = vi.fn(async (method: string) =>
+      method === 'status.get'
+        ? {
+            result: {
+              runtimeId: 'runtime-1',
+              capabilities: ['terminal.attribution-removed.v1']
+            }
+          }
+        : { result: { split: { handle: 'term-2', parentHandle: 'term-1' } } }
+    )
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+
+    await TERMINAL_HANDLERS['terminal split']({
+      flags: new Map([
+        ['terminal', 'term-1'],
+        ['direction', 'horizontal']
+      ]),
+      client: { call } as unknown as RuntimeClient,
+      cwd: '/tmp/worktree',
+      json: true
+    })
+
+    expect(call).toHaveBeenNthCalledWith(1, 'status.get')
+    expect(call).toHaveBeenNthCalledWith(
+      2,
+      'terminal.split',
+      {
+        terminal: 'term-1',
+        direction: 'horizontal',
+        command: undefined,
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION']
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
+  })
+
+  it('refuses legacy hosts because renderer-owned splits discard environment fields', async () => {
+    const call = vi.fn().mockResolvedValue({
+      result: { appVersion: '1.4.181', capabilities: ['mobile.tasks.v1'] }
+    })
+
+    await expect(
+      TERMINAL_HANDLERS['terminal split']({
+        flags: new Map([['terminal', 'term-1']]),
+        client: { call } as unknown as RuntimeClient,
+        cwd: '/tmp/worktree',
+        json: true
+      })
+    ).rejects.toMatchObject({
+      code: 'runtime_update_required',
+      message: expect.stringContaining('Update the host and try again')
+    })
+    expect(call).toHaveBeenCalledTimes(1)
+    expect(call).not.toHaveBeenCalledWith('terminal.split', expect.anything())
+  })
+})
diff --git a/src/cli/handlers/terminal.ts b/src/cli/handlers/terminal.ts
index 551ab8d95c1..677cdc81034 100644
--- a/src/cli/handlers/terminal.ts
+++ b/src/cli/handlers/terminal.ts
@@ -8,7 +8,8 @@ import type {
   RuntimeTerminalSend,
   RuntimeTerminalShow,
   RuntimeTerminalSplit,
-  RuntimeTerminalWait
+  RuntimeTerminalWait,
+  RuntimeStatus
 } from '../../shared/runtime-types'
 import type { CommandHandler } from '../dispatch'
 import { shouldUseRendererBackedInteractiveTerminal } from '../codex-command-classification'
@@ -37,6 +38,14 @@ import {
   getRequiredWorktreeSelector,
   getTerminalHandle
 } from '../selectors'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  hostSupportsTerminalCreateAttributionDisable,
+  hostSupportsTerminalSplitAttributionDisable,
+  TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE,
+  TERMINAL_SPLIT_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE,
+  withLegacyTerminalAttributionDisabledEnv
+} from '../../shared/legacy-terminal-attribution-env'
 
 // Why: terminal wait legitimately needs to outlive the CLI's default RPC
 // timeout. Even without an explicit server timeout, the client must allow
@@ -137,17 +146,30 @@ export const TERMINAL_HANDLERS: Record<string, CommandHandler> = {
     const useRendererBackedInteractiveTerminal =
       !client.isRemote && shouldUseRendererBackedInteractiveTerminal(command)
     const focus = flags.get('focus') === true
-    const result = await client.call<{ terminal: RuntimeTerminalCreate }>('terminal.create', {
-      worktree: await getBrowserWorktreeSelector(flags, cwd, client),
-      command,
-      title: getOptionalStringFlag(flags, 'title'),
-      // Why: interactive local agent TUIs need the renderer-backed terminal
-      // path for browser-side features, but CLI creates must stay backgrounded
-      // unless the caller explicitly asks for focus.
-      focus,
-      ...(focus ? { presentation: 'focused' } : {}),
-      ...(useRendererBackedInteractiveTerminal ? { rendererBacked: true, activate: focus } : {})
-    })
+    const status = await client.call<RuntimeStatus>('status.get')
+    if (!hostSupportsTerminalCreateAttributionDisable(status.result)) {
+      throw new RuntimeClientError(
+        'runtime_update_required',
+        TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE
+      )
+    }
+    const result = await client.call<{ terminal: RuntimeTerminalCreate }>(
+      'terminal.create',
+      {
+        worktree: await getBrowserWorktreeSelector(flags, cwd, client),
+        command,
+        env: withLegacyTerminalAttributionDisabledEnv(undefined),
+        envToDelete: addLegacyTerminalAttributionDisableRequest(undefined),
+        title: getOptionalStringFlag(flags, 'title'),
+        // Why: interactive local agent TUIs need the renderer-backed terminal
+        // path for browser-side features, but CLI creates must stay backgrounded
+        // unless the caller explicitly asks for focus.
+        focus,
+        ...(focus ? { presentation: 'focused' } : {}),
+        ...(useRendererBackedInteractiveTerminal ? { rendererBacked: true, activate: focus } : {})
+      },
+      { expectedRuntimeId: status.result.runtimeId }
+    )
     printResult(result, json, formatTerminalCreate)
   },
   // `focus` resolves to this canonical path via CommandSpec.aliases before dispatch.
@@ -168,11 +190,24 @@ export const TERMINAL_HANDLERS: Record<string, CommandHandler> = {
     ) {
       throw new RuntimeClientError('invalid_argument', '--direction must be horizontal or vertical')
     }
-    const result = await client.call<{ split: RuntimeTerminalSplit }>('terminal.split', {
-      terminal: await getTerminalHandle(flags, cwd, client),
-      direction: directionFlag,
-      command: getOptionalStringFlag(flags, 'command')
-    })
+    const status = await client.call<RuntimeStatus>('status.get')
+    if (!hostSupportsTerminalSplitAttributionDisable(status.result)) {
+      throw new RuntimeClientError(
+        'runtime_update_required',
+        TERMINAL_SPLIT_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE
+      )
+    }
+    const result = await client.call<{ split: RuntimeTerminalSplit }>(
+      'terminal.split',
+      {
+        terminal: await getTerminalHandle(flags, cwd, client),
+        direction: directionFlag,
+        command: getOptionalStringFlag(flags, 'command'),
+        env: withLegacyTerminalAttributionDisabledEnv(undefined),
+        envToDelete: addLegacyTerminalAttributionDisableRequest(undefined)
+      },
+      { expectedRuntimeId: status.result.runtimeId }
+    )
     printResult(result, json, formatTerminalSplit)
   }
 }
diff --git a/src/cli/index.test.ts b/src/cli/index.test.ts
index 4867aebc29b..2f86ee9583f 100644
--- a/src/cli/index.test.ts
+++ b/src/cli/index.test.ts
@@ -3112,6 +3112,10 @@ describe('orca cli worktree awareness', () => {
   it('passes explicit focus through terminal.create', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3136,13 +3140,19 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: undefined,
-      title: 'RUNNER',
-      focus: true,
-      presentation: 'focused'
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: undefined,
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'RUNNER',
+        focus: true,
+        presentation: 'focused'
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('prints terminal.read fallback screen lines in json mode', async () => {
@@ -3184,6 +3194,10 @@ describe('orca cli worktree awareness', () => {
   it('keeps interactive Codex startup commands backgrounded unless focus is explicit', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3209,19 +3223,29 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'codex',
-      title: 'Codex',
-      focus: false,
-      rendererBacked: true,
-      activate: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'codex',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Codex',
+        focus: false,
+        rendererBacked: true,
+        activate: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('keeps explicit focus semantics when forcing Codex through the renderer path', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3248,20 +3272,30 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'codex',
-      title: 'Codex',
-      focus: true,
-      presentation: 'focused',
-      rendererBacked: true,
-      activate: true
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'codex',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Codex',
+        focus: true,
+        presentation: 'focused',
+        rendererBacked: true,
+        activate: true
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('does not force the visible terminal path for explicit Codex exec commands', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3287,17 +3321,27 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'codex exec summarize',
-      title: 'Codex exec',
-      focus: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'codex exec summarize',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Codex exec',
+        focus: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('does not force the visible terminal path for Codex exec commands after global options', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3323,17 +3367,27 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'codex -m gpt-5 --sandbox workspace-write exec summarize',
-      title: 'Codex exec',
-      focus: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'codex -m gpt-5 --sandbox workspace-write exec summarize',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Codex exec',
+        focus: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('does not force the visible terminal path for Codex review commands after long options', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3359,17 +3413,27 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'codex --model=gpt-5 --sandbox=workspace-write review',
-      title: 'Codex review',
-      focus: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'codex --model=gpt-5 --sandbox=workspace-write review',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Codex review',
+        focus: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('does not force the visible terminal path for Codex help commands', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3395,17 +3459,27 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'codex --help',
-      title: 'Codex help',
-      focus: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'codex --help',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Codex help',
+        focus: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('keeps Codex prompts after global options backgrounded unless focus is explicit', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3431,19 +3505,29 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'codex -m gpt-5 "fix the flaky test"',
-      title: 'Codex prompt',
-      focus: false,
-      rendererBacked: true,
-      activate: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'codex -m gpt-5 "fix the flaky test"',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Codex prompt',
+        focus: false,
+        rendererBacked: true,
+        activate: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('keeps interactive Claude startup commands backgrounded unless focus is explicit', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3469,19 +3553,29 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'claude',
-      title: 'Claude',
-      focus: false,
-      rendererBacked: true,
-      activate: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'claude',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Claude',
+        focus: false,
+        rendererBacked: true,
+        activate: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('keeps Claude print commands on the background terminal path', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3507,12 +3601,18 @@ describe('orca cli worktree awareness', () => {
       '/tmp/repo'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'path:/tmp/repo/feature',
-      command: 'claude -p "summarize"',
-      title: 'Claude print',
-      focus: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'path:/tmp/repo/feature',
+        command: 'claude -p "summarize"',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Claude print',
+        focus: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('uses the resolved enclosing worktree for other worktree consumers', async () => {
@@ -3819,6 +3919,10 @@ describe('orca cli worktree awareness', () => {
   it('sends explicit remote terminal create worktree selectors unchanged', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3842,12 +3946,18 @@ describe('orca cli worktree awareness', () => {
       '/tmp/client/repo/src'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'id:repo-1::/srv/orca/feature',
-      command: undefined,
-      title: undefined,
-      focus: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'id:repo-1::/srv/orca/feature',
+        command: undefined,
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: undefined,
+        focus: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('collects and formats memory diagnostics', async () => {
@@ -3955,6 +4065,10 @@ describe('orca cli worktree awareness', () => {
   it('does not force remote Codex terminal creates through a local renderer path', async () => {
     queueFixtures(
       callMock,
+      okFixture('req_status', {
+        runtimeId: 'runtime-1',
+        capabilities: ['terminal.attribution-removed.v1']
+      }),
       okFixture('req_terminal_create', {
         terminal: {
           handle: 'term_1',
@@ -3982,12 +4096,18 @@ describe('orca cli worktree awareness', () => {
       '/tmp/client/repo/src'
     )
 
-    expect(callMock).toHaveBeenCalledWith('terminal.create', {
-      worktree: 'id:repo-1::/srv/orca/feature',
-      command: 'codex',
-      title: 'Codex',
-      focus: false
-    })
+    expect(callMock).toHaveBeenCalledWith(
+      'terminal.create',
+      {
+        worktree: 'id:repo-1::/srv/orca/feature',
+        command: 'codex',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+        title: 'Codex',
+        focus: false
+      },
+      { expectedRuntimeId: 'runtime-1' }
+    )
   })
 
   it('does not resolve implicit remote browser targets from client cwd', async () => {
diff --git a/src/cli/runtime/client.ts b/src/cli/runtime/client.ts
index 3a8951de554..b6c49ff7c22 100644
--- a/src/cli/runtime/client.ts
+++ b/src/cli/runtime/client.ts
@@ -87,6 +87,7 @@ export class RuntimeClient {
         }
       : {}
     const envelope = {
+      expectedRuntimeId: options?.expectedRuntimeId,
       orchestrationCapability: options?.orchestrationCapability,
       orchestrationContractVersion: method.startsWith('orchestration.')
         ? ORCHESTRATION_CONTRACT_VERSION
diff --git a/src/cli/runtime/transport.test.ts b/src/cli/runtime/transport.test.ts
index 8de35f619e5..7858d6cd131 100644
--- a/src/cli/runtime/transport.test.ts
+++ b/src/cli/runtime/transport.test.ts
@@ -50,6 +50,48 @@ describe('runtime transport timeout validation', () => {
 // Why: these tests create Unix domain socket servers in temp directories.
 // Windows does not support Unix domain sockets in the same way.
 describe.skipIf(process.platform === 'win32')('runtime transport', () => {
+  it('forwards the expected runtime fence in local requests', async () => {
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-transport-'))
+    const endpoint = join(userDataPath, 'runtime.sock')
+    let receivedRequest: Record<string, unknown> | null = null
+    const server = createServer((socket) => {
+      sockets.add(socket)
+      socket.once('close', () => sockets.delete(socket))
+      socket.once('data', (data) => {
+        receivedRequest = JSON.parse(String(data).trim()) as Record<string, unknown>
+        socket.write(
+          `${JSON.stringify({
+            id: receivedRequest.id,
+            ok: true,
+            result: { terminal: { handle: 'terminal-1' } },
+            _meta: { runtimeId: 'runtime-1' }
+          })}\n`
+        )
+      })
+    })
+    servers.add(server)
+    await new Promise<void>((resolve) => server.listen(endpoint, resolve))
+
+    await sendRequest(
+      {
+        runtimeId: 'runtime-1',
+        pid: 123,
+        transports: [{ kind: 'unix', endpoint }],
+        authToken: 'token',
+        startedAt: 1
+      },
+      'terminal.create',
+      { worktree: 'id:worktree-1' },
+      1_000,
+      { expectedRuntimeId: 'runtime-1' }
+    )
+
+    expect(receivedRequest).toMatchObject({
+      method: 'terminal.create',
+      expectedRuntimeId: 'runtime-1'
+    })
+  })
+
   it('refreshes the per-call timeout when the runtime sends keepalive frames', async () => {
     const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-transport-'))
     const endpoint = join(userDataPath, 'runtime.sock')
diff --git a/src/cli/runtime/transport.ts b/src/cli/runtime/transport.ts
index 091ca9da0e0..998052dc4b6 100644
--- a/src/cli/runtime/transport.ts
+++ b/src/cli/runtime/transport.ts
@@ -186,6 +186,7 @@ export async function sendRequest<TResult>(
           authToken: metadata.authToken,
           method,
           params,
+          expectedRuntimeId: envelope?.expectedRuntimeId,
           orchestrationCapability: envelope?.orchestrationCapability,
           orchestrationContractVersion: envelope?.orchestrationContractVersion,
           orchestrationRequestId: envelope?.orchestrationRequestId,
diff --git a/src/cli/selectors.ts b/src/cli/selectors.ts
index 3729b8598a7..aef583ad0ac 100644
--- a/src/cli/selectors.ts
+++ b/src/cli/selectors.ts
@@ -237,6 +237,14 @@ export async function getEmulatorWorktreeSelector(
   if (client.isRemote) {
     return undefined
   }
+  const terminalWorktreeId = process.env.ORCA_WORKTREE_ID
+  if (terminalWorktreeId?.trim()) {
+    return terminalWorktreeId
+  }
+  const folderWorkspaceId = process.env.ORCA_WORKSPACE_ID?.trim()
+  if (folderWorkspaceId?.startsWith('folder:')) {
+    return folderWorkspaceId
+  }
   try {
     return await resolveCurrentWorktreeSelector(cwd, client)
   } catch {
diff --git a/src/main/agent-hooks/installer-utils-remote.ts b/src/main/agent-hooks/installer-utils-remote.ts
index aa7e47d258a..b4518220e90 100644
--- a/src/main/agent-hooks/installer-utils-remote.ts
+++ b/src/main/agent-hooks/installer-utils-remote.ts
@@ -8,8 +8,6 @@
 // We deliberately keep the JSON merge logic in the existing
 // `installer-utils.ts` and only swap fs primitives — the JSON shape and
 // managed-command matching must stay identical to the local install.
-//
-// See docs/design/agent-status-over-ssh.md §8 (commit #8).
 
 import { randomUUID } from 'node:crypto'
 import type { SFTPWrapper, FileEntryWithStats } from 'ssh2'
@@ -83,9 +81,9 @@ export async function writeHooksJsonRemote(
   }
 }
 
-/** Write the managed hook script to the remote and chmod 0o755. POSIX-only —
- *  the relay deliberately does not support Windows-remote in v1 (see design
- *  doc §3 + §6). */
+/** Write the managed hook script to the remote and chmod 0o755. POSIX-only:
+ *  the payload is a shell script and every path here is POSIX-joined, so a
+ *  Windows SSH target would need a separate installer, not a tweak to this one. */
 export async function writeManagedScriptRemote(
   sftp: SFTPWrapper,
   remotePath: string,
diff --git a/src/main/agent-hooks/managed-hook-local-filesystem.test.ts b/src/main/agent-hooks/managed-hook-local-filesystem.test.ts
index f6dcf14471a..3213ee0210e 100644
--- a/src/main/agent-hooks/managed-hook-local-filesystem.test.ts
+++ b/src/main/agent-hooks/managed-hook-local-filesystem.test.ts
@@ -2,7 +2,10 @@ import { mkdtemp, mkdir, readFile, readdir, rm, stat, writeFile } from 'node:fs/
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
-import { installRemoteManagedAgentHooks } from './remote-managed-hook-installers'
+import {
+  installRemoteManagedAgentHooks,
+  REMOTE_MANAGED_HOOK_INSTALLER_AGENTS
+} from './remote-managed-hook-installers'
 import { createManagedHookLocalFilesystem } from './managed-hook-local-filesystem'
 
 const tempHomes: string[] = []
@@ -34,7 +37,10 @@ describe('managed-hook local filesystem', () => {
   it('supports cold and warm aggregate installs without SFTP or temp-file residue', async () => {
     const home = await createTempHome()
     const filesystem = createManagedHookLocalFilesystem()
-    const options = { grokHomeDir: join(home, '.grok') }
+    const options = {
+      grokHomeDir: join(home, '.grok'),
+      agents: REMOTE_MANAGED_HOOK_INSTALLER_AGENTS
+    }
 
     const cold = await installRemoteManagedAgentHooks(filesystem, home, options)
     const warm = await installRemoteManagedAgentHooks(filesystem, home, options)
@@ -61,7 +67,8 @@ describe('managed-hook local filesystem', () => {
     await writeFile(claudeConfig, '{"hooks": }', 'utf8')
 
     const results = await installRemoteManagedAgentHooks(createManagedHookLocalFilesystem(), home, {
-      grokHomeDir: join(home, '.grok')
+      grokHomeDir: join(home, '.grok'),
+      agents: REMOTE_MANAGED_HOOK_INSTALLER_AGENTS
     })
 
     expect(results).toHaveLength(14)
diff --git a/src/main/agent-hooks/managed-hook-owner-identity.ts b/src/main/agent-hooks/managed-hook-owner-identity.ts
index 7f60956e6e4..51f299595cd 100644
--- a/src/main/agent-hooks/managed-hook-owner-identity.ts
+++ b/src/main/agent-hooks/managed-hook-owner-identity.ts
@@ -32,7 +32,7 @@ function hasCode(error: unknown, code: string): boolean {
 
 export function parseLinuxStartTicks(statLine: string): string | null {
   const commandEnd = statLine.lastIndexOf(')')
-  if (commandEnd < 0) {
+  if (commandEnd === -1) {
     return null
   }
   // Field 22 is index 19 after removing pid and the parenthesized command.
diff --git a/src/main/agent-hooks/managed-hook-runtime.test.ts b/src/main/agent-hooks/managed-hook-runtime.test.ts
index 456a741df87..e4c23e13959 100644
--- a/src/main/agent-hooks/managed-hook-runtime.test.ts
+++ b/src/main/agent-hooks/managed-hook-runtime.test.ts
@@ -1,22 +1,160 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { resolveRelayGrokHome } from './managed-hook-runtime'
+import { chmod, mkdtemp, readdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeChildProcess from 'node:child_process'
 
-afterEach(() => {
+// Why: the probe spawns a real login shell, and `resolveRelayGrokHome` swallows every
+// spawn failure into its fallback. Left unmocked this asserts the runner's scheduling
+// latency, not the parser: on a loaded sharded CI box the 8s timeout expires and the
+// first case silently flips to the fallback path.
+vi.mock('node:child_process', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeChildProcess>()
+  return { ...actual, execFile: vi.fn() }
+})
+
+const { execFile } = await import('node:child_process')
+const execFileMock = vi.mocked(execFile)
+const { execFile: actualExecFile } =
+  await vi.importActual<typeof NodeChildProcess>('node:child_process')
+const { installManagedHooks, resolveRelayGrokHome } = await import('./managed-hook-runtime')
+
+type ExecFileCallback = (error: Error | null, result?: { stdout: string; stderr: string }) => void
+
+function stubProbeOutput(stdout: string): void {
+  execFileMock.mockImplementation(((...args: unknown[]) => {
+    ;(args.at(-1) as ExecFileCallback)(null, { stdout, stderr: '' })
+    return undefined
+  }) as unknown as typeof execFile)
+}
+
+function stubProbeFailure(error: Error): void {
+  execFileMock.mockImplementation(((...args: unknown[]) => {
+    ;(args.at(-1) as ExecFileCallback)(error)
+    return undefined
+  }) as unknown as typeof execFile)
+}
+
+beforeEach(() => {
+  execFileMock.mockReset()
+  // Why: `installManagedHooks` proves a skipped probe through the login-shell run log, so the
+  // probe must really spawn unless a case above stubs it. The mock loses `promisify.custom`,
+  // so the real `(error, stdout, stderr)` callback is reshaped into the `{ stdout, stderr }`
+  // that `promisify(execFile)` resolves in production.
+  execFileMock.mockImplementation(((...args: unknown[]) => {
+    const callback = args.at(-1) as ExecFileCallback
+    return (actualExecFile as (...callArgs: unknown[]) => unknown)(
+      ...args.slice(0, -1),
+      (error: Error | null, stdout: string, stderr: string) => callback(error, { stdout, stderr })
+    )
+  }) as unknown as typeof execFile)
+})
+
+const tempHomes: string[] = []
+const tempRoot = process.platform === 'win32' ? tmpdir() : '/tmp'
+const SHELL_NAME = 'login-shell'
+const SHELL_RUNS_NAME = 'login-shell-runs'
+
+async function createTempHome(): Promise<string> {
+  const home = await mkdtemp(join(tempRoot, 'orca-managed-hook-runtime-'))
+  tempHomes.push(home)
+  return home
+}
+
+/** Login shell that records each invocation, so a skipped GROK_HOME probe is observable. */
+async function stubLoginShell(home: string): Promise<void> {
+  const shell = join(home, SHELL_NAME)
+  await writeFile(
+    shell,
+    `#!/bin/sh\necho ran >> "${join(home, SHELL_RUNS_NAME)}"\nexit 0\n`,
+    'utf8'
+  )
+  await chmod(shell, 0o755)
+  vi.stubEnv('HOME', home)
+  vi.stubEnv('SHELL', shell)
+}
+
+afterEach(async () => {
   vi.unstubAllEnvs()
+  await Promise.all(tempHomes.splice(0).map((home) => rm(home, { recursive: true, force: true })))
 })
 
 describe.runIf(process.platform !== 'win32')('resolveRelayGrokHome', () => {
   it('uses the login-shell GROK_HOME and normalizes trailing separators', async () => {
     vi.stubEnv('SHELL', '/bin/sh')
-    vi.stubEnv('GROK_HOME', '/srv/grok///')
+    stubProbeOutput('/srv/grok///\n')
 
     await expect(resolveRelayGrokHome('/home/orca')).resolves.toBe('/srv/grok')
+
+    const [shell, args] = execFileMock.mock.calls[0] ?? []
+    expect(shell).toBe('/bin/sh')
+    // `sh`/`dash` reject `-lc`, so the mode choice is part of the contract under test.
+    expect(args?.[0]).toBe('-c')
+  })
+
+  it('passes -lc to a login shell that supports it', async () => {
+    vi.stubEnv('SHELL', '/bin/zsh')
+    stubProbeOutput('/srv/grok\n')
+
+    await expect(resolveRelayGrokHome('/home/orca')).resolves.toBe('/srv/grok')
+
+    const [shell, args] = execFileMock.mock.calls[0] ?? []
+    expect(shell).toBe('/bin/zsh')
+    expect(args?.[0]).toBe('-lc')
   })
 
   it('falls back when the login-shell GROK_HOME is not an absolute POSIX path', async () => {
     vi.stubEnv('SHELL', '/bin/sh')
-    vi.stubEnv('GROK_HOME', '../relative')
+    stubProbeOutput('../relative\n')
+
+    await expect(resolveRelayGrokHome('/home/orca')).resolves.toBe('/home/orca/.grok')
+  })
+
+  // Why: this is the branch that made the old test flaky — pin it so a probe failure is
+  // an asserted fallback rather than an invisible substitution for a real answer.
+  it('falls back when the probe fails or times out', async () => {
+    vi.stubEnv('SHELL', '/bin/sh')
+    stubProbeFailure(Object.assign(new Error('spawn timed out'), { killed: true }))
 
     await expect(resolveRelayGrokHome('/home/orca')).resolves.toBe('/home/orca/.grok')
   })
 })
+
+describe.runIf(process.platform !== 'win32')('installManagedHooks', () => {
+  it.each([
+    ['omitted', undefined],
+    ['empty', { agents: [] }]
+  ])(
+    'writes nothing and runs no probe when the allowlist is %s (issue #11641)',
+    async (_label, options) => {
+      const home = await createTempHome()
+      await stubLoginShell(home)
+
+      await expect(installManagedHooks(options)).resolves.toEqual({ installers: 0, errors: 0 })
+
+      // Why: no agent config home, no ~/.orca install lock, and no GROK_HOME login-shell probe.
+      expect(await readdir(home)).toEqual([SHELL_NAME])
+    }
+  )
+
+  it('still rejects an aborted request rather than resolving an empty summary', async () => {
+    const controller = new AbortController()
+    controller.abort()
+
+    await expect(
+      installManagedHooks({ signal: controller.signal, agents: [] })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+  })
+
+  it('installs only the allowlisted agent, under the install lock', async () => {
+    const home = await createTempHome()
+    await stubLoginShell(home)
+
+    await expect(installManagedHooks({ agents: ['claude'] })).resolves.toEqual({
+      installers: 1,
+      errors: 0
+    })
+
+    expect((await readdir(home)).sort()).toEqual(['.claude', '.orca', SHELL_NAME, SHELL_RUNS_NAME])
+  })
+})
diff --git a/src/main/agent-hooks/managed-hook-runtime.ts b/src/main/agent-hooks/managed-hook-runtime.ts
index bdd7195b50d..e995467ee7d 100644
--- a/src/main/agent-hooks/managed-hook-runtime.ts
+++ b/src/main/agent-hooks/managed-hook-runtime.ts
@@ -79,6 +79,11 @@ export async function installManagedHooks(options?: {
   agents?: readonly AgentHookTarget[]
 }): Promise<ManagedHookInstallSummary> {
   options?.signal?.throwIfAborted()
+  // Why: empty/omitted allowlist fails closed before any home/host probes.
+  const agents = options?.agents ?? []
+  if (agents.length === 0) {
+    return { installers: 0, errors: 0 }
+  }
   const home = homedir()
   const grokHomeDir = await resolveRelayGrokHome(home, options?.signal)
   options?.signal?.throwIfAborted()
@@ -96,7 +101,7 @@ export async function installManagedHooks(options?: {
         {
           grokHomeDir,
           signal: options?.signal,
-          agents: options?.agents
+          agents
         }
       )
       return {
diff --git a/src/main/agent-hooks/remote-hook-service-installers.test.ts b/src/main/agent-hooks/remote-hook-service-installers.test.ts
index 2b2cfcdcf38..9ba01bc81c6 100644
--- a/src/main/agent-hooks/remote-hook-service-installers.test.ts
+++ b/src/main/agent-hooks/remote-hook-service-installers.test.ts
@@ -707,7 +707,9 @@ describe('remote hook service installers', () => {
 
   it('installs Droid and Copilot when running the aggregate remote installer (issue #7253)', async () => {
     const { sftp } = createFakeSftp()
-    const results = await installRemoteManagedAgentHooks(sftp, '/home/dev')
+    const results = await installRemoteManagedAgentHooks(sftp, '/home/dev', {
+      agents: REMOTE_MANAGED_HOOK_INSTALLER_AGENTS
+    })
     const byAgent = new Map(results.map((r) => [r.agent, r.state]))
     expect(byAgent.get('droid')).toBe('installed')
     expect(byAgent.get('copilot')).toBe('installed')
@@ -727,6 +729,19 @@ describe('remote hook service installers', () => {
     }
   })
 
+  it('fails closed when the agent allowlist is omitted or empty (issue #11641)', async () => {
+    const { sftp, fs } = createFakeSftp()
+
+    await expect(installRemoteManagedAgentHooks(sftp, '/home/dev')).resolves.toEqual([])
+    await expect(
+      installRemoteManagedAgentHooks(sftp, '/home/dev', { agents: [] })
+    ).resolves.toEqual([])
+
+    // Why: fake SFTP seeds '/' only; no agent config homes or files may appear.
+    expect([...fs.files.keys()]).toEqual([])
+    expect([...fs.dirs]).toEqual(['/'])
+  })
+
   it('stops before the next installer when its relay request is cancelled', async () => {
     const controller = new AbortController()
     const claudeInstall = vi
@@ -746,7 +761,10 @@ describe('remote hook service installers', () => {
       const { sftp } = createFakeSftp()
 
       await expect(
-        installRemoteManagedAgentHooks(sftp, '/home/dev', { signal: controller.signal })
+        installRemoteManagedAgentHooks(sftp, '/home/dev', {
+          signal: controller.signal,
+          agents: REMOTE_MANAGED_HOOK_INSTALLER_AGENTS
+        })
       ).rejects.toMatchObject({ name: 'AbortError' })
       expect(claudeInstall).toHaveBeenCalledTimes(1)
       expect(openClaudeInstall).not.toHaveBeenCalled()
diff --git a/src/main/agent-hooks/remote-managed-hook-installers.ts b/src/main/agent-hooks/remote-managed-hook-installers.ts
index 0fdf0c47da4..6471ec5cfb4 100644
--- a/src/main/agent-hooks/remote-managed-hook-installers.ts
+++ b/src/main/agent-hooks/remote-managed-hook-installers.ts
@@ -26,7 +26,8 @@ export type RemoteManagedHookInstallOptions = {
   /** Stops before starting the next installer when the owning relay request
    *  is cancelled. Individual filesystem mutations remain atomic. */
   signal?: AbortSignal
-  /** Positively detected and enabled agents allowed to mutate config. */
+  /** Positively detected and enabled agents allowed to mutate config.
+   *  Required for any install: omit/empty fails closed (no config mutation). */
   agents?: readonly AgentHookTarget[]
 }
 
@@ -81,10 +82,15 @@ export async function installRemoteManagedAgentHooks(
   remoteHome: string,
   options?: RemoteManagedHookInstallOptions
 ): Promise<AgentHookInstallStatus[]> {
+  // Why: omit/empty allowlist must never mean "install every agent" — that
+  // recreates config homes for CLIs the user never installed (issue #11641).
+  const allowedAgents = new Set(options?.agents ?? [])
+  if (allowedAgents.size === 0) {
+    return []
+  }
   const results: AgentHookInstallStatus[] = []
-  const allowedAgents = options?.agents ? new Set(options.agents) : null
   for (const [agent, install] of REMOTE_MANAGED_HOOK_INSTALLERS) {
-    if (allowedAgents && !allowedAgents.has(agent)) {
+    if (!allowedAgents.has(agent)) {
       continue
     }
     // Why: relay requests can disappear during reconnect; do not start more
diff --git a/src/main/agent-hooks/server.ts b/src/main/agent-hooks/server.ts
index e5ef70e1395..4dc64d523de 100644
--- a/src/main/agent-hooks/server.ts
+++ b/src/main/agent-hooks/server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable max-lines -- Why: this file owns the loopback HTTP adapter, the on-disk last-status persistence layer (hydrate, sanitize, TTL, atomic write, drop), and the relay ingest path in one place so the cache lifecycle (set → schedule → drain) lives next to the surfaces that mutate it. Splitting would force mutual `private` accessor scaffolding for a single class. */
-// Why: this main-process adapter keeps listener internals in shared/ (`src/shared/agent-hook-listener.ts`) so the relay can host the same pipeline without Electron. See docs/design/agent-status-over-ssh.md §5.
+// Why: this main-process adapter keeps listener internals in shared/ (`src/shared/agent-hook-listener.ts`) so the relay can host the same pipeline without Electron; parsing that drifts back into this file stops applying to SSH panes.
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
 import { createHash, randomBytes, randomUUID } from 'node:crypto'
 import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'
diff --git a/src/main/agent-hooks/wsl-hook-relay-manager.test.ts b/src/main/agent-hooks/wsl-hook-relay-manager.test.ts
index cb538595c19..e6a3a727fb4 100644
--- a/src/main/agent-hooks/wsl-hook-relay-manager.test.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-manager.test.ts
@@ -11,7 +11,10 @@ import { RelayDispatcher } from '../../relay/dispatcher'
 import { registerWslHookFsHandlers } from '../../relay/wsl-hook-fs-bridge'
 import { SshChannelMultiplexer, type MultiplexerTransport } from '../ssh/ssh-channel-multiplexer'
 import { createWslHookSftpAdapter } from './wsl-hook-fs-adapter'
-import { installRemoteManagedAgentHooks } from './remote-managed-hook-installers'
+import {
+  installRemoteManagedAgentHooks,
+  REMOTE_MANAGED_HOOK_INSTALLER_AGENTS
+} from './remote-managed-hook-installers'
 import { WslHookRelayManager } from './wsl-hook-relay-manager'
 import { FAILURE_COOLDOWN_BASE_MS, type WslHookRelayManagerDeps } from './wsl-hook-relay-deps'
 import {
@@ -122,7 +125,9 @@ describe.skipIf(process.platform === 'win32')(
 
     it('runs the unchanged remote managed hook installers against a WSL guest home', async () => {
       const adapter = createWslHookSftpAdapter(harness.mux)
-      const results = await installRemoteManagedAgentHooks(adapter, home)
+      const results = await installRemoteManagedAgentHooks(adapter, home, {
+        agents: REMOTE_MANAGED_HOOK_INSTALLER_AGENTS
+      })
 
       expect(results.length).toBeGreaterThan(0)
       expect(results.every((r) => r.state !== 'error')).toBe(true)
@@ -233,13 +238,6 @@ describe('WslHookRelayManager', () => {
     return { manager: new WslHookRelayManager(deps), deps }
   }
 
-  it('exposes the stable guest endpoint instance key with a port fallback', () => {
-    expect(createManager({}).manager.getInstanceKey()).toBe('testinstance')
-    expect(createManager({ instanceKey: () => 'unsafe/key' }).manager.getInstanceKey()).toBe(
-      'port43117'
-    )
-  })
-
   it('starts one relay per distro, installs hooks, exposes the guest endpoint path, and forwards envelopes', async () => {
     const { manager, deps } = createManager({})
     manager.ensureForDistro('Ubuntu')
diff --git a/src/main/agent-hooks/wsl-hook-relay-manager.ts b/src/main/agent-hooks/wsl-hook-relay-manager.ts
index 828e2fa888a..74d163ca42f 100644
--- a/src/main/agent-hooks/wsl-hook-relay-manager.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-manager.ts
@@ -109,15 +109,6 @@ export class WslHookRelayManager {
     return this.stateFor(distro)?.opencodeOverlayDir ?? null
   }
 
-  getInstanceKey(): string | null {
-    const stableKey = sanitizeWslHookInstanceKey(this.deps.instanceKey() ?? undefined)
-    if (stableKey) {
-      return stableKey
-    }
-    const port = Number(this.deps.hookCoordsEnv().ORCA_AGENT_HOOK_PORT ?? '')
-    return Number.isInteger(port) && port > 0 ? `port${port}` : null
-  }
-
   /** Kills every live relay. Non-permanent (hooks switched off mid-session) leaves the
    *  manager reusable, so re-enabling hooks can start relays again without an app restart. */
   disposeAll({ permanent = true }: { permanent?: boolean } = {}): void {
@@ -181,7 +172,8 @@ export class WslHookRelayManager {
     }
     // Why: restart-stable instance identity keeps the guest endpoint file at
     // ONE path across restarts so daemon-surviving agents re-coordinate.
-    const instanceKey = this.getInstanceKey() ?? `port${port}`
+    const instanceKey =
+      sanitizeWslHookInstanceKey(this.deps.instanceKey() ?? undefined) ?? `port${port}`
     if (existing) {
       this.recovery.clearTimers(existing)
     }
diff --git a/src/main/ai-vault/remote-session-file-stat.ts b/src/main/ai-vault/remote-session-file-stat.ts
index aa5809a776d..57e6d2c8ed6 100644
--- a/src/main/ai-vault/remote-session-file-stat.ts
+++ b/src/main/ai-vault/remote-session-file-stat.ts
@@ -2,7 +2,7 @@ import type { AiVaultAgent, AiVaultScanIssue } from '../../shared/ai-vault-types
 import type { ExecutionHostId } from '../../shared/execution-host'
 import type { FileStat } from '../providers/types'
 import { throwIfAiVaultScanCancelled } from './ai-vault-scan-cancellation'
-import { recordRemoteSessionScanIssue } from './remote-session-scan-issues'
+import { recordSessionScanIssue } from './session-scan-issues'
 import type { RemoteSessionFilesystemProvider } from './remote-session-scanner-types'
 import type { FileWithMtime } from './session-scanner-types'
 import { errorMessage } from './session-scanner-values'
@@ -32,7 +32,7 @@ export async function statRemoteSessionFile(
   } catch (error) {
     throwIfAiVaultScanCancelled(options?.signal)
     if (!options?.missingIsExpected || !isMissingRemoteSessionPathError(error)) {
-      recordRemoteSessionScanIssue(issues, {
+      recordSessionScanIssue(issues, {
         executionHostId,
         agent,
         path,
diff --git a/src/main/ai-vault/remote-session-scan-issues.ts b/src/main/ai-vault/remote-session-scan-issues.ts
deleted file mode 100644
index aee229f443c..00000000000
--- a/src/main/ai-vault/remote-session-scan-issues.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
-
-const REMOTE_SCAN_ISSUE_LIMIT = 500
-
-export function recordRemoteSessionScanIssue(
-  issues: AiVaultScanIssue[],
-  issue: AiVaultScanIssue
-): void {
-  if (issues.length < REMOTE_SCAN_ISSUE_LIMIT - 1) {
-    issues.push(issue)
-    return
-  }
-  if (issues.length === REMOTE_SCAN_ISSUE_LIMIT - 1) {
-    // Kinded: this row is a scan notice, not a skipped transcript — the panel
-    // counts unkinded issues as skipped transcript files.
-    issues.push({
-      executionHostId: issue.executionHostId,
-      agent: issue.agent,
-      kind: 'notice',
-      path: 'Agent Session History scan',
-      message: 'Additional scan issues were omitted.'
-    })
-  }
-}
diff --git a/src/main/ai-vault/remote-session-scanner-discovery.ts b/src/main/ai-vault/remote-session-scanner-discovery.ts
index 91f21eab720..329bdb2e584 100644
--- a/src/main/ai-vault/remote-session-scanner-discovery.ts
+++ b/src/main/ai-vault/remote-session-scanner-discovery.ts
@@ -7,7 +7,7 @@ import type { FileWithMtime } from './session-scanner-types'
 import { errorMessage } from './session-scanner-values'
 import { mapRemoteScanBatches } from './remote-session-scan-batching'
 import { throwIfAiVaultScanCancelled } from './ai-vault-scan-cancellation'
-import { recordRemoteSessionScanIssue } from './remote-session-scan-issues'
+import { recordSessionScanIssue } from './session-scan-issues'
 import type {
   RemoteScannerContext,
   RemoteSessionCandidate,
@@ -124,7 +124,7 @@ function recordRemoteDirectoryIssue(
   err: unknown
 ): void {
   if (!isMissingRemoteSessionPathError(err)) {
-    recordRemoteSessionScanIssue(issues, {
+    recordSessionScanIssue(issues, {
       executionHostId,
       agent: source.agent,
       kind: 'host',
diff --git a/src/main/ai-vault/remote-session-scanner.ts b/src/main/ai-vault/remote-session-scanner.ts
index 2523cd22a43..568b42c27cd 100644
--- a/src/main/ai-vault/remote-session-scanner.ts
+++ b/src/main/ai-vault/remote-session-scanner.ts
@@ -24,7 +24,7 @@ import { createAntigravityWorkspaceResolver } from './session-scanner-antigravit
 import { errorMessage } from './session-scanner-values'
 import { mapRemoteScanBatches } from './remote-session-scan-batching'
 import { throwIfAiVaultScanCancelled } from './ai-vault-scan-cancellation'
-import { recordRemoteSessionScanIssue } from './remote-session-scan-issues'
+import { recordSessionScanIssue } from './session-scan-issues'
 import { limitRemoteScanFilesystemConcurrency } from './remote-session-scan-concurrency'
 import { aiVaultScanLimit } from '../../shared/ai-vault-session-depth'
 
@@ -205,7 +205,7 @@ async function scanRemoteInScopeSessions(args: {
   }
 
   if (index < candidates.length && sessions.length < args.limit) {
-    recordRemoteSessionScanIssue(args.issues, {
+    recordSessionScanIssue(args.issues, {
       executionHostId: args.context.executionHostId,
       agent: 'codex',
       kind: 'scope',
@@ -241,7 +241,7 @@ async function parseRemoteSessionCandidate(
     return session
   } catch (err) {
     throwIfAiVaultScanCancelled(context.signal)
-    recordRemoteSessionScanIssue(issues, {
+    recordSessionScanIssue(issues, {
       executionHostId: context.executionHostId,
       agent: candidate.source.agent,
       path: candidate.file.path,
diff --git a/src/main/ai-vault/session-first-user-prompt-read.ts b/src/main/ai-vault/session-first-user-prompt-read.ts
index f250846a20e..ac5a35f2a53 100644
--- a/src/main/ai-vault/session-first-user-prompt-read.ts
+++ b/src/main/ai-vault/session-first-user-prompt-read.ts
@@ -1,10 +1,10 @@
-import { stat } from 'node:fs/promises'
 import type {
   AiVaultAgent,
   AiVaultFirstUserPromptResult,
   AiVaultSession
 } from '../../shared/ai-vault-types'
 import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/execution-host'
+import { wslGatedStat } from '../native-chat/wsl-transcript-fs-access'
 import { parseAgentSessionFile } from './session-scanner-agent-parser'
 import { withFullFirstUserPromptCapture } from './session-scanner-first-user-prompt-capture'
 import { parseOpenCodeSqliteSession } from './session-scanner-opencode-sqlite'
@@ -118,7 +118,9 @@ async function fileWithMtimeForPath(
   }
 
   try {
-    const info = await stat(filePath)
+    // 'scan' matches the parser this feeds, so the two halves of one re-parse
+    // share a lane instead of the stat jumping the live-transcript queue.
+    const info = await wslGatedStat(filePath, 'scan')
     return {
       path: filePath,
       mtimeMs: info.mtimeMs,
diff --git a/src/main/ai-vault/session-scan-issues.ts b/src/main/ai-vault/session-scan-issues.ts
new file mode 100644
index 00000000000..b3e21f9c5a8
--- /dev/null
+++ b/src/main/ai-vault/session-scan-issues.ts
@@ -0,0 +1,27 @@
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+
+// Why: a stalled WSL distro or an unreachable remote host fails one probe per
+// discovered path, so an uncapped list ships one row per transcript file in the
+// tree over IPC. Local and remote scans share the bound — the failure shape is
+// the same and both feed the same panel.
+const SCAN_ISSUE_LIMIT = 500
+
+/** Append a scan issue, collapsing everything past the cap into one notice. */
+export function recordSessionScanIssue(issues: AiVaultScanIssue[], issue: AiVaultScanIssue): void {
+  if (issues.length < SCAN_ISSUE_LIMIT - 1) {
+    issues.push(issue)
+    return
+  }
+  if (issues.length === SCAN_ISSUE_LIMIT - 1) {
+    // Kinded: this row is a scan notice, not a skipped transcript — the panel
+    // counts unkinded issues as skipped transcript files. Spread first so a
+    // remote issue keeps its executionHostId and a local one never gains an
+    // explicit `undefined` (which would outrank the scanner's own stamping).
+    issues.push({
+      ...issue,
+      kind: 'notice',
+      path: 'Agent Session History scan',
+      message: 'Additional scan issues were omitted.'
+    })
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-antigravity-history.ts b/src/main/ai-vault/session-scanner-antigravity-history.ts
index 989ac7b4179..ccfb506b7f7 100644
--- a/src/main/ai-vault/session-scanner-antigravity-history.ts
+++ b/src/main/ai-vault/session-scanner-antigravity-history.ts
@@ -1,8 +1,28 @@
 import type { AiVaultSession } from '../../shared/ai-vault-types'
+import { wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { normalizeTitleText, parseJsonObject, timestampMs } from './session-scanner-values'
 
 const HISTORY_MATCH_WINDOW_MS = 2_000
 
+/**
+ * The local-scan `readHistory`; remote scans inject their own transport. A
+ * missing or unreadable history file is genuinely "no enrichment", but a gate
+ * refusal must propagate so the caller records a scan issue — degrading it to
+ * null lists the session with a missing cwd and no retry signal, and the
+ * resolver's memo relies on the rejection to evict rather than pin a stall.
+ */
+export async function readLocalAntigravityHistory(path: string): Promise<string | null> {
+  try {
+    return await wslGatedReadFile(path, 'utf-8', 'scan')
+  } catch (error) {
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
+    return null
+  }
+}
+
 type AntigravityHistoryEntry = {
   timestampMs: number
   workspace: string
@@ -26,8 +46,19 @@ export function createAntigravityWorkspaceResolver(
       }
       let index = indexes.get(historyPath)
       if (!index) {
-        index = readHistory(historyPath).then(indexAntigravityHistory)
-        indexes.set(historyPath, index)
+        // Why: a read failure is transient (a stalled WSL distro refuses here),
+        // so it must not be memoized — every later session under this history
+        // file would inherit the rejection for the process lifetime.
+        const pending: Promise<AntigravityHistoryIndex> = readHistory(historyPath)
+          .then(indexAntigravityHistory)
+          .catch((error: unknown) => {
+            if (indexes.get(historyPath) === pending) {
+              indexes.delete(historyPath)
+            }
+            throw error
+          })
+        index = pending
+        indexes.set(historyPath, pending)
       }
       const workspace = findAntigravityWorkspace(session, await index)
       return workspace ? { ...session, cwd: workspace } : session
diff --git a/src/main/ai-vault/session-scanner-antigravity-parser.ts b/src/main/ai-vault/session-scanner-antigravity-parser.ts
index 818167fbd0c..1896138749c 100644
--- a/src/main/ai-vault/session-scanner-antigravity-parser.ts
+++ b/src/main/ai-vault/session-scanner-antigravity-parser.ts
@@ -1,5 +1,5 @@
 import { remoteSessionContentLines } from './remote-session-content-lines'
-import { createReadStream } from 'node:fs'
+import { openTranscriptReadStream } from '../native-chat/wsl-transcript-fs-access'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
@@ -26,11 +26,16 @@ export async function parseAntigravitySessionFile(
   file: FileWithMtime,
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
-  const lines = createInterface({
-    input: createReadStream(file.path, { encoding: 'utf-8' }),
-    crlfDelay: Infinity
-  })
-  return parseAntigravitySessionLines({ file, lines, platform })
+  const input = openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan')
+  const lines = createInterface({ input, crlfDelay: Infinity })
+  try {
+    return await parseAntigravitySessionLines({ file, lines, platform })
+  } finally {
+    // readline.close() leaves the underlying stream open; destroy it so a
+    // mid-parse throw cannot leak the gated transcript handle.
+    lines.close()
+    input.destroy()
+  }
 }
 
 export async function parseAntigravitySessionContent(
diff --git a/src/main/ai-vault/session-scanner-claude-subagents.ts b/src/main/ai-vault/session-scanner-claude-subagents.ts
index 5c269d91cf3..a2dc5745948 100644
--- a/src/main/ai-vault/session-scanner-claude-subagents.ts
+++ b/src/main/ai-vault/session-scanner-claude-subagents.ts
@@ -1,5 +1,3 @@
-import { createReadStream } from 'node:fs'
-import { readdir, readFile, stat } from 'node:fs/promises'
 import { basename, extname, join } from 'node:path'
 import { createInterface } from 'node:readline'
 import type {
@@ -8,6 +6,14 @@ import type {
   AiVaultSubagentListResult,
   AiVaultSubagentRunStatus
 } from '../../shared/ai-vault-types'
+import {
+  openTranscriptReadStream,
+  wslGatedReaddir,
+  wslGatedReadFile,
+  wslGatedStat
+} from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
+import { recordSessionScanIssue } from './session-scan-issues'
 import { sessionIdFromFileName, sessionSortTime } from './session-scanner-accumulator'
 import { parseClaudeSessionFile } from './session-scanner-primary-parsers'
 import {
@@ -29,6 +35,10 @@ const SUBAGENT_RUNNING_RECENCY_MS = 5 * 60_000
 // Match the main scanner's deliberate parse batching (SESSION_PARSE_CONCURRENCY):
 // opening every subagent read stream at once stalls over SSH/WSL UNC paths.
 const SUBAGENT_PARSE_CONCURRENCY = 8
+// 'scan', not 'exact', even though a user expands this on demand: it is bulk
+// directory work feeding the same parsers as the main scan, and the exact lane
+// stays reserved for live transcript probes.
+const SUBAGENT_FS_PRIORITY = 'scan'
 
 const TASK_NOTIFICATION_MARKER = '<task-notification>'
 const TOOL_USE_RESULT_MARKER = '"toolUseResult"'
@@ -71,8 +81,13 @@ export async function listClaudeSubagentSessions(args: {
 
   let entries
   try {
-    entries = await readdir(subagentsDir, { withFileTypes: true })
-  } catch {
+    entries = await wslGatedReaddir(subagentsDir, SUBAGENT_FS_PRIORITY)
+  } catch (err) {
+    // A gate refusal is a stalled distro, not a session without subagents —
+    // report it so the panel offers a retry instead of showing an empty list.
+    if (err instanceof WslTranscriptFsError) {
+      recordSessionScanIssue(issues, { agent: 'claude', path: subagentsDir, message: err.message })
+    }
     return { sessions: [], issues }
   }
 
@@ -130,7 +145,7 @@ async function parseSubagentTranscript(args: {
   issues: AiVaultScanIssue[]
 }): Promise<AiVaultSession | null> {
   try {
-    const fileStat = await stat(args.filePath)
+    const fileStat = await wslGatedStat(args.filePath, SUBAGENT_FS_PRIORITY)
     const session = await parseClaudeSessionFile(
       {
         path: args.filePath,
@@ -161,7 +176,11 @@ async function parseSubagentTranscript(args: {
       }
     }
   } catch (err) {
-    args.issues.push({ agent: 'claude', path: args.filePath, message: errorMessage(err) })
+    recordSessionScanIssue(args.issues, {
+      agent: 'claude',
+      path: args.filePath,
+      message: errorMessage(err)
+    })
     return null
   }
 }
@@ -187,11 +206,13 @@ function resolveSubagentStatus(args: {
 // 'async_launched', notification 'running') are superseded by terminal ones.
 async function collectSubagentTaskStatuses(parentFilePath: string): Promise<Map<string, string>> {
   const statuses = new Map<string, string>()
+  const input = openTranscriptReadStream(
+    parentFilePath,
+    { encoding: 'utf-8' },
+    SUBAGENT_FS_PRIORITY
+  )
+  const lines = createInterface({ input, crlfDelay: Infinity })
   try {
-    const lines = createInterface({
-      input: createReadStream(parentFilePath, { encoding: 'utf-8' }),
-      crlfDelay: Infinity
-    })
     for await (const line of lines) {
       const hasNotification = line.includes(TASK_NOTIFICATION_MARKER)
       const hasTaskResult =
@@ -232,6 +253,11 @@ async function collectSubagentTaskStatuses(parentFilePath: string): Promise<Map<
     }
   } catch {
     // A missing/unreadable parent transcript degrades to recency-only status.
+  } finally {
+    // readline.close() leaves the underlying stream open; destroy it so a
+    // mid-read failure cannot leak the gated transcript handle.
+    lines.close()
+    input.destroy()
   }
   return statuses
 }
@@ -269,7 +295,8 @@ function taskNotificationBlockText(block: unknown): string {
 async function readSubagentMeta(transcriptPath: string): Promise<ClaudeSubagentMeta> {
   const metaPath = `${transcriptPath.slice(0, -extname(transcriptPath).length)}.meta.json`
   try {
-    const record = asRecord(JSON.parse(await readFile(metaPath, 'utf-8')) as unknown)
+    const raw = await wslGatedReadFile(metaPath, 'utf-8', SUBAGENT_FS_PRIORITY)
+    const record = asRecord(JSON.parse(raw) as unknown)
     return {
       description: normalizeTitleText(extractString(record?.description) ?? ''),
       agentType: extractString(record?.agentType)
diff --git a/src/main/ai-vault/session-scanner-codex-parser.ts b/src/main/ai-vault/session-scanner-codex-parser.ts
index 0f73fa54126..6887b7ed5d8 100644
--- a/src/main/ai-vault/session-scanner-codex-parser.ts
+++ b/src/main/ai-vault/session-scanner-codex-parser.ts
@@ -1,4 +1,4 @@
-import { createReadStream } from 'node:fs'
+import { openTranscriptReadStream } from '../native-chat/wsl-transcript-fs-access'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import { readCodexSessionIndexTitle } from './session-scanner-codex-title-index'
@@ -42,7 +42,7 @@ export async function parseCodexSessionFile(
   executionHostId?: ExecutionHostId
 ): Promise<AiVaultSession | null> {
   const lines = createInterface({
-    input: createReadStream(file.path, { encoding: 'utf-8' }),
+    input: openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan'),
     crlfDelay: Infinity
   })
 
diff --git a/src/main/ai-vault/session-scanner-codex-title-index.ts b/src/main/ai-vault/session-scanner-codex-title-index.ts
index 8ef2d5645cb..635a215562a 100644
--- a/src/main/ai-vault/session-scanner-codex-title-index.ts
+++ b/src/main/ai-vault/session-scanner-codex-title-index.ts
@@ -1,7 +1,7 @@
-import { createReadStream } from 'node:fs'
-import { stat } from 'node:fs/promises'
 import { basename, dirname, join } from 'node:path'
 import { createInterface } from 'node:readline'
+import { openTranscriptReadStream, wslGatedStat } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { extractString, normalizeTitleText, parseJsonObject } from './session-scanner-values'
 
 // Codex names threads lazily in <CODEX_HOME>/session_index.jsonl; transcripts
@@ -77,7 +77,7 @@ async function readCodexSessionIndexTitles(codexHome: string): Promise<Map<strin
   const indexPath = join(codexHome, CODEX_SESSION_INDEX_FILE)
   let signature: string
   try {
-    const indexStat = await stat(indexPath)
+    const indexStat = await wslGatedStat(indexPath, 'scan')
     signature = `${indexStat.size}:${indexStat.mtimeMs}`
   } catch {
     return new Map()
@@ -88,10 +88,14 @@ async function readCodexSessionIndexTitles(codexHome: string): Promise<Map<strin
     return cachedTitles
   }
 
-  const pending = readCodexSessionIndexTitlesFromDisk(indexPath).then((titles) => ({
-    signature,
-    titles
-  }))
+  const pending = readCodexSessionIndexTitlesFromDisk(indexPath).then(({ titles, refused }) => {
+    // Why: a gate refusal is a stalled distro, not a title-less index — caching
+    // it would pin "no titles" until the index's size or mtime changes.
+    if (refused && codexSessionIndexTitleCache.get(codexHome) === pending) {
+      codexSessionIndexTitleCache.delete(codexHome)
+    }
+    return { signature, titles }
+  })
   storeCodexSessionIndexTitleCacheEntry(codexHome, pending)
   return (await pending).titles
 }
@@ -133,11 +137,11 @@ function storeCodexSessionIndexTitleCacheEntry(
 
 async function readCodexSessionIndexTitlesFromDisk(
   indexPath: string
-): Promise<Map<string, string>> {
+): Promise<{ titles: Map<string, string>; refused: boolean }> {
   const titleBySessionId = new Map<string, string>()
   try {
     const lines = createInterface({
-      input: createReadStream(indexPath, { encoding: 'utf-8' }),
+      input: openTranscriptReadStream(indexPath, { encoding: 'utf-8' }, 'scan'),
       crlfDelay: Infinity
     })
     for await (const line of lines) {
@@ -151,8 +155,9 @@ async function readCodexSessionIndexTitlesFromDisk(
         titleBySessionId.set(sessionId, title)
       }
     }
-  } catch {
+  } catch (error) {
     // Codex creates the index opportunistically; older homes may only have raw transcripts.
+    return { titles: titleBySessionId, refused: error instanceof WslTranscriptFsError }
   }
-  return titleBySessionId
+  return { titles: titleBySessionId, refused: false }
 }
diff --git a/src/main/ai-vault/session-scanner-copilot-parser.ts b/src/main/ai-vault/session-scanner-copilot-parser.ts
index 4d0140fc3df..7e5450393e0 100644
--- a/src/main/ai-vault/session-scanner-copilot-parser.ts
+++ b/src/main/ai-vault/session-scanner-copilot-parser.ts
@@ -1,5 +1,5 @@
 import { remoteSessionContentLines } from './remote-session-content-lines'
-import { createReadStream } from 'node:fs'
+import { openTranscriptReadStream } from '../native-chat/wsl-transcript-fs-access'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
@@ -35,7 +35,7 @@ export async function parseCopilotSessionFile(
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
   const lines = createInterface({
-    input: createReadStream(file.path, { encoding: 'utf-8' }),
+    input: openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan'),
     crlfDelay: Infinity
   })
   return parseCopilotSessionLines({ file, lines, platform })
diff --git a/src/main/ai-vault/session-scanner-core-parser-wsl-stall.test.ts b/src/main/ai-vault/session-scanner-core-parser-wsl-stall.test.ts
new file mode 100644
index 00000000000..44fe71c80b2
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-core-parser-wsl-stall.test.ts
@@ -0,0 +1,267 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+import type * as NodePathModule from 'node:path'
+import type { SessionFileCandidate } from './session-scanner-types'
+
+const mocks = vi.hoisted(() => ({
+  open: vi.fn(),
+  readFile: vi.fn(),
+  readdir: vi.fn(),
+  stat: vi.fn()
+}))
+
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  open: mocks.open,
+  readFile: mocks.readFile,
+  readdir: mocks.readdir,
+  stat: mocks.stat
+}))
+
+// Derived sibling paths must retain Windows separators in this cross-platform test.
+vi.mock('node:path', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodePathModule>()
+  return { ...actual.win32, default: actual.win32 }
+})
+
+import {
+  parseAgentSessionFileCached,
+  resetSessionParseCacheForTests
+} from './session-scanner-parse-cache'
+import {
+  WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS,
+  WslTranscriptFsError
+} from '../native-chat/wsl-transcript-fs-gate'
+
+function uncPath(distro: string, ...segments: string[]): string {
+  return `\\\\wsl.localhost\\${distro}\\home\\ada\\${segments.join('\\')}`
+}
+
+const KIMI_HOME = ['.kimi-code', 'sessions', 'wd_app_9f2', 'session_abc']
+const GROK_DIR = ['.grok', 'sessions', 'ses-1']
+const OPENCODE_ROOT = ['.local', 'share', 'opencode', 'storage']
+
+const KIMI_STATE = JSON.stringify({
+  title: 'Kimi session',
+  createdAt: '2026-06-01T10:00:00.000Z',
+  updatedAt: '2026-06-01T10:05:00.000Z',
+  agents: { main: { type: 'main', parentAgentId: null } }
+})
+
+const KIMI_WIRE = `${JSON.stringify({
+  type: 'context.append_message',
+  message: { role: 'user', origin: { kind: 'user' }, content: 'ship it' }
+})}\n`
+
+const GROK_SESSION = JSON.stringify({
+  info: { id: 'ses-1', cwd: '/repo/app' },
+  generated_title: 'Grok session',
+  created_at: '2026-06-01T10:00:00.000Z'
+})
+
+const GROK_HISTORY = `${JSON.stringify({
+  type: 'user',
+  content: '<user_query>ship it</user_query>'
+})}\n`
+
+const OPENCODE_SESSION = JSON.stringify({
+  id: 'ses-1',
+  title: 'OpenCode session',
+  directory: '/repo/app',
+  time: { created: 1780000000000 }
+})
+
+const OPENCODE_MESSAGE = JSON.stringify({
+  role: 'user',
+  content: [{ type: 'text', text: 'ship it' }],
+  time: { created: 1780000000000 }
+})
+
+type ReadResult = { bytesRead: number; buffer: Buffer }
+
+let releaseStall: (() => void) | undefined
+
+function stalls<T>(): Promise<T> {
+  return new Promise<T>((resolve) => {
+    releaseStall = () => resolve({ bytesRead: 0, buffer: Buffer.alloc(0) } as T)
+  })
+}
+
+function stallingHandle() {
+  return { read: vi.fn(stalls<ReadResult>), close: vi.fn(async () => {}) }
+}
+
+function servingHandle(body: string) {
+  const bytes = Buffer.from(body)
+  return {
+    read: vi.fn(async (buffer: Buffer, offset: number, length: number, position: number) => {
+      const slice = bytes.subarray(position, Math.min(position + length, bytes.length))
+      slice.copy(buffer, offset)
+      return { bytesRead: slice.length, buffer }
+    }),
+    close: vi.fn(async () => {})
+  }
+}
+
+function missing(): Error {
+  return Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
+}
+
+function dirent(name: string) {
+  return { name, isFile: () => true }
+}
+
+function candidate(agent: SessionFileCandidate['agent'], path: string): SessionFileCandidate {
+  return {
+    agent,
+    file: {
+      path,
+      mtimeMs: 1,
+      modifiedAt: '2026-06-01T10:05:00.000Z',
+      sizeBytes: 128
+    },
+    codexHome: null
+  }
+}
+
+async function expectRefusal(target: SessionFileCandidate): Promise<void> {
+  const refusal = expect(parseAgentSessionFileCached(target, 'linux')).rejects.toBeInstanceOf(
+    WslTranscriptFsError
+  )
+  await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS + 1)
+  await refusal
+}
+
+async function releaseAndSettle(): Promise<void> {
+  releaseStall?.()
+  releaseStall = undefined
+  await vi.advanceTimersByTimeAsync(0)
+}
+
+beforeEach(() => {
+  resetSessionParseCacheForTests()
+  mocks.open.mockReset()
+  mocks.readFile.mockReset()
+  mocks.readdir.mockReset()
+  mocks.stat.mockReset()
+  releaseStall = undefined
+  mocks.stat.mockRejectedValue(missing())
+  vi.useFakeTimers()
+})
+
+afterEach(async () => {
+  await releaseAndSettle()
+  vi.useRealTimers()
+})
+
+describe('Kimi session parse against a stalled WSL transcript', () => {
+  it('refuses a stalled state.json read instead of reporting no session', async () => {
+    const state = uncPath('KimiState', ...KIMI_HOME, 'state.json')
+    mocks.readFile.mockImplementation(stalls<string>)
+
+    await expectRefusal(candidate('kimi', state))
+  })
+
+  it('refuses a stalled wire read, then caches the full session once it recovers', async () => {
+    const state = uncPath('KimiWire', ...KIMI_HOME, 'state.json')
+    mocks.readFile.mockResolvedValue(KIMI_STATE)
+    mocks.open.mockResolvedValue(stallingHandle())
+
+    await expectRefusal(candidate('kimi', state))
+    await releaseAndSettle()
+
+    mocks.open.mockResolvedValue(servingHandle(KIMI_WIRE))
+    const recovered = await parseAgentSessionFileCached(candidate('kimi', state), 'linux')
+
+    expect(recovered?.messageCount).toBe(1)
+  })
+
+  // Pins the narrowness of the parser's `instanceof WslTranscriptFsError`
+  // rethrow: widening it to every error turns this into a hard scan issue.
+  it('still returns a metadata-only session when the wire file is simply missing', async () => {
+    const state = uncPath('KimiMissing', ...KIMI_HOME, 'state.json')
+    mocks.readFile.mockResolvedValue(KIMI_STATE)
+    mocks.open.mockRejectedValue(missing())
+
+    const session = await parseAgentSessionFileCached(candidate('kimi', state), 'linux')
+
+    expect(session).toMatchObject({ agent: 'kimi', title: 'Kimi session', messageCount: 0 })
+  })
+})
+
+describe('Grok session parse against a stalled WSL transcript', () => {
+  it('refuses a stalled chat_history read instead of reporting a summary-only session', async () => {
+    const file = uncPath('GrokHistory', ...GROK_DIR, 'session.json')
+    mocks.readFile.mockResolvedValue(GROK_SESSION)
+    mocks.open.mockResolvedValue(stallingHandle())
+
+    await expectRefusal(candidate('grok', file))
+    await releaseAndSettle()
+
+    mocks.open.mockResolvedValue(servingHandle(GROK_HISTORY))
+    const recovered = await parseAgentSessionFileCached(candidate('grok', file), 'linux')
+
+    expect(recovered?.previewMessages).toEqual([
+      expect.objectContaining({ role: 'user', text: 'ship it' })
+    ])
+  })
+
+  it('still returns the summary-only session when chat_history is missing', async () => {
+    const file = uncPath('GrokMissing', ...GROK_DIR, 'session.json')
+    mocks.readFile.mockResolvedValue(GROK_SESSION)
+    mocks.open.mockRejectedValue(missing())
+
+    const session = await parseAgentSessionFileCached(candidate('grok', file), 'linux')
+
+    expect(session).toMatchObject({
+      agent: 'grok',
+      title: 'Grok session',
+      previewMessages: []
+    })
+  })
+})
+
+describe('OpenCode session parse against a stalled WSL transcript', () => {
+  function sessionPath(distro: string): string {
+    return uncPath(distro, ...OPENCODE_ROOT, 'session', 'prj', 'ses-1.json')
+  }
+
+  it('refuses a stalled message-directory listing instead of an empty transcript', async () => {
+    mocks.readFile.mockResolvedValue(OPENCODE_SESSION)
+    mocks.readdir.mockImplementation(stalls<unknown[]>)
+
+    await expectRefusal(candidate('opencode', sessionPath('OpenCodeDir')))
+  })
+
+  it('refuses a stalled per-message read instead of a partial transcript', async () => {
+    const file = sessionPath('OpenCodeMessage')
+    mocks.readdir.mockResolvedValue([dirent('msg-1.json')])
+    mocks.readFile.mockImplementation((path: string) =>
+      path === file ? Promise.resolve(OPENCODE_SESSION) : stalls<string>()
+    )
+
+    await expectRefusal(candidate('opencode', file))
+    await releaseAndSettle()
+
+    mocks.readFile.mockImplementation((path: string) =>
+      Promise.resolve(path === file ? OPENCODE_SESSION : OPENCODE_MESSAGE)
+    )
+    const recovered = await parseAgentSessionFileCached(candidate('opencode', file), 'linux')
+
+    expect(recovered?.messageCount).toBe(1)
+  })
+
+  // Same guard as Kimi's: a live process mid-write must stay a parseable
+  // session, not a refusal.
+  it('still returns the session when a live process left a half-written message', async () => {
+    const file = sessionPath('OpenCodeHalfWritten')
+    mocks.readdir.mockResolvedValue([dirent('msg-1.json')])
+    mocks.readFile.mockImplementation((path: string) =>
+      Promise.resolve(path === file ? OPENCODE_SESSION : '{"role":"user",')
+    )
+
+    const session = await parseAgentSessionFileCached(candidate('opencode', file), 'linux')
+
+    expect(session).toMatchObject({ agent: 'opencode', title: 'OpenCode session', messageCount: 0 })
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-cursor-parser.ts b/src/main/ai-vault/session-scanner-cursor-parser.ts
index b18402584e5..0f44aa923fa 100644
--- a/src/main/ai-vault/session-scanner-cursor-parser.ts
+++ b/src/main/ai-vault/session-scanner-cursor-parser.ts
@@ -1,5 +1,5 @@
 import { remoteSessionContentLines } from './remote-session-content-lines'
-import { createReadStream } from 'node:fs'
+import { openTranscriptReadStream } from '../native-chat/wsl-transcript-fs-access'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
@@ -33,7 +33,7 @@ export async function parseCursorSessionFile(
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
   const lines = createInterface({
-    input: createReadStream(file.path, { encoding: 'utf-8' }),
+    input: openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan'),
     crlfDelay: Infinity
   })
   return parseCursorSessionLines({ file, lines, platform })
diff --git a/src/main/ai-vault/session-scanner-devin-parser.ts b/src/main/ai-vault/session-scanner-devin-parser.ts
index 4ad6fa45f78..a43603bca47 100644
--- a/src/main/ai-vault/session-scanner-devin-parser.ts
+++ b/src/main/ai-vault/session-scanner-devin-parser.ts
@@ -1,4 +1,4 @@
-import { readFile } from 'node:fs/promises'
+import { wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
 import type { FileWithMtime } from './session-scanner-types'
@@ -27,7 +27,11 @@ export async function parseDevinSessionFile(
   file: FileWithMtime,
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
-  return parseDevinSessionContent(file, await readFile(file.path, 'utf-8'), platform)
+  return parseDevinSessionContent(
+    file,
+    await wslGatedReadFile(file.path, 'utf-8', 'scan'),
+    platform
+  )
 }
 
 export function parseDevinSessionContent(
diff --git a/src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts b/src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts
new file mode 100644
index 00000000000..962a2e20fa9
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts
@@ -0,0 +1,137 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Dirent } from 'node:fs'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+
+const fsMocks = vi.hoisted(() => ({ readdir: vi.fn(), stat: vi.fn() }))
+
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  readdir: fsMocks.readdir,
+  stat: fsMocks.stat
+}))
+
+import {
+  WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS,
+  WslTranscriptFsError
+} from '../native-chat/wsl-transcript-fs-gate'
+import { discoverFiles, walkSessionFiles } from './session-scanner-discovery'
+
+const SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+
+function dirent(name: string): Dirent {
+  return { name, isDirectory: () => false, isFile: () => true } as Dirent
+}
+
+let releaseStall: (() => void) | undefined
+
+function stalls<T>(): Promise<T> {
+  return new Promise<T>((resolve) => {
+    releaseStall = () => resolve(undefined as T)
+  })
+}
+
+beforeEach(() => {
+  fsMocks.readdir.mockReset()
+  fsMocks.stat.mockReset()
+  fsMocks.readdir.mockResolvedValue([])
+  releaseStall = undefined
+})
+
+// A stalled task holds its gate permit until the call settles; releasing it
+// keeps the next case from fast-failing on an already-exhausted gate.
+afterEach(async () => {
+  if (!vi.isFakeTimers()) {
+    return
+  }
+  releaseStall?.()
+  await vi.advanceTimersByTimeAsync(0)
+  vi.useRealTimers()
+})
+
+describe('walkSessionFiles WSL gate refusals', () => {
+  it('rethrows gate refusals instead of reporting an empty tree', async () => {
+    const refusal = new WslTranscriptFsError('timeout', 'slow share')
+    await expect(
+      walkSessionFiles('\\\\wsl.localhost\\Ubuntu\\home\\ada\\.codex\\sessions', 'codex', [], {
+        extensions: new Set(['.jsonl']),
+        readDirectory: async () => {
+          throw refusal
+        }
+      })
+    ).rejects.toBe(refusal)
+  })
+
+  it('still treats ordinary readdir failures as an empty tree', async () => {
+    await expect(
+      walkSessionFiles('/missing/root', 'codex', [], {
+        extensions: new Set(['.jsonl']),
+        readDirectory: async () => {
+          throw Object.assign(new Error('no such directory'), { code: 'ENOENT' })
+        }
+      })
+    ).resolves.toEqual([])
+  })
+})
+
+describe('discoverFiles containment for a stalled WSL root', () => {
+  const UNC_ROOT = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.codex\\sessions'
+
+  it('contains a stalled readdir to one root so a Promise.all fan-out still resolves', async () => {
+    vi.useFakeTimers()
+    {
+      fsMocks.readdir.mockImplementation((dir: string) =>
+        dir === UNC_ROOT ? stalls<Dirent[]>() : Promise.resolve([])
+      )
+      const issues: AiVaultScanIssue[] = []
+      const discovery = discoverFiles({
+        rootDir: UNC_ROOT,
+        limit: 10,
+        agent: 'codex',
+        issues,
+        extensions: ['.jsonl']
+      })
+      const healthy = discoverFiles({
+        rootDir: '/home/ada/.codex/sessions',
+        limit: 10,
+        agent: 'codex',
+        issues: [],
+        extensions: ['.jsonl']
+      })
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS + 1)
+
+      await expect(Promise.all([discovery, healthy])).resolves.toEqual([
+        { agent: 'codex', rootDir: UNC_ROOT, files: [] },
+        { agent: 'codex', rootDir: '/home/ada/.codex/sessions', files: [] }
+      ])
+      expect(issues).toEqual([{ agent: 'codex', path: UNC_ROOT, message: SLOW_MESSAGE }])
+    }
+  })
+
+  it('reports every stalled file without spending one deadline per file', async () => {
+    vi.useFakeTimers()
+    {
+      const names = ['a', 'b', 'c', 'd', 'e'].map((name) => dirent(`${name}.jsonl`))
+      fsMocks.readdir.mockResolvedValue(names)
+      fsMocks.stat.mockImplementation(stalls)
+      const issues: AiVaultScanIssue[] = []
+      const discovery = discoverFiles({
+        rootDir: UNC_ROOT,
+        limit: 10,
+        agent: 'codex',
+        issues,
+        extensions: ['.jsonl']
+      })
+
+      // Two deadlines total, not five: once the first stalled stat is marked
+      // stuck, every later file fast-fails on the route instead of queueing.
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS * 2 + 2)
+
+      await expect(discovery).resolves.toEqual({ agent: 'codex', rootDir: UNC_ROOT, files: [] })
+      expect(issues).toHaveLength(names.length)
+      expect(issues.every((issue) => issue.path.startsWith(UNC_ROOT))).toBe(true)
+    }
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-discovery.ts b/src/main/ai-vault/session-scanner-discovery.ts
index 031f94f3619..9ec569bc547 100644
--- a/src/main/ai-vault/session-scanner-discovery.ts
+++ b/src/main/ai-vault/session-scanner-discovery.ts
@@ -1,7 +1,9 @@
 import type { Dirent } from 'node:fs'
-import { readdir, stat } from 'node:fs/promises'
 import { extname, join } from 'node:path'
 import type { AiVaultAgent, AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { wslGatedReaddir, wslGatedStat } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
+import { recordSessionScanIssue } from './session-scan-issues'
 import type { FileWithMtime, SessionFileDiscovery } from './session-scanner-types'
 import { errorMessage } from './session-scanner-values'
 
@@ -14,15 +16,31 @@ export async function discoverFiles(args: {
   filePredicate?: (path: string) => boolean
   directoryPredicate?: (name: string, depth: number) => boolean
 }): Promise<SessionFileDiscovery> {
-  const paths = await walkSessionFiles(args.rootDir, args.agent, args.issues, {
-    extensions: new Set(args.extensions),
-    filePredicate: args.filePredicate,
-    directoryPredicate: args.directoryPredicate
-  })
+  let paths: string[]
+  try {
+    paths = await walkSessionFiles(args.rootDir, args.agent, args.issues, {
+      extensions: new Set(args.extensions),
+      filePredicate: args.filePredicate,
+      directoryPredicate: args.directoryPredicate
+    })
+  } catch (err) {
+    // Why: discoverAiVaultSessionSources fans out with Promise.all, so one
+    // stalled distro would otherwise reject the whole vault scan — including
+    // every healthy local agent. Contain it to this root.
+    if (!(err instanceof WslTranscriptFsError)) {
+      throw err
+    }
+    recordSessionScanIssue(args.issues, {
+      agent: args.agent,
+      path: args.rootDir,
+      message: err.message
+    })
+    return { agent: args.agent, rootDir: args.rootDir, files: [] }
+  }
   const files: FileWithMtime[] = []
   for (const path of paths) {
     try {
-      const fileStat = await stat(path)
+      const fileStat = await wslGatedStat(path, 'scan')
       files.push({
         path,
         mtimeMs: fileStat.mtimeMs,
@@ -33,7 +51,11 @@ export async function discoverFiles(args: {
         nlink: fileStat.nlink
       })
     } catch (err) {
-      args.issues.push({ agent: args.agent, path, message: errorMessage(err) })
+      recordSessionScanIssue(args.issues, {
+        agent: args.agent,
+        path,
+        message: errorMessage(err)
+      })
     }
   }
   return {
@@ -63,9 +85,14 @@ export async function walkSessionFiles(
   try {
     entries = options.readDirectory
       ? await options.readDirectory(dirPath)
-      : await readdir(dirPath, { withFileTypes: true })
-  } catch {
+      : await wslGatedReaddir(dirPath, 'scan', options.signal)
+  } catch (error) {
     options.signal?.throwIfAborted()
+    // Why: a gate refusal means the scan could not run, not that the tree is
+    // empty — swallowing it would misreport a stalled distro as "no transcript".
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
     return []
   }
 
diff --git a/src/main/ai-vault/session-scanner-droid-parser.ts b/src/main/ai-vault/session-scanner-droid-parser.ts
index 557920e7f40..c896b47a3e8 100644
--- a/src/main/ai-vault/session-scanner-droid-parser.ts
+++ b/src/main/ai-vault/session-scanner-droid-parser.ts
@@ -1,5 +1,5 @@
 import { remoteSessionContentLines } from './remote-session-content-lines'
-import { createReadStream } from 'node:fs'
+import { openTranscriptReadStream } from '../native-chat/wsl-transcript-fs-access'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
@@ -34,11 +34,16 @@ export async function parseDroidSessionFile(
   file: FileWithMtime,
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
-  const lines = createInterface({
-    input: createReadStream(file.path, { encoding: 'utf-8' }),
-    crlfDelay: Infinity
-  })
-  return parseDroidSessionLines({ file, lines, platform })
+  const input = openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan')
+  const lines = createInterface({ input, crlfDelay: Infinity })
+  try {
+    return await parseDroidSessionLines({ file, lines, platform })
+  } finally {
+    // readline.close() leaves the underlying stream open; destroy it so a
+    // mid-parse throw cannot leak the gated transcript handle.
+    lines.close()
+    input.destroy()
+  }
 }
 
 export async function parseDroidSessionContent(
diff --git a/src/main/ai-vault/session-scanner-fs-import-guard.test.ts b/src/main/ai-vault/session-scanner-fs-import-guard.test.ts
new file mode 100644
index 00000000000..472ca932eac
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-fs-import-guard.test.ts
@@ -0,0 +1,81 @@
+import { readFile, readdir } from 'node:fs/promises'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const AI_VAULT_DIR = join(import.meta.dirname, '.')
+const NATIVE_CHAT_DIR = join(import.meta.dirname, '..', 'native-chat')
+
+// Transcript I/O in these modules must go through the WSL admission gate, so a
+// stalled 9P mount cannot hang a scan or a Native Chat load (STA-4049).
+const NATIVE_CHAT_MODULES = [
+  'transcript-read-cache.ts',
+  'transcript-reader.ts',
+  'transcript-tail-reader.ts',
+  'transcript-file-version.ts',
+  'transcript-incremental-reader.ts',
+  'transcript-watch-engine.ts'
+]
+
+// Adding to this list must be a reviewed act: each entry names why the file
+// touches a path that can never be a WSL UNC transcript.
+const ALLOWLIST = new Set([
+  // `existsSync` on bundled module paths inside the app dir.
+  'session-scanner-service-entry-path.ts',
+  'session-scanner-service-spawn.ts',
+  'session-scanner-worker-spawn.ts',
+  'session-scanner-opencode-sqlite-worker-spawn.ts',
+  // On-demand IPC readers, gated in the STA-4049 follow-up.
+  'session-scanner-claude-subagents.ts',
+  'session-scanner-omp-subagent-listing.ts',
+  // Test-only fixture builder.
+  'session-scanner-test-fixtures.ts'
+])
+
+const FS_IMPORT = /import\s+([\s\S]*?)\s+from\s+['"]node:fs(?:\/promises)?['"]/g
+
+function valueImportsOfNodeFs(source: string): string[] {
+  return [...source.matchAll(FS_IMPORT)]
+    .map((match) => match[1]!.trim())
+    .filter((clause) => !clause.startsWith('type'))
+}
+
+async function guardedFiles(): Promise<{ name: string; path: string }[]> {
+  const aiVault = (await readdir(AI_VAULT_DIR))
+    .filter((name) => name.startsWith('session-scanner') || name === 'session-title-file-reader.ts')
+    .filter((name) => name.endsWith('.ts') && !name.endsWith('.test.ts'))
+    .filter((name) => !ALLOWLIST.has(name))
+    .map((name) => ({ name, path: join(AI_VAULT_DIR, name) }))
+  return [
+    ...aiVault,
+    ...NATIVE_CHAT_MODULES.map((name) => ({ name, path: join(NATIVE_CHAT_DIR, name) }))
+  ]
+}
+
+describe('WSL transcript gate import guard', () => {
+  it('leaves no raw node:fs value import in a gated transcript module', async () => {
+    const files = await guardedFiles()
+    const offenders: string[] = []
+    for (const file of files) {
+      for (const clause of valueImportsOfNodeFs(await readFile(file.path, 'utf-8'))) {
+        offenders.push(`${file.name}: import ${clause} from 'node:fs…'`)
+      }
+    }
+    expect(offenders).toEqual([])
+  })
+
+  it('actually covers the modules it claims to', async () => {
+    const names = (await guardedFiles()).map((file) => file.name)
+    expect(names).toEqual(expect.arrayContaining(NATIVE_CHAT_MODULES))
+    // The V12–V17 sites the previous `*parser*` wording silently skipped.
+    expect(names).toEqual(
+      expect.arrayContaining([
+        'session-title-file-reader.ts',
+        'session-scanner.ts',
+        'session-scanner-values.ts',
+        'session-scanner-codex-title-index.ts',
+        'session-scanner-kimi-paths.ts',
+        'session-scanner-opencode-sources.ts'
+      ])
+    )
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-gemini-parsers.ts b/src/main/ai-vault/session-scanner-gemini-parsers.ts
index c3cda8856bb..d8d8a485d8f 100644
--- a/src/main/ai-vault/session-scanner-gemini-parsers.ts
+++ b/src/main/ai-vault/session-scanner-gemini-parsers.ts
@@ -1,6 +1,5 @@
 import { remoteSessionContentLines } from './remote-session-content-lines'
-import { createReadStream } from 'node:fs'
-import { readFile } from 'node:fs/promises'
+import { openTranscriptReadStream, wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import type {
@@ -34,7 +33,11 @@ export async function parseGeminiSessionFile(
     return parseGeminiJsonlSessionFile(file, platform)
   }
 
-  return parseGeminiJsonSessionContent(file, await readFile(file.path, 'utf-8'), platform)
+  return parseGeminiJsonSessionContent(
+    file,
+    await wslGatedReadFile(file.path, 'utf-8', 'scan'),
+    platform
+  )
 }
 
 export async function parseGeminiSessionContent(
@@ -83,7 +86,7 @@ export async function parseGeminiJsonlSessionFile(
   platform: NodeJS.Platform
 ): Promise<AiVaultSession | null> {
   const lines = createInterface({
-    input: createReadStream(file.path, { encoding: 'utf-8' }),
+    input: openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan'),
     crlfDelay: Infinity
   })
   return parseGeminiJsonlSessionLines({ file, lines, platform })
diff --git a/src/main/ai-vault/session-scanner-graph-parsers.ts b/src/main/ai-vault/session-scanner-graph-parsers.ts
index 250ebaf9ac9..d99893acaa2 100644
--- a/src/main/ai-vault/session-scanner-graph-parsers.ts
+++ b/src/main/ai-vault/session-scanner-graph-parsers.ts
@@ -1,6 +1,5 @@
 import { remoteSessionContentLines } from './remote-session-content-lines'
-import { createReadStream } from 'node:fs'
-import { readFile } from 'node:fs/promises'
+import { openTranscriptReadStream, wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
 import { basename, dirname, join } from 'node:path'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
@@ -41,7 +40,9 @@ export async function parseRovoSessionFile(
   file: FileWithMtime,
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
-  const metadata = asRecord(JSON.parse(await readFile(file.path, 'utf-8')) as unknown)
+  const metadata = asRecord(
+    JSON.parse(await wslGatedReadFile(file.path, 'utf-8', 'scan')) as unknown
+  )
   if (!metadata) {
     return null
   }
@@ -175,11 +176,16 @@ export async function parseMessageGraphSessionFile(
   file: FileWithMtime,
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
-  const lines = createInterface({
-    input: createReadStream(file.path, { encoding: 'utf-8' }),
-    crlfDelay: Infinity
-  })
-  return parseMessageGraphSessionLines({ agent, file, lines, platform })
+  const input = openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan')
+  const lines = createInterface({ input, crlfDelay: Infinity })
+  try {
+    return await parseMessageGraphSessionLines({ agent, file, lines, platform })
+  } finally {
+    // readline.close() leaves the underlying stream open; destroy it so a
+    // mid-parse throw cannot leak the gated transcript handle.
+    lines.close()
+    input.destroy()
+  }
 }
 
 export async function parseMessageGraphSessionContent(
diff --git a/src/main/ai-vault/session-scanner-grok-parser.ts b/src/main/ai-vault/session-scanner-grok-parser.ts
index 46ed29e8f1f..94e41e4b052 100644
--- a/src/main/ai-vault/session-scanner-grok-parser.ts
+++ b/src/main/ai-vault/session-scanner-grok-parser.ts
@@ -1,5 +1,5 @@
-import { createReadStream } from 'node:fs'
-import { readFile } from 'node:fs/promises'
+import { openTranscriptReadStream, wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { dirname, join } from 'node:path'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
@@ -36,7 +36,7 @@ export async function parseGrokSessionFile(
   file: FileWithMtime,
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
-  const record = asRecord(JSON.parse(await readFile(file.path, 'utf-8')) as unknown)
+  const record = asRecord(JSON.parse(await wslGatedReadFile(file.path, 'utf-8', 'scan')) as unknown)
   if (!record) {
     return null
   }
@@ -62,12 +62,13 @@ async function consumeGrokChatHistory(
   accumulator: SessionAccumulator,
   sessionDir: string
 ): Promise<void> {
+  const input = openTranscriptReadStream(
+    join(sessionDir, 'chat_history.jsonl'),
+    { encoding: 'utf-8' },
+    'scan'
+  )
+  const lines = createInterface({ input, crlfDelay: Infinity })
   try {
-    const lines = createInterface({
-      input: createReadStream(join(sessionDir, 'chat_history.jsonl'), { encoding: 'utf-8' }),
-      crlfDelay: Infinity
-    })
-
     for await (const line of lines) {
       const record = parseJsonObject(line)
       if (!record) {
@@ -111,8 +112,18 @@ async function consumeGrokChatHistory(
         seedFirstUserPrompt: false
       })
     }
-  } catch {
-    // Summary-only sessions still provide enough metadata for the Vault list.
+  } catch (error) {
+    // Summary-only sessions still provide enough metadata for the Vault list. A
+    // gate refusal is a different thing — the history exists but is unreachable,
+    // so a message-less session must not be cached under the summary's mtime.
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
+  } finally {
+    // readline.close() leaves the underlying stream open; destroy it so a
+    // mid-read failure cannot leak the gated transcript handle.
+    lines.close()
+    input.destroy()
   }
 }
 
diff --git a/src/main/ai-vault/session-scanner-hermes-parser.ts b/src/main/ai-vault/session-scanner-hermes-parser.ts
index be844cc6627..017fd9c8fdc 100644
--- a/src/main/ai-vault/session-scanner-hermes-parser.ts
+++ b/src/main/ai-vault/session-scanner-hermes-parser.ts
@@ -1,4 +1,4 @@
-import { readFile } from 'node:fs/promises'
+import { wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
 import type { FileWithMtime } from './session-scanner-types'
@@ -26,7 +26,11 @@ export async function parseHermesSessionFile(
   file: FileWithMtime,
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
-  return parseHermesSessionContent(file, await readFile(file.path, 'utf-8'), platform)
+  return parseHermesSessionContent(
+    file,
+    await wslGatedReadFile(file.path, 'utf-8', 'scan'),
+    platform
+  )
 }
 
 export async function parseHermesSessionContent(
diff --git a/src/main/ai-vault/session-scanner-index-cache-wsl-stall.test.ts b/src/main/ai-vault/session-scanner-index-cache-wsl-stall.test.ts
new file mode 100644
index 00000000000..1a5da65f1a9
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-index-cache-wsl-stall.test.ts
@@ -0,0 +1,136 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+
+const CODEX_HOME = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.codex'
+const CODEX_SESSION_FILE = `${CODEX_HOME}\\sessions\\2026\\01\\01\\rollout-1.jsonl`
+const SESSION_ID = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee'
+const KIMI_INDEX = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.kimi\\session_index.jsonl'
+
+const mocks = vi.hoisted(() => ({ stat: vi.fn(), open: vi.fn(), readFile: vi.fn() }))
+
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  stat: mocks.stat,
+  open: mocks.open,
+  readFile: mocks.readFile
+}))
+
+import {
+  readCodexSessionIndexTitle,
+  resetCodexSessionIndexTitleCacheForTests,
+  _hasCodexSessionIndexTitleCacheEntryForTest
+} from './session-scanner-codex-title-index'
+import {
+  clearKimiSessionIndexCache,
+  hasKimiSessionIndexCacheEntryForTests,
+  readKimiWorkDirBySessionId
+} from './session-scanner-kimi-paths'
+import { readJsonObjectIfExists } from './session-scanner-values'
+import {
+  WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS,
+  WslTranscriptFsError
+} from '../native-chat/wsl-transcript-fs-gate'
+
+// Identity must not change between the refused and the recovered read, or the
+// cache would miss for that reason instead of because the entry was evicted.
+const INDEX_STATS = { size: 128, mtimeMs: 7, ctimeMs: 7 }
+
+let releaseStall: (() => void) | undefined
+
+function stalls(): Promise<never> {
+  return new Promise<never>((resolve) => {
+    releaseStall = () => resolve(undefined as never)
+  })
+}
+
+function servingHandle(body: string) {
+  const bytes = Buffer.from(body)
+  return {
+    read: vi.fn(async (buffer: Buffer, offset: number, length: number, position: number) => {
+      const slice = bytes.subarray(position, Math.min(position + length, bytes.length))
+      slice.copy(buffer, offset)
+      return { bytesRead: slice.length, buffer }
+    }),
+    close: vi.fn(async () => {})
+  }
+}
+
+async function releaseAndSettle(): Promise<void> {
+  releaseStall?.()
+  releaseStall = undefined
+  await vi.advanceTimersByTimeAsync(0)
+}
+
+beforeEach(() => {
+  resetCodexSessionIndexTitleCacheForTests()
+  clearKimiSessionIndexCache()
+  mocks.stat.mockReset()
+  mocks.open.mockReset()
+  mocks.readFile.mockReset()
+  mocks.stat.mockResolvedValue(INDEX_STATS)
+  releaseStall = undefined
+  vi.useFakeTimers()
+})
+
+afterEach(async () => {
+  await releaseAndSettle()
+  vi.useRealTimers()
+})
+
+describe('memoized WSL session indexes under a stalled mount', () => {
+  it('evicts the Codex title index instead of pinning "no titles"', async () => {
+    mocks.open.mockResolvedValue({ read: vi.fn(stalls), close: vi.fn(async () => {}) })
+    const refused = readCodexSessionIndexTitle(CODEX_SESSION_FILE, CODEX_HOME, SESSION_ID)
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS + 1)
+
+    expect(await refused).toBeNull()
+    expect(_hasCodexSessionIndexTitleCacheEntryForTest(CODEX_HOME)).toBe(false)
+
+    await releaseAndSettle()
+    mocks.open.mockResolvedValue(
+      servingHandle(`${JSON.stringify({ id: SESSION_ID, thread_name: 'Ship the gate' })}\n`)
+    )
+
+    // Same size/mtime as the refused read: only the eviction can produce a hit.
+    expect(await readCodexSessionIndexTitle(CODEX_SESSION_FILE, CODEX_HOME, SESSION_ID)).toBe(
+      'Ship the gate'
+    )
+  })
+
+  it('evicts the Kimi work-dir index instead of pinning "no cwd"', async () => {
+    mocks.open.mockResolvedValue({ read: vi.fn(stalls), close: vi.fn(async () => {}) })
+    const refused = readKimiWorkDirBySessionId(KIMI_INDEX)
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS + 1)
+
+    expect(await refused).toEqual(new Map())
+    expect(hasKimiSessionIndexCacheEntryForTests(KIMI_INDEX)).toBe(false)
+
+    await releaseAndSettle()
+    mocks.open.mockResolvedValue(
+      servingHandle(`${JSON.stringify({ sessionId: SESSION_ID, workDir: '/repo/app' })}\n`)
+    )
+
+    expect(await readKimiWorkDirBySessionId(KIMI_INDEX)).toEqual(
+      new Map([[SESSION_ID, '/repo/app']])
+    )
+  })
+
+  it('surfaces a refused optional JSON enrichment instead of caching it as absent', async () => {
+    mocks.readFile.mockImplementation(stalls)
+    const pending = readJsonObjectIfExists(`${CODEX_HOME}\\history.json`).catch(
+      (error: unknown) => error
+    )
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS + 1)
+
+    // A throw, not `null`: `parseSessionCandidate` turns it into a scan issue,
+    // where `null` would cache an un-enriched session that never re-reads.
+    expect(await pending).toBeInstanceOf(WslTranscriptFsError)
+  })
+
+  it('still degrades a missing optional JSON file to null', async () => {
+    mocks.readFile.mockRejectedValue(
+      Object.assign(new Error('ENOENT'), { code: 'ENOENT' as const })
+    )
+    await expect(readJsonObjectIfExists(`${CODEX_HOME}\\missing.json`)).resolves.toBeNull()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-kimi-parser.ts b/src/main/ai-vault/session-scanner-kimi-parser.ts
index 61341098e0d..ba6deaa8fb8 100644
--- a/src/main/ai-vault/session-scanner-kimi-parser.ts
+++ b/src/main/ai-vault/session-scanner-kimi-parser.ts
@@ -1,5 +1,5 @@
-import { createReadStream } from 'node:fs'
-import { readFile } from 'node:fs/promises'
+import { openTranscriptReadStream, wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import {
@@ -36,8 +36,16 @@ export async function parseKimiSessionFile(
 ): Promise<AiVaultSession | null> {
   let stateRecord: Record<string, unknown> | null
   try {
-    stateRecord = asRecord(JSON.parse(await readFile(file.path, 'utf-8')) as unknown)
-  } catch {
+    stateRecord = asRecord(
+      JSON.parse(await wslGatedReadFile(file.path, 'utf-8', 'scan')) as unknown
+    )
+  } catch (error) {
+    // Why: a missing/half-written state file is genuinely "no session", but a
+    // gate refusal is not — returning null would let the parse cache store that
+    // degraded answer under the file's unchanged mtime and never retry.
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
     return null
   }
   if (!stateRecord) {
@@ -83,11 +91,9 @@ async function consumeKimiWireTranscript(
     }
   }
 
+  const input = openTranscriptReadStream(wirePath, { encoding: 'utf-8' }, 'scan')
+  const lines = createInterface({ input, crlfDelay: Infinity })
   try {
-    const lines = createInterface({
-      input: createReadStream(wirePath, { encoding: 'utf-8' }),
-      crlfDelay: Infinity
-    })
     for await (const line of lines) {
       const record = parseJsonObject(line)
       if (!record) {
@@ -111,9 +117,18 @@ async function consumeKimiWireTranscript(
           break
       }
     }
-  } catch {
+  } catch (error) {
     // No transcript yet (session created but never ran a turn) — metadata-only
-    // sessions still belong in the panel.
+    // sessions still belong in the panel. A gate refusal instead means the wire
+    // bytes exist but are unreachable; a partial session must not be cached.
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
+  } finally {
+    // readline.close() leaves the underlying stream open; destroy it so a
+    // mid-read failure cannot leak the gated transcript handle.
+    lines.close()
+    input.destroy()
   }
   flushAssistant()
 }
diff --git a/src/main/ai-vault/session-scanner-kimi-paths.ts b/src/main/ai-vault/session-scanner-kimi-paths.ts
index 7ed457f6c07..590e4aee814 100644
--- a/src/main/ai-vault/session-scanner-kimi-paths.ts
+++ b/src/main/ai-vault/session-scanner-kimi-paths.ts
@@ -1,8 +1,8 @@
-import { stat } from 'node:fs/promises'
-import { createReadStream } from 'node:fs'
 import { homedir } from 'node:os'
 import { basename, dirname, join } from 'node:path'
 import { createInterface } from 'node:readline'
+import { openTranscriptReadStream, wslGatedStat } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { asRecord, extractString } from './session-scanner-values'
 import {
   KimiSessionIndexCache,
@@ -78,9 +78,9 @@ export function hasKimiSessionIndexCacheEntryForTests(indexPath: string): boolea
 
 export async function readKimiWorkDirBySessionId(indexPath: string): Promise<Map<string, string>> {
   const generation = workDirCacheByIndexPath.beginRead()
-  let identity: Awaited<ReturnType<typeof stat>>
+  let identity: Awaited<ReturnType<typeof wslGatedStat>>
   try {
-    identity = await stat(indexPath)
+    identity = await wslGatedStat(indexPath, 'scan')
   } catch {
     // Missing index (e.g. user deleted it): sessions still list, just without cwd.
     workDirCacheByIndexPath.delete(indexPath, generation)
@@ -95,18 +95,30 @@ export async function readKimiWorkDirBySessionId(indexPath: string): Promise<Map
       sizeBytes: identity.size
     },
     generation,
-    () => parseKimiSessionIndex(indexPath)
+    () =>
+      parseKimiSessionIndex(indexPath).then(({ map, refused }) => {
+        // Why: a gate refusal is a stalled distro, not a cwd-less index — evict
+        // so the partial map is not served until the index's identity changes.
+        // Inside the loader, not at the call site: only the caller that missed
+        // runs this, so a concurrent hit would otherwise serve and keep it.
+        if (refused) {
+          workDirCacheByIndexPath.delete(indexPath, generation)
+        }
+        return map
+      })
   )
 }
 
-async function parseKimiSessionIndex(indexPath: string): Promise<Map<string, string>> {
+async function parseKimiSessionIndex(
+  indexPath: string
+): Promise<{ map: Map<string, string>; refused: boolean }> {
   const map = new Map<string, string>()
   // Why: never reject. This promise is memoized and shared by every session
   // under one Kimi home; a mid-read failure (file deleted after stat, EACCES)
   // must degrade to whatever was parsed so the other sessions still list.
   try {
     const lines = createInterface({
-      input: createReadStream(indexPath, { encoding: 'utf-8' }),
+      input: openTranscriptReadStream(indexPath, { encoding: 'utf-8' }, 'scan'),
       crlfDelay: Infinity
     })
     for await (const line of lines) {
@@ -126,8 +138,9 @@ async function parseKimiSessionIndex(indexPath: string): Promise<Map<string, str
         map.set(sessionId, workDir)
       }
     }
-  } catch {
+  } catch (error) {
     // Return the partial map gathered before the read error.
+    return { map, refused: error instanceof WslTranscriptFsError }
   }
-  return map
+  return { map, refused: false }
 }
diff --git a/src/main/ai-vault/session-scanner-omp-subagent-listing.ts b/src/main/ai-vault/session-scanner-omp-subagent-listing.ts
index 0efcdbdc92c..3ecfade1813 100644
--- a/src/main/ai-vault/session-scanner-omp-subagent-listing.ts
+++ b/src/main/ai-vault/session-scanner-omp-subagent-listing.ts
@@ -1,10 +1,12 @@
-import { readdir, stat } from 'node:fs/promises'
 import { basename, extname, join } from 'node:path'
 import type {
   AiVaultScanIssue,
   AiVaultSession,
   AiVaultSubagentListResult
 } from '../../shared/ai-vault-types'
+import { wslGatedReaddir, wslGatedStat } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
+import { recordSessionScanIssue } from './session-scan-issues'
 import { sessionIdFromFileName, sessionSortTime } from './session-scanner-accumulator'
 import { parseMessageGraphSessionFile } from './session-scanner-graph-parsers'
 import {
@@ -16,6 +18,8 @@ import { errorMessage } from './session-scanner-values'
 // Match the Claude subagent lister's deliberate parse batching: opening every
 // read stream at once stalls over WSL UNC paths.
 const OMP_SUBAGENT_PARSE_CONCURRENCY = 8
+// Bulk directory work, so 'scan' — same reasoning as the Claude lister.
+const OMP_SUBAGENT_FS_PRIORITY = 'scan'
 
 /**
  * List the task-subagent transcripts of one OMP session, on demand. The main
@@ -35,8 +39,13 @@ export async function listOmpSubagentSessions(args: {
 
   let entries
   try {
-    entries = await readdir(artifactDir, { withFileTypes: true })
-  } catch {
+    entries = await wslGatedReaddir(artifactDir, OMP_SUBAGENT_FS_PRIORITY)
+  } catch (err) {
+    // A gate refusal is a stalled distro, not a session without subagents —
+    // report it so the panel offers a retry instead of showing an empty list.
+    if (err instanceof WslTranscriptFsError) {
+      recordSessionScanIssue(issues, { agent: 'omp', path: artifactDir, message: err.message })
+    }
     return { sessions: [], issues }
   }
 
@@ -79,7 +88,7 @@ async function parseOmpSubagentTranscript(args: {
 }): Promise<AiVaultSession | null> {
   const filePath = join(args.artifactDir, args.name)
   try {
-    const fileStat = await stat(filePath)
+    const fileStat = await wslGatedStat(filePath, OMP_SUBAGENT_FS_PRIORITY)
     // The shared OMP parser decorates every parse with an artifact-dir count, so
     // a child row carries its own grandchild count. It is accurate but has no
     // renderer — subagent rows don't expand — and this lister is local-only, so
@@ -107,7 +116,11 @@ async function parseOmpSubagentTranscript(args: {
       }
     }
   } catch (err) {
-    args.issues.push({ agent: 'omp', path: filePath, message: errorMessage(err) })
+    recordSessionScanIssue(args.issues, {
+      agent: 'omp',
+      path: filePath,
+      message: errorMessage(err)
+    })
     return null
   }
 }
diff --git a/src/main/ai-vault/session-scanner-omp-subagent-transcripts.ts b/src/main/ai-vault/session-scanner-omp-subagent-transcripts.ts
index 9136e8c0d34..57cadebeee0 100644
--- a/src/main/ai-vault/session-scanner-omp-subagent-transcripts.ts
+++ b/src/main/ai-vault/session-scanner-omp-subagent-transcripts.ts
@@ -1,4 +1,4 @@
-import { readdir } from 'node:fs/promises'
+import { wslGatedReaddir } from '../native-chat/wsl-transcript-fs-access'
 import { basename, dirname, extname, join } from 'node:path'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
 import type { SubagentTranscriptPartition } from './session-scanner-subagent-transcripts'
@@ -51,7 +51,7 @@ export function isOmpSubagentTranscriptFileName(name: string, isFile: boolean):
 export async function countOmpSubagentTranscripts(transcriptFilePath: string): Promise<number> {
   let entries
   try {
-    entries = await readdir(ompArtifactDirFor(transcriptFilePath), { withFileTypes: true })
+    entries = await wslGatedReaddir(ompArtifactDirFor(transcriptFilePath), 'scan')
   } catch {
     return 0
   }
diff --git a/src/main/ai-vault/session-scanner-opencode-parser.ts b/src/main/ai-vault/session-scanner-opencode-parser.ts
index 4231f7d9de4..30223e70866 100644
--- a/src/main/ai-vault/session-scanner-opencode-parser.ts
+++ b/src/main/ai-vault/session-scanner-opencode-parser.ts
@@ -1,4 +1,5 @@
-import { readFile, readdir } from 'node:fs/promises'
+import { wslGatedReaddir, wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { join } from 'node:path'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import type { FileWithMtime, SessionAccumulator } from './session-scanner-types'
@@ -26,7 +27,7 @@ export async function parseOpenCodeSessionFile(
   file: FileWithMtime,
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
-  const record = asRecord(JSON.parse(await readFile(file.path, 'utf-8')) as unknown)
+  const record = asRecord(JSON.parse(await wslGatedReadFile(file.path, 'utf-8', 'scan')) as unknown)
   if (!record) {
     return null
   }
@@ -47,8 +48,13 @@ export async function parseOpenCodeSessionFile(
 async function readOpenCodeMessagesInOrder(messageDir: string): Promise<Record<string, unknown>[]> {
   let entries
   try {
-    entries = await readdir(messageDir, { withFileTypes: true })
-  } catch {
+    entries = await wslGatedReaddir(messageDir, 'scan')
+  } catch (error) {
+    // A session with no message dir yet is empty; a gate refusal is not — an
+    // empty transcript would otherwise be cached under the session's mtime.
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
     return []
   }
   const messages: { name: string; createdMs: number; message: Record<string, unknown> }[] = []
@@ -59,11 +65,15 @@ async function readOpenCodeMessagesInOrder(messageDir: string): Promise<Record<s
     let message: Record<string, unknown> | null = null
     try {
       message = asRecord(
-        JSON.parse(await readFile(join(messageDir, entry.name), 'utf-8')) as unknown
+        JSON.parse(await wslGatedReadFile(join(messageDir, entry.name), 'utf-8', 'scan')) as unknown
       )
-    } catch {
+    } catch (error) {
       // A live OpenCode process can leave a half-written file; skip it rather
-      // than discard the whole session.
+      // than discard the whole session. A refused read is not a bad file — the
+      // partial transcript it would produce must not become the cached answer.
+      if (error instanceof WslTranscriptFsError) {
+        throw error
+      }
       continue
     }
     if (!message) {
diff --git a/src/main/ai-vault/session-scanner-opencode-sources-wsl-stall.test.ts b/src/main/ai-vault/session-scanner-opencode-sources-wsl-stall.test.ts
new file mode 100644
index 00000000000..accc60d008f
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sources-wsl-stall.test.ts
@@ -0,0 +1,104 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Dirent } from 'node:fs'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+
+const WSL_HOME = '\\\\wsl.localhost\\Ubuntu\\home\\ada'
+const WSL_DATA_DIR = `${WSL_HOME}/.local/share/opencode`
+
+const mocks = vi.hoisted(() => ({ readdir: vi.fn(), stat: vi.fn() }))
+
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  readdir: mocks.readdir,
+  stat: mocks.stat
+}))
+
+// The SQLite leg spawns a real worker thread, which fake timers cannot drive.
+vi.mock('./session-scanner-opencode-sqlite-worker-spawn', () => ({
+  listOpenCodeSqliteSessionsViaWorker: async () => []
+}))
+
+import { opencodeDiscoveries } from './session-scanner-opencode-sources'
+import { WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS } from '../native-chat/wsl-transcript-fs-gate'
+
+let releaseStall: (() => void) | undefined
+
+function restoreEnv(key: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[key]
+  } else {
+    process.env[key] = value
+  }
+}
+
+function stalls(): Promise<never> {
+  return new Promise<never>((resolve) => {
+    releaseStall = () => resolve(undefined as never)
+  })
+}
+
+beforeEach(() => {
+  mocks.readdir.mockReset()
+  mocks.stat.mockReset()
+  releaseStall = undefined
+  vi.useFakeTimers()
+})
+
+afterEach(async () => {
+  releaseStall?.()
+  releaseStall = undefined
+  await vi.advanceTimersByTimeAsync(0)
+  vi.useRealTimers()
+})
+
+describe('OpenCode source discovery with a stalled WSL data directory', () => {
+  it('reports the stalled home as an issue and still resolves every discovery', async () => {
+    mocks.readdir.mockImplementation((dir: string) =>
+      dir === WSL_DATA_DIR ? stalls() : Promise.resolve([] as Dirent[])
+    )
+    const issues: AiVaultScanIssue[] = []
+    const discoveries = Promise.all(
+      opencodeDiscoveries(
+        { opencodeStorageDir: '/home/ada/.local/share/opencode/storage' },
+        [WSL_HOME],
+        10,
+        issues
+      )
+    )
+    // Two deadlines: the data-dir probe, then the storage scan that queued
+    // behind it before the route was flagged stuck.
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS * 2 + 2)
+
+    // Zero databases for that home is the degraded answer; without the issue it
+    // would be indistinguishable from "OpenCode was never installed there".
+    const resolved = await discoveries
+    expect(resolved).toHaveLength(2)
+    expect(resolved.every((discovery) => discovery.files.length === 0)).toBe(true)
+    expect(issues.some((issue) => issue.path === WSL_DATA_DIR)).toBe(true)
+    expect(issues.every((issue) => issue.agent === 'opencode')).toBe(true)
+  })
+
+  it('reports a refused primary data directory instead of scanning clean', async () => {
+    const previousXdg = process.env.XDG_DATA_HOME
+    const previousDb = process.env.OPENCODE_DB
+    process.env.XDG_DATA_HOME = WSL_HOME
+    delete process.env.OPENCODE_DB
+    try {
+      mocks.readdir.mockImplementation(stalls)
+      const issues: AiVaultScanIssue[] = []
+      const discoveries = Promise.all(opencodeDiscoveries({}, [], 10, issues))
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS * 2 + 2)
+
+      // The primary source is the one per-root containment cannot reach, so a
+      // silent [] here reads as "no OpenCode sessions" on a clean scan.
+      await expect(discoveries).resolves.toHaveLength(1)
+      expect(
+        issues.some((issue) => issue.agent === 'opencode' && issue.path === `${WSL_HOME}/opencode`)
+      ).toBe(true)
+    } finally {
+      restoreEnv('XDG_DATA_HOME', previousXdg)
+      restoreEnv('OPENCODE_DB', previousDb)
+    }
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-sources.ts b/src/main/ai-vault/session-scanner-opencode-sources.ts
index 6d84965f8c0..365e6334512 100644
--- a/src/main/ai-vault/session-scanner-opencode-sources.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sources.ts
@@ -1,8 +1,10 @@
-import { readdir } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
 import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { wslGatedReaddir } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { resolveOpenCodeStorageDirectory } from '../opencode/opencode-data-directory'
 import { listOpenCodeDatabases } from '../opencode-usage/scanner'
+import { recordSessionScanIssue } from './session-scan-issues'
 import { discoverOpenCodeSessions } from './session-scanner-opencode-sqlite-discovery'
 import type { AiVaultScanOptions, SessionFileDiscovery } from './session-scanner-types'
 
@@ -16,7 +18,7 @@ export function opencodeDiscoveries(
   return storageDirs.map(async (storageDir, index) =>
     discoverOpenCodeSessions({
       storageDir,
-      dbPaths: await opencodeDbPathsForSource(options, wslHomeDirs, storageDir, index),
+      dbPaths: await opencodeDbPathsForSource(options, wslHomeDirs, storageDir, index, issues),
       limitPerAgent: limit,
       issues
     })
@@ -37,32 +39,47 @@ async function opencodeDbPathsForSource(
   options: AiVaultScanOptions,
   wslHomeDirs: readonly string[],
   storageDir: string,
-  sourceIndex: number
+  sourceIndex: number,
+  issues: AiVaultScanIssue[]
 ): Promise<readonly string[]> {
   if (options.opencodeDbPaths) {
     return sourceIndex === 0 ? options.opencodeDbPaths : []
   }
   // Why: custom OpenCode storage roots still keep SQLite DBs in the parent data dir.
   if (sourceIndex === 0 && options.opencodeStorageDir) {
-    return listOpenCodeDatabasesInDirectory(dirname(storageDir))
+    return listOpenCodeDatabasesInDirectory(dirname(storageDir), issues)
   }
   if (sourceIndex === 0) {
-    return listOpenCodeDatabases()
+    return listOpenCodeDatabases((path, error) => {
+      recordSessionScanIssue(issues, { agent: 'opencode', path, message: error.message })
+    })
   }
   const wslHomeDir = wslHomeDirs[sourceIndex - 1]
   return wslHomeDir
-    ? listOpenCodeDatabasesInDirectory(join(wslHomeDir, '.local', 'share', 'opencode'))
+    ? listOpenCodeDatabasesInDirectory(join(wslHomeDir, '.local', 'share', 'opencode'), issues)
     : []
 }
 
-async function listOpenCodeDatabasesInDirectory(dataDir: string): Promise<string[]> {
+async function listOpenCodeDatabasesInDirectory(
+  dataDir: string,
+  issues: AiVaultScanIssue[]
+): Promise<string[]> {
   try {
-    const entries = await readdir(dataDir, { withFileTypes: true })
+    const entries = await wslGatedReaddir(dataDir, 'scan')
     return entries
       .filter((entry) => entry.isFile() && /^opencode(?:-[A-Za-z0-9_.-]+)?\.db$/.test(entry.name))
       .map((entry) => join(dataDir, entry.name))
       .sort()
-  } catch {
+  } catch (error) {
+    // A stalled WSL data dir still degrades to "no databases", but the gap has
+    // to be reportable — an empty list otherwise reads as "OpenCode not used".
+    if (error instanceof WslTranscriptFsError) {
+      recordSessionScanIssue(issues, {
+        agent: 'opencode',
+        path: dataDir,
+        message: error.message
+      })
+    }
     return []
   }
 }
diff --git a/src/main/ai-vault/session-scanner-parse-cache.ts b/src/main/ai-vault/session-scanner-parse-cache.ts
index 727d70ac319..563055ffa39 100644
--- a/src/main/ai-vault/session-scanner-parse-cache.ts
+++ b/src/main/ai-vault/session-scanner-parse-cache.ts
@@ -1,5 +1,7 @@
-import { createReadStream } from 'node:fs'
-import { open } from 'node:fs/promises'
+import {
+  openTranscriptReadStream,
+  readTranscriptSlice
+} from '../native-chat/wsl-transcript-fs-access'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import { createAntigravitySessionResumeState } from './session-scanner-antigravity-parser'
 import { parseAgentSessionFile } from './session-scanner-agent-parser'
@@ -305,13 +307,8 @@ async function parseResumableCandidate(args: {
 // agent transcripts are append-only so that trade is accepted (worst case is
 // a stale vault row until the file is next truncated or the app restarts).
 async function endsWithNewlineAt(path: string, offset: number): Promise<boolean> {
-  const handle = await open(path, 'r')
-  try {
-    const { bytesRead, buffer } = await handle.read(Buffer.alloc(1), 0, 1, offset - 1)
-    return bytesRead === 1 && buffer[0] === NEWLINE_BYTE
-  } finally {
-    await handle.close()
-  }
+  const slice = await readTranscriptSlice(path, offset - 1, 1, 'scan')
+  return slice.length === 1 && slice[0] === NEWLINE_BYTE
 }
 
 type JsonlReadResult = {
@@ -336,7 +333,7 @@ async function consumeCompleteJsonlLines(args: {
   let remainderParts: Buffer[] = []
   let remainderLength = 0
 
-  const stream = createReadStream(args.path, { start: args.start })
+  const stream = openTranscriptReadStream(args.path, { start: args.start }, 'scan')
   for await (const chunk of stream as AsyncIterable<Buffer>) {
     bytesRead += chunk.length
     // Why check the chunk alone: the pieces held over are all mid-line, so none
diff --git a/src/main/ai-vault/session-scanner-parse-wsl-stall.test.ts b/src/main/ai-vault/session-scanner-parse-wsl-stall.test.ts
new file mode 100644
index 00000000000..9eea5176c66
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-parse-wsl-stall.test.ts
@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+import type { SessionFileCandidate } from './session-scanner-types'
+
+const STALLED_PATH = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.claude\\projects\\p\\a.jsonl'
+const SIBLING_PATH = '\\\\wsl.localhost\\Debian\\home\\ada\\.claude\\projects\\p\\b.jsonl'
+
+const mocks = vi.hoisted(() => ({ open: vi.fn(), readdir: vi.fn() }))
+
+// readdir too: every claude parse counts sibling subagent transcripts, and an
+// unmocked one would reach the host UNC path and stall under fake timers.
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  open: mocks.open,
+  readdir: mocks.readdir
+}))
+
+import {
+  parseAgentSessionFileCached,
+  resetSessionParseCacheForTests
+} from './session-scanner-parse-cache'
+import {
+  WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS,
+  WslTranscriptFsError
+} from '../native-chat/wsl-transcript-fs-gate'
+
+type ReadResult = { bytesRead: number; buffer: Buffer }
+
+// A stalled task keeps the gate's single scan slot until the call settles, so
+// every case releases its stall before the next one runs.
+let releaseStall: (() => void) | undefined
+
+function stalls(): Promise<ReadResult> {
+  return new Promise<ReadResult>((resolve) => {
+    releaseStall = () => resolve({ bytesRead: 0, buffer: Buffer.alloc(0) })
+  })
+}
+
+function servingHandle(body: Buffer) {
+  return {
+    read: vi.fn(async (buffer: Buffer, offset: number, length: number, position: number) => {
+      const slice = body.subarray(position, Math.min(position + length, body.length))
+      slice.copy(buffer, offset)
+      return { bytesRead: slice.length, buffer }
+    }),
+    close: vi.fn(async () => {})
+  }
+}
+
+function record(index: number, text: string): string {
+  return JSON.stringify({
+    type: 'user',
+    sessionId: 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee',
+    timestamp: new Date(1740000000000 + index * 60_000).toISOString(),
+    cwd: '/repo/app',
+    gitBranch: 'main',
+    message: { role: 'user', content: text }
+  })
+}
+
+function body(count: number): Buffer {
+  return Buffer.from(
+    Array.from({ length: count }, (_, index) => `${record(index, `line ${index}`)}\n`).join('')
+  )
+}
+
+function candidate(path: string, bytes: Buffer, mtimeMs: number): SessionFileCandidate {
+  return {
+    agent: 'claude',
+    file: {
+      path,
+      mtimeMs,
+      modifiedAt: new Date(mtimeMs).toISOString(),
+      sizeBytes: bytes.length
+    },
+    codexHome: null
+  }
+}
+
+async function releaseAndSettle(): Promise<void> {
+  releaseStall?.()
+  releaseStall = undefined
+  await vi.advanceTimersByTimeAsync(0)
+}
+
+beforeEach(() => {
+  resetSessionParseCacheForTests()
+  mocks.open.mockReset()
+  mocks.readdir.mockReset()
+  mocks.readdir.mockResolvedValue([])
+  releaseStall = undefined
+  vi.useFakeTimers()
+})
+
+afterEach(async () => {
+  await releaseAndSettle()
+  vi.useRealTimers()
+})
+
+describe('AI Vault session parse with a stalled WSL transcript body read', () => {
+  it('refuses the stalled candidate and still parses a sibling on a healthy distro', async () => {
+    mocks.open.mockResolvedValue({ read: vi.fn(stalls), close: vi.fn(async () => {}) })
+    // Rejecting (not resolving null) is what lets `parseSessionCandidate`
+    // report it as an issue instead of silently dropping the session. The
+    // assertion is attached before the clock moves so the rejection is never
+    // momentarily unhandled.
+    const refusal = expect(
+      parseAgentSessionFileCached(candidate(STALLED_PATH, body(2), 1), 'linux')
+    ).rejects.toBeInstanceOf(WslTranscriptFsError)
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS + 1)
+    await refusal
+
+    await releaseAndSettle()
+    const siblingBytes = body(2)
+    mocks.open.mockResolvedValue(servingHandle(siblingBytes))
+
+    const sibling = await parseAgentSessionFileCached(
+      candidate(SIBLING_PATH, siblingBytes, 1),
+      'linux'
+    )
+    expect(sibling?.messageCount).toBe(2)
+  })
+
+  it('caches no resume point when the newline probe is refused mid-append', async () => {
+    const first = body(2)
+    mocks.open.mockResolvedValue(servingHandle(first))
+    const seeded = await parseAgentSessionFileCached(candidate(STALLED_PATH, first, 1), 'linux')
+    expect(seeded?.messageCount).toBe(2)
+
+    const grown = body(3)
+    const serving = servingHandle(grown)
+    mocks.open.mockResolvedValue({
+      // Only the 1-byte resume probe stalls; the body read stays healthy.
+      read: vi.fn((buffer: Buffer, offset: number, length: number, position: number) =>
+        length === 1 ? stalls() : serving.read(buffer, offset, length, position)
+      ),
+      close: vi.fn(async () => {})
+    })
+    const refused = expect(
+      parseAgentSessionFileCached(candidate(STALLED_PATH, grown, 2), 'linux')
+    ).rejects.toBeInstanceOf(WslTranscriptFsError)
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS + 1)
+    await refused
+
+    await releaseAndSettle()
+    mocks.open.mockResolvedValue(servingHandle(grown))
+    const recovered = await parseAgentSessionFileCached(candidate(STALLED_PATH, grown, 2), 'linux')
+
+    resetSessionParseCacheForTests()
+    const cold = await parseAgentSessionFileCached(candidate(STALLED_PATH, grown, 2), 'linux')
+    expect(recovered).toEqual(cold)
+    expect(recovered?.messageCount).toBe(3)
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-parser-stream-cleanup.test.ts b/src/main/ai-vault/session-scanner-parser-stream-cleanup.test.ts
new file mode 100644
index 00000000000..7470b3430d2
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-parser-stream-cleanup.test.ts
@@ -0,0 +1,127 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { Readable } from 'node:stream'
+import type * as NodeReadlineModule from 'node:readline'
+import type * as WslFsAccessModule from '../native-chat/wsl-transcript-fs-access'
+import type { FileWithMtime } from './session-scanner-types'
+
+// readline.close() leaves its input open, so a parser that stops consuming
+// mid-file (a throw, a break) strands the gated transcript handle until the
+// gate's deadline and delays every later scan. These pin the finally blocks.
+const mocks = vi.hoisted(() => ({
+  openStream: vi.fn(),
+  readFile: vi.fn(),
+  stat: vi.fn(),
+  createInterface: vi.fn()
+}))
+
+vi.mock('../native-chat/wsl-transcript-fs-access', async (importOriginal) => ({
+  ...(await importOriginal<typeof WslFsAccessModule>()),
+  openTranscriptReadStream: mocks.openStream,
+  wslGatedReadFile: mocks.readFile,
+  wslGatedStat: mocks.stat
+}))
+
+vi.mock('node:readline', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeReadlineModule>()),
+  createInterface: mocks.createInterface
+}))
+
+import { parseAntigravitySessionFile } from './session-scanner-antigravity-parser'
+import { parseDroidSessionFile } from './session-scanner-droid-parser'
+import { parseMessageGraphSessionFile } from './session-scanner-graph-parsers'
+import { parseGrokSessionFile } from './session-scanner-grok-parser'
+import { parseKimiSessionFile } from './session-scanner-kimi-parser'
+import { clearKimiSessionIndexCache } from './session-scanner-kimi-paths'
+
+const PARSE_FAILURE = 'parser failed mid-transcript'
+
+const opened: { path: string; stream: Readable }[] = []
+const interfaces: { close: ReturnType<typeof vi.fn> }[] = []
+
+function file(path: string): FileWithMtime {
+  return { path, mtimeMs: 1, modifiedAt: '2026-06-01T10:05:00.000Z', sizeBytes: 128 }
+}
+
+function lastOpened(): { path: string; stream: Readable } {
+  const entry = opened.at(-1)
+  if (!entry) {
+    throw new Error('no transcript stream was opened')
+  }
+  return entry
+}
+
+function expectStreamTornDown(): void {
+  expect(lastOpened().stream.destroyed).toBe(true)
+  expect(interfaces.at(-1)?.close).toHaveBeenCalled()
+}
+
+beforeEach(() => {
+  opened.length = 0
+  interfaces.length = 0
+  clearKimiSessionIndexCache()
+  mocks.openStream.mockReset()
+  mocks.readFile.mockReset()
+  mocks.stat.mockReset()
+  mocks.createInterface.mockReset()
+
+  mocks.openStream.mockImplementation((path: string) => {
+    const stream = new Readable({
+      read() {
+        this.push(null)
+      }
+    })
+    opened.push({ path, stream })
+    return stream
+  })
+  // One line, then a consumer-side throw: the parser must still tear the
+  // stream down on its way out.
+  mocks.createInterface.mockImplementation(() => {
+    const lines = {
+      close: vi.fn(),
+      [Symbol.asyncIterator]: async function* () {
+        yield '{}'
+        throw new Error(PARSE_FAILURE)
+      }
+    }
+    interfaces.push(lines)
+    return lines
+  })
+})
+
+describe('session parsers that stop consuming a gated transcript early', () => {
+  it.each([
+    ['antigravity', () => parseAntigravitySessionFile(file('/w/conversation.jsonl'), 'linux')],
+    ['droid', () => parseDroidSessionFile(file('/w/session.jsonl'), 'linux')],
+    ['message graph', () => parseMessageGraphSessionFile('pi', file('/w/session.jsonl'), 'linux')]
+  ])('destroys the stream when the %s parse throws', async (_agent, parse) => {
+    await expect(parse()).rejects.toThrow(PARSE_FAILURE)
+
+    expectStreamTornDown()
+  })
+
+  it('destroys the chat_history stream when the Grok parse swallows the failure', async () => {
+    mocks.readFile.mockResolvedValue(JSON.stringify({ info: { id: 'ses-1' } }))
+
+    // Grok degrades to a summary-only session on a non-gate failure, so the
+    // teardown has no rejection to ride out on.
+    await expect(
+      parseGrokSessionFile(file('/w/.grok/sessions/ses-1/session.json'))
+    ).resolves.toBeTruthy()
+
+    expect(lastOpened().path).toContain('chat_history.jsonl')
+    expectStreamTornDown()
+  })
+
+  it('destroys the wire stream when the Kimi parse swallows the failure', async () => {
+    mocks.readFile.mockResolvedValue(JSON.stringify({ title: 'Kimi session' }))
+    // No session_index.jsonl, so only the wire transcript opens a stream.
+    mocks.stat.mockRejectedValue(Object.assign(new Error('ENOENT'), { code: 'ENOENT' }))
+
+    await expect(
+      parseKimiSessionFile(file('/w/.kimi-code/sessions/wd_app/session_abc/state.json'))
+    ).resolves.toBeTruthy()
+
+    expect(lastOpened().path).toContain('wire.jsonl')
+    expectStreamTornDown()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-primary-parsers.ts b/src/main/ai-vault/session-scanner-primary-parsers.ts
index 92db2241320..f554268c7e5 100644
--- a/src/main/ai-vault/session-scanner-primary-parsers.ts
+++ b/src/main/ai-vault/session-scanner-primary-parsers.ts
@@ -1,5 +1,5 @@
 import { remoteSessionContentLines } from './remote-session-content-lines'
-import { createReadStream } from 'node:fs'
+import { openTranscriptReadStream } from '../native-chat/wsl-transcript-fs-access'
 import { createInterface } from 'node:readline'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/execution-host'
@@ -210,7 +210,7 @@ export async function parseClaudeSessionFile(
   platform: NodeJS.Platform = process.platform
 ): Promise<AiVaultSession | null> {
   const lines = createInterface({
-    input: createReadStream(file.path, { encoding: 'utf-8' }),
+    input: openTranscriptReadStream(file.path, { encoding: 'utf-8' }, 'scan'),
     crlfDelay: Infinity
   })
   return parseClaudeSessionLines({ file, lines, platform })
diff --git a/src/main/ai-vault/session-scanner-scope-discovery.ts b/src/main/ai-vault/session-scanner-scope-discovery.ts
index b0a4792ffd6..e787aef628e 100644
--- a/src/main/ai-vault/session-scanner-scope-discovery.ts
+++ b/src/main/ai-vault/session-scanner-scope-discovery.ts
@@ -1,13 +1,18 @@
-import { createReadStream } from 'node:fs'
-import { readdir, stat } from 'node:fs/promises'
 import { createInterface } from 'node:readline'
 import { extname, join } from 'node:path'
+import {
+  openTranscriptReadStream,
+  wslGatedReaddir,
+  wslGatedStat
+} from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import {
   isPathInsideOrEqual,
   normalizeRuntimePathSeparators
 } from '../../shared/cross-platform-path'
 import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
 import { parseWslUncPath } from '../../shared/wsl-paths'
+import { recordSessionScanIssue } from './session-scan-issues'
 import type { FileWithMtime } from './session-scanner-types'
 import { errorMessage, extractString, parseJsonObject } from './session-scanner-values'
 
@@ -26,7 +31,18 @@ export function resetProjectDirCwdCacheForTests(): void {
   projectDirCwdCache.clear()
 }
 
-async function cachedProjectDirCwd(projectDir: string): Promise<string | null> {
+// A gate refusal is a stalled WSL root, not an empty one: keep the existing
+// degrade-to-empty containment but make the gap visible in the scan issues.
+function recordRefusal(issues: AiVaultScanIssue[], path: string, error: unknown): void {
+  if (error instanceof WslTranscriptFsError) {
+    recordSessionScanIssue(issues, { agent: 'claude', path, message: error.message })
+  }
+}
+
+async function cachedProjectDirCwd(
+  projectDir: string,
+  issues: AiVaultScanIssue[]
+): Promise<string | null> {
   const cached = projectDirCwdCache.get(projectDir)
   if (cached !== undefined) {
     // Refresh recency so hot in-scope dirs outlive one-off ones at the cap.
@@ -34,7 +50,7 @@ async function cachedProjectDirCwd(projectDir: string): Promise<string | null> {
     projectDirCwdCache.set(projectDir, cached)
     return cached
   }
-  const cwd = await readProjectDirCwd(projectDir)
+  const cwd = await readProjectDirCwd(projectDir, issues)
   if (cwd) {
     if (projectDirCwdCache.size >= PROJECT_DIR_CWD_CACHE_MAX) {
       const oldest = projectDirCwdCache.keys().next()
@@ -70,8 +86,8 @@ export async function discoverInScopeClaudeFiles(args: {
   const scopeProjectPrefixes = claudeProjectScopePrefixes(args.scopePaths)
   const collected = new Map<string, FileWithMtime>()
   for (const rootDir of args.rootDirs) {
-    for (const projectDir of await listProjectDirs(rootDir, scopeProjectPrefixes)) {
-      const cwd = await cachedProjectDirCwd(projectDir)
+    for (const projectDir of await listProjectDirs(rootDir, scopeProjectPrefixes, args.issues)) {
+      const cwd = await cachedProjectDirCwd(projectDir, args.issues)
       if (!cwd || !args.scopePaths.some((scopePath) => isCwdInsideScopePath(scopePath, cwd))) {
         continue
       }
@@ -148,12 +164,14 @@ function isCwdInsideScopePath(scopePath: string, cwd: string): boolean {
 
 async function listProjectDirs(
   rootDir: string,
-  scopeProjectPrefixes: ReadonlySet<string>
+  scopeProjectPrefixes: ReadonlySet<string>,
+  issues: AiVaultScanIssue[]
 ): Promise<string[]> {
   let entries
   try {
-    entries = await readdir(rootDir, { withFileTypes: true })
-  } catch {
+    entries = await wslGatedReaddir(rootDir, 'scan')
+  } catch (err) {
+    recordRefusal(issues, rootDir, err)
     return []
   }
   return entries
@@ -163,10 +181,13 @@ async function listProjectDirs(
     .map((entry) => join(rootDir, entry.name))
 }
 
-async function readProjectDirCwd(projectDir: string): Promise<string | null> {
-  const files = await newestClaudeFilesInDir(projectDir)
+async function readProjectDirCwd(
+  projectDir: string,
+  issues: AiVaultScanIssue[]
+): Promise<string | null> {
+  const files = await newestClaudeFilesInDir(projectDir, issues)
   for (const file of files.slice(0, REPRESENTATIVE_FILE_LIMIT)) {
-    const cwd = await readFirstCwd(file)
+    const cwd = await readFirstCwd(file, issues)
     if (cwd) {
       return cwd
     }
@@ -174,11 +195,15 @@ async function readProjectDirCwd(projectDir: string): Promise<string | null> {
   return null
 }
 
-async function newestClaudeFilesInDir(projectDir: string): Promise<string[]> {
+async function newestClaudeFilesInDir(
+  projectDir: string,
+  issues: AiVaultScanIssue[]
+): Promise<string[]> {
   let entries
   try {
-    entries = await readdir(projectDir, { withFileTypes: true })
-  } catch {
+    entries = await wslGatedReaddir(projectDir, 'scan')
+  } catch (err) {
+    recordRefusal(issues, projectDir, err)
     return []
   }
   const newest: { path: string; mtimeMs: number }[] = []
@@ -190,18 +215,19 @@ async function newestClaudeFilesInDir(projectDir: string): Promise<string[]> {
     try {
       addBoundedPath(newest, REPRESENTATIVE_FILE_LIMIT, {
         path,
-        mtimeMs: (await stat(path)).mtimeMs
+        mtimeMs: (await wslGatedStat(path, 'scan')).mtimeMs
       })
-    } catch {
+    } catch (err) {
       // Best effort: unreadable candidates are ignored here and reported during
       // full collection if the project directory proves in-scope.
+      recordRefusal(issues, path, err)
     }
   }
   return newest.sort((left, right) => right.mtimeMs - left.mtimeMs).map((value) => value.path)
 }
 
-async function readFirstCwd(filePath: string): Promise<string | null> {
-  const input = createReadStream(filePath, { encoding: 'utf-8' })
+async function readFirstCwd(filePath: string, issues: AiVaultScanIssue[]): Promise<string | null> {
+  const input = openTranscriptReadStream(filePath, { encoding: 'utf-8' }, 'scan')
   const lines = createInterface({ input, crlfDelay: Infinity })
   let read = 0
   try {
@@ -214,7 +240,8 @@ async function readFirstCwd(filePath: string): Promise<string | null> {
         return cwd
       }
     }
-  } catch {
+  } catch (err) {
+    recordRefusal(issues, filePath, err)
     return null
   } finally {
     // readline.close() leaves the underlying stream open; destroy it so the early
@@ -234,8 +261,9 @@ async function collectClaudeFiles(args: {
 }): Promise<void> {
   let entries
   try {
-    entries = await readdir(args.projectDir, { withFileTypes: true })
-  } catch {
+    entries = await wslGatedReaddir(args.projectDir, 'scan')
+  } catch (err) {
+    recordRefusal(args.issues, args.projectDir, err)
     return
   }
   for (const entry of entries) {
@@ -247,7 +275,7 @@ async function collectClaudeFiles(args: {
       continue
     }
     try {
-      const fileStat = await stat(path)
+      const fileStat = await wslGatedStat(path, 'scan')
       addBoundedFile(args.collected, args.limit, {
         path,
         mtimeMs: fileStat.mtimeMs,
@@ -255,7 +283,7 @@ async function collectClaudeFiles(args: {
         sizeBytes: fileStat.size
       })
     } catch (err) {
-      args.issues.push({ agent: 'claude', path, message: errorMessage(err) })
+      recordSessionScanIssue(args.issues, { agent: 'claude', path, message: errorMessage(err) })
     }
   }
 }
diff --git a/src/main/ai-vault/session-scanner-service-client.ts b/src/main/ai-vault/session-scanner-service-client.ts
index cfcee4c2240..4f46dc643c5 100644
--- a/src/main/ai-vault/session-scanner-service-client.ts
+++ b/src/main/ai-vault/session-scanner-service-client.ts
@@ -130,7 +130,7 @@ export class AiVaultScannerServiceClient {
         continue
       }
       const index = this.queue.findIndex((call) => call.lane === lane)
-      if (index < 0) {
+      if (index === -1) {
         continue
       }
       const call = this.queue.splice(index, 1)[0]!
@@ -257,7 +257,7 @@ export class AiVaultScannerServiceClient {
     call.cancelled = true
     call.reject(createAiVaultScanCancelledError())
     const queuedIndex = this.queue.indexOf(call)
-    if (queuedIndex >= 0) {
+    if (queuedIndex !== -1) {
       this.queue.splice(queuedIndex, 1)
       clearAiVaultServiceCall(call)
       this.pump()
diff --git a/src/main/ai-vault/session-scanner-subagent-transcripts.ts b/src/main/ai-vault/session-scanner-subagent-transcripts.ts
index d7df4aeedac..8d477f450af 100644
--- a/src/main/ai-vault/session-scanner-subagent-transcripts.ts
+++ b/src/main/ai-vault/session-scanner-subagent-transcripts.ts
@@ -1,4 +1,4 @@
-import { readdir } from 'node:fs/promises'
+import { wslGatedReaddir } from '../native-chat/wsl-transcript-fs-access'
 import { basename, dirname, extname, join } from 'node:path'
 
 // Exported so discovery can prune these subtrees using the same literal that
@@ -38,7 +38,7 @@ export function subagentTranscriptsDirFor(transcriptFilePath: string): string {
 export async function countSubagentTranscripts(transcriptFilePath: string): Promise<number> {
   let entries
   try {
-    entries = await readdir(subagentTranscriptsDirFor(transcriptFilePath), { withFileTypes: true })
+    entries = await wslGatedReaddir(subagentTranscriptsDirFor(transcriptFilePath), 'scan')
   } catch {
     return 0
   }
diff --git a/src/main/ai-vault/session-scanner-values.ts b/src/main/ai-vault/session-scanner-values.ts
index b058876fda3..f7d62611adb 100644
--- a/src/main/ai-vault/session-scanner-values.ts
+++ b/src/main/ai-vault/session-scanner-values.ts
@@ -1,6 +1,7 @@
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, join } from 'node:path'
-import { readFile } from 'node:fs/promises'
+import { wslGatedReadFile } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { asRecord } from './session-scanner-record-value'
 
 export { asRecord }
@@ -76,8 +77,15 @@ export async function readJsonObjectIfExists(
   filePath: string
 ): Promise<Record<string, unknown> | null> {
   try {
-    return asRecord(JSON.parse(await readFile(filePath, 'utf-8')) as unknown)
-  } catch {
+    return asRecord(JSON.parse(await wslGatedReadFile(filePath, 'utf-8', 'scan')) as unknown)
+  } catch (error) {
+    // A missing or malformed file is genuinely "no enrichment", but a gate
+    // refusal must reach `parseSessionCandidate` as an issue — degrading it to
+    // null caches the un-enriched session under an unchanged mtime, and the
+    // non-resumable agents that use this never re-read it.
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
     return null
   }
 }
diff --git a/src/main/ai-vault/session-scanner-worker-client.ts b/src/main/ai-vault/session-scanner-worker-client.ts
index 6b780c5086d..70e75c4f982 100644
--- a/src/main/ai-vault/session-scanner-worker-client.ts
+++ b/src/main/ai-vault/session-scanner-worker-client.ts
@@ -176,7 +176,7 @@ export class AiVaultScannerWorkerClient {
       return
     }
     const index = this.queue.indexOf(call)
-    if (index >= 0) {
+    if (index !== -1) {
       this.queue.splice(index, 1)
       this.clearCall(call)
     }
diff --git a/src/main/ai-vault/session-scanner.ts b/src/main/ai-vault/session-scanner.ts
index 3a98b7018ac..b4ef6f06ce7 100644
--- a/src/main/ai-vault/session-scanner.ts
+++ b/src/main/ai-vault/session-scanner.ts
@@ -1,4 +1,3 @@
-import { readFile } from 'node:fs/promises'
 import type {
   AiVaultListResult,
   AiVaultScanIssue,
@@ -14,6 +13,7 @@ import {
 } from './codex-session-root-dedup'
 import {
   createAntigravityWorkspaceResolver,
+  readLocalAntigravityHistory,
   type AntigravityWorkspaceResolver
 } from './session-scanner-antigravity-history'
 import { antigravityHistoryPathForBrainDir } from './session-scanner-antigravity-paths'
@@ -27,6 +27,7 @@ import {
   parseAgentSessionFileCached,
   type SessionParseStats
 } from './session-scanner-parse-cache'
+import { recordSessionScanIssue } from './session-scan-issues'
 import { discoverInScopeClaudeFiles } from './session-scanner-scope-discovery'
 import {
   DEFAULT_CODEX_HOME_DIR,
@@ -71,7 +72,9 @@ export async function scanAiVaultSessions(
     const executionHostId = options.executionHostId ?? LOCAL_EXECUTION_HOST_ID
     const issues: AiVaultScanIssue[] = []
     const parseStats = createSessionParseStats()
-    const antigravityWorkspaceResolver = createAntigravityWorkspaceResolver(readOptionalTextFile)
+    const antigravityWorkspaceResolver = createAntigravityWorkspaceResolver(
+      readLocalAntigravityHistory
+    )
     // Why: persisted entries must be seeded before any candidate is parsed, or
     // the cold scan gains nothing from the cache file (#9210).
     throwIfAiVaultScanCancelled(options.signal)
@@ -255,7 +258,7 @@ async function parseSessionCandidates(args: {
 
     for (const result of results) {
       if (result.issue) {
-        args.issues.push(result.issue)
+        recordSessionScanIssue(args.issues, result.issue)
       }
       if (result.session) {
         sessions.push(result.session)
@@ -305,14 +308,6 @@ async function parseSessionCandidate(
   }
 }
 
-async function readOptionalTextFile(path: string): Promise<string | null> {
-  try {
-    return await readFile(path, 'utf-8')
-  } catch {
-    return null
-  }
-}
-
 function withSessionExecutionHost(
   session: AiVaultSession,
   executionHostId: ExecutionHostId
diff --git a/src/main/ai-vault/session-title-file-reader-wsl-stall.test.ts b/src/main/ai-vault/session-title-file-reader-wsl-stall.test.ts
new file mode 100644
index 00000000000..337c2064d8a
--- /dev/null
+++ b/src/main/ai-vault/session-title-file-reader-wsl-stall.test.ts
@@ -0,0 +1,83 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+
+const UNC_PATH = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.claude\\projects\\p\\stalled.jsonl'
+const STALLED_SESSION_ID = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee'
+const LOCAL_SESSION_ID = 'bbbbbbbb-cccc-4ddd-8eee-ffffffffffff'
+
+const mocks = vi.hoisted(() => ({ lstat: vi.fn() }))
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const original = await importOriginal<typeof NodeFsPromisesModule>()
+  return {
+    ...original,
+    // Only the WSL request is faked; the local sibling reads a real temp file.
+    lstat: (path: string, ...rest: unknown[]) =>
+      path.startsWith('\\\\')
+        ? mocks.lstat(path)
+        : (original.lstat as (...args: unknown[]) => unknown)(path, ...rest)
+  }
+})
+
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { readAiVaultSessionTitlesFromFiles } from './session-title-file-reader'
+import { resetSessionParseCacheForTests } from './session-scanner-parse-cache'
+import { WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS } from '../native-chat/wsl-transcript-fs-gate'
+
+let releaseStall: (() => void) | undefined
+let tempRoot: string | undefined
+
+function stalls(): Promise<never> {
+  return new Promise<never>((resolve) => {
+    releaseStall = () => resolve(undefined as never)
+  })
+}
+
+function userRecord(sessionId: string, text: string): string {
+  return JSON.stringify({
+    type: 'user',
+    sessionId,
+    timestamp: new Date(1740000000000).toISOString(),
+    cwd: '/repo/app',
+    gitBranch: 'main',
+    message: { role: 'user', content: text }
+  })
+}
+
+beforeEach(async () => {
+  resetSessionParseCacheForTests()
+  mocks.lstat.mockReset()
+  releaseStall = undefined
+  tempRoot = await mkdtemp(join(tmpdir(), 'orca-title-stall-'))
+})
+
+afterEach(async () => {
+  releaseStall?.()
+  releaseStall = undefined
+  await vi.advanceTimersByTimeAsync(0)
+  vi.useRealTimers()
+  if (tempRoot) {
+    await rm(tempRoot, { recursive: true, force: true })
+    tempRoot = undefined
+  }
+})
+
+describe('AI Vault session titles with a stalled WSL transcript lstat', () => {
+  it('drops only the stalled request and still returns the rest of the batch', async () => {
+    const localPath = join(tempRoot!, `${LOCAL_SESSION_ID}.jsonl`)
+    await writeFile(localPath, `${userRecord(LOCAL_SESSION_ID, 'hello world')}\n`)
+    mocks.lstat.mockImplementation(stalls)
+    vi.useFakeTimers()
+
+    const pending = readAiVaultSessionTitlesFromFiles([
+      { agent: 'claude', sessionId: STALLED_SESSION_ID, transcriptPath: UNC_PATH },
+      { agent: 'claude', sessionId: LOCAL_SESSION_ID, transcriptPath: localPath }
+    ])
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS + 1)
+
+    const { titles } = await pending
+    expect(titles).toEqual([{ agent: 'claude', sessionId: LOCAL_SESSION_ID, title: 'hello world' }])
+  })
+})
diff --git a/src/main/ai-vault/session-title-file-reader.ts b/src/main/ai-vault/session-title-file-reader.ts
index 799d2b95da9..15228d132bb 100644
--- a/src/main/ai-vault/session-title-file-reader.ts
+++ b/src/main/ai-vault/session-title-file-reader.ts
@@ -1,4 +1,4 @@
-import { lstat } from 'node:fs/promises'
+import { wslGatedLstat } from '../native-chat/wsl-transcript-fs-access'
 import {
   AI_VAULT_SESSION_TITLE_REQUEST_MAX_COUNT,
   type AiVaultSessionTitle,
@@ -27,7 +27,7 @@ async function readOneTitle(
     return cache?.get(request) ?? null
   }
   try {
-    const stats = await lstat(transcriptPath)
+    const stats = await wslGatedLstat(transcriptPath, 'scan', signal)
     if (!stats.isFile() || signal?.aborted) {
       return null
     }
diff --git a/src/main/ai-vault/session-title-request-paths.ts b/src/main/ai-vault/session-title-request-paths.ts
index 86e78ebc397..5e25e512d92 100644
--- a/src/main/ai-vault/session-title-request-paths.ts
+++ b/src/main/ai-vault/session-title-request-paths.ts
@@ -1,5 +1,6 @@
 import type { AiVaultSessionTitleRequest } from '../../shared/ai-vault-session-title'
 import { toHostReadableTranscriptPath } from '../native-chat/host-readable-transcript-path'
+import { wslTranscriptFsRefusal } from '../native-chat/wsl-transcript-fs-gate'
 
 export function resolveHostReadableAiVaultTitleRequests(
   requests: AiVaultSessionTitleRequest[],
@@ -10,7 +11,15 @@ export function resolveHostReadableAiVaultTitleRequests(
       if (!request.transcriptPath || signal?.aborted) {
         return request
       }
-      const transcriptPath = await toHostReadableTranscriptPath(request.transcriptPath)
+      let transcriptPath: string | null
+      try {
+        transcriptPath = await toHostReadableTranscriptPath(request.transcriptPath)
+      } catch (error) {
+        // Why: one stalled distro's path must not fail the whole titles batch;
+        // degrade to the id-only shape like any unreadable path.
+        void wslTranscriptFsRefusal(error) // rethrows anything that is not a gate refusal
+        transcriptPath = null
+      }
       return transcriptPath && !signal?.aborted
         ? { ...request, transcriptPath }
         : { agent: request.agent, sessionId: request.sessionId }
diff --git a/src/main/attribution/terminal-attribution-path-env-casing.test.ts b/src/main/attribution/terminal-attribution-path-env-casing.test.ts
deleted file mode 100644
index 95ff6fdc2e3..00000000000
--- a/src/main/attribution/terminal-attribution-path-env-casing.test.ts
+++ /dev/null
@@ -1,169 +0,0 @@
-import { mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
-import { applyTerminalAttributionEnv } from './terminal-attribution'
-
-describe('applyTerminalAttributionEnv PATH key casing', () => {
-  let tmpRoot: string | null = null
-
-  afterEach(() => {
-    if (tmpRoot) {
-      rmSync(tmpRoot, { force: true, recursive: true })
-      tmpRoot = null
-    }
-  })
-
-  function makeTmpRoot(): string {
-    tmpRoot = mkdtempSync(join(tmpdir(), 'orca-attribution-path-casing-'))
-    return tmpRoot
-  }
-
-  // Why: a Windows child that inherits both spellings crashes the packaged orca.exe launcher
-  // with "Item has already been added. Key in dictionary: 'PATH'" (stablyai/orca#12046).
-  function pathEnvKeys(env: Record<string, string>): string[] {
-    return Object.keys(env).filter((key) => /^path$/i.test(key))
-  }
-
-  it('writes back the inherited Windows `Path` spelling instead of adding `PATH`', () => {
-    const root = makeTmpRoot()
-    const userDataPath = join(root, 'user-data')
-    const baseEnv: Record<string, string> = {
-      Path: 'C:\\Windows\\system32;C:\\Program Files\\Git\\cmd',
-      SystemRoot: 'C:\\Windows'
-    }
-
-    applyTerminalAttributionEnv(baseEnv, {
-      enabled: true,
-      platform: 'win32',
-      shellFamily: 'native-windows',
-      userDataPath
-    })
-
-    const win32Dir = join(userDataPath, 'orca-terminal-attribution', 'win32')
-    const pathEntries = baseEnv.Path.split(';')
-
-    expect(pathEnvKeys(baseEnv)).toEqual(['Path'])
-    expect(pathEntries[0]).toBe(win32Dir)
-    expect(pathEntries).toContain('C:\\Program Files\\Git\\cmd')
-  })
-
-  // Why: Win32 resolves a duplicated variable by taking the first match in the block, so the
-  // shim must land on the first-listed spelling and the shadowed one must keep its value —
-  // dropping it would promote it the moment anything downstream removes the live key.
-  it.each([
-    { first: 'PATH', second: 'Path' },
-    { first: 'Path', second: 'PATH' }
-  ])(
-    'prepends the shim onto the first-listed `$first` and leaves `$second` untouched',
-    ({ first, second }) => {
-      const root = makeTmpRoot()
-      const userDataPath = join(root, 'user-data')
-      const baseEnv: Record<string, string> = {
-        [first]: 'C:\\tools\\bin;C:\\Windows\\system32',
-        [second]: 'C:\\Windows\\system32'
-      }
-
-      applyTerminalAttributionEnv(baseEnv, {
-        enabled: true,
-        platform: 'win32',
-        shellFamily: 'native-windows',
-        userDataPath
-      })
-
-      const win32Dir = join(userDataPath, 'orca-terminal-attribution', 'win32')
-      expect(baseEnv[first].split(';')).toEqual([
-        win32Dir,
-        'C:\\tools\\bin',
-        'C:\\Windows\\system32'
-      ])
-      expect(baseEnv[second]).toBe('C:\\Windows\\system32')
-    }
-  )
-
-  it('keeps a shadowed duplicate when the live spelling strips down to nothing', () => {
-    const root = makeTmpRoot()
-    const userDataPath = join(root, 'user-data')
-    const shimDir = join(userDataPath, 'orca-terminal-attribution', 'win32')
-    const baseEnv: Record<string, string> = { Path: shimDir, PATH: 'C:\\Windows\\system32' }
-
-    applyTerminalAttributionEnv(baseEnv, {
-      enabled: false,
-      platform: 'win32',
-      shellFamily: 'native-windows',
-      userDataPath
-    })
-
-    expect(pathEnvKeys(baseEnv)).toEqual(['PATH'])
-    expect(baseEnv.PATH).toBe('C:\\Windows\\system32')
-  })
-
-  it('strips shim entries from the inherited `Path` when attribution is disabled', () => {
-    const root = makeTmpRoot()
-    const userDataPath = join(root, 'user-data')
-    const shimDir = join(userDataPath, 'orca-terminal-attribution', 'win32')
-    const baseEnv: Record<string, string> = { Path: `${shimDir};C:\\Windows\\system32` }
-
-    applyTerminalAttributionEnv(baseEnv, {
-      enabled: false,
-      platform: 'win32',
-      shellFamily: 'native-windows',
-      userDataPath
-    })
-
-    expect(pathEnvKeys(baseEnv)).toEqual(['Path'])
-    expect(baseEnv.Path).toBe('C:\\Windows\\system32')
-  })
-
-  // Why: the daemon receives a sparse env patch with no path key and re-merges its own block
-  // underneath it, so guessing the spelling here hands the child both.
-  it.each([
-    { hostKey: 'PATH', otherKey: 'Path' },
-    { hostKey: 'Path', otherKey: 'PATH' }
-  ])('adopts a host block spelt `$hostKey` on a path-less env', ({ hostKey, otherKey }) => {
-    const root = makeTmpRoot()
-    const userDataPath = join(root, 'user-data')
-    const inherited = { PATH: process.env.PATH, Path: process.env.Path }
-    delete process.env.PATH
-    delete process.env.Path
-    process.env[hostKey] = 'C:\\Windows\\system32'
-
-    try {
-      const baseEnv: Record<string, string> = { SystemRoot: 'C:\\Windows' }
-
-      applyTerminalAttributionEnv(baseEnv, {
-        enabled: true,
-        platform: 'win32',
-        shellFamily: 'native-windows',
-        userDataPath
-      })
-
-      expect(pathEnvKeys(baseEnv)).toEqual([hostKey])
-      expect(baseEnv[otherKey]).toBeUndefined()
-    } finally {
-      delete process.env[hostKey]
-      for (const [key, value] of Object.entries(inherited)) {
-        if (value !== undefined) {
-          process.env[key] = value
-        }
-      }
-    }
-  })
-
-  it('leaves a case-sensitive POSIX `Path` variable alone', () => {
-    const root = makeTmpRoot()
-    const baseEnv: Record<string, string> = {
-      PATH: '/usr/bin:/bin',
-      Path: '/decoy'
-    }
-
-    applyTerminalAttributionEnv(baseEnv, {
-      enabled: true,
-      platform: 'linux',
-      userDataPath: join(root, 'user-data')
-    })
-
-    expect(baseEnv.Path).toBe('/decoy')
-    expect(baseEnv.PATH.split(':')).toContain('/usr/bin')
-  })
-})
diff --git a/src/main/attribution/terminal-attribution-win32-dash-argument.test.ts b/src/main/attribution/terminal-attribution-win32-dash-argument.test.ts
deleted file mode 100644
index 810322a53c9..00000000000
--- a/src/main/attribution/terminal-attribution-win32-dash-argument.test.ts
+++ /dev/null
@@ -1,100 +0,0 @@
-import { spawnSync } from 'node:child_process'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
-import { applyTerminalAttributionEnv } from './terminal-attribution'
-
-// Why (#12046 follow-up): `powershell.exe -File <script> ... -` fails argument
-// binding with PSArgumentException before the script runs, so any command
-// carrying a bare `-` must never be dispatched to the PowerShell wrapper.
-describe('win32 attribution wrappers with a bare `-` argument', () => {
-  let tmpRoot: string | null = null
-
-  afterEach(() => {
-    if (tmpRoot) {
-      rmSync(tmpRoot, { force: true, recursive: true })
-      tmpRoot = null
-    }
-  })
-
-  function shimDir(): string {
-    tmpRoot = mkdtempSync(join(tmpdir(), 'orca-attribution-dash-'))
-    const userDataPath = join(tmpRoot, 'user-data')
-    const baseEnv: Record<string, string> = {
-      Path: 'C:\\Windows\\system32',
-      SystemRoot: 'C:\\Windows'
-    }
-    applyTerminalAttributionEnv(baseEnv, {
-      enabled: true,
-      platform: 'win32',
-      shellFamily: 'native-windows',
-      userDataPath
-    })
-    return join(userDataPath, 'orca-terminal-attribution', 'win32')
-  }
-
-  it('guards the git PowerShell dispatch behind a bare-dash check', () => {
-    const wrapper = readFileSync(join(shimDir(), 'git.cmd'), 'utf8')
-    const guardAt = wrapper.indexOf('call :orca_has_bare_dash %*')
-    const dispatchAt = wrapper.indexOf('powershell.exe')
-
-    expect(guardAt).toBeGreaterThan(-1)
-    expect(guardAt).toBeLessThan(dispatchAt)
-    expect(wrapper).toContain('if not errorlevel 1 goto run')
-    expect(wrapper).toContain(':orca_has_bare_dash')
-    expect(wrapper).toContain('if "%~1"=="-" exit /b 0')
-  })
-
-  it('guards the gh PowerShell dispatch behind a bare-dash check', () => {
-    const wrapper = readFileSync(join(shimDir(), 'gh.cmd'), 'utf8')
-    const guardAt = wrapper.indexOf('call :orca_has_bare_dash %*')
-    const dispatchAt = wrapper.indexOf('powershell.exe')
-
-    expect(guardAt).toBeGreaterThan(-1)
-    expect(guardAt).toBeLessThan(dispatchAt)
-    expect(wrapper).toContain(':orca_has_bare_dash')
-  })
-
-  const itWindows = process.platform === 'win32' ? it : it.skip
-
-  // Why: the guard exists for a runtime failure, so the real regression is a
-  // real `git commit -F -` through the generated wrapper on a real Windows host.
-  itWindows('commits a message piped through `git commit -F -`', () => {
-    const dir = shimDir()
-    const gitCmd = join(dir, 'git.cmd')
-    const repo = mkdtempSync(join(tmpdir(), 'orca-attribution-dash-repo-'))
-    try {
-      const git = (...args: string[]): void => {
-        spawnSync('git', args, { cwd: repo, encoding: 'utf8' })
-      }
-      git('init', '-q', '-b', 'main')
-      git('config', 'user.email', 'test@example.com')
-      git('config', 'user.name', 'Test')
-      writeFileSync(join(repo, 'a.txt'), 'hello\n')
-      git('add', '.')
-
-      const env = {
-        ...process.env,
-        ORCA_ENABLE_GIT_ATTRIBUTION: '1',
-        ORCA_REAL_GIT: spawnSync('where', ['git.exe'], { encoding: 'utf8' }).stdout.split(
-          /\r?\n/
-        )[0]
-      }
-      const result = spawnSync('cmd.exe', ['/d', '/c', gitCmd, 'commit', '-F', '-'], {
-        cwd: repo,
-        env,
-        input: 'piped subject\n',
-        encoding: 'utf8'
-      })
-
-      expect(result.stderr).not.toContain('PSArgumentException')
-      expect(result.status).toBe(0)
-      expect(
-        spawnSync('git', ['log', '-1', '--format=%B'], { cwd: repo, encoding: 'utf8' }).stdout
-      ).toContain('piped subject')
-    } finally {
-      rmSync(repo, { force: true, recursive: true })
-    }
-  })
-})
diff --git a/src/main/attribution/terminal-attribution.test.ts b/src/main/attribution/terminal-attribution.test.ts
deleted file mode 100644
index 86096168f0c..00000000000
--- a/src/main/attribution/terminal-attribution.test.ts
+++ /dev/null
@@ -1,824 +0,0 @@
-import { execFileSync } from 'node:child_process'
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  writeFileSync
-} from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
-import { applyTerminalAttributionEnv, resolveAttributionShellFamily } from './terminal-attribution'
-
-describe('applyTerminalAttributionEnv', () => {
-  let tmpRoot: string | null = null
-  // Why: these subprocess fixtures create extensionless Bash fake commands;
-  // native Windows command resolution is covered by wrapper/PATH assertions below.
-  const posixSubprocessIt = process.platform === 'win32' ? it.skip : it
-
-  afterEach(() => {
-    if (tmpRoot) {
-      rmSync(tmpRoot, { force: true, recursive: true })
-      tmpRoot = null
-    }
-  })
-
-  function makeTmpRoot(): string {
-    tmpRoot = mkdtempSync(join(tmpdir(), 'orca-attribution-'))
-    return tmpRoot
-  }
-
-  function stripInheritedAttributionPath(pathValue: string): string {
-    const pathDelimiter = process.platform === 'win32' ? ';' : ':'
-    return pathValue
-      .split(pathDelimiter)
-      .filter((entry) => !entry.includes('orca-terminal-attribution'))
-      .join(pathDelimiter)
-  }
-
-  function cleanAttributionEnv(env?: Record<string, string>): Record<string, string> {
-    const base = { ...process.env }
-    delete base.ORCA_ENABLE_GIT_ATTRIBUTION
-    delete base.ORCA_GIT_COMMIT_TRAILER
-    delete base.ORCA_GH_PR_FOOTER
-    delete base.ORCA_GH_ISSUE_FOOTER
-    delete base.ORCA_ATTRIBUTION_SHIM_DIR
-    delete base.ORCA_REAL_GIT
-    delete base.ORCA_REAL_GH
-    base.PATH = stripInheritedAttributionPath(base.PATH ?? '')
-    const next = { ...base, ...env }
-    return next as Record<string, string>
-  }
-
-  function runGit(repo: string, args: string[], env?: Record<string, string>): string {
-    return execFileSync('git', args, {
-      cwd: repo,
-      encoding: 'utf8',
-      env: cleanAttributionEnv(env)
-    })
-  }
-
-  it('classifies Windows native and POSIX shell families for attribution shims', () => {
-    expect(resolveAttributionShellFamily({ platform: 'win32', shellPath: 'powershell.exe' })).toBe(
-      'native-windows'
-    )
-    expect(resolveAttributionShellFamily({ platform: 'win32', shellPath: 'cmd.exe' })).toBe(
-      'native-windows'
-    )
-    expect(
-      resolveAttributionShellFamily({
-        platform: 'win32',
-        shellPath: 'C:\\Program Files\\Git\\bin\\bash.exe'
-      })
-    ).toBe('posix')
-    expect(resolveAttributionShellFamily({ platform: 'win32', shellPath: 'wsl.exe' })).toBe('posix')
-    expect(resolveAttributionShellFamily({ platform: 'win32', isWsl: true })).toBe('posix')
-    expect(resolveAttributionShellFamily({ platform: 'darwin', shellPath: '/bin/zsh' })).toBe(
-      undefined
-    )
-  })
-
-  posixSubprocessIt('does not amend HEAD when git commit --dry-run exits successfully', () => {
-    const root = makeTmpRoot()
-    const repo = join(root, 'repo')
-    mkdirSync(repo)
-    runGit(repo, ['init'])
-    runGit(repo, ['config', 'user.name', 'Orca Test'])
-    runGit(repo, ['config', 'user.email', 'orca-test@example.com'])
-    writeFileSync(join(repo, 'README.md'), 'initial\n')
-    runGit(repo, ['add', 'README.md'])
-    runGit(repo, ['commit', '-m', 'initial'])
-
-    const attributionEnv = { PATH: stripInheritedAttributionPath(process.env.PATH ?? '') }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-    const beforeHead = runGit(repo, ['rev-parse', 'HEAD']).trim()
-    writeFileSync(join(repo, 'second.txt'), 'second\n')
-    runGit(repo, ['add', 'second.txt'])
-
-    // Why: dry-run reports what would be committed but must not rewrite the
-    // existing HEAD just because the real git command returns success.
-    runGit(repo, ['commit', '--dry-run', '-m', 'second'], attributionEnv)
-
-    expect(runGit(repo, ['rev-parse', 'HEAD']).trim()).toBe(beforeHead)
-    expect(runGit(repo, ['log', '-1', '--format=%B'])).not.toContain('Co-authored-by: Orca')
-
-    runGit(repo, ['commit', '-m', 'second'], attributionEnv)
-    expect(runGit(repo, ['rev-parse', 'HEAD']).trim()).not.toBe(beforeHead)
-    expect(runGit(repo, ['log', '-1', '--format=%B'])).toContain(
-      'Co-authored-by: Orca <help@stably.ai>'
-    )
-  })
-
-  posixSubprocessIt('still adds the trailer when git commit uses --no-verify shorthand', () => {
-    const root = makeTmpRoot()
-    const repo = join(root, 'repo')
-    mkdirSync(repo)
-    runGit(repo, ['init'])
-    runGit(repo, ['config', 'user.name', 'Orca Test'])
-    runGit(repo, ['config', 'user.email', 'orca-test@example.com'])
-    writeFileSync(join(repo, 'README.md'), 'initial\n')
-    runGit(repo, ['add', 'README.md'])
-
-    const attributionEnv = { PATH: stripInheritedAttributionPath(process.env.PATH ?? '') }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    runGit(repo, ['commit', '-n', '-m', 'initial'], attributionEnv)
-
-    expect(runGit(repo, ['log', '-1', '--format=%B'])).toContain(
-      'Co-authored-by: Orca <help@stably.ai>'
-    )
-  })
-
-  posixSubprocessIt('adds the trailer when git commit uses combined -am shorthand', () => {
-    const root = makeTmpRoot()
-    const repo = join(root, 'repo')
-    mkdirSync(repo)
-    runGit(repo, ['init'])
-    runGit(repo, ['config', 'user.name', 'Orca Test'])
-    runGit(repo, ['config', 'user.email', 'orca-test@example.com'])
-    writeFileSync(join(repo, 'README.md'), 'initial\n')
-    runGit(repo, ['add', 'README.md'])
-    runGit(repo, ['commit', '-m', 'initial'])
-    writeFileSync(join(repo, 'README.md'), 'changed\n')
-
-    const attributionEnv = { PATH: stripInheritedAttributionPath(process.env.PATH ?? '') }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    runGit(repo, ['commit', '-am', 'combined message'], attributionEnv)
-
-    expect(runGit(repo, ['log', '-1', '--format=%B'])).toContain(
-      'Co-authored-by: Orca <help@stably.ai>'
-    )
-  })
-
-  posixSubprocessIt('adds the trailer when git commit follows global git config args', () => {
-    const root = makeTmpRoot()
-    const repo = join(root, 'repo')
-    mkdirSync(repo)
-    runGit(repo, ['init'])
-    runGit(repo, ['config', 'user.name', 'Orca Test'])
-    runGit(repo, ['config', 'user.email', 'orca-test@example.com'])
-    writeFileSync(join(repo, 'README.md'), 'initial\n')
-    runGit(repo, ['add', 'README.md'])
-
-    const attributionEnv = { PATH: stripInheritedAttributionPath(process.env.PATH ?? '') }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    runGit(repo, ['-c', 'core.quotePath=false', 'commit', '-m', 'initial'], attributionEnv)
-
-    expect(runGit(repo, ['log', '-1', '--format=%B'])).toContain(
-      'Co-authored-by: Orca <help@stably.ai>'
-    )
-  })
-
-  posixSubprocessIt('adds the trailer to commit message files before git runs', () => {
-    const root = makeTmpRoot()
-    const repo = join(root, 'repo')
-    const messagePath = join(root, 'message.txt')
-    mkdirSync(repo)
-    runGit(repo, ['init'])
-    runGit(repo, ['config', 'user.name', 'Orca Test'])
-    runGit(repo, ['config', 'user.email', 'orca-test@example.com'])
-    writeFileSync(join(repo, 'README.md'), 'initial\n')
-    writeFileSync(messagePath, 'initial from file\n')
-    runGit(repo, ['add', 'README.md'])
-
-    const attributionEnv = { PATH: stripInheritedAttributionPath(process.env.PATH ?? '') }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    runGit(repo, ['commit', '-F', messagePath], attributionEnv)
-
-    expect(runGit(repo, ['log', '-1', '--format=%B'])).toContain(
-      'Co-authored-by: Orca <help@stably.ai>'
-    )
-    expect(readFileSync(messagePath, 'utf8')).toBe('initial from file\n')
-  })
-
-  posixSubprocessIt(
-    'passes missing commit message files through without adding fallback message args',
-    () => {
-      const root = makeTmpRoot()
-      const binDir = join(root, 'bin')
-      const argsPath = join(root, 'commit-args')
-      mkdirSync(binDir)
-      writeFileSync(
-        join(binDir, 'git'),
-        `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1" == "commit" ]]; then
-  printf '%s\\n' "$@" >"${argsPath}"
-  exit 9
-fi
-exit 1
-`,
-        'utf8'
-      )
-      chmodSync(join(binDir, 'git'), 0o755)
-
-      const attributionEnv = {
-        PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-      }
-      applyTerminalAttributionEnv(attributionEnv, {
-        enabled: true,
-        userDataPath: join(root, 'user-data')
-      })
-
-      expect(() =>
-        execFileSync('git', ['commit', '-F', join(root, 'missing-message.txt')], {
-          encoding: 'utf8',
-          env: cleanAttributionEnv(attributionEnv)
-        })
-      ).toThrow()
-
-      expect(readFileSync(argsPath, 'utf8')).not.toContain('Co-authored-by: Orca')
-    }
-  )
-
-  posixSubprocessIt(
-    'passes reuse and fixup commit message modes through without attribution',
-    () => {
-      const root = makeTmpRoot()
-      const binDir = join(root, 'bin')
-      const argsPath = join(root, 'commit-args')
-      const messagePath = join(root, 'message.txt')
-      mkdirSync(binDir)
-      writeFileSync(messagePath, 'from file\n')
-      writeFileSync(
-        join(binDir, 'git'),
-        `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1" == "commit" ]]; then
-  printf '%s\\n' "$@" >>"${argsPath}"
-  exit 0
-fi
-exit 1
-`,
-        'utf8'
-      )
-      chmodSync(join(binDir, 'git'), 0o755)
-
-      const attributionEnv = {
-        PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-      }
-      applyTerminalAttributionEnv(attributionEnv, {
-        enabled: true,
-        userDataPath: join(root, 'user-data')
-      })
-
-      execFileSync('git', ['commit', '-C', 'HEAD'], {
-        encoding: 'utf8',
-        env: cleanAttributionEnv(attributionEnv)
-      })
-      execFileSync('git', ['commit', '--fixup', 'HEAD'], {
-        encoding: 'utf8',
-        env: cleanAttributionEnv(attributionEnv)
-      })
-      execFileSync('git', ['commit', '-F', messagePath, '--fixup', 'HEAD'], {
-        encoding: 'utf8',
-        env: cleanAttributionEnv(attributionEnv)
-      })
-
-      expect(readFileSync(argsPath, 'utf8')).not.toContain('Co-authored-by: Orca')
-    }
-  )
-
-  posixSubprocessIt('adds the trailer before commit-msg hooks validate the commit', () => {
-    const root = makeTmpRoot()
-    const repo = join(root, 'repo')
-    mkdirSync(repo)
-    runGit(repo, ['init'])
-    runGit(repo, ['config', 'user.name', 'Orca Test'])
-    runGit(repo, ['config', 'user.email', 'orca-test@example.com'])
-    const hookPath = join(repo, '.git', 'hooks', 'commit-msg')
-    const hookCounterPath = join(repo, 'hook-count')
-    writeFileSync(
-      hookPath,
-      `#!/usr/bin/env bash
-set -euo pipefail
-count=0
-if [[ -f "${hookCounterPath}" ]]; then
-  count="$(cat "${hookCounterPath}")"
-fi
-printf '%s\\n' "$((count + 1))" >"${hookCounterPath}"
-grep -Fq 'Co-authored-by: Orca <help@stably.ai>' "$1"
-`,
-      'utf8'
-    )
-    chmodSync(hookPath, 0o755)
-    writeFileSync(join(repo, 'README.md'), 'initial\n')
-    runGit(repo, ['add', 'README.md'])
-
-    const attributionEnv = { PATH: stripInheritedAttributionPath(process.env.PATH ?? '') }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    runGit(repo, ['commit', '-m', 'initial'], attributionEnv)
-
-    expect(readFileSync(hookCounterPath, 'utf8').trim()).toBe('1')
-    expect(runGit(repo, ['log', '-1', '--format=%B'])).toContain(
-      'Co-authored-by: Orca <help@stably.ai>'
-    )
-  })
-
-  posixSubprocessIt('adds git attribution to the original commit command without amending', () => {
-    const root = makeTmpRoot()
-    const binDir = join(root, 'bin')
-    const commitPath = join(root, 'commit-called')
-    const amendPath = join(root, 'amend-called')
-    const argsPath = join(root, 'commit-args')
-    mkdirSync(binDir)
-    writeFileSync(
-      join(binDir, 'git'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1 $2 $3" == "config --bool commit.gpgsign" ]]; then
-  printf '%s\\n' 'true'
-  exit 0
-fi
-if [[ "$1" == "commit" ]]; then
-  if [[ "\${2:-}" == "--amend" ]]; then
-    touch "${amendPath}"
-  else
-    printf '%s\\n' "$@" >"${argsPath}"
-    touch "${commitPath}"
-  fi
-  exit 0
-fi
-exit 1
-`,
-      'utf8'
-    )
-    chmodSync(join(binDir, 'git'), 0o755)
-
-    const attributionEnv = {
-      PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-    }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    execFileSync('git', ['commit', '-m', 'signed commit'], {
-      encoding: 'utf8',
-      env: cleanAttributionEnv(attributionEnv)
-    })
-
-    expect(existsSync(commitPath)).toBe(true)
-    expect(existsSync(amendPath)).toBe(false)
-    expect(readFileSync(argsPath, 'utf8')).toContain('Co-authored-by: Orca <help@stably.ai>')
-  })
-
-  posixSubprocessIt('passes editor-based commits through without attribution', () => {
-    const root = makeTmpRoot()
-    const binDir = join(root, 'bin')
-    const argsPath = join(root, 'commit-args')
-    mkdirSync(binDir)
-    writeFileSync(
-      join(binDir, 'git'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1" == "commit" ]]; then
-  printf '%s\\n' "$@" >"${argsPath}"
-  exit 0
-fi
-exit 1
-`,
-      'utf8'
-    )
-    chmodSync(join(binDir, 'git'), 0o755)
-
-    const attributionEnv = {
-      PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-    }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    execFileSync('git', ['commit'], {
-      encoding: 'utf8',
-      env: cleanAttributionEnv(attributionEnv)
-    })
-
-    expect(readFileSync(argsPath, 'utf8')).toBe('commit\n')
-  })
-
-  posixSubprocessIt('preserves interactive gh pr create without guessing which PR to edit', () => {
-    const root = makeTmpRoot()
-    const binDir = join(root, 'bin')
-    const markerPath = join(root, 'gh-edit-called')
-    mkdirSync(binDir)
-    writeFileSync(
-      join(binDir, 'gh'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1 $2" == "pr create" ]]; then
-  printf '%s\\n' 'interactive create complete'
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "pr view --json url" ]]; then
-  printf '%s\\n' 'https://github.com/stablyai/orca/pull/123'
-  exit 0
-fi
-if [[ "$1 $2" == "api repos/stablyai/orca/pulls/123" && "\${3:-}" == "--jq" ]]; then
-  printf '%s\\n' 'Existing body'
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "api -X PATCH repos/stablyai/orca/pulls/123" ]]; then
-  touch "${markerPath}"
-  exit 0
-fi
-exit 1
-`,
-      'utf8'
-    )
-    chmodSync(join(binDir, 'gh'), 0o755)
-    const attributionEnv = {
-      PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-    }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    const output = execFileSync('gh', ['pr', 'create'], {
-      encoding: 'utf8',
-      env: cleanAttributionEnv(attributionEnv)
-    })
-
-    expect(output).toBe('interactive create complete\n')
-    expect(existsSync(markerPath)).toBe(false)
-  })
-
-  posixSubprocessIt('adds gh attribution for noninteractive create output URLs', () => {
-    const root = makeTmpRoot()
-    const binDir = join(root, 'bin')
-    const prMarkerPath = join(root, 'pr-edit-called')
-    const issueMarkerPath = join(root, 'issue-edit-called')
-    const patchArgsPath = join(root, 'patch-args')
-    mkdirSync(binDir)
-    writeFileSync(
-      join(binDir, 'gh'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1 $2" == "pr create" ]]; then
-  printf '%s\\n' 'https://github.com/stablyai/orca/pull/123'
-  exit 0
-fi
-if [[ "$1 $2" == "issue create" ]]; then
-  printf '%s\\n' 'https://github.com/stablyai/orca/issues/456'
-  exit 0
-fi
-if [[ "$1 $2" == "api repos/stablyai/orca/pulls/123" && "\${3:-}" == "--jq" ]]; then
-  printf '%s\\n' 'PR body'
-  exit 0
-fi
-if [[ "$1 $2" == "api repos/stablyai/orca/issues/456" && "\${3:-}" == "--jq" ]]; then
-  printf '%s\\n' 'Issue body'
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "api -X PATCH repos/stablyai/orca/pulls/123" ]]; then
-  printf '%s\\n' "$@" >"${patchArgsPath}"
-  touch "${prMarkerPath}"
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "api -X PATCH repos/stablyai/orca/issues/456" ]]; then
-  touch "${issueMarkerPath}"
-  exit 0
-fi
-exit 1
-`,
-      'utf8'
-    )
-    chmodSync(join(binDir, 'gh'), 0o755)
-    const attributionEnv = {
-      PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-    }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    expect(
-      execFileSync('gh', ['pr', 'create', '--fill'], {
-        encoding: 'utf8',
-        env: cleanAttributionEnv(attributionEnv)
-      })
-    ).toBe('https://github.com/stablyai/orca/pull/123\n')
-    expect(
-      execFileSync('gh', ['issue', 'create', '--title', 'Issue', '--body', 'Body'], {
-        encoding: 'utf8',
-        env: cleanAttributionEnv(attributionEnv)
-      })
-    ).toBe('https://github.com/stablyai/orca/issues/456\n')
-
-    expect(existsSync(prMarkerPath)).toBe(true)
-    expect(existsSync(issueMarkerPath)).toBe(true)
-    expect(readFileSync(patchArgsPath, 'utf8')).toContain('body=@')
-    expect(readFileSync(patchArgsPath, 'utf8')).not.toContain('PR body')
-  })
-
-  posixSubprocessIt('passes gh create help through without editing existing PRs or issues', () => {
-    const root = makeTmpRoot()
-    const binDir = join(root, 'bin')
-    const markerPath = join(root, 'gh-edit-called')
-    mkdirSync(binDir)
-    writeFileSync(
-      join(binDir, 'gh'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1 $2 $3" == "pr create --help" ]]; then
-  printf '%s\\n' 'pr help'
-  exit 0
-fi
-if [[ "$1 $2 $3" == "issue create --help" ]]; then
-  printf '%s\\n' 'issue help'
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "pr view --json url" ]]; then
-  printf '%s\\n' 'https://github.com/stablyai/orca/pull/123'
-  exit 0
-fi
-if [[ "$1 $2" == "issue list" ]]; then
-  printf '%s\\n' 'https://github.com/stablyai/orca/issues/456'
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "api -X PATCH repos/stablyai/orca/pulls/123" ]]; then
-  touch "${markerPath}"
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "api -X PATCH repos/stablyai/orca/issues/456" ]]; then
-  touch "${markerPath}"
-  exit 0
-fi
-exit 1
-`,
-      'utf8'
-    )
-    chmodSync(join(binDir, 'gh'), 0o755)
-    const attributionEnv = {
-      PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-    }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    const output = execFileSync('gh', ['pr', 'create', '--help'], {
-      encoding: 'utf8',
-      env: cleanAttributionEnv(attributionEnv)
-    })
-
-    expect(output).toBe('pr help\n')
-    const issueOutput = execFileSync('gh', ['issue', 'create', '--help'], {
-      encoding: 'utf8',
-      env: cleanAttributionEnv(attributionEnv)
-    })
-
-    expect(issueOutput).toBe('issue help\n')
-    expect(existsSync(markerPath)).toBe(false)
-  })
-
-  posixSubprocessIt(
-    'preserves interactive gh issue create without guessing which issue to edit',
-    () => {
-      const root = makeTmpRoot()
-      const binDir = join(root, 'bin')
-      const markerPath = join(root, 'gh-edit-called')
-      mkdirSync(binDir)
-      writeFileSync(
-        join(binDir, 'gh'),
-        `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1 $2" == "issue create" ]]; then
-  printf '%s\\n' 'interactive issue create complete'
-  exit 0
-fi
-if [[ "$1 $2" == "issue list" ]]; then
-  printf '%s\\n' 'https://github.com/stablyai/orca/issues/456'
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "api -X PATCH repos/stablyai/orca/issues/456" ]]; then
-  touch "${markerPath}"
-  exit 0
-fi
-exit 1
-`,
-        'utf8'
-      )
-      chmodSync(join(binDir, 'gh'), 0o755)
-      const attributionEnv = {
-        PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-      }
-      applyTerminalAttributionEnv(attributionEnv, {
-        enabled: true,
-        userDataPath: join(root, 'user-data')
-      })
-
-      const output = execFileSync('gh', ['issue', 'create'], {
-        encoding: 'utf8',
-        env: cleanAttributionEnv(attributionEnv)
-      })
-
-      expect(output).toBe('interactive issue create complete\n')
-      expect(existsSync(markerPath)).toBe(false)
-    }
-  )
-
-  posixSubprocessIt('skips gh attribution edits when viewing the created item fails', () => {
-    const root = makeTmpRoot()
-    const binDir = join(root, 'bin')
-    const markerPath = join(root, 'gh-edit-called')
-    mkdirSync(binDir)
-    writeFileSync(
-      join(binDir, 'gh'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1 $2" == "pr create" ]]; then
-  printf '%s\\n' 'https://github.com/stablyai/orca/pull/123'
-  exit 0
-fi
-if [[ "$1 $2" == "api repos/stablyai/orca/pulls/123" && "\${3:-}" == "--jq" ]]; then
-  exit 7
-fi
-if [[ "$1 $2 $3 $4" == "api -X PATCH repos/stablyai/orca/pulls/123" ]]; then
-  touch "${markerPath}"
-  exit 0
-fi
-exit 1
-`,
-      'utf8'
-    )
-    chmodSync(join(binDir, 'gh'), 0o755)
-    const attributionEnv = {
-      PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-    }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    const output = execFileSync('gh', ['pr', 'create', '--fill'], {
-      encoding: 'utf8',
-      env: cleanAttributionEnv(attributionEnv)
-    })
-
-    expect(output).toBe('https://github.com/stablyai/orca/pull/123\n')
-    expect(existsSync(markerPath)).toBe(false)
-  })
-
-  posixSubprocessIt('keeps gh create successful when the attribution edit fails', () => {
-    const root = makeTmpRoot()
-    const binDir = join(root, 'bin')
-    mkdirSync(binDir)
-    writeFileSync(
-      join(binDir, 'gh'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-if [[ "$1 $2" == "pr create" ]]; then
-  printf '%s\\n' 'https://github.com/stablyai/orca/pull/123'
-  exit 0
-fi
-if [[ "$1 $2" == "api repos/stablyai/orca/pulls/123" && "\${3:-}" == "--jq" ]]; then
-  printf '%s\\n' 'Existing body'
-  exit 0
-fi
-if [[ "$1 $2 $3 $4" == "api -X PATCH repos/stablyai/orca/pulls/123" ]]; then
-  exit 9
-fi
-exit 1
-`,
-      'utf8'
-    )
-    chmodSync(join(binDir, 'gh'), 0o755)
-    const attributionEnv = {
-      PATH: `${binDir}:${stripInheritedAttributionPath(process.env.PATH ?? '')}`
-    }
-    applyTerminalAttributionEnv(attributionEnv, {
-      enabled: true,
-      userDataPath: join(root, 'user-data')
-    })
-
-    const output = execFileSync('gh', ['pr', 'create', '--fill'], {
-      encoding: 'utf8',
-      env: cleanAttributionEnv(attributionEnv)
-    })
-
-    expect(output).toBe('https://github.com/stablyai/orca/pull/123\n')
-  })
-
-  it('fails open when shim files cannot be written', () => {
-    const root = makeTmpRoot()
-    const blockedUserDataPath = join(root, 'not-a-directory')
-    writeFileSync(blockedUserDataPath, 'blocked\n')
-    const baseEnv: Record<string, string> = { PATH: '/usr/bin' }
-
-    applyTerminalAttributionEnv(baseEnv, {
-      enabled: true,
-      userDataPath: blockedUserDataPath
-    })
-
-    expect(baseEnv.ORCA_ENABLE_GIT_ATTRIBUTION).toBeUndefined()
-    expect(baseEnv.PATH).toBe('/usr/bin')
-  })
-
-  it('does not duplicate shim directories when applied to an already-injected env', () => {
-    const root = makeTmpRoot()
-    const baseEnv: Record<string, string> = {
-      PATH: stripInheritedAttributionPath(process.env.PATH ?? '')
-    }
-    const options = { enabled: true, userDataPath: join(root, 'user-data') }
-    const pathDelimiter = process.platform === 'win32' ? ';' : ':'
-
-    applyTerminalAttributionEnv(baseEnv, options)
-    applyTerminalAttributionEnv(baseEnv, options)
-
-    const shimEntries = baseEnv.PATH.split(pathDelimiter).filter((entry) =>
-      entry.includes('orca-terminal-attribution')
-    )
-    expect(new Set(shimEntries).size).toBe(shimEntries.length)
-  })
-
-  it('puts only Windows shims on PATH for native Windows shells', () => {
-    const root = makeTmpRoot()
-    const userDataPath = join(root, 'user-data')
-    const baseEnv: Record<string, string> = { PATH: 'C:\\Git\\cmd;C:\\Windows\\System32' }
-
-    applyTerminalAttributionEnv(baseEnv, {
-      enabled: true,
-      platform: 'win32',
-      shellFamily: 'native-windows',
-      userDataPath
-    })
-
-    const posixDir = join(userDataPath, 'orca-terminal-attribution', 'posix')
-    const win32Dir = join(userDataPath, 'orca-terminal-attribution', 'win32')
-    const pathEntries = baseEnv.PATH.split(';')
-
-    expect(pathEntries[0]).toBe(win32Dir)
-    expect(pathEntries).not.toContain(posixDir)
-    expect(baseEnv.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
-    expect(existsSync(join(win32Dir, 'git.cmd'))).toBe(true)
-  })
-
-  it('keeps POSIX shims first for Windows Git Bash and WSL shells', () => {
-    const root = makeTmpRoot()
-    const userDataPath = join(root, 'user-data')
-    const baseEnv: Record<string, string> = { PATH: 'C:\\Program Files\\Git\\cmd;C:\\Windows' }
-
-    applyTerminalAttributionEnv(baseEnv, {
-      enabled: true,
-      platform: 'win32',
-      shellFamily: 'posix',
-      userDataPath
-    })
-
-    const posixDir = join(userDataPath, 'orca-terminal-attribution', 'posix')
-    const win32Dir = join(userDataPath, 'orca-terminal-attribution', 'win32')
-    const pathEntries = baseEnv.PATH.split(';')
-
-    expect(pathEntries[0]).toBe(posixDir)
-    expect(pathEntries).not.toContain(win32Dir)
-    expect(baseEnv.ORCA_ATTRIBUTION_SHIM_DIR).toBe(posixDir)
-    expect(existsSync(join(posixDir, 'git'))).toBe(true)
-  })
-
-  it('writes PowerShell wrappers without raw-template backslash escapes', () => {
-    const root = makeTmpRoot()
-    applyTerminalAttributionEnv(
-      { PATH: stripInheritedAttributionPath(process.env.PATH ?? '') },
-      { enabled: true, userDataPath: join(root, 'user-data') }
-    )
-
-    const shimDir = join(root, 'user-data', 'orca-terminal-attribution', 'win32')
-    const gitWrapper = readFileSync(join(shimDir, 'git-wrapper.ps1'), 'utf8')
-    const ghWrapper = readFileSync(join(shimDir, 'gh-wrapper.ps1'), 'utf8')
-
-    expect(gitWrapper).toContain('Test-ExplicitCommitMessage')
-    expect(gitWrapper).toContain('"`r`n`r`n"')
-    expect(ghWrapper).toContain('$body.TrimEnd("`r", "`n")')
-    expect(ghWrapper).toContain('"`r`n`r`n"')
-    expect(gitWrapper).not.toContain('"\\`r"')
-    expect(ghWrapper).not.toContain('"\\`r"')
-  })
-})
diff --git a/src/main/attribution/terminal-attribution.ts b/src/main/attribution/terminal-attribution.ts
deleted file mode 100644
index cfeef746dbf..00000000000
--- a/src/main/attribution/terminal-attribution.ts
+++ /dev/null
@@ -1,1058 +0,0 @@
-/* eslint-disable max-lines -- Why: this module owns the generated git/gh wrapper
-scripts for both POSIX shells and Windows shells. Keeping the scripts adjacent
-to the env injection code makes the attribution behavior auditable as one unit
-instead of scattering generated shell fragments across files. */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { join, win32 as pathWin32 } from 'node:path'
-import { ORCA_GIT_COMMIT_TRAILER } from '../../shared/orca-attribution'
-import { resolvePathEnvKey } from '../pty/windows-environment-path'
-
-const ATTRIBUTION_ROOT_DIR = 'orca-terminal-attribution'
-const ATTRIBUTION_SHIM_VERSION = '7'
-const ORCA_PRODUCT_URL = 'https://github.com/stablyai/orca'
-const ORCA_GH_FOOTER = `Made with [Orca](${ORCA_PRODUCT_URL}) 🐋`
-const SHELL_DOLLAR = '$'
-const POWERSHELL_TICK = '`'
-const ATTRIBUTION_ENV_KEYS = [
-  'ORCA_ENABLE_GIT_ATTRIBUTION',
-  'ORCA_GIT_COMMIT_TRAILER',
-  'ORCA_GH_PR_FOOTER',
-  'ORCA_GH_ISSUE_FOOTER',
-  'ORCA_ATTRIBUTION_SHIM_DIR',
-  'ORCA_REAL_GIT',
-  'ORCA_REAL_GH'
-] as const
-
-const writtenRoots = new Set<string>()
-
-type AttributionShimPaths = {
-  posixDir: string
-  win32Dir: string
-}
-
-export type AttributionShellFamily = 'native-windows' | 'posix'
-
-export function resolveAttributionShellFamily(options: {
-  platform?: NodeJS.Platform
-  shellPath?: string
-  isWsl?: boolean
-}): AttributionShellFamily | undefined {
-  const platform = options.platform ?? process.platform
-  if (platform !== 'win32') {
-    return undefined
-  }
-  const shellName = options.shellPath?.replaceAll('\\', '/').split('/').pop()?.toLowerCase()
-  if (options.isWsl || shellName === 'wsl.exe' || shellName === 'wsl') {
-    return 'posix'
-  }
-  if (shellName === 'bash.exe' || shellName === 'sh.exe' || shellName === 'zsh.exe') {
-    return 'posix'
-  }
-  return 'native-windows'
-}
-
-export function applyTerminalAttributionEnv(
-  baseEnv: Record<string, string>,
-  options: {
-    enabled: boolean
-    userDataPath: string
-    platform?: NodeJS.Platform
-    shellFamily?: AttributionShellFamily
-  }
-): void {
-  const platform = options.platform ?? process.platform
-  if (!options.enabled) {
-    clearTerminalAttributionEnv(baseEnv, platform)
-    return
-  }
-
-  let shimPaths: AttributionShimPaths
-  try {
-    shimPaths = ensureAttributionShims(options.userDataPath)
-  } catch {
-    return
-  }
-
-  const pathDelimiter = platform === 'win32' ? ';' : ':'
-  const pathKey = resolvePathEnvKey(baseEnv, platform)
-  const basePath = baseEnv[pathKey] ?? process.env[pathKey] ?? ''
-  // Why: resolve real Windows commands before prepending shims so cmd wrappers
-  // cannot recursively point ORCA_REAL_* at themselves.
-  const resolvedGit = platform === 'win32' ? resolveWindowsExecutable('git', basePath) : null
-  const resolvedGh = platform === 'win32' ? resolveWindowsExecutable('gh', basePath) : null
-  const { posixDir, win32Dir } = shimPaths
-  const shellFamily = options.shellFamily ?? (platform === 'win32' ? 'native-windows' : 'posix')
-  // Why: Windows native shells can try to open extensionless POSIX shims before
-  // PATHEXT reaches git.cmd, which surfaces an "Open With" dialog.
-  const prependDirs =
-    platform === 'win32' && shellFamily === 'native-windows' ? [win32Dir] : [posixDir]
-  const prependDirKeys = new Set(
-    prependDirs.map((dir) => (platform === 'win32' ? dir.toLowerCase() : dir))
-  )
-  const cleanedBasePath = stripAttributionPathEntries(basePath, pathDelimiter)
-    .split(pathDelimiter)
-    .filter((entry) => {
-      if (!entry) {
-        return false
-      }
-      const key = platform === 'win32' ? entry.toLowerCase() : entry
-      return !prependDirKeys.has(key)
-    })
-    .join(pathDelimiter)
-
-  // Why: these wrappers should affect only Orca-managed PTYs. Prepending the
-  // shim directory here keeps the attribution behavior scoped to Orca's live
-  // terminal environment instead of mutating global git/gh config or the
-  // user's external shell PATH.
-  baseEnv[pathKey] = [...prependDirs, cleanedBasePath].filter(Boolean).join(pathDelimiter)
-  baseEnv.ORCA_ENABLE_GIT_ATTRIBUTION = '1'
-  baseEnv.ORCA_GIT_COMMIT_TRAILER = ORCA_GIT_COMMIT_TRAILER
-  baseEnv.ORCA_GH_PR_FOOTER = ORCA_GH_FOOTER
-  baseEnv.ORCA_GH_ISSUE_FOOTER = ORCA_GH_FOOTER
-  if (shellFamily === 'posix') {
-    baseEnv.ORCA_ATTRIBUTION_SHIM_DIR = posixDir
-  } else {
-    delete baseEnv.ORCA_ATTRIBUTION_SHIM_DIR
-  }
-
-  if (platform === 'win32') {
-    if (resolvedGit) {
-      baseEnv.ORCA_REAL_GIT = resolvedGit
-    }
-    if (resolvedGh) {
-      baseEnv.ORCA_REAL_GH = resolvedGh
-    }
-  }
-}
-
-function clearTerminalAttributionEnv(
-  baseEnv: Record<string, string>,
-  platform: NodeJS.Platform
-): void {
-  for (const key of ATTRIBUTION_ENV_KEYS) {
-    delete baseEnv[key]
-  }
-  const pathDelimiter = platform === 'win32' ? ';' : ':'
-  const pathKey = resolvePathEnvKey(baseEnv, platform)
-  const cleanedPath = stripAttributionPathEntries(baseEnv[pathKey] ?? '', pathDelimiter)
-  if (cleanedPath) {
-    baseEnv[pathKey] = cleanedPath
-  } else {
-    delete baseEnv[pathKey]
-  }
-}
-
-function stripAttributionPathEntries(pathValue: string, pathDelimiter: string): string {
-  return pathValue
-    .split(pathDelimiter)
-    .filter((entry) => {
-      const normalized = entry.replace(/\\/g, '/').toLowerCase()
-      return !normalized.includes('/orca-terminal-attribution/')
-    })
-    .join(pathDelimiter)
-}
-
-function ensureAttributionShims(userDataPath: string): AttributionShimPaths {
-  const rootDir = join(userDataPath, ATTRIBUTION_ROOT_DIR)
-  const posixDir = join(rootDir, 'posix')
-  const win32Dir = join(rootDir, 'win32')
-  const versionFile = join(rootDir, 'VERSION')
-
-  if (writtenRoots.has(rootDir)) {
-    return { posixDir, win32Dir }
-  }
-
-  if (readShimVersion(versionFile) === ATTRIBUTION_SHIM_VERSION) {
-    writtenRoots.add(rootDir)
-    return { posixDir, win32Dir }
-  }
-
-  mkdirSync(posixDir, { recursive: true })
-  mkdirSync(win32Dir, { recursive: true })
-
-  writeExecutable(join(posixDir, 'git'), POSIX_GIT_WRAPPER)
-  writeExecutable(join(posixDir, 'gh'), POSIX_GH_WRAPPER)
-
-  writeExecutable(join(win32Dir, 'git.cmd'), WIN32_GIT_CMD_WRAPPER)
-  writeExecutable(join(win32Dir, 'gh.cmd'), WIN32_GH_CMD_WRAPPER)
-  writeExecutable(join(win32Dir, 'git-wrapper.ps1'), WIN32_GIT_PS_WRAPPER)
-  writeExecutable(join(win32Dir, 'gh-wrapper.ps1'), WIN32_GH_PS_WRAPPER)
-  writeFileSync(versionFile, `${ATTRIBUTION_SHIM_VERSION}\n`, 'utf8')
-
-  writtenRoots.add(rootDir)
-
-  return { posixDir, win32Dir }
-}
-
-function readShimVersion(versionFile: string): string | null {
-  try {
-    return readFileSync(versionFile, 'utf8').trim()
-  } catch {
-    return null
-  }
-}
-
-function writeExecutable(filePath: string, contents: string): void {
-  writeFileSync(filePath, contents, 'utf8')
-  chmodSync(filePath, 0o755)
-}
-
-function resolveWindowsExecutable(command: string, pathValue: string): string | null {
-  const pathExt = (process.env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD')
-    .split(';')
-    .map((ext) => ext.toLowerCase())
-  const searchDirs = pathValue.split(';').filter(Boolean)
-
-  for (const dir of searchDirs) {
-    for (const ext of pathExt) {
-      const candidate = pathWin32.join(dir, `${command}${ext}`)
-      if (existsSync(candidate)) {
-        return candidate
-      }
-    }
-    const bareCandidate = pathWin32.join(dir, command)
-    if (existsSync(bareCandidate)) {
-      return bareCandidate
-    }
-  }
-
-  return null
-}
-
-const POSIX_COMMON = String.raw`#!/usr/bin/env bash
-set -euo pipefail
-
-clean_path() {
-  local current_path="${SHELL_DOLLAR}{PATH:-}"
-  local script_dir
-  script_dir="$(cd -- "$(dirname "${SHELL_DOLLAR}{BASH_SOURCE[0]}")" && pwd)"
-  local cleaned=()
-  local entry
-  IFS=':' read -r -a entries <<<"$current_path"
-  for entry in "${SHELL_DOLLAR}{entries[@]}"; do
-    case "$entry" in
-      "$script_dir"|*/orca-terminal-attribution/posix|*/orca-terminal-attribution/win32|*\\orca-terminal-attribution\\posix|*\\orca-terminal-attribution\\win32)
-        ;;
-      *)
-        cleaned+=("$entry")
-        ;;
-    esac
-  done
-  (IFS=':'; printf '%s' "${SHELL_DOLLAR}{cleaned[*]:-}")
-}
-`
-
-const POSIX_GIT_WRAPPER = `${POSIX_COMMON}
-real_path="$(clean_path)"
-real_git="$(PATH="$real_path" command -v git || true)"
-if [[ -z "$real_git" ]]; then
-  echo "Orca attribution wrapper could not locate git on PATH." >&2
-  exit 127
-fi
-
-is_commit_command() {
-  while [[ $# -gt 0 ]]; do
-    case "$1" in
-      -c|--config|-C|--git-dir|--work-tree|--namespace)
-        shift 2
-        ;;
-      --config=*|--git-dir=*|--work-tree=*|--namespace=*)
-        shift
-        ;;
-      commit)
-        return 0
-        ;;
-      -*)
-        shift
-        ;;
-      *)
-        return 1
-        ;;
-    esac
-  done
-  return 1
-}
-
-if [[ "\${ORCA_ENABLE_GIT_ATTRIBUTION:-0}" != "1" || "\${ORCA_ATTRIBUTION_BYPASS:-0}" == "1" ]] || ! is_commit_command "$@"; then
-  PATH="$real_path" exec "$real_git" "$@"
-fi
-
-for arg in "$@"; do
-  case "$arg" in
-    --dry-run)
-      PATH="$real_path" exec "$real_git" "$@"
-      ;;
-  esac
-done
-
-trailer="\${ORCA_GIT_COMMIT_TRAILER:-Co-authored-by: Orca <help@stably.ai>}"
-
-has_explicit_commit_message() {
-  local arg
-  while [[ $# -gt 0 ]]; do
-    arg="$1"
-    case "$arg" in
-      -m|--message|-F|--file)
-        return 0
-        ;;
-      --message=*|--file=*|-[!-]*m|-m?*|-F?*)
-        return 0
-        ;;
-    esac
-    shift
-  done
-  return 1
-}
-
-has_unsupported_commit_message_source() {
-  local arg next_arg
-  local saw_commit=0
-  while [[ $# -gt 0 ]]; do
-    arg="$1"
-    if [[ $saw_commit -eq 0 ]]; then
-      case "$arg" in
-        -c|--config|-C|--git-dir|--work-tree|--namespace)
-          shift 2
-          continue
-          ;;
-        --config=*|--git-dir=*|--work-tree=*|--namespace=*)
-          shift
-          continue
-          ;;
-        commit)
-          saw_commit=1
-          shift
-          continue
-          ;;
-      esac
-    fi
-    case "$arg" in
-      -C|--reuse-message|-c|--reedit-message|--fixup|--squash)
-        return 0
-        ;;
-      -F|--file)
-        shift
-        next_arg="${SHELL_DOLLAR}{1:-}"
-        [[ -z "$next_arg" || ! -f "$next_arg" ]] && return 0
-        ;;
-      --file=*)
-        next_arg="${SHELL_DOLLAR}{arg#--file=}"
-        [[ ! -f "$next_arg" ]] && return 0
-        ;;
-      -F?*)
-        next_arg="${SHELL_DOLLAR}{arg:2}"
-        [[ ! -f "$next_arg" ]] && return 0
-        ;;
-    esac
-    shift
-  done
-  return 1
-}
-
-message_already_has_trailer() {
-  local arg next_arg
-  while [[ $# -gt 0 ]]; do
-    arg="$1"
-    case "$arg" in
-      -m|--message)
-        shift
-        next_arg="${SHELL_DOLLAR}{1:-}"
-        grep -Fqi "$trailer" <<<"$next_arg" && return 0
-        ;;
-      --message=*)
-        grep -Fqi "$trailer" <<<"${SHELL_DOLLAR}{arg#--message=}" && return 0
-        ;;
-      -m?*)
-        grep -Fqi "$trailer" <<<"${SHELL_DOLLAR}{arg:2}" && return 0
-        ;;
-      -[!-]*m)
-        shift
-        next_arg="${SHELL_DOLLAR}{1:-}"
-        grep -Fqi "$trailer" <<<"$next_arg" && return 0
-        ;;
-      -F|--file)
-        shift
-        next_arg="${SHELL_DOLLAR}{1:-}"
-        [[ -n "$next_arg" && -f "$next_arg" ]] && grep -Fqi "$trailer" "$next_arg" && return 0
-        ;;
-      --file=*)
-        next_arg="${SHELL_DOLLAR}{arg#--file=}"
-        [[ -f "$next_arg" ]] && grep -Fqi "$trailer" "$next_arg" && return 0
-        ;;
-      -F?*)
-        next_arg="${SHELL_DOLLAR}{arg:2}"
-        [[ -f "$next_arg" ]] && grep -Fqi "$trailer" "$next_arg" && return 0
-        ;;
-    esac
-    shift
-  done
-  return 1
-}
-
-if ! has_explicit_commit_message "$@" || has_unsupported_commit_message_source "$@" || message_already_has_trailer "$@"; then
-  PATH="$real_path" exec "$real_git" "$@"
-fi
-
-tmp_file=""
-cleanup_commit_message() {
-  if [[ -n "$tmp_file" ]]; then
-    rm -f "$tmp_file"
-  fi
-}
-trap cleanup_commit_message EXIT
-
-attributed_args=()
-replaced_file_message=0
-while [[ $# -gt 0 ]]; do
-  arg="$1"
-  case "$arg" in
-    -F|--file)
-      if [[ $replaced_file_message -eq 0 ]]; then
-        shift
-        source_file="${SHELL_DOLLAR}{1:-}"
-        tmp_file="$(mktemp)"
-        if [[ -n "$source_file" && -f "$source_file" ]]; then
-          printf '%s\n\n%s\n' "$(cat "$source_file")" "$trailer" >"$tmp_file"
-          attributed_args+=("$arg" "$tmp_file")
-          replaced_file_message=1
-        else
-          attributed_args+=("$arg" "$source_file")
-        fi
-      else
-        attributed_args+=("$arg")
-      fi
-      ;;
-    --file=*)
-      if [[ $replaced_file_message -eq 0 ]]; then
-        source_file="${SHELL_DOLLAR}{arg#--file=}"
-        tmp_file="$(mktemp)"
-        if [[ -f "$source_file" ]]; then
-          printf '%s\n\n%s\n' "$(cat "$source_file")" "$trailer" >"$tmp_file"
-          attributed_args+=("--file=$tmp_file")
-          replaced_file_message=1
-        else
-          attributed_args+=("$arg")
-        fi
-      else
-        attributed_args+=("$arg")
-      fi
-      ;;
-    -F?*)
-      if [[ $replaced_file_message -eq 0 ]]; then
-        source_file="${SHELL_DOLLAR}{arg:2}"
-        tmp_file="$(mktemp)"
-        if [[ -f "$source_file" ]]; then
-          printf '%s\n\n%s\n' "$(cat "$source_file")" "$trailer" >"$tmp_file"
-          attributed_args+=("-F$tmp_file")
-          replaced_file_message=1
-        else
-          attributed_args+=("$arg")
-        fi
-      else
-        attributed_args+=("$arg")
-      fi
-      ;;
-    *)
-      attributed_args+=("$arg")
-      ;;
-  esac
-  shift
-done
-
-if [[ $replaced_file_message -eq 0 ]]; then
-  attributed_args+=("-m" "$trailer")
-fi
-
-# Why: commit-msg hooks and commit signing must see the final message. Only
-# commands that already provide a noninteractive message get attribution; editor
-# based commits pass through unchanged instead of being amended after success.
-ORCA_ATTRIBUTION_BYPASS=1 PATH="$real_path" exec "$real_git" "${SHELL_DOLLAR}{attributed_args[@]}"
-`
-
-const POSIX_GH_WRAPPER = `${POSIX_COMMON}
-real_path="$(clean_path)"
-real_gh="$(PATH="$real_path" command -v gh || true)"
-if [[ -z "$real_gh" ]]; then
-  echo "Orca attribution wrapper could not locate gh on PATH." >&2
-  exit 127
-fi
-
-append_footer() {
-  local kind="$1"
-  local url_pattern="$2"
-  local footer="$3"
-  local stdout_capture="$4"
-  local stderr_capture="$5"
-  local url=""
-
-  url="$(printf '%s\n%s\n' "$stdout_capture" "$stderr_capture" | grep -Eo "$url_pattern" | tail -n 1 || true)"
-  append_footer_url "$kind" "$footer" "$url"
-}
-
-append_footer_url() {
-  local kind="$1"
-  local footer="$2"
-  local url="$3"
-
-  if [[ -z "$url" ]]; then
-    return 0
-  fi
-
-  local api_path
-  api_path="$(github_api_path "$kind" "$url" || true)"
-  if [[ -z "$api_path" ]]; then
-    return 0
-  fi
-
-  local body
-  if ! body="$(PATH="$real_path" "$real_gh" api "$api_path" --jq '.body // ""' 2>/dev/null)"; then
-    return 0
-  fi
-  if grep -Fqi "$footer" <<<"$body"; then
-    return 0
-  fi
-
-  local tmp_file
-  tmp_file="$(mktemp)"
-  if [[ -n "$body" ]]; then
-    printf '%s\n\n%s\n' "$body" "$footer" >"$tmp_file"
-  else
-    printf '%s\n' "$footer" >"$tmp_file"
-  fi
-  # Why: gh exposes create output as a URL, but does not provide a transactional
-  # body append. Use REST instead of gh pr/issue edit because those commands can
-  # hit unrelated GraphQL fields, while the URL maps directly to one REST item.
-  PATH="$real_path" "$real_gh" api -X PATCH "$api_path" -F "body=@$tmp_file" >/dev/null || true
-  rm -f "$tmp_file"
-}
-
-github_api_path() {
-  local kind="$1"
-  local url="$2"
-  if [[ "$kind" == "pr" && "$url" =~ ^https://github[.]com/([^/]+)/([^/]+)/pull/([0-9]+) ]]; then
-    printf 'repos/%s/%s/pulls/%s' "${SHELL_DOLLAR}{BASH_REMATCH[1]}" "${SHELL_DOLLAR}{BASH_REMATCH[2]}" "${SHELL_DOLLAR}{BASH_REMATCH[3]}"
-    return 0
-  fi
-  if [[ "$kind" == "issue" && "$url" =~ ^https://github[.]com/([^/]+)/([^/]+)/issues/([0-9]+) ]]; then
-    printf 'repos/%s/%s/issues/%s' "${SHELL_DOLLAR}{BASH_REMATCH[1]}" "${SHELL_DOLLAR}{BASH_REMATCH[2]}" "${SHELL_DOLLAR}{BASH_REMATCH[3]}"
-    return 0
-  fi
-  return 1
-}
-
-has_noninteractive_create_args() {
-  local arg
-  for arg in "$@"; do
-    case "$arg" in
-      --title|-t|--title=*|--body|-b|--body=*|--body-file|-F|--body-file=*|--fill|--fill-first|--fill-verbose|--template|-T|--template=*|--recover|--recover=*|--web)
-        return 0
-        ;;
-    esac
-  done
-  return 1
-}
-
-has_passthrough_create_args() {
-  local arg
-  for arg in "$@"; do
-    case "$arg" in
-      --help|-h|--version)
-        return 0
-        ;;
-    esac
-  done
-  return 1
-}
-
-if [[ "\${ORCA_ENABLE_GIT_ATTRIBUTION:-0}" != "1" || "\${ORCA_ATTRIBUTION_BYPASS:-0}" == "1" ]]; then
-  PATH="$real_path" exec "$real_gh" "$@"
-fi
-
-if [[ "\${1:-}" == "pr" && "\${2:-}" == "create" ]]; then
-  footer="\${ORCA_GH_PR_FOOTER:-Made with [Orca](https://github.com/stablyai/orca) 🐋}"
-  if has_passthrough_create_args "$@"; then
-    PATH="$real_path" exec "$real_gh" "$@"
-  fi
-  if ! has_noninteractive_create_args "$@"; then
-    # Why: gh switches off interactive prompts when stdout/stderr are redirected,
-    # and post-create "pr view" can select the wrong PR in fork/multi-PR cases.
-    # Preserve interactive UX and skip attribution rather than guessing.
-    PATH="$real_path" exec "$real_gh" "$@"
-  fi
-  stdout_file="$(mktemp)"
-  stderr_file="$(mktemp)"
-  cleanup_capture() {
-    rm -f "$stdout_file" "$stderr_file"
-  }
-  trap cleanup_capture EXIT
-  if PATH="$real_path" "$real_gh" "$@" >"$stdout_file" 2>"$stderr_file"; then
-    status=0
-  else
-    status=$?
-  fi
-  stdout_capture="$(cat "$stdout_file")"
-  stderr_capture="$(cat "$stderr_file")"
-  cat "$stderr_file" >&2
-  cat "$stdout_file"
-  if [[ $status -eq 0 ]]; then
-    append_footer "pr" 'https://github.com/[^[:space:]]+/pull/[0-9]+' "$footer" "$stdout_capture" "$stderr_capture"
-  fi
-  cleanup_capture
-  trap - EXIT
-  exit $status
-fi
-
-if [[ "\${1:-}" == "issue" && "\${2:-}" == "create" ]]; then
-  footer="\${ORCA_GH_ISSUE_FOOTER:-Made with [Orca](https://github.com/stablyai/orca) 🐋}"
-  if has_passthrough_create_args "$@"; then
-    PATH="$real_path" exec "$real_gh" "$@"
-  fi
-  if ! has_noninteractive_create_args "$@"; then
-    # Why: gh issue create also requires a live TTY for prompts, but gh has no
-    # current-issue lookup equivalent to "pr view". Do not guess with issue list:
-    # that can edit an unrelated issue if the command printed no URL.
-    PATH="$real_path" exec "$real_gh" "$@"
-  fi
-  stdout_file="$(mktemp)"
-  stderr_file="$(mktemp)"
-  cleanup_capture() {
-    rm -f "$stdout_file" "$stderr_file"
-  }
-  trap cleanup_capture EXIT
-  if PATH="$real_path" "$real_gh" "$@" >"$stdout_file" 2>"$stderr_file"; then
-    status=0
-  else
-    status=$?
-  fi
-  stdout_capture="$(cat "$stdout_file")"
-  stderr_capture="$(cat "$stderr_file")"
-  cat "$stderr_file" >&2
-  cat "$stdout_file"
-  if [[ $status -eq 0 ]]; then
-    append_footer "issue" 'https://github.com/[^[:space:]]+/issues/[0-9]+' "$footer" "$stdout_capture" "$stderr_capture"
-  fi
-  cleanup_capture
-  trap - EXIT
-  exit $status
-fi
-
-PATH="$real_path" exec "$real_gh" "$@"
-`
-
-const WIN32_GIT_CMD_WRAPPER = String.raw`@echo off
-setlocal
-if not "%ORCA_ENABLE_GIT_ATTRIBUTION%"=="1" goto run
-if "%ORCA_ATTRIBUTION_BYPASS%"=="1" goto run
-call :orca_is_git_commit %*
-if errorlevel 1 goto run
-call :orca_has_bare_dash %*
-if not errorlevel 1 goto run
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0git-wrapper.ps1" %*
-exit /b %ERRORLEVEL%
-:run
-if defined ORCA_REAL_GIT (
-  "%ORCA_REAL_GIT%" %*
-) else (
-  echo Orca attribution wrapper could not locate git on PATH. 1>&2
-  exit /b 127
-)
-exit /b %ERRORLEVEL%
-
-:orca_is_git_commit
-if "%~1"=="" exit /b 1
-if /I "%~1"=="commit" exit /b 0
-set "orca_git_arg=%~1"
-if /I "%orca_git_arg%"=="-c" goto skip_two
-if /I "%orca_git_arg%"=="--config" goto skip_two
-if /I "%orca_git_arg%"=="-C" goto skip_two
-if /I "%orca_git_arg%"=="--git-dir" goto skip_two
-if /I "%orca_git_arg%"=="--work-tree" goto skip_two
-if /I "%orca_git_arg%"=="--namespace" goto skip_two
-if /I "%orca_git_arg:~0,9%"=="--config=" goto skip_one
-if /I "%orca_git_arg:~0,10%"=="--git-dir=" goto skip_one
-if /I "%orca_git_arg:~0,12%"=="--work-tree=" goto skip_one
-if /I "%orca_git_arg:~0,12%"=="--namespace=" goto skip_one
-if "%orca_git_arg:~0,1%"=="-" goto skip_one
-exit /b 1
-:skip_two
-shift
-shift
-goto orca_is_git_commit
-:skip_one
-shift
-goto orca_is_git_commit
-
-rem Why: powershell.exe -File rejects a bare "-" while binding arguments, so the
-rem script never runs. Pass those straight to git, which is what the PS wrapper
-rem does with a stdin message anyway.
-:orca_has_bare_dash
-if "%~1"=="" exit /b 1
-if "%~1"=="-" exit /b 0
-shift
-goto orca_has_bare_dash
-`
-
-const WIN32_GH_CMD_WRAPPER = String.raw`@echo off
-setlocal
-if not "%ORCA_ENABLE_GIT_ATTRIBUTION%"=="1" goto run
-if "%ORCA_ATTRIBUTION_BYPASS%"=="1" goto run
-if /I "%~1"=="pr" if /I "%~2"=="create" goto wrap
-if /I "%~1"=="issue" if /I "%~2"=="create" goto wrap
-goto run
-:wrap
-call :orca_has_bare_dash %*
-if not errorlevel 1 goto run
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0gh-wrapper.ps1" %*
-exit /b %ERRORLEVEL%
-:run
-if defined ORCA_REAL_GH (
-  "%ORCA_REAL_GH%" %*
-) else (
-  echo Orca attribution wrapper could not locate gh on PATH. 1>&2
-  exit /b 127
-)
-exit /b %ERRORLEVEL%
-
-rem Why: powershell.exe -File rejects a bare "-" while binding arguments, so the
-rem script never runs. Creating without the footer beats not creating at all.
-:orca_has_bare_dash
-if "%~1"=="" exit /b 1
-if "%~1"=="-" exit /b 0
-shift
-goto orca_has_bare_dash
-`
-
-const WIN32_GIT_PS_WRAPPER = String.raw`$ErrorActionPreference = 'Stop'
-$realGit = if ($env:ORCA_REAL_GIT) { $env:ORCA_REAL_GIT } else { 'git' }
-$trailer = if ($env:ORCA_GIT_COMMIT_TRAILER) { $env:ORCA_GIT_COMMIT_TRAILER } else { 'Co-authored-by: Orca <help@stably.ai>' }
-
-if ($args -contains '--dry-run') {
-  & $realGit @args
-  exit $LASTEXITCODE
-}
-
-function Test-GitCommitCommand {
-  param([string[]]$CommandArgs)
-  for ($i = 0; $i -lt $CommandArgs.Count; $i++) {
-    $arg = $CommandArgs[$i]
-    if ($arg -eq '-c' -or $arg -eq '--config' -or $arg -eq '-C' -or $arg -eq '--git-dir' -or $arg -eq '--work-tree' -or $arg -eq '--namespace') {
-      $i++
-      continue
-    }
-    if ($arg.StartsWith('--config=') -or $arg.StartsWith('--git-dir=') -or $arg.StartsWith('--work-tree=') -or $arg.StartsWith('--namespace=')) {
-      continue
-    }
-    if ($arg -eq 'commit') {
-      return $true
-    }
-    if ($arg.StartsWith('-')) {
-      continue
-    }
-    return $false
-  }
-  return $false
-}
-
-function Test-ExplicitCommitMessage {
-  param([string[]]$CommandArgs)
-  foreach ($arg in $CommandArgs) {
-    if ($arg -eq '-m' -or $arg -eq '--message' -or $arg -eq '-F' -or $arg -eq '--file' -or $arg.StartsWith('--message=') -or $arg.StartsWith('--file=') -or ($arg.StartsWith('-m') -and $arg.Length -gt 2) -or ($arg.StartsWith('-F') -and $arg.Length -gt 2) -or ($arg.StartsWith('-') -and -not $arg.StartsWith('--') -and $arg.EndsWith('m'))) {
-      return $true
-    }
-  }
-  return $false
-}
-
-function Test-UnsupportedCommitMessageSource {
-  param([string[]]$CommandArgs)
-  $sawCommit = $false
-  for ($i = 0; $i -lt $CommandArgs.Count; $i++) {
-    $arg = $CommandArgs[$i]
-    if (-not $sawCommit) {
-      if ($arg -eq '-c' -or $arg -eq '--config' -or $arg -eq '-C' -or $arg -eq '--git-dir' -or $arg -eq '--work-tree' -or $arg -eq '--namespace') {
-        $i++
-        continue
-      }
-      if ($arg.StartsWith('--config=') -or $arg.StartsWith('--git-dir=') -or $arg.StartsWith('--work-tree=') -or $arg.StartsWith('--namespace=')) {
-        continue
-      }
-      if ($arg -eq 'commit') {
-        $sawCommit = $true
-        continue
-      }
-    }
-    if ($arg -eq '-C' -or $arg -eq '--reuse-message' -or $arg -eq '-c' -or $arg -eq '--reedit-message' -or $arg -eq '--fixup' -or $arg -eq '--squash') {
-      return $true
-    }
-    if ($arg -eq '-F' -or $arg -eq '--file') {
-      $i++
-      if ($i -ge $CommandArgs.Count -or -not (Test-Path -LiteralPath $CommandArgs[$i])) {
-        return $true
-      }
-      continue
-    }
-    if ($arg.StartsWith('--file=')) {
-      if (-not (Test-Path -LiteralPath $arg.Substring('--file='.Length))) {
-        return $true
-      }
-      continue
-    }
-    if ($arg.StartsWith('-F') -and $arg.Length -gt 2) {
-      if (-not (Test-Path -LiteralPath $arg.Substring(2))) {
-        return $true
-      }
-      continue
-    }
-  }
-  return $false
-}
-
-function Test-CommitMessageHasTrailer {
-  param([string[]]$CommandArgs)
-  for ($i = 0; $i -lt $CommandArgs.Count; $i++) {
-    $arg = $CommandArgs[$i]
-    if ($arg -eq '-m' -or $arg -eq '--message') {
-      $i++
-      if ($i -lt $CommandArgs.Count -and $CommandArgs[$i] -match [Regex]::Escape($trailer)) {
-        return $true
-      }
-    } elseif ($arg.StartsWith('--message=')) {
-      if ($arg.Substring('--message='.Length) -match [Regex]::Escape($trailer)) {
-        return $true
-      }
-    } elseif ($arg.StartsWith('-m') -and $arg.Length -gt 2) {
-      if ($arg.Substring(2) -match [Regex]::Escape($trailer)) {
-        return $true
-      }
-    } elseif ($arg.StartsWith('-') -and -not $arg.StartsWith('--') -and $arg.EndsWith('m')) {
-      $i++
-      if ($i -lt $CommandArgs.Count -and $CommandArgs[$i] -match [Regex]::Escape($trailer)) {
-        return $true
-      }
-    } elseif ($arg -eq '-F' -or $arg -eq '--file') {
-      $i++
-      if ($i -lt $CommandArgs.Count -and (Test-Path -LiteralPath $CommandArgs[$i]) -and (Get-Content -LiteralPath $CommandArgs[$i] -Raw) -match [Regex]::Escape($trailer)) {
-        return $true
-      }
-    } elseif ($arg.StartsWith('--file=')) {
-      $path = $arg.Substring('--file='.Length)
-      if ((Test-Path -LiteralPath $path) -and (Get-Content -LiteralPath $path -Raw) -match [Regex]::Escape($trailer)) {
-        return $true
-      }
-    } elseif ($arg.StartsWith('-F') -and $arg.Length -gt 2) {
-      $path = $arg.Substring(2)
-      if ((Test-Path -LiteralPath $path) -and (Get-Content -LiteralPath $path -Raw) -match [Regex]::Escape($trailer)) {
-        return $true
-      }
-    }
-  }
-  return $false
-}
-
-if (-not (Test-GitCommitCommand $args) -or -not (Test-ExplicitCommitMessage $args) -or (Test-UnsupportedCommitMessageSource $args) -or (Test-CommitMessageHasTrailer $args)) {
-  & $realGit @args
-  exit $LASTEXITCODE
-}
-
-$tmpFile = $null
-$attributedArgs = New-Object System.Collections.Generic.List[string]
-$replacedFileMessage = $false
-for ($i = 0; $i -lt $args.Count; $i++) {
-  $arg = $args[$i]
-  if (($arg -eq '-F' -or $arg -eq '--file') -and -not $replacedFileMessage) {
-    $i++
-    $sourceFile = if ($i -lt $args.Count) { $args[$i] } else { '' }
-    if ($sourceFile -and (Test-Path -LiteralPath $sourceFile)) {
-      $tmpFile = [System.IO.Path]::GetTempFileName()
-      Set-Content -LiteralPath $tmpFile -Value ((Get-Content -LiteralPath $sourceFile -Raw).TrimEnd("${POWERSHELL_TICK}r", "${POWERSHELL_TICK}n") + "${POWERSHELL_TICK}r${POWERSHELL_TICK}n${POWERSHELL_TICK}r${POWERSHELL_TICK}n" + $trailer) -NoNewline
-      $attributedArgs.Add($arg)
-      $attributedArgs.Add($tmpFile)
-      $replacedFileMessage = $true
-    } else {
-      $attributedArgs.Add($arg)
-      $attributedArgs.Add($sourceFile)
-    }
-  } elseif ($arg.StartsWith('--file=') -and -not $replacedFileMessage) {
-    $sourceFile = $arg.Substring('--file='.Length)
-    if (Test-Path -LiteralPath $sourceFile) {
-      $tmpFile = [System.IO.Path]::GetTempFileName()
-      Set-Content -LiteralPath $tmpFile -Value ((Get-Content -LiteralPath $sourceFile -Raw).TrimEnd("${POWERSHELL_TICK}r", "${POWERSHELL_TICK}n") + "${POWERSHELL_TICK}r${POWERSHELL_TICK}n${POWERSHELL_TICK}r${POWERSHELL_TICK}n" + $trailer) -NoNewline
-      $attributedArgs.Add("--file=$tmpFile")
-      $replacedFileMessage = $true
-    } else {
-      $attributedArgs.Add($arg)
-    }
-  } elseif ($arg.StartsWith('-F') -and $arg.Length -gt 2 -and -not $replacedFileMessage) {
-    $sourceFile = $arg.Substring(2)
-    if (Test-Path -LiteralPath $sourceFile) {
-      $tmpFile = [System.IO.Path]::GetTempFileName()
-      Set-Content -LiteralPath $tmpFile -Value ((Get-Content -LiteralPath $sourceFile -Raw).TrimEnd("${POWERSHELL_TICK}r", "${POWERSHELL_TICK}n") + "${POWERSHELL_TICK}r${POWERSHELL_TICK}n${POWERSHELL_TICK}r${POWERSHELL_TICK}n" + $trailer) -NoNewline
-      $attributedArgs.Add("-F$tmpFile")
-      $replacedFileMessage = $true
-    } else {
-      $attributedArgs.Add($arg)
-    }
-  } else {
-    $attributedArgs.Add($arg)
-  }
-}
-
-if (-not $replacedFileMessage) {
-  $attributedArgs.Add('-m')
-  $attributedArgs.Add($trailer)
-}
-
-# Why: commit-msg hooks and signing should validate the final message. Editor
-# commits pass through unchanged rather than being amended after success.
-$env:ORCA_ATTRIBUTION_BYPASS = '1'
-try {
-  $attributedArgArray = $attributedArgs.ToArray()
-  & $realGit @attributedArgArray
-  exit $LASTEXITCODE
-} finally {
-  if ($tmpFile) {
-    Remove-Item -LiteralPath $tmpFile -Force -ErrorAction SilentlyContinue
-  }
-}
-`
-
-const WIN32_GH_PS_WRAPPER = String.raw`$ErrorActionPreference = 'Stop'
-$realGh = if ($env:ORCA_REAL_GH) { $env:ORCA_REAL_GH } else { 'gh' }
-
-function Test-NonInteractiveCreateArgs {
-  param([string[]]$CommandArgs)
-  foreach ($arg in $CommandArgs) {
-    if ($arg -match '^(--title|-t|--body|-b|--body-file|-F|--fill|--fill-first|--fill-verbose|--template|-T|--recover|--web)(=|$)') {
-      return $true
-    }
-  }
-  return $false
-}
-
-function Test-PassthroughCreateArgs {
-  param([string[]]$CommandArgs)
-  foreach ($arg in $CommandArgs) {
-    if ($arg -eq '--help' -or $arg -eq '-h' -or $arg -eq '--version') {
-      return $true
-    }
-  }
-  return $false
-}
-
-function Get-GitHubApiPath {
-  param([string]$Kind, [string]$CreatedUrl)
-  if ($Kind -eq 'pr' -and $CreatedUrl -match '^https://github\.com/([^/]+)/([^/]+)/pull/([0-9]+)') {
-    return "repos/$($Matches[1])/$($Matches[2])/pulls/$($Matches[3])"
-  }
-  if ($Kind -eq 'issue' -and $CreatedUrl -match '^https://github\.com/([^/]+)/([^/]+)/issues/([0-9]+)') {
-    return "repos/$($Matches[1])/$($Matches[2])/issues/$($Matches[3])"
-  }
-  return $null
-}
-
-function Test-CreateCommand {
-  param([string[]]$CommandArgs, [string]$Kind)
-  return $CommandArgs.Count -ge 2 -and $CommandArgs[0].ToLowerInvariant() -eq $Kind -and $CommandArgs[1].ToLowerInvariant() -eq 'create'
-}
-
-$isPrCreate = Test-CreateCommand $args 'pr'
-$isIssueCreate = Test-CreateCommand $args 'issue'
-if (($isPrCreate -or $isIssueCreate) -and (Test-PassthroughCreateArgs $args)) {
-  & $realGh @args
-  exit $LASTEXITCODE
-}
-
-if (($isPrCreate -or $isIssueCreate) -and -not (Test-NonInteractiveCreateArgs $args)) {
-  & $realGh @args
-  $status = $LASTEXITCODE
-  if ($status -ne 0) {
-    exit $status
-  }
-  exit 0
-}
-
-$stdoutFile = [System.IO.Path]::GetTempFileName()
-$stderrFile = [System.IO.Path]::GetTempFileName()
-& $realGh @args > $stdoutFile 2> $stderrFile
-$status = $LASTEXITCODE
-$stdoutCapture = if (Test-Path -LiteralPath $stdoutFile) { Get-Content -LiteralPath $stdoutFile -Raw } else { '' }
-$stderrCapture = if (Test-Path -LiteralPath $stderrFile) { Get-Content -LiteralPath $stderrFile -Raw } else { '' }
-if ($stderrCapture) {
-  [Console]::Error.Write($stderrCapture)
-}
-if ($status -ne 0) {
-  if ($stdoutCapture) {
-    [Console]::Out.Write($stdoutCapture)
-  }
-  Remove-Item -LiteralPath $stdoutFile, $stderrFile -Force -ErrorAction SilentlyContinue
-  exit $status
-}
-if ($stdoutCapture) {
-  [Console]::Out.Write($stdoutCapture)
-}
-
-if ($isPrCreate) {
-  $createdUrl = ([regex]::Matches(($stdoutCapture + [Environment]::NewLine + $stderrCapture), 'https://github.com/\S+/pull/\d+') | Select-Object -Last 1).Value
-  if ($createdUrl) {
-    $apiPath = Get-GitHubApiPath 'pr' $createdUrl
-    $body = if ($apiPath) { (& $realGh api $apiPath --jq '.body // ""' 2>$null) | Out-String } else { $null }
-    if ($LASTEXITCODE -ne 0) {
-      $body = $null
-    }
-    $footer = if ($env:ORCA_GH_PR_FOOTER) { $env:ORCA_GH_PR_FOOTER } else { 'Made with [Orca](https://github.com/stablyai/orca) 🐋' }
-    if ($null -ne $body -and $body -notmatch [Regex]::Escape($footer)) {
-      $tmpFile = [System.IO.Path]::GetTempFileName()
-      try {
-        $trimmed = $body.TrimEnd("${POWERSHELL_TICK}r", "${POWERSHELL_TICK}n")
-        if ([string]::IsNullOrWhiteSpace($trimmed)) {
-          Set-Content -LiteralPath $tmpFile -Value $footer -NoNewline
-        } else {
-          Set-Content -LiteralPath $tmpFile -Value ($trimmed + "${POWERSHELL_TICK}r${POWERSHELL_TICK}n${POWERSHELL_TICK}r${POWERSHELL_TICK}n" + $footer) -NoNewline
-        }
-        # Why: gh has no transactional body append for newly-created PRs. This
-        # immediate REST patch keeps attribution scoped to the URL gh returned.
-        try {
-          & $realGh api -X PATCH $apiPath -F "body=@$tmpFile" | Out-Null
-        } catch {
-        }
-      } finally {
-        Remove-Item -LiteralPath $tmpFile -Force -ErrorAction SilentlyContinue
-      }
-    }
-  }
-}
-
-if ($isIssueCreate) {
-  $createdUrl = ([regex]::Matches(($stdoutCapture + [Environment]::NewLine + $stderrCapture), 'https://github.com/\S+/issues/\d+') | Select-Object -Last 1).Value
-  if ($createdUrl) {
-    $apiPath = Get-GitHubApiPath 'issue' $createdUrl
-    $body = if ($apiPath) { (& $realGh api $apiPath --jq '.body // ""' 2>$null) | Out-String } else { $null }
-    if ($LASTEXITCODE -ne 0) {
-      $body = $null
-    }
-    $footer = if ($env:ORCA_GH_ISSUE_FOOTER) { $env:ORCA_GH_ISSUE_FOOTER } else { 'Made with [Orca](https://github.com/stablyai/orca) 🐋' }
-    if ($null -ne $body -and $body -notmatch [Regex]::Escape($footer)) {
-      $tmpFile = [System.IO.Path]::GetTempFileName()
-      try {
-        $trimmed = $body.TrimEnd("${POWERSHELL_TICK}r", "${POWERSHELL_TICK}n")
-        if ([string]::IsNullOrWhiteSpace($trimmed)) {
-          Set-Content -LiteralPath $tmpFile -Value $footer -NoNewline
-        } else {
-          Set-Content -LiteralPath $tmpFile -Value ($trimmed + "${POWERSHELL_TICK}r${POWERSHELL_TICK}n${POWERSHELL_TICK}r${POWERSHELL_TICK}n" + $footer) -NoNewline
-        }
-        # Why: gh has no transactional body append for newly-created issues.
-        # This immediate REST patch keeps attribution scoped to the URL gh returned.
-        try {
-          & $realGh api -X PATCH $apiPath -F "body=@$tmpFile" | Out-Null
-        } catch {
-        }
-      } finally {
-        Remove-Item -LiteralPath $tmpFile -Force -ErrorAction SilentlyContinue
-      }
-    }
-  }
-}
-
-Remove-Item -LiteralPath $stdoutFile, $stderrFile -Force -ErrorAction SilentlyContinue
-exit 0
-`
diff --git a/src/main/automations/hermes-cron-output.ts b/src/main/automations/hermes-cron-output.ts
index db1e054f7e8..581b7f998d1 100644
--- a/src/main/automations/hermes-cron-output.ts
+++ b/src/main/automations/hermes-cron-output.ts
@@ -470,7 +470,7 @@ function findMatchingSessionRunIndex(
     (sessionRun, index) =>
       !usedSessionRunIndexes.has(index) && getRunKey(sessionRun) === outputRunKey
   )
-  if (exactMatchIndex >= 0) {
+  if (exactMatchIndex !== -1) {
     return exactMatchIndex
   }
 
@@ -798,7 +798,7 @@ function readHermesSessionDbRunRefs(jobId: string): HermesSessionRunRef[] {
   }
 }
 
-function readHermesSessionDbRunById(jobId: string, runId: string): unknown | null {
+function readHermesSessionDbRunById(jobId: string, runId: string): unknown {
   if (!existsSync(HERMES_STATE_DB)) {
     return null
   }
diff --git a/src/main/browser/agent-browser-bridge.test.ts b/src/main/browser/agent-browser-bridge.test.ts
index b9f5a9bd92d..125949f3a50 100644
--- a/src/main/browser/agent-browser-bridge.test.ts
+++ b/src/main/browser/agent-browser-bridge.test.ts
@@ -74,8 +74,8 @@ type ExecFileCallback = (error: unknown, stdout?: string, stderr?: string) => vo
 }
 
 function mockBrowserManager(
-  tabs: Map<string, number> = new Map([['tab-1', 100]]),
-  worktrees: Map<string, string> = new Map(),
+  tabs = new Map<string, number>([['tab-1', 100]]),
+  worktrees = new Map<string, string>(),
   overrides: Partial<BrowserManager> = {}
 ): BrowserManager {
   return {
diff --git a/src/main/browser/browser-cookie-import-google-exclusion.test.ts b/src/main/browser/browser-cookie-import-google-exclusion.test.ts
index 24472f8c828..431ca758f2f 100644
--- a/src/main/browser/browser-cookie-import-google-exclusion.test.ts
+++ b/src/main/browser/browser-cookie-import-google-exclusion.test.ts
@@ -89,6 +89,7 @@ describe('file import excludes the Google cookie family', () => {
       totalCookies: 4,
       importedCookies: 2,
       skippedCookies: 2,
+      googleCookiesSkipped: 2,
       domains: ['linear.app', 'youtube.com']
     })
     expect(cookiesRemoveMock.mock.calls).toEqual([['https://linear.app/', 'old-linear']])
@@ -110,6 +111,7 @@ describe('file import excludes the Google cookie family', () => {
       totalCookies: 1,
       importedCookies: 0,
       skippedCookies: 1,
+      googleCookiesSkipped: 1,
       domains: []
     })
     expect(cookiesRemoveMock).not.toHaveBeenCalled()
@@ -118,7 +120,7 @@ describe('file import excludes the Google cookie family', () => {
 })
 
 describe('native Chromium import excludes the Google cookie family', () => {
-  let clearStorageDataMock: ReturnType<typeof vi.fn>
+  let clearDataMock: ReturnType<typeof vi.fn>
   let cookiesGetMock: ReturnType<typeof vi.fn>
   let cookiesRemoveMock: ReturnType<typeof vi.fn>
   let cookiesSetMock: ReturnType<typeof vi.fn>
@@ -132,7 +134,7 @@ describe('native Chromium import excludes the Google cookie family', () => {
     execFileSyncMock.mockImplementation(() => {
       throw new Error('OS browser version lookup unavailable')
     })
-    clearStorageDataMock = vi.fn().mockResolvedValue(undefined)
+    clearDataMock = vi.fn().mockResolvedValue(undefined)
     cookiesGetMock = vi.fn().mockResolvedValue([])
     cookiesRemoveMock = vi.fn().mockResolvedValue(undefined)
     cookiesSetMock = vi.fn().mockResolvedValue(undefined)
@@ -143,7 +145,7 @@ describe('native Chromium import excludes the Google cookie family', () => {
         remove: cookiesRemoveMock,
         set: cookiesSetMock
       },
-      clearStorageData: clearStorageDataMock
+      clearData: clearDataMock
     })
     platformSpy = vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
   })
@@ -164,7 +166,7 @@ describe('native Chromium import excludes the Google cookie family', () => {
     createChromiumCookieTestDatabase(targetCookiesPath, rows).close()
   }
 
-  it('never wipes the jar wholesale and keeps the live Google cookies', async () => {
+  it('bulk clears while excluding live Google cookies before importing', async () => {
     const sourceCookiesPath = seedSource([
       { domain: '.google.com', name: 'SID', value: 'transplanted-sid' },
       { domain: '.example.com', name: 'session', value: 'new' }
@@ -181,13 +183,67 @@ describe('native Chromium import excludes the Google cookie family', () => {
       totalCookies: 2,
       importedCookies: 1,
       skippedCookies: 1,
+      googleCookiesSkipped: 1,
       domains: ['example.com']
     })
-    expect(clearStorageDataMock).not.toHaveBeenCalled()
-    expect(cookiesRemoveMock.mock.calls).toEqual([['https://example.com/', 'stale']])
+    expect(clearDataMock.mock.calls).toEqual([
+      [{ dataTypes: ['cookies'], excludeOrigins: ['https://google.com'] }]
+    ])
+    expect(cookiesRemoveMock).not.toHaveBeenCalled()
     expect(cookiesSetMock.mock.calls.map(([details]) => details.domain)).toEqual(['.example.com'])
   })
 
+  it('reports an excluded Google row even when its encrypted value is invalid', async () => {
+    const sourceCookiesPath = join(tmpDir, 'Chrome', 'Default', 'Network', 'Cookies')
+    createChromiumCookieTestDatabase(sourceCookiesPath, [
+      {
+        domain: '.google.com',
+        name: 'SID',
+        value: '',
+        encryptedValue: Buffer.from('v10-invalid')
+      },
+      { domain: '.example.com', name: 'session', value: 'new' }
+    ]).close()
+    seedTarget([])
+
+    const result = await importCookiesFromBrowser(chromeBrowser(sourceCookiesPath), 'persist:test')
+
+    expect(result.ok && result.summary).toMatchObject({
+      totalCookies: 2,
+      importedCookies: 1,
+      skippedCookies: 1,
+      googleCookiesSkipped: 1
+    })
+    expect(execFileSyncMock).not.toHaveBeenCalled()
+    expect(cookiesSetMock.mock.calls.map(([details]) => details.name)).toEqual(['session'])
+  })
+
+  it('does not request an encryption key for excluded Google rows', async () => {
+    const sourceCookiesPath = join(tmpDir, 'Chrome', 'Default', 'Network', 'Cookies')
+    createChromiumCookieTestDatabase(sourceCookiesPath, [
+      {
+        domain: '.google.com',
+        name: 'SID',
+        value: '',
+        encryptedValue: Buffer.from('v10-invalid')
+      }
+    ]).close()
+    seedTarget([])
+
+    const result = await importCookiesFromBrowser(chromeBrowser(sourceCookiesPath), 'persist:test')
+
+    expect(result.ok && result.summary).toEqual({
+      totalCookies: 1,
+      importedCookies: 0,
+      skippedCookies: 1,
+      googleCookiesSkipped: 1,
+      domains: []
+    })
+    expect(execFileSyncMock).not.toHaveBeenCalled()
+    expect(clearDataMock).not.toHaveBeenCalled()
+    expect(cookiesSetMock).not.toHaveBeenCalled()
+  })
+
   it('keeps the live Google rows in the staged restart-fallback database', async () => {
     const sourceCookiesPath = seedSource([
       { domain: '.google.com', name: 'SID', value: 'transplanted-sid' },
@@ -211,6 +267,35 @@ describe('native Chromium import excludes the Google cookie family', () => {
       { host_key: '.google.com', name: 'SID', value: 'live-sid' }
     ])
   })
+
+  // Why (STA-4061): reconstruction drops partition keys, so a rejected removal must not rebuild
+  // anything — not the excluded Google rows, and not the non-Google rows that were already gone.
+  it('fails the import without reconstructing any cookie when selective removal rejects', async () => {
+    const sourceCookiesPath = seedSource([
+      { domain: '.example.com', name: 'session', value: 'new' }
+    ])
+    seedTarget([{ domain: '.example.com', name: 'stale', value: 'stale' }])
+    cookiesGetMock.mockResolvedValue([
+      existingCookie('.google.com', 'SID'),
+      existingCookie('.example.com', 'removed-first'),
+      existingCookie('.other.test', 'stale')
+    ])
+    cookiesRemoveMock.mockImplementation(async (_url: string, name: string) => {
+      if (name === 'stale') {
+        throw new Error('cookie store unavailable')
+      }
+    })
+    clearDataMock.mockRejectedValue(new Error('storage busy'))
+
+    const result = await importCookiesFromBrowser(chromeBrowser(sourceCookiesPath), 'persist:test')
+
+    expect(result).toMatchObject({ ok: false })
+    expect(result.ok || result.reason).toContain('Could not clear existing cookies')
+    expect(clearDataMock).toHaveBeenCalledOnce()
+    expect(cookiesRemoveMock.mock.calls.map(([, name]) => name)).toEqual(['removed-first', 'stale'])
+    expect(cookiesSetMock).not.toHaveBeenCalled()
+    expect(setPendingCookieImportMock).not.toHaveBeenCalled()
+  })
 })
 
 // Why: freshly imported rows store the decrypted value as a BLOB; read both forms as text.
diff --git a/src/main/browser/browser-cookie-import-partition-rollback.electron.test.ts b/src/main/browser/browser-cookie-import-partition-rollback.electron.test.ts
new file mode 100644
index 00000000000..bbd0d9a8a25
--- /dev/null
+++ b/src/main/browser/browser-cookie-import-partition-rollback.electron.test.ts
@@ -0,0 +1,197 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import { build as buildVite } from 'vite'
+
+const electronBinary = createRequire(import.meta.url)('electron') as string
+const fixtureRoots: string[] = []
+
+afterAll(() => {
+  for (const root of fixtureRoots) {
+    rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+  }
+})
+
+type CdpCookie = { name: string; value: string; partitionKey?: Record<string, unknown> }
+
+type FixtureResult = {
+  beforePartitionKey: Record<string, unknown> | undefined
+  clearError: string | null
+  bulkClearCalls: number
+  remainingChips: CdpCookie[]
+  remainingPlain: CdpCookie[]
+  remainingExcluded: CdpCookie[]
+}
+
+const EXPECTED_PARTITION_KEY = {
+  topLevelSite: 'https://top.example',
+  hasCrossSiteAncestor: true
+}
+
+function buildFixtureMain(policyPath: string, resultPath: string): string {
+  return `
+const { app, BrowserWindow, session } = require('electron')
+const { writeFileSync } = require('node:fs')
+const { removeTransplantableCookies } = require(${JSON.stringify(policyPath)})
+const resultPath = ${JSON.stringify(resultPath)}
+let currentStep = 'starting'
+const mark = (step) => {
+  currentStep = step
+  writeFileSync(resultPath, JSON.stringify({ step }))
+}
+
+async function run() {
+  const timeout = setTimeout(() => {
+    writeFileSync(resultPath, JSON.stringify({ step: 'timed out after ' + currentStep }))
+    app.exit(1)
+  }, 20000)
+  await app.whenReady()
+  mark('ready')
+  const partition = 'persist:partition-rollback-cookie-test'
+  const targetSession = session.fromPartition(partition)
+  const window = new BrowserWindow({ show: false, webPreferences: { partition } })
+  mark('window created')
+  await window.loadURL('data:text/html,<title>cookie rollback fixture</title>')
+  mark('window loaded')
+  const debug = window.webContents.debugger
+  debug.attach('1.3')
+  mark('debugger attached')
+  await debug.sendCommand('Network.enable')
+  mark('network enabled')
+
+  // Only CDP can create a partitioned cookie; Electron's cookies API has no partitionKey.
+  await debug.sendCommand('Network.setCookie', {
+    url: 'https://app.acme-chips.test/',
+    name: 'chips-auth',
+    value: 'keep-me',
+    secure: true,
+    sameSite: 'None',
+    partitionKey: ${JSON.stringify(EXPECTED_PARTITION_KEY)}
+  })
+  const beforeChips = (await debug.sendCommand('Network.getAllCookies')).cookies
+    .find((cookie) => cookie.name === 'chips-auth')
+  if (!beforeChips || !beforeChips.partitionKey) throw new Error('CHIPS fixture cookie was not stored partitioned')
+  mark('partitioned cookie set')
+
+  await targetSession.cookies.set({ url: 'https://plain.example/', name: 'plain', value: 'stale', secure: true })
+  await targetSession.cookies.set({ url: 'https://victim.example/', name: 'victim', value: 'stale', secure: true })
+  // Why: keep a live excluded cookie in the partial-failure fixture so the fallback proves it
+  // preserves that cookie while deleting the removable ones it can reach.
+  await targetSession.cookies.set({ url: 'https://accounts.google.com/', name: 'SID', value: 'live', secure: true })
+  mark('removable cookies set')
+
+  const store = {
+    get: (filter) => targetSession.cookies.get(filter),
+    set: (details) => targetSession.cookies.set(details),
+    // Why: one rejecting removal is what drove the old rollback; the rest still succeed.
+    remove: async (url, name) => {
+      if (name === 'victim') throw new Error('forced victim removal failure')
+      return targetSession.cookies.remove(url, name)
+    }
+  }
+
+  // Why: the bulk clear is the ordinary path now, so rejecting it is what routes this fixture onto
+  // the per-cookie fallback where a partial failure — and the old rollback — could happen at all.
+  let bulkClearCalls = 0
+  const clearSession = {
+    cookies: store,
+    clearData: async () => {
+      bulkClearCalls++
+      throw new Error('forced bulk clear failure')
+    }
+  }
+
+  let clearError = null
+  try {
+    await removeTransplantableCookies(clearSession)
+  } catch (error) {
+    clearError = String(error?.message || error)
+  }
+  mark('clear finished')
+
+  const afterCookies = (await debug.sendCommand('Network.getAllCookies')).cookies
+  const project = (name) => afterCookies
+    .filter((cookie) => cookie.name === name)
+    .map((cookie) => ({ name: cookie.name, value: cookie.value, partitionKey: cookie.partitionKey }))
+  clearTimeout(timeout)
+  writeFileSync(resultPath, JSON.stringify({
+    beforePartitionKey: beforeChips.partitionKey,
+    clearError,
+    bulkClearCalls,
+    remainingChips: project('chips-auth'),
+    remainingPlain: project('plain'),
+    remainingExcluded: project('SID')
+  }))
+  debug.detach()
+  window.destroy()
+  app.exit(0)
+}
+
+run().catch((error) => {
+  writeFileSync(resultPath, JSON.stringify({ step: currentStep, error: String(error?.stack || error) }))
+  app.exit(1)
+})
+`
+}
+
+async function runFixture(): Promise<FixtureResult> {
+  const root = mkdtempSync(join(tmpdir(), 'orca-partition-rollback-'))
+  fixtureRoots.push(root)
+  const policyPath = join(root, 'browser-cookie-import-policy.cjs')
+  const resultPath = join(root, 'result.json')
+  const fixturePath = join(root, 'main.cjs')
+  await buildVite({
+    configFile: false,
+    logLevel: 'silent',
+    build: {
+      emptyOutDir: false,
+      lib: {
+        entry: join(process.cwd(), 'src/main/browser/browser-cookie-import-policy.ts'),
+        formats: ['cjs'],
+        fileName: () => 'browser-cookie-import-policy.cjs'
+      },
+      outDir: root,
+      target: 'node20',
+      rollupOptions: { external: ['electron', /^node:/] }
+    }
+  })
+  writeFileSync(fixturePath, buildFixtureMain(policyPath, resultPath))
+  const { ELECTRON_RUN_AS_NODE: _electronRunAsNode, ...env } = process.env
+  const electronArgs = [fixturePath, `--user-data-dir=${join(root, 'profile')}`]
+  const executable = process.platform === 'linux' ? 'xvfb-run' : electronBinary
+  const args =
+    process.platform === 'linux'
+      ? ['--auto-servernum', electronBinary, ...electronArgs, '--no-sandbox']
+      : electronArgs
+  const run = spawnSync(executable, args, {
+    encoding: 'utf8',
+    env,
+    timeout: 60_000
+  })
+  const fixtureResult = existsSync(resultPath) ? readFileSync(resultPath, 'utf8') : 'no result'
+  expect(run.error).toBeUndefined()
+  expect(run.status, `${fixtureResult}\n${run.stdout}\n${run.stderr}`).toBe(0)
+  return JSON.parse(fixtureResult) as FixtureResult
+}
+
+describe('non-Google partitioned cookie under a failed Electron cookie clear', () => {
+  it('never resurrects a removed partitioned cookie', async () => {
+    const result = await runFixture()
+
+    expect(result.beforePartitionKey).toEqual(EXPECTED_PARTITION_KEY)
+    // Why (STA-4065): the fallback is only reachable once the bulk clear has been tried and failed;
+    // if it ever succeeded here the partial-failure assertions below would be vacuous.
+    expect(result.bulkClearCalls).toBe(1)
+    expect(result.remainingExcluded.map(({ name }) => name)).toEqual(['SID'])
+    expect(result.clearError).toContain('Could not clear existing cookies')
+    // STA-4061: rollback rebuilt this cookie through cookies.set, which drops partitionKey.
+    expect(
+      result.remainingChips,
+      `chips-auth survived: ${JSON.stringify(result.remainingChips)}`
+    ).toEqual([])
+    expect(result.remainingPlain).toEqual([])
+  }, 90_000)
+})
diff --git a/src/main/browser/browser-cookie-import-partition.electron.test.ts b/src/main/browser/browser-cookie-import-partition.electron.test.ts
new file mode 100644
index 00000000000..e844341e12f
--- /dev/null
+++ b/src/main/browser/browser-cookie-import-partition.electron.test.ts
@@ -0,0 +1,213 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import { build as buildVite } from 'vite'
+import { createChromiumCookieTestDatabase } from './browser-cookie-import-test-database'
+
+const electronBinary = createRequire(import.meta.url)('electron') as string
+const fixtureRoots: string[] = []
+
+afterAll(() => {
+  for (const root of fixtureRoots) {
+    rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+  }
+})
+
+type FixtureResult = {
+  before: Record<string, unknown>
+  after: Record<string, unknown>
+  electronCookieKeys: string[]
+  importResult: Record<string, unknown>
+  remainingNames: string[]
+}
+
+function buildFixtureMain(
+  importPath: string,
+  resultPath: string,
+  sourceCookiesPath: string
+): string {
+  return `
+const { app, BrowserWindow, session } = require('electron')
+const { writeFileSync } = require('node:fs')
+const { importCookiesFromBrowser } = require(${JSON.stringify(importPath)})
+const resultPath = ${JSON.stringify(resultPath)}
+let currentStep = 'starting'
+const mark = (step) => {
+  currentStep = step
+  writeFileSync(resultPath, JSON.stringify({ step }))
+}
+
+async function run() {
+  const timeout = setTimeout(() => {
+    writeFileSync(resultPath, JSON.stringify({ step: 'timed out after ' + currentStep }))
+    app.exit(1)
+  }, 15000)
+  await app.whenReady()
+  mark('ready')
+  const partition = 'persist:partition-cookie-test'
+  const targetSession = session.fromPartition(partition)
+  const window = new BrowserWindow({ show: false, webPreferences: { partition } })
+  mark('window created')
+  await window.loadURL('data:text/html,<title>cookie fixture</title>')
+  mark('window loaded')
+  const debug = window.webContents.debugger
+  debug.attach('1.3')
+  mark('debugger attached')
+  await debug.sendCommand('Network.enable')
+  mark('network enabled')
+  await debug.sendCommand('Network.setCookie', {
+    url: 'https://accounts.google.com/',
+    name: 'partitioned-google',
+    value: 'live-value',
+    secure: true,
+    httpOnly: true,
+    sameSite: 'None',
+    partitionKey: { topLevelSite: 'https://example.com', hasCrossSiteAncestor: true }
+  })
+  mark('partitioned cookie set')
+  await targetSession.cookies.set({
+    url: 'https://stale.example/',
+    name: 'stale',
+    value: 'remove-me',
+    secure: true
+  })
+  // Why: the excluded origin is HTTPS, so prove registrable-domain matching also keeps HTTP.
+  await targetSession.cookies.set({
+    url: 'http://mail.google.com/',
+    name: 'http-google',
+    value: 'live-http-value',
+    secure: false
+  })
+  await targetSession.cookies.set({
+    url: 'https://google.com/',
+    domain: '.google.com',
+    name: 'domain-google',
+    value: 'live-domain-value',
+    secure: true
+  })
+  mark('ordinary cookie set')
+
+  const beforeCookies = (await debug.sendCommand('Network.getAllCookies')).cookies
+  const before = beforeCookies.find((cookie) => cookie.name === 'partitioned-google')
+  const electronCookie = (await targetSession.cookies.get({ name: 'partitioned-google' }))[0]
+  if (!before || !electronCookie) throw new Error('Partitioned fixture cookie was not created')
+  mark('cookies read')
+
+  const importResult = await importCookiesFromBrowser({
+    family: 'chrome',
+    label: 'Chromium fixture',
+    cookiesPath: ${JSON.stringify(sourceCookiesPath)},
+    profiles: [{ name: 'Default', directory: 'Default' }],
+    selectedProfile: 'Default'
+  }, partition)
+  if (!importResult.ok) throw new Error('Native import failed: ' + importResult.reason)
+  mark('native import complete')
+
+  const afterCookies = (await debug.sendCommand('Network.getAllCookies')).cookies
+  const after = afterCookies.find((cookie) => cookie.name === 'partitioned-google')
+  if (!after) throw new Error('Partitioned Google cookie was removed')
+  clearTimeout(timeout)
+  writeFileSync(resultPath, JSON.stringify({
+    before,
+    after,
+    electronCookieKeys: Object.keys(electronCookie).sort(),
+    importResult,
+    remainingNames: afterCookies.map((cookie) => cookie.name).sort()
+  }))
+  debug.detach()
+  window.destroy()
+  app.exit(0)
+}
+
+run().catch((error) => {
+  writeFileSync(resultPath, JSON.stringify({ step: currentStep, error: String(error?.stack || error) }))
+  app.exit(1)
+})
+`
+}
+
+async function runFixture(): Promise<FixtureResult> {
+  const root = mkdtempSync(join(tmpdir(), 'orca-partition-cookie-'))
+  fixtureRoots.push(root)
+  const importPath = join(root, 'browser-cookie-import.cjs')
+  const registryStubPath = join(root, 'browser-session-registry.cjs')
+  const resultPath = join(root, 'result.json')
+  const sourceCookiesPath = join(root, 'source', 'Network', 'Cookies')
+  const fixturePath = join(root, 'main.cjs')
+  createChromiumCookieTestDatabase(sourceCookiesPath, [
+    { domain: '.example.com', name: 'imported', value: 'new-value' }
+  ]).close()
+  writeFileSync(
+    registryStubPath,
+    'exports.browserSessionRegistry = { clearPendingCookieImport() {}, setPendingCookieImport() {} }\n'
+  )
+  await buildVite({
+    configFile: false,
+    logLevel: 'silent',
+    plugins: [
+      {
+        name: 'stub-browser-session-registry',
+        resolveId(source, importer) {
+          return source === './browser-session-registry' &&
+            importer?.endsWith('browser-cookie-import.ts')
+            ? registryStubPath
+            : null
+        }
+      }
+    ],
+    build: {
+      emptyOutDir: false,
+      lib: {
+        entry: join(process.cwd(), 'src/main/browser/browser-cookie-import.ts'),
+        formats: ['cjs'],
+        fileName: () => 'browser-cookie-import.cjs'
+      },
+      outDir: root,
+      target: 'node20',
+      rollupOptions: { external: ['electron', /^node:/] }
+    }
+  })
+  writeFileSync(fixturePath, buildFixtureMain(importPath, resultPath, sourceCookiesPath))
+  const { ELECTRON_RUN_AS_NODE: _electronRunAsNode, ...env } = process.env
+  const electronArgs = [fixturePath, `--user-data-dir=${join(root, 'profile')}`]
+  const executable = process.platform === 'linux' ? 'xvfb-run' : electronBinary
+  const args =
+    process.platform === 'linux'
+      ? ['--auto-servernum', electronBinary, ...electronArgs, '--no-sandbox']
+      : electronArgs
+  const run = spawnSync(executable, args, {
+    encoding: 'utf8',
+    env,
+    timeout: 60_000
+  })
+  const fixtureResult = existsSync(resultPath) ? readFileSync(resultPath, 'utf8') : 'no result'
+  expect(run.error).toBeUndefined()
+  expect(run.status, `${fixtureResult}\n${run.stdout}\n${run.stderr}`).toBe(0)
+  return JSON.parse(fixtureResult) as FixtureResult
+}
+
+describe('native Chromium excluded partition cookie under Electron', () => {
+  it('survives selective clearing unchanged without a lossy Electron reconstruction', async () => {
+    const result = await runFixture()
+
+    expect(result.before.partitionKey).toEqual({
+      topLevelSite: 'https://example.com',
+      hasCrossSiteAncestor: true
+    })
+    expect(result.electronCookieKeys).not.toContain('partitionKey')
+    expect(result.after).toEqual(result.before)
+    expect(result.importResult).toMatchObject({
+      ok: true,
+      summary: { importedCookies: 1, domains: ['example.com'] }
+    })
+    expect(result.remainingNames).toEqual([
+      'domain-google',
+      'http-google',
+      'imported',
+      'partitioned-google'
+    ])
+  }, 90_000)
+})
diff --git a/src/main/browser/browser-cookie-import-policy.test.ts b/src/main/browser/browser-cookie-import-policy.test.ts
index 0969921724c..51a1a6107d5 100644
--- a/src/main/browser/browser-cookie-import-policy.test.ts
+++ b/src/main/browser/browser-cookie-import-policy.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it, vi, type Mock } from 'vitest'
 import { DatabaseSync } from 'node:sqlite'
 import type { Cookie } from 'electron'
 import {
@@ -6,7 +6,7 @@ import {
   isNonTransplantableCookieDomain,
   NON_TRANSPLANTABLE_HOST_KEY_SQL,
   normalizeCookieDomain,
-  removeAllCookiesExcept,
+  removeTransplantableCookies,
   replaceCookiesForImportedDomains
 } from './browser-cookie-import-policy'
 
@@ -207,70 +207,193 @@ describe('NON_TRANSPLANTABLE_HOST_KEY_SQL', () => {
   })
 })
 
-describe('removeAllCookiesExcept', () => {
-  it('removes only the cookies the predicate does not exclude', async () => {
-    const get = vi
-      .fn()
-      .mockResolvedValue([
-        cookie('.google.com', 'SID'),
-        cookie('.example.com', 'session'),
-        cookie('other.test', 'tracker', '/scoped')
-      ])
-    const remove = vi.fn().mockResolvedValue(undefined)
-    const set = vi.fn().mockResolvedValue(undefined)
+type CookieClearMocks = {
+  get: Mock
+  remove: Mock
+  set: Mock
+  clearData: Mock
+}
 
-    await removeAllCookiesExcept({ get, remove, set }, (c) => c.domain === '.google.com')
+describe('removeTransplantableCookies', () => {
+  const rejectingBulkClear = () => vi.fn().mockRejectedValue(new Error('storage busy'))
 
-    expect(remove.mock.calls).toEqual([
-      ['https://example.com/', 'session'],
-      ['https://other.test/scoped', 'tracker']
+  function clearSession(cookies: Cookie[], overrides: Partial<CookieClearMocks> = {}) {
+    const store = {
+      get: vi.fn().mockResolvedValue(cookies),
+      remove: vi.fn().mockResolvedValue(undefined),
+      set: vi.fn().mockResolvedValue(undefined),
+      ...overrides
+    }
+    const clearData = overrides.clearData ?? vi.fn().mockResolvedValue(undefined)
+    return {
+      session: { cookies: store, clearData },
+      get: store.get,
+      remove: store.remove,
+      set: store.set,
+      clearData
+    }
+  }
+
+  // Why (STA-4065): the bulk call is the ordinary path even when the jar holds cookies to keep —
+  // excludeOrigins preserves the whole google.com family, verified against real Electron.
+  it('clears a jar holding Google cookies in one call that excludes them', async () => {
+    const { session, remove, set, clearData } = clearSession([
+      cookie('.google.com', 'SID'),
+      cookie('accounts.google.com', 'ACCOUNT'),
+      cookie('.example.com', 'session'),
+      cookie('other.test', 'tracker', '/scoped')
     ])
+
+    await removeTransplantableCookies(session)
+
+    expect(clearData.mock.calls).toEqual([
+      [{ dataTypes: ['cookies'], excludeOrigins: ['https://google.com'] }]
+    ])
+    expect(remove).not.toHaveBeenCalled()
     expect(set).not.toHaveBeenCalled()
   })
 
-  it('restores every successfully removed cookie when another removal fails', async () => {
-    const get = vi
-      .fn()
-      .mockResolvedValue([
+  it('bulk clears in one call when the jar holds nothing to preserve', async () => {
+    const { session, remove, set, clearData } = clearSession([
+      cookie('.example.com', 'session'),
+      cookie('other.test', 'tracker', '/scoped'),
+      cookie('notgoogle.com', 'lookalike')
+    ])
+
+    await removeTransplantableCookies(session)
+
+    expect(clearData.mock.calls).toEqual([
+      [{ dataTypes: ['cookies'], excludeOrigins: ['https://google.com'] }]
+    ])
+    expect(remove).not.toHaveBeenCalled()
+    expect(set).not.toHaveBeenCalled()
+  })
+
+  it('touches nothing when the jar is already empty', async () => {
+    const { session, remove, clearData } = clearSession([])
+
+    await removeTransplantableCookies(session)
+
+    expect(clearData).not.toHaveBeenCalled()
+    expect(remove).not.toHaveBeenCalled()
+  })
+
+  it('bulk clears cookies the per-cookie path could never address', async () => {
+    const { session, clearData } = clearSession([
+      { ...cookie('.example.com', 'session'), domain: '' }
+    ])
+
+    await removeTransplantableCookies(session)
+
+    expect(clearData).toHaveBeenCalledOnce()
+  })
+
+  it('falls back to per-cookie removal when the bulk clear rejects', async () => {
+    const { session, remove, clearData } = clearSession(
+      [cookie('.example.com', 'session'), cookie('other.test', 'tracker')],
+      { clearData: rejectingBulkClear() }
+    )
+
+    await removeTransplantableCookies(session)
+
+    expect(clearData).toHaveBeenCalledOnce()
+    expect(remove.mock.calls).toEqual([
+      ['https://example.com/', 'session'],
+      ['https://other.test/', 'tracker']
+    ])
+  })
+
+  it('re-reads the jar after a rejected bulk clear', async () => {
+    const beforeAttempt = [cookie('.removed.test', 'gone-before-fallback')]
+    const afterAttempt = [
+      cookie('.google.com', 'SID'),
+      cookie('.survivor.test', 'survived'),
+      cookie('.arrived.test', 'arrived-during-clear')
+    ]
+    const get = vi.fn().mockResolvedValueOnce(beforeAttempt).mockResolvedValueOnce(afterAttempt)
+    const { session, remove } = clearSession(beforeAttempt, {
+      get,
+      clearData: rejectingBulkClear()
+    })
+
+    await removeTransplantableCookies(session)
+
+    expect(get).toHaveBeenCalledTimes(2)
+    expect(remove.mock.calls).toEqual([
+      ['https://survivor.test/', 'survived'],
+      ['https://arrived.test/', 'arrived-during-clear']
+    ])
+  })
+
+  // Why: the fallback carries the same exclusion as the bulk call, so a rejected clearData must
+  // not become the path that finally deletes a live Google session.
+  it('still preserves Google cookies on the per-cookie fallback', async () => {
+    const { session, remove, set } = clearSession(
+      [
+        cookie('.google.com', 'SID'),
+        cookie('accounts.google.com', 'ACCOUNT'),
+        cookie('.example.com', 'session')
+      ],
+      { clearData: rejectingBulkClear() }
+    )
+
+    await removeTransplantableCookies(session)
+
+    expect(remove.mock.calls).toEqual([['https://example.com/', 'session']])
+    expect(set).not.toHaveBeenCalled()
+  })
+
+  // Why (STA-4061): reconstructing a removed cookie loses its partition key, and the snapshot
+  // cannot say which cookies had one, so a failed clear must stay failed.
+  it('never reconstructs removed cookies when another removal fails', async () => {
+    const { session, remove, set } = clearSession(
+      [
+        cookie('.google.com', 'SID'),
         cookie('.example.com', 'first', '/one'),
         cookie('.example.com', 'second', '/two'),
         cookie('.example.com', 'third', '/three')
-      ])
-    const remove = vi.fn().mockImplementation(async (_url: string, name: string) => {
-      if (name === 'second') {
-        throw new Error('store unavailable')
+      ],
+      {
+        clearData: rejectingBulkClear(),
+        remove: vi.fn().mockImplementation(async (_url: string, name: string) => {
+          if (name === 'second') {
+            throw new Error('store unavailable')
+          }
+        })
       }
-    })
-    const set = vi.fn().mockResolvedValue(undefined)
+    )
 
-    await expect(removeAllCookiesExcept({ get, remove, set }, () => false)).rejects.toThrow(
-      'Could not clear existing cookies'
+    await expect(removeTransplantableCookies(session)).rejects.toThrow(
+      'the session was left partially cleared'
     )
     expect(remove).toHaveBeenCalledTimes(3)
-    expect(set.mock.calls.map(([details]) => details.name)).toEqual(['first', 'third'])
+    expect(set).not.toHaveBeenCalled()
   })
 
   it('bounds parallel removals so large cookie jars do not clear serially or fan out', async () => {
-    const get = vi
-      .fn()
-      .mockResolvedValue(
-        Array.from({ length: 12 }, (_, index) => cookie('.example.com', `${index}`))
-      )
     let releaseRemovals: (() => void) | undefined
     const removalsReleased = new Promise<void>((resolve) => {
       releaseRemovals = resolve
     })
     let active = 0
     let maxActive = 0
-    const remove = vi.fn().mockImplementation(async () => {
-      active++
-      maxActive = Math.max(maxActive, active)
-      await removalsReleased
-      active--
-    })
-    const set = vi.fn().mockResolvedValue(undefined)
+    const { session, remove, set } = clearSession(
+      [
+        cookie('.google.com', 'SID'),
+        ...Array.from({ length: 12 }, (_, index) => cookie('.example.com', `${index}`))
+      ],
+      {
+        clearData: rejectingBulkClear(),
+        remove: vi.fn().mockImplementation(async () => {
+          active++
+          maxActive = Math.max(maxActive, active)
+          await removalsReleased
+          active--
+        })
+      }
+    )
 
-    const clearing = removeAllCookiesExcept({ get, remove, set }, () => false)
+    const clearing = removeTransplantableCookies(session)
     await vi.waitFor(() => expect(remove).toHaveBeenCalledTimes(8))
     expect(maxActive).toBe(8)
     releaseRemovals?.()
@@ -281,23 +404,26 @@ describe('removeAllCookiesExcept', () => {
   })
 
   it('serializes cookies that share Electron removal coordinates', async () => {
-    const get = vi
-      .fn()
-      .mockResolvedValue([
-        cookie('.example.com', 'session'),
-        { ...cookie('example.com', 'session'), hostOnly: true }
-      ])
     let releaseFirst: (() => void) | undefined
     const firstReleased = new Promise<void>((resolve) => {
       releaseFirst = resolve
     })
-    const remove = vi
-      .fn()
-      .mockImplementationOnce(() => firstReleased)
-      .mockResolvedValueOnce(undefined)
-    const set = vi.fn().mockResolvedValue(undefined)
+    const { session, remove } = clearSession(
+      [
+        cookie('.google.com', 'SID'),
+        cookie('.example.com', 'session'),
+        { ...cookie('example.com', 'session'), hostOnly: true }
+      ],
+      {
+        clearData: rejectingBulkClear(),
+        remove: vi
+          .fn()
+          .mockImplementationOnce(() => firstReleased)
+          .mockResolvedValueOnce(undefined)
+      }
+    )
 
-    const clearing = removeAllCookiesExcept({ get, remove, set }, () => false)
+    const clearing = removeTransplantableCookies(session)
     await vi.waitFor(() => expect(remove).toHaveBeenCalledOnce())
     releaseFirst?.()
     await clearing
diff --git a/src/main/browser/browser-cookie-import-policy.ts b/src/main/browser/browser-cookie-import-policy.ts
index 8f6008ac7a4..6f81407f4a9 100644
--- a/src/main/browser/browser-cookie-import-policy.ts
+++ b/src/main/browser/browser-cookie-import-policy.ts
@@ -1,4 +1,4 @@
-import type { Cookie, Cookies } from 'electron'
+import type { Cookie, Cookies, Session } from 'electron'
 import { parse as parseDomain } from 'psl'
 import { mapSettledWithConcurrency } from '../../shared/map-with-concurrency'
 
@@ -59,11 +59,16 @@ export function normalizeCookieImportDomain(domain: string): string | null {
 // it is copied. Signing in directly inside Orca is the only path that produces a working
 // session, so an import must never write these cookies and never remove them either — the
 // live session is always more valuable than anything an import could put in its place.
+// Entries must be canonical lowercase ASCII (punycode) registrable domains, never subdomains or
+// public suffixes, because clearData derives one excluded origin and matches at that boundary.
 // Adding a site is one entry here.
 // youtube.com is deliberately NOT listed: YouTube accepts a transplanted session and re-issues
 // its cookies via the accounts.youtube.com relay, so excluding it would silently drop imports
 // users actually asked for.
 const NON_TRANSPLANTABLE_DOMAINS = ['google.com'] as const
+const NON_TRANSPLANTABLE_CLEAR_EXCLUDED_ORIGINS = NON_TRANSPLANTABLE_DOMAINS.map(
+  (root) => `https://${root}`
+)
 const COOKIE_CLEAR_CONCURRENCY = 8
 
 export function isNonTransplantableCookieDomain(domain: string): boolean {
@@ -196,16 +201,49 @@ export async function restoreImportedDomainCookies(
   }
 }
 
-// Why: clearStorageData wipes the whole jar, including the non-transplantable families an
-// import is never allowed to remove; this is the clear step that can leave them in place.
-export async function removeAllCookiesExcept(
-  store: Pick<Cookies, 'get' | 'remove' | 'set'>,
-  isExcluded: (cookie: Cookie) => boolean
+// Why (STA-4061): 'set' stays out so the lossy partition-dropping reconstruction cannot return.
+export type CookieClearSession = {
+  cookies: Pick<Cookies, 'get' | 'remove'>
+  clearData: Session['clearData']
+}
+
+// Why: Electron cannot round-trip partition identity, so excluded cookies must never be removed.
+// Why (STA-4061): the same gap forbids rolling a partial clear back. cookies.get() omits
+// partitionKey and cookies.set() silently drops it, so every reconstruction is a coin flip that
+// can downgrade a partitioned (CHIPS) cookie into an unpartitioned one — and nothing in the
+// snapshot says which cookies are at risk. A partially cleared jar is a retryable import failure;
+// a downgraded cookie is unrecoverable auth-state corruption that survives restart.
+// Why (STA-4065): the exclusion is module state rather than a parameter so the predicate and the
+// origins the bulk clear preserves cannot drift apart — a caller-supplied predicate that disagreed
+// with NON_TRANSPLANTABLE_DOMAINS would silently delete a cookie the bulk call is meant to keep.
+export async function removeTransplantableCookies(
+  targetSession: CookieClearSession
 ): Promise<void> {
+  const store = targetSession.cookies
+  const initialCookies = await store.get({})
+  if (initialCookies.length === 0) {
+    return
+  }
+
+  // Why (STA-4065): measured on Electron 43, excludeOrigins preserves the whole registrable
+  // family — host, leading-dot, subdomain, and partitioned Google cookies — so one call replaces a
+  // remove() per cookie even when the jar holds cookies to keep. That is the ordinary case here:
+  // this import exists for Google, so a Google cookie is usually present.
+  try {
+    await targetSession.clearData({
+      dataTypes: ['cookies'],
+      excludeOrigins: NON_TRANSPLANTABLE_CLEAR_EXCLUDED_ORIGINS
+    })
+    return
+  } catch {
+    // Why: a rejected bulk clear can still have changed the jar, so the fallback must act on the
+    // survivors rather than stale removal coordinates from before the attempt.
+  }
+
   const existingCookies = await store.get({})
   const removableGroups = new Map<string, { cookie: Cookie; url: string }[]>()
   for (const cookie of existingCookies) {
-    if (isExcluded(cookie)) {
+    if (isNonTransplantableCookieDomain(cookie.domain ?? '')) {
       continue
     }
     const domain = cookie.domain ? normalizeCookieDomain(cookie.domain) : null
@@ -219,30 +257,25 @@ export async function removeAllCookiesExcept(
     removableGroups.set(key, group)
   }
 
-  const removedCookies: Cookie[] = []
   const results = await mapSettledWithConcurrency(
     [...removableGroups.values()],
     COOKIE_CLEAR_CONCURRENCY,
     async (group) => {
-      // Why: identical remove keys must stay ordered so duplicate scoped cookies are not raced.
+      // Why: identical removal coordinates must stay ordered instead of racing.
       for (const { cookie, url } of group) {
         await store.remove(url, cookie.name)
-        removedCookies.push(cookie)
       }
     }
   )
   const failures = results.flatMap((result) =>
     result.status === 'rejected' ? [result.reason] : []
   )
-  if (failures.length === 0) {
-    return
+  if (failures.length > 0) {
+    throw new AggregateError(
+      failures,
+      'Could not clear existing cookies; the session was left partially cleared'
+    )
   }
-  try {
-    await restoreImportedDomainCookies(store, removedCookies)
-  } catch (restoreError) {
-    throw new AggregateError([...failures, restoreError], 'Cookie clearing and rollback failed')
-  }
-  throw new AggregateError(failures, 'Could not clear existing cookies')
 }
 
 export async function replaceCookiesForImportedDomains(
diff --git a/src/main/browser/browser-cookie-import-replacement.test.ts b/src/main/browser/browser-cookie-import-replacement.test.ts
index 79553d3a651..db70922ccb5 100644
--- a/src/main/browser/browser-cookie-import-replacement.test.ts
+++ b/src/main/browser/browser-cookie-import-replacement.test.ts
@@ -79,6 +79,7 @@ describe('validated cookie replacement', () => {
       totalCookies: 3,
       importedCookies: 1,
       skippedCookies: 2,
+      googleCookiesSkipped: 2,
       domains: ['example.com']
     })
     expect(cookiesRemoveMock.mock.calls).toEqual([['https://example.com/', 'old-example']])
@@ -99,6 +100,7 @@ describe('validated cookie replacement', () => {
       totalCookies: 1,
       importedCookies: 0,
       skippedCookies: 1,
+      googleCookiesSkipped: 1,
       domains: []
     })
     expect(cookiesGetMock).not.toHaveBeenCalled()
@@ -166,7 +168,7 @@ describe('validated cookie replacement', () => {
 })
 
 describe('native Chromium integrity-cookie accounting', () => {
-  let clearStorageDataMock: ReturnType<typeof vi.fn>
+  let clearDataMock: ReturnType<typeof vi.fn>
   let cookiesSetMock: ReturnType<typeof vi.fn>
   let tmpDir: string
 
@@ -178,7 +180,7 @@ describe('native Chromium integrity-cookie accounting', () => {
     })
     clearPendingCookieImportMock.mockClear()
     setPendingCookieImportMock.mockClear()
-    clearStorageDataMock = vi.fn().mockResolvedValue(undefined)
+    clearDataMock = vi.fn().mockResolvedValue(undefined)
     cookiesSetMock = vi.fn().mockResolvedValue(undefined)
     sessionFromPartitionMock.mockReset().mockReturnValue({
       cookies: {
@@ -187,7 +189,7 @@ describe('native Chromium integrity-cookie accounting', () => {
         remove: vi.fn().mockResolvedValue(undefined),
         set: cookiesSetMock
       },
-      clearStorageData: clearStorageDataMock
+      clearData: clearDataMock
     })
   })
 
@@ -215,6 +217,7 @@ describe('native Chromium integrity-cookie accounting', () => {
         totalCookies: 3,
         importedCookies: 1,
         skippedCookies: 2,
+        googleCookiesSkipped: 2,
         domains: ['example.com']
       })
       expect(cookiesSetMock.mock.calls.map(([details]) => details.name)).toEqual(['AEC'])
@@ -246,9 +249,10 @@ describe('native Chromium integrity-cookie accounting', () => {
         totalCookies: 3,
         importedCookies: 0,
         skippedCookies: 3,
+        googleCookiesSkipped: 2,
         domains: []
       })
-      expect(clearStorageDataMock).not.toHaveBeenCalled()
+      expect(clearDataMock).not.toHaveBeenCalled()
       expect(cookiesSetMock).not.toHaveBeenCalled()
       expect(setPendingCookieImportMock).not.toHaveBeenCalled()
       expect(clearPendingCookieImportMock).not.toHaveBeenCalled()
diff --git a/src/main/browser/browser-cookie-import.test.ts b/src/main/browser/browser-cookie-import.test.ts
index 50e232c0b7e..90514321d54 100644
--- a/src/main/browser/browser-cookie-import.test.ts
+++ b/src/main/browser/browser-cookie-import.test.ts
@@ -423,7 +423,7 @@ describe('importCookiesFromBrowser Chromium', () => {
   let cookiesSetMock: ReturnType<typeof vi.fn>
   let cookiesRemoveMock: ReturnType<typeof vi.fn>
   let cookiesFlushStoreMock: ReturnType<typeof vi.fn>
-  let clearStorageDataMock: ReturnType<typeof vi.fn>
+  let clearDataMock: ReturnType<typeof vi.fn>
   let setUserAgentMock: ReturnType<typeof vi.fn>
 
   beforeEach(() => {
@@ -431,7 +431,7 @@ describe('importCookiesFromBrowser Chromium', () => {
     cookiesSetMock = vi.fn().mockResolvedValue(undefined)
     cookiesRemoveMock = vi.fn().mockResolvedValue(undefined)
     cookiesFlushStoreMock = vi.fn().mockResolvedValue(undefined)
-    clearStorageDataMock = vi.fn().mockResolvedValue(undefined)
+    clearDataMock = vi.fn().mockResolvedValue(undefined)
     setUserAgentMock = vi.fn()
     appGetPathMock.mockReset()
     appGetPathMock.mockReturnValue(join(tmpDir, 'userData'))
@@ -450,7 +450,7 @@ describe('importCookiesFromBrowser Chromium', () => {
         remove: cookiesRemoveMock,
         flushStore: cookiesFlushStoreMock
       },
-      clearStorageData: clearStorageDataMock,
+      clearData: clearDataMock,
       setUserAgent: setUserAgentMock
     })
   })
@@ -511,9 +511,7 @@ describe('importCookiesFromBrowser Chromium', () => {
         ['', '-wal', '-shm'].map((suffix) => readFileSync(sourceCookiesPath + suffix))
       ).toEqual(sourceFilesBefore)
       expect(cookiesRemoveMock).not.toHaveBeenCalled()
-      // Why: STA-3811 — the pre-import clear is selective now, so a wholesale wipe would
-      // take the non-transplantable families with it.
-      expect(clearStorageDataMock).not.toHaveBeenCalled()
+      expect(clearDataMock).not.toHaveBeenCalled()
       // Why: STA-3514 — imports must never impersonate the source browser; the
       // session keeps the engine UA the registry set at startup.
       expect(setUserAgentMock).not.toHaveBeenCalled()
diff --git a/src/main/browser/browser-cookie-import.ts b/src/main/browser/browser-cookie-import.ts
index bffb12cfa02..3c3a701f953 100644
--- a/src/main/browser/browser-cookie-import.ts
+++ b/src/main/browser/browser-cookie-import.ts
@@ -80,7 +80,7 @@ import {
   NON_TRANSPLANTABLE_HOST_KEY_SQL,
   normalizeCookieDomain,
   normalizeCookieImportDomain,
-  removeAllCookiesExcept,
+  removeTransplantableCookies,
   replaceCookiesForImportedDomains,
   restoreImportedDomainCookies,
   type CookieImportMode
@@ -584,6 +584,7 @@ async function importValidatedCookies(
   )
   const integritySkipped = validDomainCookies.length - sourceBoundFiltered.length
   const nonTransplantableSkipped = sourceBoundFiltered.length - importableCookies.length
+  const googleCookiesSkipped = integritySkipped + nonTransplantableSkipped
   const invalidDomainSkipped = cookies.length - validDomainCookies.length
   diag(
     `importValidatedCookies: ${cookies.length} validated, ${invalidDomainSkipped} unsafe-domain skipped, ${integritySkipped} source-bound skipped, ${nonTransplantableSkipped} non-transplantable skipped of ${totalInput} total, partition="${targetPartition}"`
@@ -693,6 +694,7 @@ async function importValidatedCookies(
     totalCookies: totalInput,
     importedCookies: importedCount,
     skippedCookies: skipped,
+    ...(googleCookiesSkipped > 0 ? { googleCookiesSkipped } : {}),
     domains: [...domainSet].sort()
   }
 
@@ -911,7 +913,7 @@ export function buildChromiumCookieInsertParams(
       return decryptedValue
     }
 
-    const sourceHasColumn = Object.prototype.hasOwnProperty.call(sourceRow, column.name)
+    const sourceHasColumn = Object.hasOwn(sourceRow, column.name)
     const sourceValue = sourceHasColumn ? normalizeSqliteCookieValue(sourceRow[column.name]) : null
     if (sourceValue !== null) {
       return sourceValue
@@ -1590,7 +1592,12 @@ export async function importCookiesFromBrowser(
 
     const needsSourceKey = sourceRows.some((sourceRow) => {
       const encRaw = sourceRow.encrypted_value
-      return encRaw instanceof Uint8Array && encRaw.length > 0
+      if (!(encRaw instanceof Uint8Array) || encRaw.length === 0) {
+        return false
+      }
+      const domain = sourceRow.host_key as string
+      const name = sourceRow.name as string
+      return !(isGoogleSourceBoundCookie(name, domain) || isNonTransplantableCookieDomain(domain))
     })
     const sourceKey = needsSourceKey
       ? getEncryptionKey(browser.keychainService!, browser.keychainAccount!, browser)
@@ -1653,6 +1660,20 @@ export async function importCookiesFromBrowser(
     }
 
     for (const sourceRow of sourceRows) {
+      const domain = sourceRow.host_key as string
+      const name = sourceRow.name as string
+
+      if (isGoogleSourceBoundCookie(name, domain)) {
+        integritySkipped++
+        continue
+      }
+
+      // Why: transplanting these replaces a working sign-in with a session the site rejects.
+      if (isNonTransplantableCookieDomain(domain)) {
+        nonTransplantableSkipped++
+        continue
+      }
+
       const encRaw = sourceRow.encrypted_value
       // Why: node:sqlite returns BLOBs as Uint8Array; treat any other type as missing, not an empty buffer that would silently blank the cookie value.
       const encBuf = encRaw instanceof Uint8Array ? Buffer.from(encRaw) : null
@@ -1674,20 +1695,6 @@ export async function importCookiesFromBrowser(
         decryptedValue = Buffer.alloc(0)
       }
 
-      const domain = sourceRow.host_key as string
-      const name = sourceRow.name as string
-
-      if (isGoogleSourceBoundCookie(name, domain)) {
-        integritySkipped++
-        continue
-      }
-
-      // Why: transplanting these replaces a working sign-in with a session the site rejects.
-      if (isNonTransplantableCookieDomain(domain)) {
-        nonTransplantableSkipped++
-        continue
-      }
-
       let validDomain = sourceDomainValidity.get(domain)
       if (validDomain === undefined) {
         validDomain = normalizeCookieImportDomain(domain) !== null
@@ -1740,6 +1747,7 @@ export async function importCookiesFromBrowser(
     diag(
       `  skipped ${integritySkipped} Google integrity cookies (SIDCC/STRP/AEC) and ${nonTransplantableSkipped} non-transplantable-domain cookies`
     )
+    const googleCookiesSkipped = integritySkipped + nonTransplantableSkipped
 
     if (decryptedCookies.length === 0) {
       closeStagingDb()
@@ -1751,6 +1759,7 @@ export async function importCookiesFromBrowser(
           totalCookies: sourceRows.length,
           importedCookies: 0,
           skippedCookies: skipped + integritySkipped + nonTransplantableSkipped,
+          ...(googleCookiesSkipped > 0 ? { googleCookiesSkipped } : {}),
           domains: []
         }
       }
@@ -1771,9 +1780,7 @@ export async function importCookiesFromBrowser(
     // Why: clear stale cookies first; mixing them with the imported set makes sites reject the
     // session. Non-transplantable families are exempt — nothing was imported for them, and their
     // live session is the only one that works.
-    await removeAllCookiesExcept(targetSession.cookies, (cookie) =>
-      isNonTransplantableCookieDomain(cookie.domain ?? '')
-    )
+    await removeTransplantableCookies(targetSession)
     diag(
       `  cleared existing session cookies before loading ${decryptedCookies.length} imported cookies`
     )
@@ -1842,6 +1849,7 @@ export async function importCookiesFromBrowser(
       totalCookies: sourceRows.length,
       importedCookies: imported,
       skippedCookies: skipped + integritySkipped + nonTransplantableSkipped,
+      ...(googleCookiesSkipped > 0 ? { googleCookiesSkipped } : {}),
       domains: [...domainSet].sort(),
       ...(warning ? { warning } : {})
     }
diff --git a/src/main/browser/browser-download-destination.test.ts b/src/main/browser/browser-download-destination.test.ts
index 5db849c80e9..d3719bf1e4a 100644
--- a/src/main/browser/browser-download-destination.test.ts
+++ b/src/main/browser/browser-download-destination.test.ts
@@ -86,6 +86,40 @@ describe('BrowserDownloadDestinationReservations', () => {
     expect(macReservations.reserve('report.csv').filename).toBe('report (1).csv')
   })
 
+  it('rewrites Windows reserved device basenames', () => {
+    const reservations = new BrowserDownloadDestinationReservations({
+      downloadsPath,
+      pathExists: vi.fn(() => false),
+      platform: 'win32'
+    })
+
+    expect(reservations.reserve('CON').filename).toBe('_CON')
+    expect(reservations.reserve('con.txt').filename).toBe('_con.txt')
+    expect(reservations.reserve('NUL.tar.gz').filename).toBe('_NUL.tar.gz')
+    expect(reservations.reserve('AUX.json').filename).toBe('_AUX.json')
+    expect(reservations.reserve('PRN').filename).toBe('_PRN')
+    expect(reservations.reserve('CLOCK$.csv').filename).toBe('_CLOCK$.csv')
+    expect(reservations.reserve('CONIN$.txt').filename).toBe('_CONIN$.txt')
+    expect(reservations.reserve('CONOUT$.log').filename).toBe('_CONOUT$.log')
+    expect(reservations.reserve('COM1.log').filename).toBe('_COM1.log')
+    expect(reservations.reserve('COM¹.log').filename).toBe('_COM¹.log')
+    expect(reservations.reserve('LPT9.csv').filename).toBe('_LPT9.csv')
+    expect(reservations.reserve('LPT³.csv').filename).toBe('_LPT³.csv')
+    expect(reservations.reserve('COM10.log').filename).toBe('COM10.log')
+    expect(reservations.reserve('LPT0.csv').filename).toBe('LPT0.csv')
+    expect(reservations.reserve('CONSOLE.txt').filename).toBe('CONSOLE.txt')
+  })
+
+  it('preserves Windows device-like names on other platforms', () => {
+    const reservations = new BrowserDownloadDestinationReservations({
+      downloadsPath,
+      pathExists: vi.fn(() => false),
+      platform: 'linux'
+    })
+
+    expect(reservations.reserve('CON.txt').filename).toBe('CON.txt')
+  })
+
   it('fails after bounded collision attempts', () => {
     const reservations = new BrowserDownloadDestinationReservations({
       downloadsPath,
diff --git a/src/main/browser/browser-download-destination.ts b/src/main/browser/browser-download-destination.ts
index 1aa875f76ad..53e541c4a0d 100644
--- a/src/main/browser/browser-download-destination.ts
+++ b/src/main/browser/browser-download-destination.ts
@@ -5,6 +5,8 @@ import { app } from 'electron'
 
 const MAX_BROWSER_DOWNLOAD_COLLISION_ATTEMPTS = 1_000
 const WINDOWS_RESERVED_FILENAME_CHARS = new Set(['<', '>', ':', '"', '|', '?', '*'])
+const WINDOWS_RESERVED_FILENAME =
+  /^(?:con|prn|aux|nul|clock\$|conin\$|conout\$|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/iu
 
 export type BrowserDownloadDestination = {
   filename: string
@@ -18,7 +20,7 @@ type BrowserDownloadDestinationOptions = {
   platform?: NodeJS.Platform
 }
 
-function normalizeFilename(filename: string): string {
+function normalizeFilename(filename: string, platform: NodeJS.Platform): string {
   // Normalize separators first so basename strips paths from any platform.
   const normalizedSeparators = filename.replace(/\\/g, '/')
   const rawBasename = path.posix.basename(normalizedSeparators).trim()
@@ -32,7 +34,12 @@ function normalizeFilename(filename: string): string {
     .join('')
     .replace(/[. ]+$/g, '')
     .trim()
-  return safeName || 'download'
+  if (!safeName) {
+    return 'download'
+  }
+  return platform === 'win32' && WINDOWS_RESERVED_FILENAME.test(safeName)
+    ? `_${safeName}`
+    : safeName
 }
 
 function buildCollisionCandidate(filename: string, suffix: number): string {
@@ -65,7 +72,7 @@ export class BrowserDownloadDestinationReservations {
   }
 
   reserve(filename: string): BrowserDownloadDestination {
-    const safeFilename = normalizeFilename(filename)
+    const safeFilename = normalizeFilename(filename, this.platform)
     const downloadsPath = this.downloadsPath()
 
     for (let attempt = 0; attempt < MAX_BROWSER_DOWNLOAD_COLLISION_ATTEMPTS; attempt += 1) {
diff --git a/src/main/browser/browser-session-registry.persistence.test.ts b/src/main/browser/browser-session-registry.persistence.test.ts
index f5f9bb7a7b2..f27a861a45c 100644
--- a/src/main/browser/browser-session-registry.persistence.test.ts
+++ b/src/main/browser/browser-session-registry.persistence.test.ts
@@ -24,7 +24,7 @@ function seedMeta(fsState: FsState, meta: unknown): void {
 
 function installModuleMocks(
   fsState: FsState,
-  copyFailures: Set<string> = new Set()
+  copyFailures = new Set<string>()
 ): {
   sessionFromPartitionMock: ReturnType<typeof vi.fn>
   setupClientHintsOverrideMock: ReturnType<typeof vi.fn>
diff --git a/src/main/browser/browser-webauthn-access.ts b/src/main/browser/browser-webauthn-access.ts
index 4f04065e36c..60da5b1e297 100644
--- a/src/main/browser/browser-webauthn-access.ts
+++ b/src/main/browser/browser-webauthn-access.ts
@@ -15,7 +15,7 @@ function isSecureBrowserOrigin(rawOrigin: string | undefined): boolean {
   }
 }
 
-function isFidoHidDevice(device: Electron.HIDDevice | unknown): device is Electron.HIDDevice {
+function isFidoHidDevice(device: unknown): device is Electron.HIDDevice {
   if (!device || typeof device !== 'object') {
     return false
   }
diff --git a/src/main/browser/cdp-bridge-integration.test.ts b/src/main/browser/cdp-bridge-integration.test.ts
index b3b1fae9401..b3b836d07b0 100644
--- a/src/main/browser/cdp-bridge-integration.test.ts
+++ b/src/main/browser/cdp-bridge-integration.test.ts
@@ -212,7 +212,7 @@ function createMockGuest(
       removeListener: vi.fn((event: string, handler: (...args: unknown[]) => void) => {
         const handlers = debuggerListeners.get(event) ?? []
         const idx = handlers.indexOf(handler)
-        if (idx >= 0) {
+        if (idx !== -1) {
           handlers.splice(idx, 1)
         }
       }),
diff --git a/src/main/cli/wsl-cli-installer.ts b/src/main/cli/wsl-cli-installer.ts
index f6a1684e19c..3dee00a871b 100644
--- a/src/main/cli/wsl-cli-installer.ts
+++ b/src/main/cli/wsl-cli-installer.ts
@@ -379,7 +379,7 @@ export class WslCliInstaller {
   private async readCommandFile(
     distro: string,
     commandPath: string
-  ): Promise<string | 'not_file' | null> {
+  ): Promise<(string & {}) | 'not_file' | null> {
     const output = await this.run(
       distro,
       [
diff --git a/src/main/cli/wsl-cli-registration-registry.ts b/src/main/cli/wsl-cli-registration-registry.ts
index d1a84a42f52..99d3faff5d4 100644
--- a/src/main/cli/wsl-cli-registration-registry.ts
+++ b/src/main/cli/wsl-cli-registration-registry.ts
@@ -138,7 +138,7 @@ async function readState(userDataPath: string): Promise<WslCliRegistrationRegist
 function upsertDistro(distros: string[], distro: string): string[] {
   const key = normalizeWslDistroKey(distro)
   const existingIndex = distros.findIndex((entry) => normalizeWslDistroKey(entry) === key)
-  if (existingIndex < 0) {
+  if (existingIndex === -1) {
     return [...distros, distro.trim()]
   }
   return distros.map((entry, index) => (index === existingIndex ? distro.trim() : entry))
diff --git a/src/main/codex-accounts/runtime-home-service.test.ts b/src/main/codex-accounts/runtime-home-service.test.ts
index 966d901f994..09f9337ebb0 100644
--- a/src/main/codex-accounts/runtime-home-service.test.ts
+++ b/src/main/codex-accounts/runtime-home-service.test.ts
@@ -167,7 +167,6 @@ function createSettings(overrides: TestSettingsOverrides = {}): GlobalSettings {
     compactWorktreeCards: false,
     terminalWindowsShell: 'powershell.exe',
     terminalWindowsPowerShellImplementation: 'powershell.exe',
-    enableGitHubAttribution: true,
     ...overrides,
     diffWordWrap: overrides.diffWordWrap ?? false,
     localWindowsRuntimeDefault: overrides.localWindowsRuntimeDefault ?? { kind: 'windows-host' },
diff --git a/src/main/codex-accounts/service.test.ts b/src/main/codex-accounts/service.test.ts
index ec80a01c3be..87974d3e411 100644
--- a/src/main/codex-accounts/service.test.ts
+++ b/src/main/codex-accounts/service.test.ts
@@ -159,7 +159,6 @@ function createSettings(overrides: Partial<GlobalSettings> = {}): GlobalSettings
     compactWorktreeCards: false,
     terminalWindowsShell: 'powershell.exe',
     terminalWindowsPowerShellImplementation: 'powershell.exe',
-    enableGitHubAttribution: true,
     ...overrides,
     diffWordWrap: overrides.diffWordWrap ?? false,
     localWindowsRuntimeDefault: overrides.localWindowsRuntimeDefault ?? { kind: 'windows-host' },
diff --git a/src/main/codex-accounts/service.ts b/src/main/codex-accounts/service.ts
index b55c9b50315..eef834af323 100644
--- a/src/main/codex-accounts/service.ts
+++ b/src/main/codex-accounts/service.ts
@@ -1311,7 +1311,7 @@ export class CodexAccountService {
 
     const managedRootMarker = '/.local/share/orca/codex-accounts/'
     const markerIndex = wslInfo.linuxPath.indexOf(managedRootMarker)
-    if (markerIndex < 0) {
+    if (markerIndex === -1) {
       return null
     }
     const wslHome = wslInfo.linuxPath.slice(0, markerIndex)
diff --git a/src/main/codex/codex-pane-account-registry.ts b/src/main/codex/codex-pane-account-registry.ts
index 595f1d3e767..39853471683 100644
--- a/src/main/codex/codex-pane-account-registry.ts
+++ b/src/main/codex/codex-pane-account-registry.ts
@@ -111,6 +111,7 @@ function isShellStartupHomeOverride(value: unknown): value is CodexShellStartupH
     typeof context.home === 'string' &&
     context.home.length > 0 &&
     (context.shell === undefined || typeof context.shell === 'string') &&
+    (context.configHome === undefined || typeof context.configHome === 'string') &&
     typeof context.codexHome === 'string' &&
     context.codexHome.length > 0
   )
@@ -207,6 +208,7 @@ function shellStartupHomeOverridesEqual(
   return (
     left?.home === right?.home &&
     left?.shell === right?.shell &&
+    left?.configHome === right?.configHome &&
     left?.codexHome === right?.codexHome
   )
 }
diff --git a/src/main/codex/codex-real-home-path.test.ts b/src/main/codex/codex-real-home-path.test.ts
index 7dc961c7a18..25d4f2b5bba 100644
--- a/src/main/codex/codex-real-home-path.test.ts
+++ b/src/main/codex/codex-real-home-path.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, sep } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
@@ -11,9 +11,15 @@ import {
 import { __resetShellStartupEnvCache } from '../pty/shell-startup-env'
 
 const temporaryHomes: string[] = []
+const savedConfigHome = process.env.XDG_CONFIG_HOME
 
 afterEach(() => {
   __resetShellStartupEnvCache()
+  if (savedConfigHome === undefined) {
+    delete process.env.XDG_CONFIG_HOME
+  } else {
+    process.env.XDG_CONFIG_HOME = savedConfigHome
+  }
   for (const path of temporaryHomes.splice(0)) {
     rmSync(path, { recursive: true, force: true })
   }
@@ -56,6 +62,9 @@ describe('hasCustomCodexHomeOverride', () => {
       temporaryHomes.push(paneHome)
       writeFileSync(join(paneHome, '.zshrc'), 'export CODEX_HOME="$HOME/custom-codex-home"\n')
 
+      // Why cleared: the context records XDG_CONFIG_HOME, so a developer machine
+      // that sets one would otherwise change the recorded shape.
+      delete process.env.XDG_CONFIG_HOME
       expect(hasCustomCodexHomeOverrideForLaunch({ HOME: paneHome, SHELL: '/bin/zsh' })).toBe(true)
       const override = getCustomCodexHomeOverrideForLaunch({
         HOME: paneHome,
@@ -75,4 +84,50 @@ describe('hasCustomCodexHomeOverride', () => {
       ).toBe(true)
     }
   )
+
+  // Why: a fish user who exports XDG_CONFIG_HOME from config.fish never passes it to
+  // a Dock-launched Orca, so the launch env is the only place it appears. Reading the
+  // main process env instead scans ~/.config and misses the override entirely.
+  it.skipIf(process.platform === 'win32')(
+    'resolves a fish override under the launch env XDG_CONFIG_HOME, not the process one',
+    () => {
+      const paneHome = mkdtempSync(join(tmpdir(), 'orca-codex-fish-home-'))
+      temporaryHomes.push(paneHome)
+      const configHome = join(paneHome, 'xdg')
+      mkdirSync(join(configHome, 'fish'), { recursive: true })
+      writeFileSync(
+        join(configHome, 'fish', 'config.fish'),
+        'set -gx CODEX_HOME "$HOME/custom-codex-home"\n'
+      )
+      // The decoy fish reads only if XDG_CONFIG_HOME is ignored.
+      mkdirSync(join(paneHome, '.config', 'fish'), { recursive: true })
+      writeFileSync(
+        join(paneHome, '.config', 'fish', 'config.fish'),
+        'set -gx CODEX_HOME /wrong-default-config-home\n'
+      )
+      delete process.env.XDG_CONFIG_HOME
+
+      const launchEnv = {
+        HOME: paneHome,
+        SHELL: '/opt/homebrew/bin/fish',
+        XDG_CONFIG_HOME: configHome
+      }
+      const override = getCustomCodexHomeOverrideForLaunch(launchEnv)
+
+      expect(override).toEqual({
+        source: 'shell-startup',
+        context: {
+          home: paneHome,
+          shell: '/opt/homebrew/bin/fish',
+          configHome,
+          codexHome: join(paneHome, 'custom-codex-home')
+        }
+      })
+      // And the recorded configHome is what a later re-check resolves against.
+      expect(
+        override?.source === 'shell-startup' &&
+          shellStartupCodexHomeOverrideMatches(override.context)
+      ).toBe(true)
+    }
+  )
 })
diff --git a/src/main/codex/codex-real-home-path.ts b/src/main/codex/codex-real-home-path.ts
index 700359d4f37..60c644032f8 100644
--- a/src/main/codex/codex-real-home-path.ts
+++ b/src/main/codex/codex-real-home-path.ts
@@ -5,6 +5,8 @@ import { readShellStartupEnvVar } from '../pty/shell-startup-env'
 export type CodexShellStartupHomeOverride = {
   home: string
   shell?: string
+  /** Why recorded: fish reads config under it, so re-reads must use the same root. */
+  configHome?: string
   codexHome: string
 }
 
@@ -54,7 +56,10 @@ export function getCustomCodexHomeOverrideForLaunch(
   }
   const home = launchEnv ? getLaunchEnvValue(launchEnv, 'HOME') : process.env.HOME
   const shell = launchEnv ? getLaunchEnvValue(launchEnv, 'SHELL') : process.env.SHELL
-  const shellCodexHome = readShellStartupEnvVar('CODEX_HOME', home, shell)
+  const configHome = launchEnv
+    ? getLaunchEnvValue(launchEnv, 'XDG_CONFIG_HOME')
+    : process.env.XDG_CONFIG_HOME
+  const shellCodexHome = readShellStartupEnvVar('CODEX_HOME', home, shell, configHome)
   if (!home || !shellCodexHome || !hasCustomCodexHomeOverride({ CODEX_HOME: shellCodexHome })) {
     return null
   }
@@ -63,6 +68,7 @@ export function getCustomCodexHomeOverrideForLaunch(
     context: {
       home,
       ...(shell ? { shell } : {}),
+      ...(configHome ? { configHome } : {}),
       codexHome: shellCodexHome
     }
   }
@@ -85,7 +91,8 @@ export function shellStartupCodexHomeOverrideMatches(
   const currentCodexHome = readShellStartupEnvVar(
     'CODEX_HOME',
     currentContext.home,
-    currentContext.shell
+    currentContext.shell,
+    currentContext.configHome
   )
   return Boolean(
     currentCodexHome &&
@@ -101,15 +108,16 @@ export function shellStartupCodexHomeOverrideContextsEqual(
   return (
     normalizePathForComparison(left.home) === normalizePathForComparison(right.home) &&
     left.shell === right.shell &&
+    left.configHome === right.configHome &&
     normalizePathForComparison(left.codexHome) === normalizePathForComparison(right.codexHome)
   )
 }
 
 function getLaunchEnvValue(
   launchEnv: NodeJS.ProcessEnv,
-  key: 'CODEX_HOME' | 'ORCA_CODEX_HOME' | 'HOME' | 'SHELL'
+  key: 'CODEX_HOME' | 'ORCA_CODEX_HOME' | 'HOME' | 'SHELL' | 'XDG_CONFIG_HOME'
 ): string | undefined {
-  return Object.prototype.hasOwnProperty.call(launchEnv, key) ? launchEnv[key] : process.env[key]
+  return Object.hasOwn(launchEnv, key) ? launchEnv[key] : process.env[key]
 }
 
 function normalizePathForComparison(value: string): string {
diff --git a/src/main/codex/codex-session-resume-home.test.ts b/src/main/codex/codex-session-resume-home.test.ts
index 75d91d7ab34..2f0aa5429c6 100644
--- a/src/main/codex/codex-session-resume-home.test.ts
+++ b/src/main/codex/codex-session-resume-home.test.ts
@@ -140,7 +140,7 @@ describe('resolveTrustedCodexSessionResumeHome', () => {
         trustedCodexHomes: [homePath],
         ...withoutHomeRanking,
         fileIsRegular: () => true,
-        listSessionFiles: async function* (): AsyncIterable<string> {
+        async *listSessionFiles(): AsyncIterable<string> {
           yield extendedEntry
         }
       })
@@ -153,7 +153,7 @@ describe('resolveTrustedCodexSessionResumeHome', () => {
         trustedCodexHomes: [homePath],
         ...withoutHomeRanking,
         fileIsRegular: () => true,
-        listSessionFiles: async function* (): AsyncIterable<string> {
+        async *listSessionFiles(): AsyncIterable<string> {
           yield `\\\\.\\C:\\Users\\Example\\.codex\\sessions\\2026\\07\\20\\rollout-${sessionId}.jsonl`
         }
       })
diff --git a/src/main/computer/macos-native-provider-transport.ts b/src/main/computer/macos-native-provider-transport.ts
index 54c4cf773aa..1048ce5a94c 100644
--- a/src/main/computer/macos-native-provider-transport.ts
+++ b/src/main/computer/macos-native-provider-transport.ts
@@ -52,7 +52,7 @@ export function consumeNativeProviderLines(
   let remaining = buffer
   while (true) {
     const newline = remaining.indexOf('\n')
-    if (newline < 0) {
+    if (newline === -1) {
       return remaining
     }
     const line = remaining.slice(0, newline)
diff --git a/src/main/cursor/hook-service.ts b/src/main/cursor/hook-service.ts
index 63ff9b36a71..ab9d07b25eb 100644
--- a/src/main/cursor/hook-service.ts
+++ b/src/main/cursor/hook-service.ts
@@ -216,7 +216,7 @@ export class CursorHookService {
     return this.getStatus()
   }
 
-  // Installs managed Cursor hooks on an SSH remote (POSIX-only). See docs/design/agent-status-over-ssh.md §8.
+  // Installs managed Cursor hooks on an SSH remote (POSIX-only); the managed script/JSON shape must match local install() or remote panes report a different status.
   async installRemote(sftp: SFTPWrapper, remoteHome: string): Promise<AgentHookInstallStatus> {
     const remoteConfigPath = `${remoteHome.replace(/\/$/, '')}/.cursor/hooks.json`
     const remoteScriptPath = `${remoteHome.replace(/\/$/, '')}/.orca/agent-hooks/cursor-hook.sh`
diff --git a/src/main/daemon/client.test.ts b/src/main/daemon/client.test.ts
index 47b77cfb78e..266cd0fe255 100644
--- a/src/main/daemon/client.test.ts
+++ b/src/main/daemon/client.test.ts
@@ -335,6 +335,30 @@ describe('DaemonClient', () => {
       client = new DaemonClient({ socketPath, tokenPath })
       await expect(client.ensureConnected()).rejects.toThrow()
     })
+
+    it('fails a retired endpoint at the connect, not at the token read', async () => {
+      rmSync(tokenPath)
+      client = new DaemonClient({ socketPath, tokenPath })
+
+      const error = (await client
+        .ensureConnected()
+        .catch((err: unknown) => err)) as NodeJS.ErrnoException
+
+      expect(error.syscall).toBe('connect')
+      expect(['ENOENT', 'ECONNREFUSED']).toContain(error.code)
+    })
+
+    it('still attempts the handshake when the token is gone but a daemon is listening', async () => {
+      const hellos: HelloMessage[] = []
+      await startMockDaemon({ onHello: (msg) => hellos.push(msg) })
+      rmSync(tokenPath)
+
+      client = new DaemonClient({ socketPath, tokenPath })
+      await client.ensureConnected()
+
+      expect(hellos.length).toBeGreaterThan(0)
+      expect(hellos[0]?.token).toBe('')
+    })
   })
 
   describe('RPC', () => {
diff --git a/src/main/daemon/client.ts b/src/main/daemon/client.ts
index d137ee84ea5..147277c8450 100644
--- a/src/main/daemon/client.ts
+++ b/src/main/daemon/client.ts
@@ -114,12 +114,24 @@ export class DaemonClient {
     }
   }
 
+  // Why: a missing token must not preempt the connect that proves whether the endpoint is gone.
+  private readToken(): string {
+    try {
+      return readFileSync(this.tokenPath, 'utf-8').trim()
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException | null)?.code === 'ENOENT') {
+        return ''
+      }
+      throw error
+    }
+  }
+
   private async doConnect(
     timeoutMs: number,
     attemptGeneration: number,
     sharedBudget: boolean
   ): Promise<void> {
-    const token = readFileSync(this.tokenPath, 'utf-8').trim()
+    const token = this.readToken()
     const deadlineMs = Date.now() + timeoutMs
     const remainingMs = (): number =>
       sharedBudget ? Math.max(1, deadlineMs - Date.now()) : timeoutMs
diff --git a/src/main/daemon/daemon-incarnation-evidence.ts b/src/main/daemon/daemon-incarnation-evidence.ts
index 01d9ffc97c5..f5c88935998 100644
--- a/src/main/daemon/daemon-incarnation-evidence.ts
+++ b/src/main/daemon/daemon-incarnation-evidence.ts
@@ -237,7 +237,7 @@ async function probeWindowsProcess(
 
 export function parseLinuxProcessState(statLine: string): string | null {
   const commandEnd = statLine.lastIndexOf(')')
-  if (commandEnd < 0) {
+  if (commandEnd === -1) {
     return null
   }
   return (
diff --git a/src/main/daemon/daemon-pty-adapter.test.ts b/src/main/daemon/daemon-pty-adapter.test.ts
index cbc58a44274..1fe5bc9770e 100644
--- a/src/main/daemon/daemon-pty-adapter.test.ts
+++ b/src/main/daemon/daemon-pty-adapter.test.ts
@@ -595,6 +595,42 @@ describe('DaemonPtyAdapter (IPtyProvider)', () => {
       }
     })
 
+    it('respawns after a retired daemon regardless of how the connection ended', async () => {
+      // Why this shape: the daemon retires when its last authenticated client drops, and that drop
+      // is often our own disconnect() — which observes no socket close. Once the token read stops
+      // preempting the connect, the retired endpoint fails as a connect and isDaemonGoneError
+      // classifies it, so recovery no longer depends on having witnessed the drop.
+      let respawnServer: DaemonServer | undefined
+      const respawn = vi.fn(async () => {
+        respawnServer = new DaemonServer({
+          socketPath,
+          tokenPath,
+          spawnSubprocess: () => createMockSubprocess()
+        })
+        await respawnServer.start()
+      })
+      const healingAdapter = new DaemonPtyAdapter({ socketPath, tokenPath, respawn })
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        const { id } = await healingAdapter.spawn({ cols: 80, rows: 24 })
+        const client = (healingAdapter as unknown as { client: DaemonClient }).client
+
+        client.disconnect()
+        await server.shutdown()
+        expect(existsSync(tokenPath)).toBe(false)
+        expect(client.hasObservedAuthenticatedDisconnect()).toBe(false)
+
+        await expect(
+          healingAdapter.spawn({ sessionId: id, cols: 80, rows: 24 })
+        ).resolves.toMatchObject({ id })
+        expect(respawn).toHaveBeenCalledTimes(1)
+      } finally {
+        warn.mockRestore()
+        healingAdapter.dispose()
+        await respawnServer?.shutdown()
+      }
+    })
+
     it('does not spawn a daemon per keystroke after respawn fails', async () => {
       const respawn = vi.fn(async () => {
         throw new Error('daemon unavailable')
@@ -1322,6 +1358,48 @@ describe('DaemonPtyAdapter (IPtyProvider)', () => {
       })
     })
 
+    // A proven `0` and an absent field are different facts. Dropping
+    // the zero left consumers unable to tell "the app negotiated nothing" from
+    // "this source could not say", which is what makes Preview guess wrong.
+    it('publishes proven kitty flags including a known zero', async () => {
+      const { id } = await adapter.spawn({ cols: 80, rows: 24 })
+      lastSubprocess._simulateData('plain output\r\n')
+
+      await expect(adapter.getBufferSnapshot(id)).resolves.toMatchObject({
+        kittyKeyboardFlags: 0
+      })
+
+      lastSubprocess._simulateData('\x1b[>8u')
+      await expect(adapter.getBufferSnapshot(id)).resolves.toMatchObject({
+        kittyKeyboardFlags: 8
+      })
+    })
+
+    // The other half of that contract: a daemon that cannot say must leave the
+    // key absent, so consumers keep the state unknown instead of reading a `0`.
+    it('omits kitty flags when the daemon snapshot has none', async () => {
+      const { id } = await adapter.spawn({ cols: 80, rows: 24 })
+      lastSubprocess._simulateData('plain output\r\n')
+      const realRequest = DaemonClient.prototype.request
+      const legacyClient = vi
+        .spyOn(DaemonClient.prototype, 'request')
+        .mockImplementation(async function (this: DaemonClient, type, payload, timeoutMs) {
+          const result = await realRequest.call(this, type, payload, timeoutMs)
+          if (type !== 'getSnapshot') {
+            return result
+          }
+          const { snapshot } = result as { snapshot: { modes: Record<string, unknown> } }
+          const { kittyKeyboardFlags: _omitted, ...modes } = snapshot.modes
+          return { snapshot: { ...snapshot, modes } }
+        })
+
+      const snapshot = await adapter.getBufferSnapshot(id)
+      legacyClient.mockRestore()
+
+      expect(snapshot).not.toBeNull()
+      expect(snapshot).not.toHaveProperty('kittyKeyboardFlags')
+    })
+
     it('exposes live state separately from the visible frame', async () => {
       const { id } = await adapter.spawn({ cols: 80, rows: 24 })
       lastSubprocess._simulateData('\x1b[?1049h\x1b[?1004h\x1b[?25lframe')
@@ -1833,6 +1911,20 @@ describe('DaemonPtyAdapter (IPtyProvider)', () => {
       expect(adapter.hasPty(id)).toBe(true)
     })
 
+    // Why: off-socket the cache can only be missing exits it never received, so a
+    // miss is ignorance. Answering false there authorizes a respawn over a live shell.
+    it('answers unknown, not absent, for an uncached id while disconnected', async () => {
+      const { id } = await adapter.spawn({ cols: 80, rows: 24 })
+      const unknownId = 'repo::/repo/unknown@@deadbeef'
+      expect(adapter.hasPty(unknownId)).toBe(false)
+
+      await server.shutdown()
+      await waitFor(() => !(adapter as unknown as { client: DaemonClient }).client.isConnected())
+
+      expect(adapter.hasPty(unknownId)).toBe(null)
+      expect(adapter.hasPty(id)).toBe(true)
+    })
+
     it('returns active sessions', async () => {
       await adapter.spawn({
         cols: 80,
diff --git a/src/main/daemon/daemon-pty-adapter.ts b/src/main/daemon/daemon-pty-adapter.ts
index 94d66c639a7..49bc8b5a34b 100644
--- a/src/main/daemon/daemon-pty-adapter.ts
+++ b/src/main/daemon/daemon-pty-adapter.ts
@@ -59,6 +59,7 @@ import type {
   PtySpawnResult
 } from '../providers/types'
 import type { PtyProcessInspection } from '../providers/pty-process-inspection'
+import { parseTerminalKittyKeyboardFlags } from '../../shared/terminal-kitty-keyboard-flags'
 import { isShellProcess } from '../../shared/agent-detection'
 import { resolveWslSessionContext } from './wsl-session-context'
 import { normalizeWslColdRestoreCwd } from './wsl-cold-restore-cwd'
@@ -835,7 +836,11 @@ export class DaemonPtyAdapter implements IPtyProvider {
     const snapshotFrame = result.snapshot.snapshotAnsi
     const snapshotPayload = snapshotPrefix + snapshotFrame
     // Why kitty flags ride beside the payload, not inside it: the snapshot reaches renderer xterms where POST_REPLAY_REATTACH_RESET's kitty reset must win (terminal-query-authority.md §kitty).
-    const kittyKeyboardFlags = result.snapshot.modes.kittyKeyboardFlags
+    // Why known `0` is no longer dropped: the pane tracker must be able to tell
+    // "the app negotiated nothing" from "this reattach proved nothing".
+    const kittyKeyboardFlags = parseTerminalKittyKeyboardFlags(
+      result.snapshot.modes.kittyKeyboardFlags
+    )
     return {
       id: sessionId,
       ...incarnationResult(),
@@ -855,7 +860,7 @@ export class DaemonPtyAdapter implements IPtyProvider {
           }
         : {}),
       ...(providerSequence ? { providerSequence } : {}),
-      ...(typeof kittyKeyboardFlags === 'number' && kittyKeyboardFlags > 0
+      ...(kittyKeyboardFlags !== undefined
         ? { snapshotKittyKeyboardFlags: kittyKeyboardFlags }
         : {}),
       isReattach: true,
@@ -935,8 +940,10 @@ export class DaemonPtyAdapter implements IPtyProvider {
     return providerSequence ? { providerSequence } : undefined
   }
 
-  hasPty(id: string): boolean {
-    return this.activeSessionIds.has(id)
+  hasPty(id: string): boolean | null {
+    // Why null off-socket: the cache only tracks exits it received, so a miss while
+    // disconnected (or before the first listSessions) is ignorance, not absence.
+    return this.activeSessionIds.has(id) ? true : this.client.isConnected() ? false : null
   }
 
   async probePtyLiveness(id: string): Promise<boolean | null> {
@@ -1221,6 +1228,7 @@ export class DaemonPtyAdapter implements IPtyProvider {
       if (!snapshot || typeof snapshot.outputSequence !== 'number') {
         return null
       }
+      const kittyKeyboardFlags = parseTerminalKittyKeyboardFlags(snapshot.modes.kittyKeyboardFlags)
       return {
         data: snapshot.rehydrateSequences + snapshot.snapshotAnsi,
         frameRestoreAnsi: snapshot.frameRestoreAnsi,
@@ -1233,6 +1241,9 @@ export class DaemonPtyAdapter implements IPtyProvider {
         source: 'headless',
         oscLinks: snapshot.oscLinks,
         alternateScreen: snapshot.modes.alternateScreen,
+        // Why known `0` is carried too: it proves the app negotiated nothing at
+        // this boundary, which is a different fact from a source that cannot say.
+        ...(kittyKeyboardFlags !== undefined ? { kittyKeyboardFlags } : {}),
         ...(snapshot.pendingEscapeTailAnsi
           ? { pendingEscapeTailAnsi: snapshot.pendingEscapeTailAnsi }
           : {})
@@ -1464,8 +1475,7 @@ export class DaemonPtyAdapter implements IPtyProvider {
       )
       return processes
     } catch (error) {
-      const missingAuthenticatedToken =
-        isMissingTokenFileError(error) && this.client.hasObservedAuthenticatedDisconnect()
+      const missingAuthenticatedToken = this.isRetiredEndpointTokenMissing()
       const missingNamedPipe = isMissingWindowsNamedPipeError(error)
       this.observeAuditFailure(
         missingAuthenticatedToken
@@ -1949,7 +1959,7 @@ export class DaemonPtyAdapter implements IPtyProvider {
     }
   }
 
-  // Why final=true not teardown: clean disconnect needs the full-depth snapshot as the restore source, but the
+  // Why final=true not teardown: clean disconnect needs the full daemon-window snapshot as the restore source, but the
   // detached daemon's PTYs keep running for warm reattach, so shell-ready scanner state must stay intact.
   private async checkpointAllSessions(): Promise<void> {
     const completed = await this.checkpointSessions(this.activeSessionIds, { final: true })
@@ -2111,14 +2121,16 @@ export class DaemonPtyAdapter implements IPtyProvider {
     return 'unavailable'
   }
 
-  // Why: on daemon-death errors, respawn a fresh daemon and retry once rather than leaving terminals broken until app restart.
+  // Why: the token read no longer throws, so audit its absence directly after an authenticated drop.
+  private isRetiredEndpointTokenMissing(): boolean {
+    return this.client.hasObservedAuthenticatedDisconnect() && !existsSync(this.tokenPath)
+  }
+
   private async withDaemonRetry<T>(fn: () => Promise<T>): Promise<T> {
     try {
       return await fn()
     } catch (err) {
-      // Why: the token is removed only after an authenticated drop; an initial missing token may still hide a live daemon.
-      const missingRetiredEndpointToken =
-        isMissingTokenFileError(err) && this.client.hasObservedAuthenticatedDisconnect()
+      const missingRetiredEndpointToken = this.isRetiredEndpointTokenMissing()
       if (missingRetiredEndpointToken) {
         this.observeAuditFailure(
           'token_missing_after_authenticated_disconnect',
@@ -2126,11 +2138,7 @@ export class DaemonPtyAdapter implements IPtyProvider {
           ['token_file']
         )
       }
-      if (
-        this.respawnAdoptionClosed ||
-        !this.respawnFn ||
-        (!isDaemonGoneError(err) && !missingRetiredEndpointToken)
-      ) {
+      if (this.respawnAdoptionClosed || !this.respawnFn || !isDaemonGoneError(err)) {
         throw err
       }
       if (!this.respawnPromise) {
@@ -2524,14 +2532,6 @@ export function isDaemonGoneError(err: unknown): boolean {
   )
 }
 
-function isMissingTokenFileError(err: unknown): boolean {
-  if (!(err instanceof Error)) {
-    return false
-  }
-  const errno = err as NodeJS.ErrnoException
-  return errno.code === 'ENOENT' && errno.syscall === 'open'
-}
-
 function isMissingWindowsNamedPipeError(err: unknown): boolean {
   if (process.platform !== 'win32' || !(err instanceof Error)) {
     return false
diff --git a/src/main/daemon/daemon-pty-router-history-handoff.test.ts b/src/main/daemon/daemon-pty-router-history-handoff.test.ts
index 07c2a5033d5..3ac04ebeac4 100644
--- a/src/main/daemon/daemon-pty-router-history-handoff.test.ts
+++ b/src/main/daemon/daemon-pty-router-history-handoff.test.ts
@@ -7,6 +7,7 @@ import { DaemonPtyRouter } from './daemon-pty-router'
 import { DaemonServer } from './daemon-server'
 import { getDaemonSocketPath } from './daemon-spawner'
 import { TERMINAL_HISTORY_INLINE_SEED_CODE_UNITS } from './terminal-history-seed-chunks'
+import { DAEMON_SESSION_SCROLLBACK_ROWS } from './daemon-session-scrollback-window'
 import type { DaemonFileLog } from './daemon-file-log'
 import type { SubprocessHandle } from './session'
 
@@ -93,14 +94,21 @@ describe('DaemonPtyRouter history handoff', () => {
     }
     await Promise.all([legacyServer?.shutdown(), currentServer?.shutdown()])
     rmSync(testDir, { recursive: true, force: true })
+    vi.unstubAllEnvs()
     vi.restoreAllMocks()
   })
 
   it('moves a slept v29 session to v30 with its full large history', async () => {
     const sessionId = 'large-legacy-session'
     const marker = 'V29-HISTORY-HANDOFF-MARKER'
+    // Why: this fixture plays an OLD daemon binary, whose sessions retained ~5000 rows. New code
+    // applies the flat window at session create, which would shrink the history below the chunked
+    // seed threshold and silently skip the transfer path this test exists to cover.
+    vi.stubEnv('ORCA_DAEMON_SESSION_SCROLLBACK_ROWS', '5000')
     await legacyAdapter.spawn({ sessionId, cols: 400, rows: 24 })
     legacySubprocess.emitData(`${'x'.repeat(TERMINAL_HISTORY_INLINE_SEED_CODE_UNITS + 1)}${marker}`)
+    // Keep only the played legacy session deep; the receiving daemon must use today's flat window.
+    vi.stubEnv('ORCA_DAEMON_SESSION_SCROLLBACK_ROWS', String(DAEMON_SESSION_SCROLLBACK_ROWS))
     router = new DaemonPtyRouter({ current: currentAdapter, legacy: [legacyAdapter] })
     await router.discoverLegacySessions()
     const client = (
diff --git a/src/main/daemon/daemon-pty-router.test.ts b/src/main/daemon/daemon-pty-router.test.ts
index 41cc8016169..7ddc240cc74 100644
--- a/src/main/daemon/daemon-pty-router.test.ts
+++ b/src/main/daemon/daemon-pty-router.test.ts
@@ -529,6 +529,33 @@ describe('DaemonPtyRouter', () => {
     expect(current.hasPty).not.toHaveBeenCalledWith('legacy-session')
   })
 
+  // Why: an unreachable generation cannot certify that another generation's session
+  // is gone — collapsing its null to false hands a respawn a fabricated death.
+  it('answers unknown when any adapter cannot see the session', () => {
+    const current = createAdapter('current')
+    const legacy = createAdapter('legacy')
+    legacy.hasPty = vi.fn(() => null)
+    const router = new DaemonPtyRouter({ current, legacy: [legacy] })
+
+    expect(router.hasPty('unmapped-session')).toBe(null)
+  })
+
+  it('does not report terminal_gone for inspection when an adapter cannot answer', async () => {
+    const current = createAdapter('current')
+    const legacy = createAdapter('legacy')
+    legacy.hasPty = vi.fn(() => null)
+    const router = new DaemonPtyRouter({ current, legacy: [legacy] })
+
+    await expect(router.inspectProcess('unmapped-session')).resolves.toEqual({
+      foregroundProcess: null,
+      hasChildProcesses: false
+    })
+
+    // Unproven routes must not be memoized as an owner.
+    const unanimous = new DaemonPtyRouter({ current: createAdapter('c2'), legacy: [] })
+    await expect(unanimous.inspectProcess('unmapped-session')).rejects.toThrow('terminal_gone')
+  })
+
   it('discovers an unmapped live session from one coalesced inventory', async () => {
     const current = createAdapter('current')
     const legacy = createAdapter('legacy', ['surviving-session'])
diff --git a/src/main/daemon/daemon-pty-router.ts b/src/main/daemon/daemon-pty-router.ts
index 5104268cbef..a3962e511be 100644
--- a/src/main/daemon/daemon-pty-router.ts
+++ b/src/main/daemon/daemon-pty-router.ts
@@ -77,12 +77,15 @@ export class DaemonPtyRouter implements IPtyProvider {
     return await this.adapterFor(id).attach(id)
   }
 
-  hasPty(id: string): boolean {
+  hasPty(id: string): boolean | null {
     const routed = this.sessionAdapters.get(id)
     if (routed) {
       return routed.hasPty(id)
     }
-    return this.current.hasPty(id) || this.legacy.some((adapter) => adapter.hasPty(id))
+    // Why: one adapter's ignorance is not another's absence proof — only a unanimous
+    // proven-absence across every generation may read as false.
+    const answers = this.allAdapters().map((adapter) => adapter.hasPty(id))
+    return answers.includes(true) ? true : answers.includes(null) ? null : false
   }
 
   async probePtyLiveness(id: string): Promise<boolean | null> {
@@ -314,14 +317,19 @@ export class DaemonPtyRouter implements IPtyProvider {
   }
 
   private adapterForInspection(sessionId: string): DaemonPtyAdapter {
-    const adapter =
+    const owner =
       this.sessionAdapters.get(sessionId) ??
-      this.allAdapters().find((candidate) => candidate.hasPty(sessionId))
-    if (!adapter) {
+      this.allAdapters().find((candidate) => candidate.hasPty(sessionId) === true)
+    if (owner) {
+      this.sessionAdapters.set(sessionId, owner)
+      return owner
+    }
+    // Why: only unanimous proven absence is gone; an adapter that cannot answer routes
+    // to current without memoizing a route we never established.
+    if (this.hasPty(sessionId) === false) {
       throw new Error('terminal_gone')
     }
-    this.sessionAdapters.set(sessionId, adapter)
-    return adapter
+    return this.current
   }
 
   private allAdapters(): DaemonPtyAdapter[] {
diff --git a/src/main/daemon/daemon-self-retirement-respawn.test.ts b/src/main/daemon/daemon-self-retirement-respawn.test.ts
index a5df5453fe6..c588b5a6918 100644
--- a/src/main/daemon/daemon-self-retirement-respawn.test.ts
+++ b/src/main/daemon/daemon-self-retirement-respawn.test.ts
@@ -213,17 +213,52 @@ describe('daemon self-retirement respawn', () => {
     expect(respawn).not.toHaveBeenCalled()
   })
 
-  it('does not treat an initial missing token as respawn authority', async () => {
+  it('does not respawn a listening daemon whose token is absent', async () => {
+    await startServer()
+    rmSync(tokenPath)
     const respawn = vi.fn(async () => {})
     const adapter = new DaemonPtyAdapter({ socketPath, tokenPath, respawn })
 
-    await expect(adapter.spawn({ sessionId: 'missing', cols: 80, rows: 24 })).rejects.toMatchObject(
-      {
-        code: 'ENOENT'
-      }
-    )
+    await expect(
+      adapter.spawn({ sessionId: 'startup-window', cols: 80, rows: 24 })
+    ).rejects.toThrow(/Invalid token/i)
 
     expect(respawn).not.toHaveBeenCalled()
     adapter.dispose()
   })
+
+  it('does not let stale disconnect evidence authorize respawning a listening daemon', async () => {
+    const original = await startServer()
+    const respawn = vi.fn(async () => {})
+    const adapter = new DaemonPtyAdapter({ socketPath, tokenPath, respawn })
+    await adapter.listProcesses()
+    const client = (
+      adapter as unknown as {
+        client: { hasObservedAuthenticatedDisconnect(): boolean }
+      }
+    ).client
+
+    await original.shutdown()
+    await waitFor(() => client.hasObservedAuthenticatedDisconnect())
+    await startServer()
+    rmSync(tokenPath)
+
+    await expect(
+      adapter.spawn({ sessionId: 'replacement-startup-window', cols: 80, rows: 24 })
+    ).rejects.toThrow(/Invalid token/i)
+
+    expect(respawn).not.toHaveBeenCalled()
+    adapter.dispose()
+  })
+
+  it('respawns when nothing is accepting on the endpoint', async () => {
+    const respawn = vi.fn(async () => {})
+    const adapter = new DaemonPtyAdapter({ socketPath, tokenPath, respawn })
+
+    // Fails after the respawn attempt because the mock respawn starts no replacement.
+    await expect(adapter.spawn({ sessionId: 'missing', cols: 80, rows: 24 })).rejects.toThrow()
+
+    expect(respawn).toHaveBeenCalledTimes(1)
+    adapter.dispose()
+  })
 })
diff --git a/src/main/daemon/daemon-server-attachment-lifecycle.test.ts b/src/main/daemon/daemon-server-attachment-lifecycle.test.ts
new file mode 100644
index 00000000000..fdc445ad59e
--- /dev/null
+++ b/src/main/daemon/daemon-server-attachment-lifecycle.test.ts
@@ -0,0 +1,135 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Socket } from 'node:net'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DaemonClient } from './client'
+import { DaemonServer } from './daemon-server'
+import { getDaemonSocketPath } from './daemon-spawner'
+import type { SubprocessHandle } from './session'
+import type { CreateOrAttachOptions, CreateOrAttachResult } from './terminal-host'
+
+function createMockSubprocess(): SubprocessHandle {
+  let onExit: ((code: number) => void) | undefined
+  return {
+    pid: 55_555,
+    getForegroundProcess: () => null,
+    write: vi.fn(),
+    resize: vi.fn(),
+    kill: vi.fn(() => onExit?.(0)),
+    forceKill: vi.fn(() => onExit?.(137)),
+    signal: vi.fn(),
+    onData: vi.fn(),
+    onExit(callback) {
+      onExit = callback
+    },
+    dispose: vi.fn()
+  }
+}
+
+type DaemonAttachmentPrivate = {
+  host: {
+    detach: (sessionId: string, token: symbol) => void
+    detachClients: (attachments: readonly { sessionId: string; token: symbol }[]) => void
+    createOrAttach: (options: CreateOrAttachOptions) => Promise<CreateOrAttachResult>
+    sessions: Map<string, { hasAttachedClients: boolean }>
+  }
+  clients: Map<string, { streamSocket: Socket | null }>
+  streamClientIdBySessionId: Map<string, string>
+  attachTokenBySessionId: Map<string, symbol>
+}
+
+describe('DaemonServer attachment lifecycle', () => {
+  let directory: string
+  let server: DaemonServer
+  let client: DaemonClient
+
+  beforeEach(async () => {
+    directory = mkdtempSync(join(tmpdir(), 'daemon-attachment-lifecycle-'))
+    const socketPath = getDaemonSocketPath(directory)
+    const tokenPath = join(directory, 'daemon.token')
+    server = new DaemonServer({
+      socketPath,
+      tokenPath,
+      spawnSubprocess: createMockSubprocess
+    })
+    await server.start()
+    client = new DaemonClient({ socketPath, tokenPath })
+    await client.ensureConnected()
+  })
+
+  afterEach(async () => {
+    client.disconnect()
+    await server.shutdown()
+    rmSync(directory, { recursive: true, force: true })
+  })
+
+  async function createSession(sessionId: string): Promise<void> {
+    await client.request('createOrAttach', { sessionId, cols: 80, rows: 24 })
+  }
+
+  it('parks attached sessions when their stream transport closes', async () => {
+    await createSession('transport-owned-session')
+    const daemon = server as unknown as DaemonAttachmentPrivate
+    const detachClients = vi.spyOn(daemon.host, 'detachClients')
+    const streamSocket = [...daemon.clients.values()][0]?.streamSocket
+
+    streamSocket?.destroy()
+
+    await vi.waitFor(() => expect(detachClients).toHaveBeenCalledOnce())
+    expect(detachClients.mock.calls[0]?.[0]).toEqual([
+      { sessionId: 'transport-owned-session', token: expect.any(Symbol) }
+    ])
+    expect(daemon.host.sessions.get('transport-owned-session')?.hasAttachedClients).toBe(false)
+    expect(daemon.streamClientIdBySessionId.has('transport-owned-session')).toBe(false)
+    expect(daemon.attachTokenBySessionId.has('transport-owned-session')).toBe(false)
+  })
+
+  it('parks only the requesting client attachment on explicit detach', async () => {
+    await createSession('explicitly-detached-session')
+    const daemon = server as unknown as DaemonAttachmentPrivate
+    const detach = vi.spyOn(daemon.host, 'detach')
+
+    await client.request('detach', { sessionId: 'explicitly-detached-session' })
+
+    expect(detach).toHaveBeenCalledWith('explicitly-detached-session', expect.any(Symbol))
+    expect(daemon.host.sessions.get('explicitly-detached-session')?.hasAttachedClients).toBe(false)
+    expect(daemon.streamClientIdBySessionId.has('explicitly-detached-session')).toBe(false)
+    expect(daemon.attachTokenBySessionId.has('explicitly-detached-session')).toBe(false)
+  })
+
+  it('parks an attachment completed after its transport already closed', async () => {
+    const daemon = server as unknown as DaemonAttachmentPrivate
+    const originalCreateOrAttach = daemon.host.createOrAttach.bind(daemon.host)
+    let attachmentCreated!: () => void
+    let finishRequest!: () => void
+    const created = new Promise<void>((resolve) => {
+      attachmentCreated = resolve
+    })
+    const gate = new Promise<void>((resolve) => {
+      finishRequest = resolve
+    })
+    vi.spyOn(daemon.host, 'createOrAttach').mockImplementation(async (options) => {
+      const result = await originalCreateOrAttach(options)
+      attachmentCreated()
+      await gate
+      return result
+    })
+    const request = client
+      .request('createOrAttach', { sessionId: 'close-race-session', cols: 80, rows: 24 })
+      .catch(() => undefined)
+    await created
+
+    client.disconnect()
+    await vi.waitFor(() => expect(daemon.clients.size).toBe(0))
+    expect(daemon.host.sessions.get('close-race-session')?.hasAttachedClients).toBe(true)
+    finishRequest()
+
+    await request
+    await vi.waitFor(() =>
+      expect(daemon.host.sessions.get('close-race-session')?.hasAttachedClients).toBe(false)
+    )
+    expect(daemon.streamClientIdBySessionId.has('close-race-session')).toBe(false)
+    expect(daemon.attachTokenBySessionId.has('close-race-session')).toBe(false)
+  })
+})
diff --git a/src/main/daemon/daemon-server.ts b/src/main/daemon/daemon-server.ts
index 51d9d0913a2..090be538b98 100644
--- a/src/main/daemon/daemon-server.ts
+++ b/src/main/daemon/daemon-server.ts
@@ -145,7 +145,7 @@ export class DaemonServer {
   private transportSockets = new Set<Socket>()
   private createOrAttachInFlight = 0
   private idleShutdownState: 'running' | 'idle-shutdown-pending' | 'shutting-down' = 'running'
-  private initialAdoptionTimer: unknown | null = null
+  private initialAdoptionTimer: unknown = null
   private initialAdoptionDeadlineMs: number | null = null
   private retirementRequested = false
   private shutdownPromise: Promise<void> | null = null
@@ -184,6 +184,7 @@ export class DaemonServer {
     }
   })
   private streamClientIdBySessionId = new Map<string, string>()
+  private attachTokenBySessionId = new Map<string, symbol>()
   private lastInputAtBySessionId = new Map<string, number>()
   private pendingPtySpawnPreparations = new Map<string, Set<PendingPtySpawnPreparation>>()
   private historySeedTransfers = new TerminalHistorySeedTransferRegistry()
@@ -227,7 +228,17 @@ export class DaemonServer {
     this.onAuthenticatedClientPair = opts.onAuthenticatedClientPair ?? (() => {})
     this.host = new TerminalHost({
       spawnSubprocess: opts.spawnSubprocess,
-      ...(opts.onPtySessionExit ? { onSessionReaped: opts.onPtySessionExit } : {})
+      // Why host-level and not the attach callback: a session whose client transport already dropped
+      // has no attachment left to fire exit bookkeeping, and the daemon must still notice it can idle.
+      onSessionReaped: (sessionId) => {
+        this.streamClientIdBySessionId.delete(sessionId)
+        this.attachTokenBySessionId.delete(sessionId)
+        this.lastInputAtBySessionId.delete(sessionId)
+        this.transientFactRelay.onSessionExit(sessionId)
+        this.streamDataBatcher.refreshSessionDroppability(sessionId)
+        opts.onPtySessionExit?.(sessionId)
+        this.reevaluateIdleShutdown()
+      }
     })
     this.ptySpawnHealthCheck = opts.ptySpawnHealthCheck ?? checkPtySpawnHealth
     this.preparePtySpawn = opts.preparePtySpawn ?? (() => Promise.resolve())
@@ -774,6 +785,7 @@ export class DaemonServer {
       this.historySeedTransfers.clearOwner(clientId)
       const wasFullyAuthenticated = client.authenticatedPairEstablished
       this.streamDataBatcher.clear(clientId)
+      this.detachClientSessions(clientId)
       client.streamSocket?.destroy()
       this.clients.delete(clientId)
       this.recordFullyAuthenticatedDisconnect(wasFullyAuthenticated)
@@ -811,6 +823,7 @@ export class DaemonServer {
       // Why: a preflight that outlives its output channel would create an unattached daemon PTY.
       this.cancelPendingPtySpawnPreparationsForClient(client.clientId)
       this.streamDataBatcher.clear(client.clientId)
+      this.detachClientSessions(client.clientId)
       client.streamSocket = null
     }
 
@@ -936,6 +949,36 @@ export class DaemonServer {
     }
   }
 
+  private detachClientSessions(clientId: string): void {
+    const attachments: { sessionId: string; token: symbol }[] = []
+    for (const [sessionId, attachedClientId] of this.streamClientIdBySessionId) {
+      if (attachedClientId !== clientId) {
+        continue
+      }
+      const token = this.attachTokenBySessionId.get(sessionId)
+      if (token) {
+        attachments.push({ sessionId, token })
+      }
+      this.streamClientIdBySessionId.delete(sessionId)
+      this.attachTokenBySessionId.delete(sessionId)
+    }
+    if (attachments.length > 0) {
+      this.host.detachClients(attachments)
+    }
+  }
+
+  private detachSessionForClient(sessionId: string, clientId: string): void {
+    if (this.streamClientIdBySessionId.get(sessionId) !== clientId) {
+      return
+    }
+    const token = this.attachTokenBySessionId.get(sessionId)
+    if (token) {
+      this.host.detach(sessionId, token)
+    }
+    this.streamClientIdBySessionId.delete(sessionId)
+    this.attachTokenBySessionId.delete(sessionId)
+  }
+
   private async routeRequest(clientId: string, request: DaemonRequest): Promise<unknown> {
     const client = this.clients.get(clientId)
 
@@ -1071,6 +1114,7 @@ export class DaemonServer {
                 this.transientFactRelay.onSessionExit(routedSessionId)
                 this.streamDataBatcher.refreshSessionDroppability(routedSessionId)
                 this.streamClientIdBySessionId.delete(routedSessionId)
+                this.attachTokenBySessionId.delete(routedSessionId)
                 this.lastInputAtBySessionId.delete(routedSessionId)
                 this.reevaluateIdleShutdown()
               }
@@ -1081,7 +1125,16 @@ export class DaemonServer {
           this.reevaluateIdleShutdown()
         }
         routedSessionId = result.agentSessionEnsure?.owner.ptyId ?? p.sessionId
+        if (
+          this.clients.get(clientId) !== client ||
+          !client.authenticatedPairEstablished ||
+          client.streamSocket === null
+        ) {
+          this.host.detach(routedSessionId, result.attachToken)
+          throw new TerminalAttachCanceledError(routedSessionId)
+        }
         this.streamClientIdBySessionId.set(routedSessionId, clientId)
+        this.attachTokenBySessionId.set(routedSessionId, result.attachToken)
         this.streamDataBatcher.refreshSessionDroppability(routedSessionId)
         // Why an attach-time marker: background resync can precede this attach, so scan suppression must start at the new stream's head.
         if (this.transientFactRelay.isBackgrounded(routedSessionId)) {
@@ -1228,7 +1281,7 @@ export class DaemonServer {
         return {}
 
       case 'detach':
-        // Note: detach token handling simplified — full impl would track tokens per client
+        this.detachSessionForClient(request.payload.sessionId, clientId)
         this.log.log('session-detached', {
           sessionId: request.payload.sessionId
         })
diff --git a/src/main/daemon/daemon-session-scrollback-window.test.ts b/src/main/daemon/daemon-session-scrollback-window.test.ts
new file mode 100644
index 00000000000..14f86857081
--- /dev/null
+++ b/src/main/daemon/daemon-session-scrollback-window.test.ts
@@ -0,0 +1,94 @@
+/**
+ * OOM regression: a daemon owning 100+ terminals retained ~5000 rows of grid per session with no
+ * bound, grew to ~1.9 GB, and was killed under system memory pressure — losing every session it
+ * owned. Sessions now retain a flat window; deep scrolling on an open terminal is the renderer's
+ * live buffer, and the window is what a rebuild (reload/remount/restart/remote attach) restores.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { TerminalHost } from './terminal-host'
+import type { SubprocessHandle } from './session'
+import {
+  DAEMON_SESSION_SCROLLBACK_ROWS,
+  resolveDaemonSessionScrollbackRows
+} from './daemon-session-scrollback-window'
+
+describe('resolveDaemonSessionScrollbackRows', () => {
+  it('defaults to the flat window', () => {
+    expect(resolveDaemonSessionScrollbackRows({} as NodeJS.ProcessEnv)).toBe(
+      DAEMON_SESSION_SCROLLBACK_ROWS
+    )
+  })
+
+  it('accepts the inclusive override bounds and rejects everything outside them', () => {
+    for (const raw of ['100', '2500', '5000']) {
+      const env = { ORCA_DAEMON_SESSION_SCROLLBACK_ROWS: raw } as NodeJS.ProcessEnv
+      expect(resolveDaemonSessionScrollbackRows(env)).toBe(Number(raw))
+    }
+    // Why bounded: 0 loses the visible screen's context; huge values silently reintroduce the
+    // unbounded retention this window exists to prevent.
+    for (const raw of ['0', '50', '99', '5001', '50000', '-1', '3.5', 'nonsense', '']) {
+      const env = { ORCA_DAEMON_SESSION_SCROLLBACK_ROWS: raw } as NodeJS.ProcessEnv
+      expect(resolveDaemonSessionScrollbackRows(env)).toBe(DAEMON_SESSION_SCROLLBACK_ROWS)
+    }
+  })
+})
+
+describe('daemon session scrollback window', () => {
+  let host: TerminalHost
+  let dataCb: ((data: string) => void) | null
+
+  function createMockSubprocess(): SubprocessHandle {
+    let onExitCb: ((code: number) => void) | null = null
+    return {
+      pid: 4242,
+      getForegroundProcess: vi.fn(() => null),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(() => {
+        setTimeout(() => onExitCb?.(0), 1)
+      }),
+      forceKill: vi.fn(() => onExitCb?.(137)),
+      signal: vi.fn(),
+      onData(cb) {
+        dataCb = cb
+      },
+      onExit(cb) {
+        onExitCb = cb
+      },
+      dispose: vi.fn()
+    } as SubprocessHandle
+  }
+
+  beforeEach(() => {
+    dataCb = null
+    host = new TerminalHost({ spawnSubprocess: () => createMockSubprocess() })
+  })
+
+  afterEach(async () => {
+    await host.dispose()
+  })
+
+  it('caps retained rows at the window while keeping the newest content', async () => {
+    await host.createOrAttach({
+      sessionId: 'windowed',
+      cols: 80,
+      rows: 24,
+      streamClient: { onData: vi.fn(), onExit: vi.fn() }
+    })
+    const total = DAEMON_SESSION_SCROLLBACK_ROWS + 500
+    for (let i = 1; i <= total; i += 1) {
+      dataCb?.(`LINE_${String(i).padStart(5, '0')}\r\n`)
+    }
+    await vi.waitFor(() => {
+      const snapshot = host.getSnapshot('windowed')
+      expect(snapshot?.snapshotAnsi ?? snapshot?.scrollbackAnsi).toBeTruthy()
+      const text = `${snapshot?.scrollbackAnsi ?? ''}${snapshot?.snapshotAnsi ?? ''}`
+      // Newest line always present; the oldest has scrolled past the window.
+      expect(text).toContain(`LINE_${String(total).padStart(5, '0')}`)
+      expect(text).not.toContain('LINE_00001')
+      const retainedMatches = text.match(/LINE_\d{5}/g) ?? []
+      expect(retainedMatches.length).toBeLessThanOrEqual(DAEMON_SESSION_SCROLLBACK_ROWS + 24)
+      expect(retainedMatches.length).toBeGreaterThan(DAEMON_SESSION_SCROLLBACK_ROWS - 50)
+    })
+  })
+})
diff --git a/src/main/daemon/daemon-session-scrollback-window.ts b/src/main/daemon/daemon-session-scrollback-window.ts
new file mode 100644
index 00000000000..68ecf6eeb4b
--- /dev/null
+++ b/src/main/daemon/daemon-session-scrollback-window.ts
@@ -0,0 +1,24 @@
+const DAEMON_SESSION_SCROLLBACK_ENV_VAR = 'ORCA_DAEMON_SESSION_SCROLLBACK_ROWS'
+
+// Why a flat window and not full renderer depth: retained grid is the daemon's dominant heap term and
+// session count is unbounded — a host owning 100+ terminals at full depth retained ~1 GB of grid and
+// was OOM-killed, taking every session it owned with it. A terminal the user has open scrolls its full
+// live renderer buffer; the daemon window is only what a REBUILD (reload, remount, restart, remote
+// attach) restores, and 1000 rows is the generous end of what terminal products restore there.
+export const DAEMON_SESSION_SCROLLBACK_ROWS = 1000
+// Why: keep any override within sane terminal bounds — 0 would lose the visible screen's context and
+// huge values silently reintroduce the unbounded-retention failure this window exists to prevent.
+const MIN_OVERRIDE_ROWS = 100
+const MAX_OVERRIDE_ROWS = 5000
+
+export function resolveDaemonSessionScrollbackRows(env: NodeJS.ProcessEnv = process.env): number {
+  const raw = env[DAEMON_SESSION_SCROLLBACK_ENV_VAR]?.trim()
+  if (!raw || !/^\d+$/.test(raw)) {
+    return DAEMON_SESSION_SCROLLBACK_ROWS
+  }
+  const parsed = Number(raw)
+  if (!Number.isSafeInteger(parsed) || parsed < MIN_OVERRIDE_ROWS || parsed > MAX_OVERRIDE_ROWS) {
+    return DAEMON_SESSION_SCROLLBACK_ROWS
+  }
+  return parsed
+}
diff --git a/src/main/daemon/daemon-transport-attachment-release.test.ts b/src/main/daemon/daemon-transport-attachment-release.test.ts
new file mode 100644
index 00000000000..ca6a544dc95
--- /dev/null
+++ b/src/main/daemon/daemon-transport-attachment-release.test.ts
@@ -0,0 +1,93 @@
+/**
+ * Attachment-leak regression: an attachment that outlives its transport leaves the session looking
+ * viewed forever — producer pause/resume and any attachment-gated behavior then act on a client that
+ * no longer exists. A dropped client transport must release exactly that client's attachments, and
+ * protocol detach must really detach (it was previously logging-only).
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DaemonPtyAdapter } from './daemon-pty-adapter'
+import { DaemonServer } from './daemon-server'
+import { getDaemonSocketPath } from './daemon-spawner'
+import type { Session, SubprocessHandle } from './session'
+
+function fixtureSubprocess(): SubprocessHandle {
+  let onExitCb: ((code: number) => void) | null = null
+  return {
+    pid: 1234,
+    getForegroundProcess: () => null,
+    write: () => {},
+    resize: () => {},
+    kill: () => {
+      setTimeout(() => onExitCb?.(0), 1)
+    },
+    forceKill: () => onExitCb?.(137),
+    signal: () => {},
+    onData: () => {},
+    onExit: (cb) => {
+      onExitCb = cb
+    },
+    dispose: () => {}
+  } as SubprocessHandle
+}
+
+describe('transport-drop attachment release', () => {
+  let dir: string
+  let socketPath: string
+  let tokenPath: string
+  let server: DaemonServer | null
+  let adapter: DaemonPtyAdapter | null
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'daemon-attachment-release-'))
+    socketPath = getDaemonSocketPath(dir)
+    tokenPath = join(dir, 'daemon.token')
+    server = null
+    adapter = null
+  })
+
+  afterEach(async () => {
+    await adapter?.disconnectOnly().catch(() => {})
+    await server?.shutdown().catch(() => {})
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  function sessionOf(started: DaemonServer, sessionId: string): Session | undefined {
+    const host = (started as unknown as { host: { sessions: Map<string, Session> } }).host
+    return host.sessions.get(sessionId)
+  }
+
+  it('releases a dropped client transport instead of leaving a phantom attachment', async () => {
+    const started = new DaemonServer({
+      socketPath,
+      tokenPath,
+      spawnSubprocess: () => fixtureSubprocess()
+    })
+    await started.start()
+    server = started
+
+    adapter = new DaemonPtyAdapter({
+      socketPath,
+      tokenPath,
+      profileScope: dir,
+      historyPath: join(dir, 'history')
+    })
+    await adapter.spawn({ sessionId: 'viewed-then-dropped', cols: 80, rows: 24 })
+
+    const session = sessionOf(started, 'viewed-then-dropped')
+    expect(session).toBeDefined()
+    expect(session!.hasAttachedClients).toBe(true)
+
+    // Drop the transport without any protocol detach — the crash/abrupt-exit case.
+    const client = (adapter as unknown as { client: { disconnect(): void } }).client
+    client.disconnect()
+
+    await vi.waitFor(() => {
+      expect(session!.hasAttachedClients).toBe(false)
+    })
+    // The session itself must survive the disconnect — only the attachment is released.
+    expect(session!.isAlive).toBe(true)
+  })
+})
diff --git a/src/main/daemon/degraded-daemon-pty-provider.test.ts b/src/main/daemon/degraded-daemon-pty-provider.test.ts
index 8c38ced2740..2f76fff6f7b 100644
--- a/src/main/daemon/degraded-daemon-pty-provider.test.ts
+++ b/src/main/daemon/degraded-daemon-pty-provider.test.ts
@@ -472,6 +472,22 @@ describe('DegradedDaemonPtyProvider', () => {
     })
   })
 
+  // Why: while degraded, a provider that cannot answer must not let inspection
+  // manufacture terminal_gone — that verdict retires a pane that may still be live.
+  it('answers unknown, and refuses terminal_gone, when no provider can answer', async () => {
+    const current = createDaemonAdapter('daemon')
+    const fallback = createProvider('fallback')
+    current.hasPty = vi.fn(() => null)
+    fallback.hasPty = vi.fn(() => null)
+    const provider = new DegradedDaemonPtyProvider({ current, legacy: [], fallback })
+
+    expect(provider.hasPty('unmapped-session')).toBe(null)
+    await expect(provider.inspectProcess('unmapped-session')).resolves.toEqual({
+      foregroundProcess: null,
+      hasChildProcesses: false
+    })
+  })
+
   it('caches a provider discovered by hasPty before routing later operations', () => {
     const current = createDaemonAdapter('daemon', ['daemon-session'])
     const fallback = createProvider('fallback')
@@ -685,6 +701,37 @@ describe('DegradedDaemonPtyProvider', () => {
   })
 })
 
+describe('DegradedDaemonPtyProvider owner gate against an unanswerable fallback', () => {
+  // STA-3077 made hasPty three-valued: null now means "this provider cannot answer", where
+  // before the only answers were yes and no. The owner gate asks the fallback to *prove* it owns
+  // a session before letting it act, and it must read that new null as "not proven" — otherwise
+  // the in-process fallback answers for a daemon-owned session, the pane closes, and the agent
+  // keeps running as an orphan. Nothing else exercises null at this boundary: every other double
+  // answers false, which makes `!== true` and `=== false` indistinguishable.
+  it('refuses a mutating operation when the fallback cannot answer for the session', async () => {
+    const current = createDaemonAdapter('daemon')
+    const fallback = createProvider('fallback')
+    fallback.hasPty = vi.fn(() => null)
+    const provider = new DegradedDaemonPtyProvider({ current, legacy: [], fallback })
+
+    await expect(provider.shutdown('wt-1@@unanswerable', {})).rejects.toBeInstanceOf(
+      TerminalSessionOwnerUnverifiedError
+    )
+    expect(fallback.shutdown).not.toHaveBeenCalled()
+    expect(current.shutdown).not.toHaveBeenCalled()
+  })
+
+  it('still lets the fallback act on a session it positively claims', async () => {
+    const current = createDaemonAdapter('daemon')
+    const fallback = createProvider('fallback')
+    fallback.hasPty = vi.fn(() => true)
+    const provider = new DegradedDaemonPtyProvider({ current, legacy: [], fallback })
+
+    await provider.shutdown('wt-1@@local', {})
+    expect(fallback.shutdown).toHaveBeenCalledWith('wt-1@@local', {})
+  })
+})
+
 describe('DegradedDaemonPtyProvider with a held daemon', () => {
   const HELD_SESSION = 'wt-1@@held-daemon-session'
 
@@ -783,3 +830,22 @@ describe('DegradedDaemonPtyProvider with a held daemon', () => {
     expect(current.shutdown).not.toHaveBeenCalled()
   })
 })
+
+// A memoized route outlives the session it was established for: listProcesses
+// drops ids missing from an authoritative inventory without an exit fanout. So a
+// mapped owner that cannot answer must stay unknown — coercing it to a liveness
+// proof is worse than the absence it replaced, because callers skip the real probe.
+it('keeps a mapped owner that cannot answer unknown, and still probes', async () => {
+  const current = createDaemonAdapter('current', ['s1'])
+  const fallback = createProvider('fallback')
+  const provider = new DegradedDaemonPtyProvider({ current, legacy: [], fallback })
+
+  expect(provider.hasPty('s1')).toBe(true)
+
+  current.hasPty = vi.fn(() => null)
+  expect(provider.hasPty('s1')).toBeNull()
+
+  current.probePtyLiveness = vi.fn(async () => null)
+  await provider.probePtyLiveness('s1')
+  expect(current.probePtyLiveness).toHaveBeenCalled()
+})
diff --git a/src/main/daemon/degraded-daemon-pty-provider.ts b/src/main/daemon/degraded-daemon-pty-provider.ts
index ec85118e5b7..02706432829 100644
--- a/src/main/daemon/degraded-daemon-pty-provider.ts
+++ b/src/main/daemon/degraded-daemon-pty-provider.ts
@@ -95,14 +95,25 @@ export class DegradedDaemonPtyProvider implements IPtyProvider {
     return ownerForDaemonOwnedOperation(this.providerFor(id), this.fallback, id)
   }
 
-  hasPty(id: string): boolean {
+  hasPty(id: string): boolean | null {
     const mapped = this.sessionProviders.get(id)
-    return mapped ? (mapped.hasPty?.(id) ?? true) : this.findProviderForExistingSession(id) !== null
+    if (mapped) {
+      // Why not `?? true`: a route outlives the session it was memoized for, so an
+      // owner that cannot answer must stay unknown rather than become a liveness proof.
+      return mapped.hasPty ? mapped.hasPty(id) : true
+    }
+    if (this.findProviderForExistingSession(id)) {
+      return true
+    }
+    // Why: one provider that cannot answer makes absence unknown; only unanimous proof is false.
+    return this.allProviders().every((provider) => provider.hasPty?.(id) === false) ? false : null
   }
 
   async probePtyLiveness(id: string): Promise<boolean | null> {
     const mapped = this.sessionProviders.get(id)
-    if (mapped && (mapped.hasPty?.(id) ?? true)) {
+    // Why only an explicit true short-circuits: an owner that cannot answer must
+    // fall through to the real probe instead of skipping it on a fabricated proof.
+    if (mapped && (mapped.hasPty ? mapped.hasPty(id) === true : true)) {
       return true
     }
     return await this.ownerRecovery.probe(id)
@@ -186,9 +197,9 @@ export class DegradedDaemonPtyProvider implements IPtyProvider {
     return this.providerFor(id).getForegroundProcess(id)
   }
   inspectProcess(id: string) {
-    return this.hasPty(id)
-      ? inspectPtyProviderProcess(this.providerFor(id), id)
-      : Promise.reject(new Error('terminal_gone'))
+    return this.hasPty(id) === false
+      ? Promise.reject(new Error('terminal_gone'))
+      : inspectPtyProviderProcess(this.providerFor(id), id)
   }
   async confirmForegroundProcess(id: string): Promise<string | null> {
     return this.providerFor(id).confirmForegroundProcess?.(id) ?? null
diff --git a/src/main/daemon/headless-emulator-modes.ts b/src/main/daemon/headless-emulator-modes.ts
new file mode 100644
index 00000000000..bf65d527a3c
--- /dev/null
+++ b/src/main/daemon/headless-emulator-modes.ts
@@ -0,0 +1,32 @@
+import type { Terminal } from '@xterm/headless'
+import type { TerminalMouseModeMirror } from './terminal-mouse-mode-mirror'
+import type { TerminalModes } from './types'
+
+type TerminalWithKittyKeyboard = Terminal & {
+  // Why: kitty keyboard flags aren't on the public IModes; read the core service the CSI u handlers mutate.
+  _core?: { coreService?: { kittyKeyboard?: { flags?: number } } }
+}
+
+export function readKittyKeyboardFlags(terminal: Terminal): number {
+  const flags = (terminal as TerminalWithKittyKeyboard)._core?.coreService?.kittyKeyboard?.flags
+  return typeof flags === 'number' ? flags : 0
+}
+
+/** Mode state a snapshot must carry so a restored pane behaves like the live one. */
+export function readTerminalModes(
+  terminal: Terminal,
+  mouseModes: TerminalMouseModeMirror
+): TerminalModes {
+  const buffer = terminal.buffer.active
+  const mouseTrackingMode = mouseModes.mouseTrackingMode
+  return {
+    bracketedPaste: terminal.modes.bracketedPasteMode,
+    mouseTracking: mouseTrackingMode !== 'none',
+    mouseTrackingMode,
+    sgrMouseMode: mouseModes.sgrMouseMode,
+    sgrMousePixelsMode: mouseModes.sgrMousePixelsMode,
+    applicationCursor: buffer.type === 'normal' ? terminal.modes.applicationCursorKeysMode : false,
+    alternateScreen: buffer.type === 'alternate',
+    kittyKeyboardFlags: readKittyKeyboardFlags(terminal)
+  }
+}
diff --git a/src/main/daemon/headless-emulator.ts b/src/main/daemon/headless-emulator.ts
index 12be643d637..e26ce0d3094 100644
--- a/src/main/daemon/headless-emulator.ts
+++ b/src/main/daemon/headless-emulator.ts
@@ -10,6 +10,7 @@ import {
 import { advancePartialEscapeTail } from '../../shared/terminal-partial-escape-tail'
 import type { TerminalViewAttributes } from '../../shared/terminal-view-attributes'
 import { collectHeadlessOscLinkRanges } from './headless-osc-link-ranges'
+import { readTerminalModes } from './headless-emulator-modes'
 import { buildRehydrateSequences } from './terminal-mode-rehydrate-sequences'
 import { TerminalMouseModeMirror } from './terminal-mouse-mode-mirror'
 import { TerminalOscCwdTitleScanner } from './terminal-osc-cwd-title-scanner'
@@ -338,24 +339,6 @@ export class HeadlessEmulator {
   }
 
   private getModes(): TerminalModes {
-    const buffer = this.terminal.buffer.active
-    const mouseTrackingMode = this.mouseModes.mouseTrackingMode
-    return {
-      bracketedPaste: this.terminal.modes.bracketedPasteMode,
-      mouseTracking: mouseTrackingMode !== 'none',
-      mouseTrackingMode,
-      sgrMouseMode: this.mouseModes.sgrMouseMode,
-      sgrMousePixelsMode: this.mouseModes.sgrMousePixelsMode,
-      applicationCursor:
-        buffer.type === 'normal' ? this.terminal.modes.applicationCursorKeysMode : false,
-      alternateScreen: buffer.type === 'alternate',
-      kittyKeyboardFlags: this.getKittyKeyboardFlags()
-    }
-  }
-
-  private getKittyKeyboardFlags(): number {
-    const flags = (this.terminal as TerminalWithSynchronousWrite)._core?.coreService?.kittyKeyboard
-      ?.flags
-    return typeof flags === 'number' ? flags : 0
+    return readTerminalModes(this.terminal, this.mouseModes)
   }
 }
diff --git a/src/main/daemon/macos-login-session-death-watch.ts b/src/main/daemon/macos-login-session-death-watch.ts
index 1f529ff3e00..e2df486e38f 100644
--- a/src/main/daemon/macos-login-session-death-watch.ts
+++ b/src/main/daemon/macos-login-session-death-watch.ts
@@ -66,9 +66,9 @@ export class MacosLoginSessionDeathWatch {
   private probeInFlight = false
   private stopped = false
   private retired = false
-  private scheduledProbeTimer: unknown | null = null
+  private scheduledProbeTimer: unknown = null
   private scheduledProbeAtMs: number | null = null
-  private ptyExitDebounceTimer: unknown | null = null
+  private ptyExitDebounceTimer: unknown = null
   private pendingProbeTrigger: string | null = null
   private probeAbortController: AbortController | null = null
 
diff --git a/src/main/daemon/pty-subprocess.test.ts b/src/main/daemon/pty-subprocess.test.ts
index 5322bd6294b..81d77da5720 100644
--- a/src/main/daemon/pty-subprocess.test.ts
+++ b/src/main/daemon/pty-subprocess.test.ts
@@ -78,9 +78,12 @@ vi.mock('../providers/windows-conpty-process-membership', () => ({
 import { createPtySubprocess, checkPtySpawnHealth } from './pty-subprocess'
 import { PREVIOUS_DAEMON_PROTOCOL_VERSIONS, PROTOCOL_VERSION } from './types'
 import { TERMINAL_GIT_CREDENTIAL_GUARD_POLICY_ENV } from '../../shared/terminal-git-credential-guard'
+import {
+  LEGACY_TERMINAL_SHIM_ENV_KEYS,
+  stripLegacyTerminalShimEnv
+} from '../pty/legacy-terminal-shim-dir'
 
 const ORCA_SHELL_WRAPPER_ENV = [
-  'ORCA_ATTRIBUTION_SHIM_DIR',
   'ORCA_OPENCODE_CONFIG_DIR',
   'ORCA_MIMOCODE_HOME',
   'ORCA_PI_CODING_AGENT_DIR',
@@ -1276,6 +1279,35 @@ describe('createPtySubprocess', () => {
     expect(env.ELECTRON_RUN_AS_NODE).toBeUndefined()
   })
 
+  it('does not inherit legacy attribution state from a pre-upgrade daemon', () => {
+    const proc = mockPtyProcess()
+    spawnMock.mockReturnValue(proc)
+    const saved = Object.fromEntries(
+      [...LEGACY_TERMINAL_SHIM_ENV_KEYS, 'PATH'].map((key) => [key, process.env[key]])
+    )
+    process.env.ORCA_ENABLE_GIT_ATTRIBUTION = '1'
+    process.env.ORCA_ATTRIBUTION_SHIM_DIR = '/tmp/orca-terminal-attribution/posix'
+    process.env.PATH = `/tmp/orca-terminal-attribution/posix${delimiter}/usr/bin`
+
+    try {
+      createPtySubprocess({ sessionId: 'test', cols: 80, rows: 24 })
+    } finally {
+      for (const [key, value] of Object.entries(saved)) {
+        if (value === undefined) {
+          delete process.env[key]
+        } else {
+          process.env[key] = value
+        }
+      }
+    }
+
+    const env = spawnMock.mock.calls.at(-1)?.[2].env
+    expect(env.PATH).toBe('/usr/bin')
+    for (const key of LEGACY_TERMINAL_SHIM_ENV_KEYS) {
+      expect(env[key]).toBeUndefined()
+    }
+  })
+
   it('does not inherit NODE_ENV from the daemon process env', () => {
     // Why: a dev-mode Orca forks the daemon with NODE_ENV=development; leaking
     // Orca's build mode into user shells breaks `next build` and Vitest.
@@ -1296,7 +1328,9 @@ describe('createPtySubprocess', () => {
 
     const env = spawnMock.mock.calls.at(-1)?.[2].env
     expect(env.NODE_ENV).toBeUndefined()
-    expect(env.PATH).toBe(process.env.PATH)
+    const expectedEnv = { PATH: process.env.PATH ?? '' }
+    stripLegacyTerminalShimEnv(expectedEnv, process.platform)
+    expect(env.PATH).toBe(expectedEnv.PATH)
   })
 
   it('keeps an explicitly requested NODE_ENV for daemon PTY shells', () => {
@@ -1760,7 +1794,7 @@ describe('createPtySubprocess', () => {
     expect(spawnEnv.MY_VAR).toBe('test-value')
   })
 
-  it('uses shell wrapper when attribution shims must survive shell startup', () => {
+  it('uses shell wrapper when managed env must survive shell startup', () => {
     const proc = mockPtyProcess()
     spawnMock.mockReturnValue(proc)
     const platform = Object.getOwnPropertyDescriptor(process, 'platform')
@@ -1773,7 +1807,7 @@ describe('createPtySubprocess', () => {
         rows: 24,
         env: {
           SHELL: '/bin/zsh',
-          ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/orca-terminal-attribution/posix'
+          ORCA_OPENCODE_CONFIG_DIR: '/tmp/orca-opencode-config'
         }
       })
     } finally {
@@ -2165,7 +2199,7 @@ describe('createPtySubprocess', () => {
         PATH: '/tmp/orca-agent-teams-bin:/usr/bin',
         ORCA_AGENT_TEAMS_TEAM_ID: 'team-test'
       },
-      envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
+      envToDelete: ['TERM_PROGRAM']
     })
 
     const lastCall = spawnMock.mock.calls.at(-1)!
@@ -2173,7 +2207,6 @@ describe('createPtySubprocess', () => {
     expect(lastCall[2].env.TERM).toBe('screen-256color')
     expect(lastCall[2].env.PATH.split(':')[0]).toBe('/tmp/orca-agent-teams-bin')
     expect(lastCall[2].env.TERM_PROGRAM).toBeUndefined()
-    expect(lastCall[2].env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
   })
 
   it('collapses its own env merge onto the requested Windows `Path` spelling', () => {
@@ -2209,6 +2242,8 @@ describe('createPtySubprocess', () => {
     const proc = mockPtyProcess()
     spawnMock.mockReturnValue(proc)
     const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    const expectedEnv = { PATH: process.env.PATH ?? '' }
+    stripLegacyTerminalShimEnv(expectedEnv, 'win32')
 
     Object.defineProperty(process, 'platform', { value: 'win32' })
     try {
@@ -2220,7 +2255,7 @@ describe('createPtySubprocess', () => {
     }
 
     const env = spawnMock.mock.calls.at(-1)![2].env
-    expect(env.PATH).toBe(process.env.PATH)
+    expect(env.PATH).toBe(expectedEnv.PATH)
   })
 
   it('preserves a duplicated path block supplied by main', () => {
diff --git a/src/main/daemon/pty-subprocess.ts b/src/main/daemon/pty-subprocess.ts
index 7566b81f6fe..a6eade9f621 100644
--- a/src/main/daemon/pty-subprocess.ts
+++ b/src/main/daemon/pty-subprocess.ts
@@ -6,7 +6,7 @@ import { delimiter, win32 as pathWin32 } from 'node:path'
 import type { SubprocessHandle } from './session'
 import { DaemonProtocolError } from './types'
 import {
-  getAttributionShellLaunchConfig,
+  getMarkerlessShellLaunchConfig,
   getShellReadyLaunchConfig,
   resolvePtyShellPath
 } from './shell-ready'
@@ -35,6 +35,7 @@ import { isHostCodexHomeForWsl, isWslCodexHomeForHost } from '../pty/codex-home-
 import { removeInheritedNoColor } from '../pty/terminal-color-env'
 import { removeAppImageRuntimeEnv } from '../pty/appimage-terminal-env'
 import { stripInheritedBuildModeEnv } from '../pty/build-mode-env'
+import { stripLegacyTerminalShimEnv } from '../pty/legacy-terminal-shim-dir'
 import { resolvePathEnvKey } from '../pty/windows-environment-path'
 import { parseWslPath } from '../wsl'
 import { addWslEnvKeys } from '../wsl-env'
@@ -629,6 +630,8 @@ export function createPtySubprocess(opts: PtySubprocessOptions): SubprocessHandl
     // Why: `supports-hyperlinks` gates OSC 8 on a TERM_PROGRAM allowlist excluding Orca; force it since xterm.js parses OSC 8 for clickable links.
     FORCE_HYPERLINK: '1'
   } as Record<string, string>
+  // Why: an older client may not ask a newly upgraded daemon to delete inherited shim state.
+  stripLegacyTerminalShimEnv(env, process.platform)
   composeGuardedDaemonGitConfigEnv(env, opts.env, opts.launchAgent)
   deleteRequestedDaemonEnvKeys(env, opts.envToDelete)
   if (opts.env?.TERM) {
@@ -800,18 +803,17 @@ export function createPtySubprocess(opts: PtySubprocessOptions): SubprocessHandl
       // Why: payload-bearing Codex startup text can be dropped by rc-file noise; plain Codex stays markerless for the startup-speed path.
       shellLaunch = shouldWaitForShellReady
         ? getShellReadyLaunchConfig(shellPath)
-        : getAttributionShellLaunchConfig(shellPath)
+        : getMarkerlessShellLaunchConfig(shellPath)
     } else if (opts.command) {
       shellLaunch = getShellReadyLaunchConfig(shellPath)
     } else {
       shellLaunch =
-        env.ORCA_ATTRIBUTION_SHIM_DIR ||
         env.ORCA_OPENCODE_CONFIG_DIR ||
         env.ORCA_MIMOCODE_HOME ||
         env.ORCA_OMP_STATUS_EXTENSION ||
         env.ORCA_CODEX_HOME ||
         env.ORCA_AGENT_TEAMS_SHIM_DIR
-          ? getAttributionShellLaunchConfig(shellPath)
+          ? getMarkerlessShellLaunchConfig(shellPath)
           : null
     }
     if (shellLaunch) {
@@ -835,6 +837,8 @@ export function createPtySubprocess(opts: PtySubprocessOptions): SubprocessHandl
     ? requestedEnv[resolvePathEnvKey(requestedEnv, process.platform)]
     : undefined
   promoteAgentTeamsShimPath(env, requestedPath)
+  // Why: raw requested PATH promotion runs after the inherited-env scrub.
+  stripLegacyTerminalShimEnv(env, process.platform)
 
   // Why: asar packaging can strip +x from node-pty's spawn-helper; the daemon is a separate forked process from the main-process fix.
   ensureNodePtySpawnHelperExecutable()
@@ -1062,6 +1066,8 @@ export function createPtySubprocess(opts: PtySubprocessOptions): SubprocessHandl
   return {
     pid: proc.pid,
     shellPath,
+    shellCwd: spawnCwd,
+    shellPathEnv: env.PATH,
     ...(slavePath ? { slavePath } : {}),
     ...(startupCommandDeliveredInShellArgs ? { startupCommandDeliveredInShellArgs: true } : {}),
     getForegroundProcess: () => {
diff --git a/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts b/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts
new file mode 100644
index 00000000000..74907d84406
--- /dev/null
+++ b/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts
@@ -0,0 +1,419 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { createPtySubprocess } from './pty-subprocess'
+import { Session } from './session'
+
+const describePosix = process.platform === 'win32' ? describe.skip : describe
+const hasZsh = process.platform !== 'win32' && spawnSync('/bin/zsh', ['--version']).status === 0
+const hasBash = process.platform !== 'win32' && spawnSync('/bin/bash', ['--version']).status === 0
+const COMMAND_OUTPUT = 'ORCA_STARTUP_COMMAND_RAN'
+const READ_STARTED_FILE = '.orca-read-started'
+
+type ShellFixture = {
+  name: string
+  shellPath: string
+  startupFile: string
+  replacement: string
+  command: string
+  instrumentationOutput: string
+  secretRead: string
+  childRead: string
+}
+
+const FIXTURES: ShellFixture[] = [
+  {
+    name: 'zsh profile',
+    shellPath: '/bin/zsh',
+    startupFile: '.zprofile',
+    replacement: 'exec -a kiro-cli-term /bin/zsh -o noglobalrcs -l -i',
+    command: `printf 'ORCA_STARTUP_%s:PF=%s\\n' COMMAND_RAN "\${(j:,:)precmd_functions}"\r`,
+    instrumentationOutput: `${COMMAND_OUTPUT}:PF=`,
+    secretRead: `: > "$HOME/${READ_STARTED_FILE}"; read -sk 1\n`,
+    childRead: `/bin/zsh -fc ': > "$HOME/${READ_STARTED_FILE}"; read -sk 1'\n`
+  },
+  {
+    name: 'zsh environment',
+    shellPath: '/bin/zsh',
+    startupFile: '.zshenv',
+    replacement: 'exec /bin/zsh -o noglobalrcs -l -i',
+    command: `printf 'ORCA_STARTUP_%s:PF=%s\\n' COMMAND_RAN "\${(j:,:)precmd_functions}"\r`,
+    instrumentationOutput: `${COMMAND_OUTPUT}:PF=`,
+    secretRead: `: > "$HOME/${READ_STARTED_FILE}"; read -sk 1\n`,
+    childRead: `/bin/zsh -fc ': > "$HOME/${READ_STARTED_FILE}"; read -sk 1'\n`
+  },
+  {
+    name: 'bash profile',
+    shellPath: '/bin/bash',
+    startupFile: '.bash_profile',
+    replacement: 'exec -a figterm-test /bin/bash --noprofile --norc -l -i',
+    command: `printf 'ORCA_STARTUP_%s:PC=%s\\n' COMMAND_RAN "$PROMPT_COMMAND"\r`,
+    instrumentationOutput: `${COMMAND_OUTPUT}:PC=`,
+    secretRead: `: > "$HOME/${READ_STARTED_FILE}"; read -s -n 1\n`,
+    childRead: `/bin/bash --noprofile --norc -c ': > "$HOME/${READ_STARTED_FILE}"; read -s -n 1'\n`
+  }
+]
+
+function count(text: string, needle: string): number {
+  return text.split(needle).length - 1
+}
+
+function waitForOutput(
+  subscribe: (settle: () => void) => void,
+  isDone: () => boolean,
+  timeoutMs = 5_000
+): Promise<void> {
+  if (isDone()) {
+    return Promise.resolve()
+  }
+  return new Promise<void>((resolve, reject) => {
+    const deadline = setTimeout(
+      () => reject(new Error('Timed out waiting for PTY output')),
+      timeoutMs
+    )
+    const settle = (): void => {
+      if (!isDone()) {
+        return
+      }
+      clearTimeout(deadline)
+      resolve()
+    }
+    subscribe(settle)
+    settle()
+  })
+}
+
+function waitForCondition(isDone: () => boolean, timeoutMs = 5_000): Promise<void> {
+  return new Promise<void>((resolve, reject) => {
+    const interval = setInterval(() => {
+      if (!isDone()) {
+        return
+      }
+      clearInterval(interval)
+      clearTimeout(deadline)
+      resolve()
+    }, 10)
+    const deadline = setTimeout(() => {
+      clearInterval(interval)
+      reject(new Error('Timed out waiting for fixture state'))
+    }, timeoutMs)
+  })
+}
+
+function runCleanupActions(...actions: (() => void)[]): void {
+  for (const action of actions) {
+    try {
+      action()
+    } catch {}
+  }
+}
+
+type RunningFixture = {
+  session: Session
+  subprocess: ReturnType<typeof createPtySubprocess>
+  output: () => string
+  readStarted: () => boolean
+  subscribe: (settle: () => void) => void
+  cleanup: () => Promise<void>
+}
+
+function startFixture(
+  fixture: ShellFixture,
+  startupContent: string,
+  extraFiles: Record<string, string> = {}
+): RunningFixture {
+  const tempHome = mkdtempSync(join(tmpdir(), 'orca-shell-ready-exec-'))
+  const previousHome = process.env.HOME
+  const previousZdotdir = process.env.ZDOTDIR
+  const previousOrigZdotdir = process.env.ORCA_ORIG_ZDOTDIR
+  let subprocess: ReturnType<typeof createPtySubprocess> | undefined
+  let session: Session | undefined
+  let consoleWarnSpy: { mockRestore: () => void } | undefined
+  try {
+    writeFileSync(join(tempHome, fixture.startupFile), startupContent)
+    for (const [fileName, content] of Object.entries(extraFiles)) {
+      writeFileSync(join(tempHome, fileName), content)
+    }
+    process.env.HOME = tempHome
+    delete process.env.ZDOTDIR
+    delete process.env.ORCA_ORIG_ZDOTDIR
+    consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    subprocess = createPtySubprocess({
+      sessionId: `repro-13767-${fixture.startupFile}`,
+      cols: 80,
+      rows: 24,
+      cwd: tempHome,
+      command: fixture.command,
+      shellOverride: fixture.shellPath,
+      env: {
+        HOME: tempHome,
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        SHELL: fixture.shellPath,
+        TERM: 'xterm-256color'
+      },
+      envToDelete: ['ORCA_EXEC_REPRO_DONE', 'ORCA_ORIG_ZDOTDIR', 'ZDOTDIR']
+    })
+    session = new Session({
+      sessionId: `repro-13767-${fixture.startupFile}`,
+      cols: 80,
+      rows: 24,
+      subprocess,
+      shellReadySupported: true
+    })
+    let output = ''
+    let onOutput = (): void => {}
+    session.attachClient({
+      onData: (data) => {
+        output += data
+        onOutput()
+      },
+      onExit: () => {}
+    })
+    session.write(fixture.command)
+    const runningSubprocess = subprocess
+    const runningSession = session
+    const activeConsoleWarnSpy = consoleWarnSpy
+
+    return {
+      session: runningSession,
+      subprocess: runningSubprocess,
+      output: () => output,
+      readStarted: () => existsSync(join(tempHome, READ_STARTED_FILE)),
+      subscribe: (settle) => {
+        onOutput = settle
+      },
+      cleanup: async () => {
+        if (runningSession.isAlive) {
+          try {
+            await runningSession.forceKillAndWaitForExit(3_000)
+          } catch {
+            runCleanupActions(() => runningSubprocess.forceKill())
+          }
+        }
+        runCleanupActions(
+          () => runningSession.dispose(),
+          () => activeConsoleWarnSpy.mockRestore(),
+          () => restoreEnvironment(previousHome, previousZdotdir, previousOrigZdotdir),
+          () => rmSync(tempHome, { recursive: true, force: true })
+        )
+      }
+    }
+  } catch (error) {
+    runCleanupActions(
+      () => subprocess?.forceKill(),
+      () => session?.dispose(),
+      () => !session && subprocess?.dispose(),
+      () => consoleWarnSpy?.mockRestore(),
+      () => restoreEnvironment(previousHome, previousZdotdir, previousOrigZdotdir),
+      () => rmSync(tempHome, { recursive: true, force: true })
+    )
+    throw error
+  }
+}
+
+function restoreEnvironment(
+  home: string | undefined,
+  zdotdir: string | undefined,
+  originalZdotdir: string | undefined
+): void {
+  setEnvironmentValue('HOME', home)
+  setEnvironmentValue('ZDOTDIR', zdotdir)
+  setEnvironmentValue('ORCA_ORIG_ZDOTDIR', originalZdotdir)
+}
+
+function setEnvironmentValue(key: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[key]
+  } else {
+    process.env[key] = value
+  }
+}
+
+async function runExecOracle(fixture: ShellFixture): Promise<void> {
+  const running = startFixture(
+    fixture,
+    `if [[ -z "\${ORCA_EXEC_REPRO_DONE:-}" ]]; then
+  export ORCA_EXEC_REPRO_DONE=1
+  ${fixture.replacement}
+fi
+`
+  )
+  try {
+    await waitForOutput(running.subscribe, () => running.output().includes(COMMAND_OUTPUT))
+    expect(running.session.shellState).toBe('ready')
+    expect(count(running.output(), COMMAND_OUTPUT)).toBe(1)
+    expect(running.output()).toContain(fixture.instrumentationOutput)
+    expect(running.output()).not.toContain('orca-shell-start')
+  } finally {
+    await running.cleanup()
+  }
+}
+
+async function runReadOracle(fixture: ShellFixture, child: boolean): Promise<void> {
+  const running = startFixture(fixture, child ? fixture.childRead : fixture.secretRead)
+  try {
+    await waitForCondition(running.readStarted)
+    await new Promise((resolve) => setTimeout(resolve, 300))
+    expect(running.session.shellState).toBe('pending')
+    expect(running.output()).not.toContain(COMMAND_OUTPUT)
+
+    running.subprocess.write('x\r')
+    await waitForOutput(running.subscribe, () => running.output().includes(COMMAND_OUTPUT))
+    expect(count(running.output(), COMMAND_OUTPUT)).toBe(1)
+    expect(running.output()).not.toContain('orca-shell-start')
+  } finally {
+    await running.cleanup()
+  }
+}
+
+describePosix('#13767 shell-ready marker loss across exec', () => {
+  it('continues setup cleanup after force-kill failure', () => {
+    const dispose = vi.fn()
+    const restore = vi.fn()
+    runCleanupActions(
+      () => {
+        throw new Error('force kill failed')
+      },
+      dispose,
+      restore
+    )
+    expect(dispose).toHaveBeenCalledOnce()
+    expect(restore).toHaveBeenCalledOnce()
+  })
+
+  for (const fixture of FIXTURES) {
+    const runnable = fixture.shellPath.endsWith('zsh') ? hasZsh : hasBash
+    const testCase = runnable ? it : it.skip
+    testCase(
+      `releases at the real ${fixture.name} prompt after exec`,
+      () => runExecOracle(fixture),
+      10_000
+    )
+    testCase(
+      `keeps queued input out of a real ${fixture.name} silent read`,
+      () => runReadOracle(fixture, false),
+      10_000
+    )
+    testCase(
+      `keeps queued input out of a child read during ${fixture.name} startup`,
+      () => runReadOracle(fixture, true),
+      10_000
+    )
+  }
+
+  const zshFixture = FIXTURES[0] as ShellFixture
+  const zshTest = hasZsh ? it : it.skip
+  zshTest(
+    'keeps queued input out of a zle-line-init read after exec',
+    async () => {
+      const running = startFixture(
+        zshFixture,
+        `if [[ -z "\${ORCA_EXEC_REPRO_DONE:-}" ]]; then
+  export ORCA_EXEC_REPRO_DONE=1
+  exec env ZDOTDIR="$HOME" /bin/zsh -o noglobalrcs -l -i
+fi
+`,
+        {
+          '.zshrc': `zle-line-init() {
+  print -n 'HOOK_SECRET> '
+  read -sk 1
+  print -r -- HOOK_DONE
+}
+zle -N zle-line-init
+`
+        }
+      )
+      try {
+        try {
+          await waitForOutput(running.subscribe, () => running.output().includes('HOOK_SECRET> '))
+        } catch (error) {
+          throw new Error(`ZLE hook startup output: ${JSON.stringify(running.output())}`, {
+            cause: error
+          })
+        }
+        await new Promise((resolve) => setTimeout(resolve, 300))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+
+        running.subprocess.write('x')
+        try {
+          await waitForOutput(running.subscribe, () => running.output().includes(COMMAND_OUTPUT))
+        } catch (error) {
+          throw new Error(`ZLE hook output: ${JSON.stringify(running.output())}`, { cause: error })
+        }
+        expect(running.output()).toContain('HOOK_DONE')
+        expect(count(running.output(), COMMAND_OUTPUT)).toBe(1)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+
+  const sqliteTest = hasZsh && existsSync('/usr/bin/sqlite3') ? it : it.skip
+  sqliteTest(
+    'does not treat an exec-replaced readline program as the shell prompt',
+    async () => {
+      const running = startFixture(zshFixture, 'exec /usr/bin/sqlite3\n')
+      try {
+        await waitForOutput(running.subscribe, () => running.output().includes('sqlite> '))
+        await new Promise((resolve) => setTimeout(resolve, 300))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+
+  sqliteTest(
+    'does not trust a non-shell executable renamed to the shell basename',
+    async () => {
+      const running = startFixture(
+        zshFixture,
+        'ln -s /usr/bin/sqlite3 "$HOME/zsh" && exec "$HOME/zsh"\n'
+      )
+      try {
+        await waitForOutput(running.subscribe, () => running.output().includes('sqlite> '))
+        await new Promise((resolve) => setTimeout(resolve, 300))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+
+  zshTest(
+    'retains the timeout backstop when zsh disables bracketed paste',
+    async () => {
+      const running = startFixture(
+        zshFixture,
+        `if [[ -z "\${ORCA_EXEC_REPRO_DONE:-}" ]]; then
+  export ORCA_EXEC_REPRO_DONE=1
+  exec env ZDOTDIR="$HOME" /bin/zsh -o noglobalrcs -l -i
+fi
+`,
+        {
+          '.zshrc': "zmodload zsh/zle\nunset zle_bracketed_paste\nPS1='NO_BRACKET_PROMPT> '\n"
+        }
+      )
+      try {
+        await waitForOutput(running.subscribe, () =>
+          running.output().includes('NO_BRACKET_PROMPT> ')
+        )
+        await new Promise((resolve) => setTimeout(resolve, 300))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+})
diff --git a/src/main/daemon/session.test.ts b/src/main/daemon/session.test.ts
index bc90bf5d97f..5769858f2cf 100644
--- a/src/main/daemon/session.test.ts
+++ b/src/main/daemon/session.test.ts
@@ -1,5 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { SESSION_FORCE_KILL_RETRY_MS, Session } from './session'
+import { HeadlessEmulator } from './headless-emulator'
 import type { SessionState, ShellReadyState } from './types'
 import type { TuiAgent } from '../../shared/types'
 
@@ -430,6 +431,29 @@ describe('Session', () => {
       expect(session.getSnapshot()?.snapshotAnsi).not.toContain('orca-shell-ready')
     })
 
+    it.each([
+      ['after the ready marker', ['\x1b]777;orca-shell-ready\x07', '\x1b[?2004hfish> ']],
+      ['after the ESC introducer', ['\x1b]777;orca-shell-ready\x07\x1b', '[?2004hfish> ']]
+    ])('preserves Fish bracketed-paste output split %s', (_boundary, chunks) => {
+      createSession({ shellReadySupported: true })
+      const received: string[] = []
+      session.attachClient({
+        onData: (data) => received.push(data),
+        onExit: () => {}
+      })
+
+      for (const chunk of chunks) {
+        subprocess.simulateData(chunk)
+      }
+
+      const output = received.join('')
+      expect(output).toBe('\x1b[?2004hfish> ')
+      const rendered = new HeadlessEmulator({ cols: 80, rows: 24 })
+      expect(rendered.writeSync(output)).toBe(true)
+      expect(rendered.getVisibleLines().join('\n')).not.toContain('[?2004h')
+      rendered.dispose()
+    })
+
     it('publishes an absolute output sequence with live snapshots', () => {
       createSession()
       subprocess.simulateData('first')
diff --git a/src/main/daemon/session.ts b/src/main/daemon/session.ts
index f24a6a7fcc9..3771b3194b5 100644
--- a/src/main/daemon/session.ts
+++ b/src/main/daemon/session.ts
@@ -8,11 +8,15 @@ import {
 import { isValidPtySize, normalizePtySize } from './daemon-pty-size'
 import { PostReadyFlushGate } from './post-ready-flush-gate'
 import {
-  createShellReadyScanState,
-  drainShellReadyHeldBytes,
-  scanForShellReady,
-  type ShellReadyScanState
-} from '../shell-ready-marker-scanner'
+  createShellStartupOutputScanState,
+  drainShellStartupOutputScanState,
+  scanShellStartupOutput,
+  type ShellStartupOutputScanState
+} from '../shell-startup-output-scanner'
+import {
+  createShellPromptReadinessProbe,
+  type ShellPromptReadinessProbe
+} from '../shell-prompt-readiness-probe'
 import { isPowerShellProcess } from '../../shared/shell-process-detection'
 import { killWithDescendantSweep } from '../pty-descendant-termination'
 import type { TuiAgent } from '../../shared/types'
@@ -60,6 +64,8 @@ export type SubprocessHandle = {
   /** Shell the subprocess actually spawned, after fallbacks. The host reconciles the caller's shell-ready
    *  assumption against it so a fallback shell without a ready marker never gates startup commands. */
   shellPath?: string
+  shellCwd?: string
+  shellPathEnv?: string
   /** Slave device path, so startup replies can read the line discipline's ECHO bit before
    *  writing. Absent on handles with no POSIX slave to read (ConPTY, tests). */
   slavePath?: string
@@ -124,7 +130,9 @@ export class Session {
   private preReadyStdinQueue: string[] = []
   private releaseStartupDeviceAttributesResponder: (() => void) | null = null
   private startupDeviceAttributesQueryFilter: StartupDeviceAttributesQueryFilter | null = null
-  private shellReadyScanState: ShellReadyScanState | null = null
+  private shellStartupOutputScanState: ShellStartupOutputScanState | null = null
+  private shellStartupPid: number | null = null
+  private shellPromptReadinessProbe: ShellPromptReadinessProbe | null = null
   private shellReadyTimer: ReturnType<typeof setTimeout> | null = null
   private killTimer: ReturnType<typeof setTimeout> | null = null
   private postReadyFlushGate: PostReadyFlushGate
@@ -169,7 +177,7 @@ export class Session {
 
     if (opts.shellReadySupported) {
       this._shellState = 'pending'
-      this.shellReadyScanState = createShellReadyScanState()
+      this.shellStartupOutputScanState = createShellStartupOutputScanState()
       // Why: `write` queues everything until the ready marker, including the renderer's DA1
       // reply — and a shell that withholds its first prompt until DA1 is answered (fish) then
       // never emits the marker that would release it. Answer from the daemon, past the queue.
@@ -195,6 +203,16 @@ export class Session {
       onEmission: (emission) => this.emitSubprocessOutput(emission),
       ...(echoProbe ? { echoProbe } : {})
     })
+    if (this._shellState === 'pending') {
+      this.shellPromptReadinessProbe = createShellPromptReadinessProbe({
+        slavePath: this.subprocess.slavePath,
+        shellPath: this.subprocess.shellPath,
+        shellCwd: this.subprocess.shellCwd,
+        shellPathEnv: this.subprocess.shellPathEnv,
+        getShellPid: () => this.shellStartupPid,
+        onPromptReady: () => this.onShellPromptReady()
+      })
+    }
     this.subprocess.onData((data) => this.handleSubprocessData(data))
     this.subprocess.onExit((code) => this.handleSubprocessExit(code))
   }
@@ -219,6 +237,11 @@ export class Session {
     return this._state !== 'exited'
   }
 
+  /** A viewing client is attached; a dropped transport must clear this or pause/resume semantics leak. */
+  get hasAttachedClients(): boolean {
+    return this.attachedClients.length > 0
+  }
+
   get isTerminating(): boolean {
     return this._isTerminating
   }
@@ -603,7 +626,9 @@ export class Session {
       clearTimeout(this.shellReadyTimer)
       this.shellReadyTimer = null
     }
-    this.shellReadyScanState = null
+    this.shellPromptReadinessProbe?.dispose()
+    this.shellPromptReadinessProbe = null
+    this.shellStartupOutputScanState = null
     this.preReadyStdinQueue = []
     this.postReadyFlushGate.clear()
     this.disposeSubprocessHandle()
@@ -649,10 +674,13 @@ export class Session {
     }
 
     let releaseStartupDeviceAttributes = false
-    if (this._shellState === 'pending' && this.shellReadyScanState) {
-      const scanned = scanForShellReady(this.shellReadyScanState, data)
+    if (this._shellState === 'pending' && this.shellStartupOutputScanState) {
+      const scanned = scanShellStartupOutput(this.shellStartupOutputScanState, data)
       data = scanned.output
-      if (scanned.matched) {
+      if (scanned.shellPid) {
+        this.shellStartupPid = scanned.shellPid
+      }
+      if (scanned.ready) {
         this.transitionToReady(scanned.postMarkerBytesObserved)
         releaseStartupDeviceAttributes = true
       }
@@ -661,6 +689,9 @@ export class Session {
     }
 
     this.startupIngress.accept(data)
+    if (this._shellState === 'pending' && data.length > 0) {
+      this.shellPromptReadinessProbe?.notifyOutput(data)
+    }
     if (releaseStartupDeviceAttributes) {
       this.releaseStartupDeviceAttributes()
     }
@@ -696,6 +727,8 @@ export class Session {
     }
 
     this.releaseStartupDeviceAttributes()
+    this.shellPromptReadinessProbe?.dispose()
+    this.shellPromptReadinessProbe = null
     this.releaseHeldShellReadyBytes()
     this.startupIngress.drainAndClose()
     this._exitCode = code
@@ -727,11 +760,11 @@ export class Session {
   }
 
   private releaseHeldShellReadyBytes(): string {
-    if (!this.shellReadyScanState) {
+    if (!this.shellStartupOutputScanState) {
       return ''
     }
-    const heldBytes = drainShellReadyHeldBytes(this.shellReadyScanState)
-    this.shellReadyScanState = null
+    const heldBytes = drainShellStartupOutputScanState(this.shellStartupOutputScanState)
+    this.shellStartupOutputScanState = null
     // Why: scanning strips marker bytes before fan-out; if readiness never completes, release any held prefix before timeout/exit discards it.
     this.startupIngress.accept(heldBytes)
     return heldBytes
@@ -758,7 +791,9 @@ export class Session {
 
   private transitionToReady(postMarkerBytesObserved = false): void {
     this._shellState = 'ready'
-    this.shellReadyScanState = null
+    this.shellStartupOutputScanState = null
+    this.shellPromptReadinessProbe?.dispose()
+    this.shellPromptReadinessProbe = null
     if (this.shellReadyTimer) {
       clearTimeout(this.shellReadyTimer)
       this.shellReadyTimer = null
@@ -775,11 +810,25 @@ export class Session {
       return
     }
     this._shellState = 'timed_out'
+    this.shellPromptReadinessProbe?.dispose()
+    this.shellPromptReadinessProbe = null
     this.releaseStartupDeviceAttributes()
     this.releaseHeldShellReadyBytes()
     this.flushPreReadyQueue()
   }
 
+  private onShellPromptReady(): void {
+    if (this._shellState !== 'pending') {
+      return
+    }
+    console.warn(
+      `[Session] ${this.sessionId}: shell-ready wrapper was replaced before its marker; releasing at the identified shell prompt. OSC 133 integration may be unavailable.`
+    )
+    this.releaseHeldShellReadyBytes()
+    this.transitionToReady(true)
+    this.releaseStartupDeviceAttributes()
+  }
+
   private flushPreReadyQueue(): void {
     const queued = this.preReadyStdinQueue
     this.preReadyStdinQueue = []
diff --git a/src/main/daemon/shell-ready.test.ts b/src/main/daemon/shell-ready.test.ts
index 9610f2600d1..2d931e7206e 100644
--- a/src/main/daemon/shell-ready.test.ts
+++ b/src/main/daemon/shell-ready.test.ts
@@ -5,6 +5,13 @@ import { join } from 'node:path'
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import type * as ShellReadyModule from './shell-ready'
 import { getZshShellReadyMarkerRegistrationBlock } from '../shell-templates'
+import { fishRequirementViolation, resolveFishBinary } from '../../shared/fish-binary-requirement'
+import {
+  createShellStartupOutputScanState,
+  drainShellStartupOutputScanState,
+  scanShellStartupOutput
+} from '../shell-startup-output-scanner'
+import { HeadlessEmulator } from './headless-emulator'
 
 async function importFreshShellReady(): Promise<typeof ShellReadyModule> {
   vi.resetModules()
@@ -16,8 +23,8 @@ const hasBash = process.platform !== 'win32' && spawnSync('bash', ['--version'])
 const itWithBash = hasBash ? it : it.skip
 const hasZsh = process.platform !== 'win32' && spawnSync('zsh', ['--version']).status === 0
 const itWithZsh = hasZsh ? it : it.skip
-const hasFish = process.platform !== 'win32' && spawnSync('fish', ['--version']).status === 0
-const itWithFish = hasFish ? it : it.skip
+const FISH = resolveFishBinary()
+const itWithFish = FISH.available ? it : it.skip
 
 const SHELL_READY_MARKER_OUTPUT = '\x1b]777;orca-shell-ready\x07'
 
@@ -166,6 +173,11 @@ function expectFinalZdotdirRestoreContext(content: string) {
 }
 
 describePosix('daemon shell-ready launch config', () => {
+  // Always runs, so the CI lane cannot report green with every live fish test skipped.
+  it('has the fish the live tests need when CI requires one', () => {
+    expect(fishRequirementViolation(FISH)).toBeNull()
+  })
+
   let previousUserDataPath: string | undefined
   let previousOrcaOrigZdotdir: string | undefined
   let userDataPath: string
@@ -252,10 +264,10 @@ describePosix('daemon shell-ready launch config', () => {
     expect(init).toContain('functions -e __orca_shell_ready_marker')
   })
 
-  it('keeps attribution-only fish spawns unwrapped', async () => {
-    const { getAttributionShellLaunchConfig } = await importFreshShellReady()
+  it('keeps markerless fish spawns unwrapped', async () => {
+    const { getMarkerlessShellLaunchConfig } = await importFreshShellReady()
 
-    const config = getAttributionShellLaunchConfig('/opt/homebrew/bin/fish')
+    const config = getMarkerlessShellLaunchConfig('/opt/homebrew/bin/fish')
 
     expect(config).toEqual({ args: null, env: {}, supportsReadyMarker: false })
   })
@@ -290,6 +302,8 @@ describePosix('daemon shell-ready launch config', () => {
           }
         })
         let output = ''
+        let scannedOutput = ''
+        const startupScanState = createShellStartupOutputScanState()
         let commandWritten = false
         let erasureProbeWritten = false
         let queryCarry = ''
@@ -315,6 +329,7 @@ describePosix('daemon shell-ready launch config', () => {
         }, 50)
         proc.onData((chunk) => {
           output += chunk
+          scannedOutput += scanShellStartupOutput(startupScanState, chunk).output
           // Why: fish stalls its first prompt 10s waiting on these and re-queries
           // each prompt, so answer every occurrence — an unanswered query makes
           // fish swallow the post-marker command as its reply.
@@ -344,9 +359,15 @@ describePosix('daemon shell-ready launch config', () => {
         clearTimeout(deadline)
         clearInterval(sentinelPoll)
         proc.kill()
+        scannedOutput += drainShellStartupOutputScanState(startupScanState)
 
         expect(output).toContain(SHELL_READY_MARKER_OUTPUT)
         expect(output.split(SHELL_READY_MARKER_OUTPUT)).toHaveLength(2)
+        expect(scannedOutput).toBe(output.replace(SHELL_READY_MARKER_OUTPUT, ''))
+        const rendered = new HeadlessEmulator({ cols: 80, rows: 24 })
+        expect(rendered.writeSync(scannedOutput)).toBe(true)
+        expect(rendered.getVisibleLines().join('\n')).not.toContain('[?2004h')
+        rendered.dispose()
         expect(existsSync(sentinel)).toBe(true)
         // Why: asserts the erase directly rather than inferring it from the marker
         // count, which only holds once enough prompts have been drawn to expose it.
@@ -456,6 +477,7 @@ describePosix('daemon shell-ready launch config', () => {
     const zshrc = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zshrc'), 'utf8')
     const zlogin = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zlogin'), 'utf8')
     expect(zshenv).toContain('_orca_user_zdotdir="${_orca_spawn_orig_zdotdir:-$HOME}"')
+    expect(zshenv).toContain('printf "\\033]777;orca-shell-start:%s\\007" "$$"')
     expect(zshenv).toContain('*/shell-ready/zsh) _orca_user_zdotdir="$HOME" ;;')
     expect(zshenv).toContain('""|*/shell-ready/zsh) export ORCA_ORIG_ZDOTDIR="$HOME" ;;')
     expectZdotdirSourceContext(zprofile, '.zprofile')
@@ -604,8 +626,6 @@ describePosix('daemon shell-ready launch config', () => {
       '[[ -n "${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="${ORCA_CODEX_HOME}"'
     const agentTeamsPathRestoreLine = '[[ -n "${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0'
     const ompWrapperLine = 'command omp --extension "${ORCA_OMP_STATUS_EXTENSION}" "$@"'
-    const primeWrapperLine =
-      'command prime-agent --extension "${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"'
     expect(zshrc).toContain(restoreLine)
     expect(zlogin).toContain(restoreLine)
     expect(bashRc).toContain(restoreLine)
@@ -627,9 +647,12 @@ describePosix('daemon shell-ready launch config', () => {
     expect(zshrc).toContain(ompWrapperLine)
     expect(zlogin).toContain(ompWrapperLine)
     expect(bashRc).toContain(ompWrapperLine)
-    expect(zshrc).toContain(primeWrapperLine)
-    expect(zlogin).toContain(primeWrapperLine)
-    expect(bashRc).toContain(primeWrapperLine)
+    for (const wrapperFile of [zshrc, zlogin, bashRc]) {
+      expect(wrapperFile).not.toContain('prime-agent()')
+      expect(wrapperFile).not.toContain('__orca_prime_agent')
+      expect(wrapperFile).not.toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION')
+      expect(wrapperFile).not.toContain('command prime-agent --extension')
+    }
   })
 
   // Why: regression guard for issue #2422 — bash wrapper must emit OSC 133 C/D so SSH sessions clear stale 'working' agent rows.
@@ -643,6 +666,7 @@ describePosix('daemon shell-ready launch config', () => {
     const bashRc = readFileSync(join(userDataPath, 'shell-ready', 'bash', 'rcfile'), 'utf8')
 
     expect(bashRc).toContain('printf "\\033]133;D;%s\\007"')
+    expect(bashRc).toContain('printf "\\033]777;orca-shell-start:%s\\007" "$$"')
     expect(bashRc).toContain('printf "\\033]133;C\\007"')
     // precmd is prepended (captures $? first), epilogue appended last, so a framework needing last position stays between them.
     expect(bashRc).toContain(
diff --git a/src/main/daemon/shell-ready.ts b/src/main/daemon/shell-ready.ts
index 27bcf6f48cb..189ff1c54b7 100644
--- a/src/main/daemon/shell-ready.ts
+++ b/src/main/daemon/shell-ready.ts
@@ -11,12 +11,12 @@ import {
   isPowerShellExecutableName
 } from '../powershell-osc133-bootstrap'
 import { getPosixOmpShellWrapper } from '../pty/omp-shell-wrapper'
-import { getPosixPrimeAgentShellWrapper } from '../pty/prime-agent-shell-wrapper'
 import {
   getFishShellReadyInitCommand,
   getZshEnvTemplate,
   getZshFinalZdotdirRestoreBlock,
   getZshShellReadyMarkerRegistrationBlock,
+  SHELL_STARTUP_IDENTITY_MARKER_BLOCK,
   getZshStartupFileSourceBlock
 } from '../shell-templates'
 
@@ -89,6 +89,7 @@ function shellReadyWrappersExist(): boolean {
 
 export function getDaemonBashShellReadyRcfileContent(): string {
   return `# Orca daemon bash shell-ready wrapper
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 [[ -f /etc/profile ]] && source /etc/profile
 if [[ -f "$HOME/.bash_profile" ]]; then
   source "$HOME/.bash_profile"
@@ -102,14 +103,6 @@ fi
 # treat each embedded newline as Enter and mangle the prompt into PS2
 # continuation. Modern readline defaults this on; force it for the rest.
 [[ $- == *i* ]] && bind 'set enable-bracketed-paste on' 2>/dev/null
-__orca_restore_attribution_path() {
-  [[ -n "\${ORCA_ATTRIBUTION_SHIM_DIR:-}" ]] || return 0
-  case "$PATH" in
-    "\${ORCA_ATTRIBUTION_SHIM_DIR}"|"\${ORCA_ATTRIBUTION_SHIM_DIR}:"*) return 0 ;;
-  esac
-  export PATH="\${ORCA_ATTRIBUTION_SHIM_DIR}:$PATH"
-}
-__orca_restore_attribution_path
 __orca_restore_agent_teams_path() {
   [[ -n "\${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0
   case "$PATH" in
@@ -123,7 +116,6 @@ __orca_restore_agent_teams_path
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 ${getPosixOmpShellWrapper()}
-${getPosixPrimeAgentShellWrapper()}
 # Why: Codex must keep using Orca's runtime CODEX_HOME after profile scripts.
 [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 # Why: emit OSC 133 C/D so terminal-command-lifecycle can drop stale agent
@@ -224,14 +216,6 @@ ${getZshStartupFileSourceBlock({
   interactiveOnly: true,
   skipWhenHomeIsCurrentZdotdir: true
 })}
-__orca_restore_attribution_path() {
-  [[ -n "\${ORCA_ATTRIBUTION_SHIM_DIR:-}" ]] || return 0
-  case "$PATH" in
-    "\${ORCA_ATTRIBUTION_SHIM_DIR}"|"\${ORCA_ATTRIBUTION_SHIM_DIR}:"*) return 0 ;;
-  esac
-  export PATH="\${ORCA_ATTRIBUTION_SHIM_DIR}:$PATH"
-}
-[[ ! -o login ]] && __orca_restore_attribution_path
 __orca_restore_agent_teams_path() {
   [[ -n "\${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0
   case "$PATH" in
@@ -245,7 +229,6 @@ if [[ ! -o login ]]; then
   [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
   [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
   ${getPosixOmpShellWrapper()}
-  ${getPosixPrimeAgentShellWrapper()}
   [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 fi
 __orca_osc133_precmd() {
@@ -289,14 +272,6 @@ ${getZshStartupFileSourceBlock({ fileName: '.zprofile' })}
   const zshRc = getDaemonZshShellReadyRcfileContent()
   const zshLogin = `# Orca daemon zsh shell-ready wrapper
 ${getZshStartupFileSourceBlock({ fileName: '.zlogin', interactiveOnly: true })}
-__orca_restore_attribution_path() {
-  [[ -n "\${ORCA_ATTRIBUTION_SHIM_DIR:-}" ]] || return 0
-  case "$PATH" in
-    "\${ORCA_ATTRIBUTION_SHIM_DIR}"|"\${ORCA_ATTRIBUTION_SHIM_DIR}:"*) return 0 ;;
-  esac
-  export PATH="\${ORCA_ATTRIBUTION_SHIM_DIR}:$PATH"
-}
-__orca_restore_attribution_path
 __orca_restore_agent_teams_path() {
   [[ -n "\${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0
   case "$PATH" in
@@ -309,7 +284,6 @@ __orca_restore_agent_teams_path
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 ${getPosixOmpShellWrapper()}
-${getPosixPrimeAgentShellWrapper()}
 [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 ${getZshShellReadyMarkerRegistrationBlock(SHELL_READY_MARKER)}
 ${getZshFinalZdotdirRestoreBlock()}
@@ -388,7 +362,8 @@ function getWrappedShellLaunchConfig(
         ORCA_ORIG_ZDOTDIR: resolveOriginalZdotdir(),
         ORCA_ZSHENV_SOURCE_DIR: resolveOriginalZshenvSourceDir(),
         ZDOTDIR: join(root, 'zsh'),
-        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0'
+        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0',
+        ORCA_SHELL_STARTUP_IDENTITY: options.emitReadyMarker ? '1' : '0'
       },
       supportsReadyMarker: options.emitReadyMarker
     }
@@ -400,7 +375,8 @@ function getWrappedShellLaunchConfig(
     return {
       args: ['--rcfile', join(root, 'bash', 'rcfile')],
       env: {
-        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0'
+        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0',
+        ORCA_SHELL_STARTUP_IDENTITY: options.emitReadyMarker ? '1' : '0'
       },
       supportsReadyMarker: options.emitReadyMarker
     }
@@ -419,7 +395,7 @@ function getWrappedShellLaunchConfig(
     }
   }
 
-  // Why: mirrors local-pty-shell-ready.ts; attribution-only fish stays unwrapped.
+  // Why: mirrors local-pty-shell-ready.ts; markerless fish stays unwrapped.
   if (shellName === 'fish' && options.emitReadyMarker) {
     return {
       args: ['-l', '-C', getFishShellReadyInitCommand(SHELL_READY_MARKER)],
@@ -439,6 +415,6 @@ export function getShellReadyLaunchConfig(shellPath: string): ShellLaunchConfig
   return getWrappedShellLaunchConfig(shellPath, { emitReadyMarker: true })
 }
 
-export function getAttributionShellLaunchConfig(shellPath: string): ShellLaunchConfig {
+export function getMarkerlessShellLaunchConfig(shellPath: string): ShellLaunchConfig {
   return getWrappedShellLaunchConfig(shellPath, { emitReadyMarker: false })
 }
diff --git a/src/main/daemon/terminal-host-session-create.ts b/src/main/daemon/terminal-host-session-create.ts
index dcc88fada05..5ce264809e4 100644
--- a/src/main/daemon/terminal-host-session-create.ts
+++ b/src/main/daemon/terminal-host-session-create.ts
@@ -9,6 +9,7 @@ import type { CreateOrAttachResult } from './terminal-host-create-contract'
 import type { TerminalHostOptions } from './terminal-host-options'
 import type { TerminalHostTombstones } from './terminal-host-tombstones'
 import type { TerminalSessionTeardown } from './terminal-session-teardown'
+import { resolveDaemonSessionScrollbackRows } from './daemon-session-scrollback-window'
 import { SessionNotFoundError } from './types'
 import { resolveWslSessionContext } from './wsl-session-context'
 
@@ -107,6 +108,7 @@ export async function createOrAttachTerminalSession(
       wslDistro
     }),
     shellReadySupported,
+    scrollback: resolveDaemonSessionScrollbackRows(),
     historySeedChunks: opts.historySeedChunks,
     ...(opts.startupIngress ? { startupIngress: opts.startupIngress } : {}),
     wslDistro,
diff --git a/src/main/daemon/terminal-host-session-reaping-leak.test.ts b/src/main/daemon/terminal-host-session-reaping-leak.test.ts
index 4a0a0d36446..501711607ee 100644
--- a/src/main/daemon/terminal-host-session-reaping-leak.test.ts
+++ b/src/main/daemon/terminal-host-session-reaping-leak.test.ts
@@ -3,8 +3,8 @@
  *
  * SessionIds are minted fresh per pane and never reused, so a `TerminalHost`
  * that never removes exited sessions from its `sessions` map leaks one dead
- * `Session` — each pinning a `@xterm/headless` emulator with ~5000 rows of
- * scrollback — per terminal for the lifetime of the long-lived daemon process.
+ * `Session` and its `@xterm/headless` scrollback grid per terminal for the
+ * lifetime of the long-lived daemon process.
  *
  * The fix wires a Session `onExit` hook to `TerminalHost.reapSession`, which
  * disposes the emulator and drops the entry from the map. These tests assert the
diff --git a/src/main/daemon/terminal-host.ts b/src/main/daemon/terminal-host.ts
index ae348a3854e..7f206be48c5 100644
--- a/src/main/daemon/terminal-host.ts
+++ b/src/main/daemon/terminal-host.ts
@@ -57,7 +57,7 @@ export class TerminalHost {
         if (options.agentSessionGeneration && this.sessions.get(options.sessionId)?.isAlive) {
           throw new Error('agent_session_claim_unavailable')
         }
-        return await createOrAttachTerminalSession(options, {
+        const result = await createOrAttachTerminalSession(options, {
           sessions: this.sessions,
           sessionTeardown: this.sessionTeardown,
           killedTombstones: this.killedTombstones,
@@ -72,6 +72,7 @@ export class TerminalHost {
             this.reapSession(sessionId)
           }
         })
+        return result
       }
     })
   }
@@ -114,7 +115,7 @@ export class TerminalHost {
     return Promise.resolve(killed)
   }
 
-  // Why: dispose a dead session's emulator so exited terminals don't pin ~5000 rows of scrollback for the daemon's life.
+  // Why: dispose a dead session's emulator so exited terminals don't pin their scrollback window for the daemon's life.
   private reapSession(sessionId: string): void {
     const session = this.sessions.get(sessionId)
     if (!session || session.isAlive) {
@@ -130,8 +131,13 @@ export class TerminalHost {
   }
 
   detach(sessionId: string, token: symbol): void {
-    const session = this.sessions.get(sessionId)
-    session?.detachClient(token)
+    this.detachClients([{ sessionId, token }])
+  }
+
+  detachClients(attachments: readonly { sessionId: string; token: symbol }[]): void {
+    for (const { sessionId, token } of attachments) {
+      this.sessions.get(sessionId)?.detachClient(token)
+    }
   }
 
   async getCwd(sessionId: string): Promise<string | null> {
diff --git a/src/main/daemon/terminal-session-teardown.ts b/src/main/daemon/terminal-session-teardown.ts
index 1ba58393721..352927a5dfd 100644
--- a/src/main/daemon/terminal-session-teardown.ts
+++ b/src/main/daemon/terminal-session-teardown.ts
@@ -39,9 +39,8 @@ export class TerminalSessionTeardown {
     }
     if (immediate) {
       return this.forceKillPlainShellSession(sessionId, session)
-    } else {
-      session.kill()
     }
+    session.kill()
   }
 
   /**
diff --git a/src/main/daemon/terminal-view-attribute-responder.ts b/src/main/daemon/terminal-view-attribute-responder.ts
index ddd04bf11dc..decca3d3f99 100644
--- a/src/main/daemon/terminal-view-attribute-responder.ts
+++ b/src/main/daemon/terminal-view-attribute-responder.ts
@@ -57,7 +57,7 @@ function isValidColorIndex(value: number): boolean {
 function relativeLuminance([r, g, b]: TerminalViewRgb): number {
   const linear = (channel: number): number => {
     const c = channel / 255
-    return c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4)
+    return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4
   }
   return linear(r) * 0.2126 + linear(g) * 0.7152 + linear(b) * 0.0722
 }
diff --git a/src/main/daemon/xterm-env-polyfill.ts b/src/main/daemon/xterm-env-polyfill.ts
index 9ab12627299..27605b8fa9a 100644
--- a/src/main/daemon/xterm-env-polyfill.ts
+++ b/src/main/daemon/xterm-env-polyfill.ts
@@ -1,6 +1,6 @@
 // @xterm/headless checks for `window` to detect browser vs node environment.
 // In ELECTRON_RUN_AS_NODE mode, `window` is undefined. This polyfill must be
 // imported before any @xterm/headless import.
-if (typeof globalThis.window === 'undefined') {
+if (globalThis.window === undefined) {
   ;(globalThis as Record<string, unknown>).window = globalThis
 }
diff --git a/src/main/emulator/android/adb-devices.ts b/src/main/emulator/android/adb-devices.ts
index 692bbb4d0fb..7264a825310 100644
--- a/src/main/emulator/android/adb-devices.ts
+++ b/src/main/emulator/android/adb-devices.ts
@@ -8,7 +8,7 @@ export type AndroidAdbDeviceState =
   | 'bootloader'
   | 'recovery'
   | 'no permissions'
-  | string
+  | (string & {})
 
 export type AndroidAdbDevice = {
   serial: string
diff --git a/src/main/emulator/emulator-bridge.test.ts b/src/main/emulator/emulator-bridge.test.ts
index 33b4f9d2421..a880c0f15a3 100644
--- a/src/main/emulator/emulator-bridge.test.ts
+++ b/src/main/emulator/emulator-bridge.test.ts
@@ -216,6 +216,95 @@ describe('EmulatorBridge helper ownership', () => {
     expect(bridge.getActiveForWorktree('wt-1')).toBeNull()
   })
 
+  it('does not clean up a failed attach while another start claim can register the device', async () => {
+    const waitForEndpointReady = vi.fn(async () => true)
+    execServeSimCommandMock.mockResolvedValue({
+      device: 'device-1',
+      streamUrl: 'http://127.0.0.1:3102/stream.mjpeg',
+      wsUrl: 'ws://127.0.0.1:3102'
+    })
+    const bridge = new EmulatorBridge({ waitForEndpointReady })
+
+    const failedLease = await bridge.acquireHelperForDevice('device-1')
+    const survivingLease = await bridge.acquireHelperForDevice('device-1')
+
+    await failedLease.release({ cleanupIfUnused: true })
+    bridge.registerActiveEmulator('wt-surviving', survivingLease.info, { managed: true })
+    await survivingLease.release()
+
+    expect(killServeSimHelperProcessesForDeviceMock).not.toHaveBeenCalled()
+    expect(shutdownSimulatorDeviceMock).not.toHaveBeenCalled()
+    expect(bridge.getActiveForWorktree('wt-surviving')).toMatchObject({
+      deviceUdid: 'device-1'
+    })
+  })
+
+  it('cleans up a failed attach when no start claim or registered workspace remains', async () => {
+    const waitForEndpointReady = vi.fn(async () => true)
+    execServeSimCommandMock.mockResolvedValue({
+      device: 'device-1',
+      streamUrl: 'http://127.0.0.1:3102/stream.mjpeg',
+      wsUrl: 'ws://127.0.0.1:3102'
+    })
+    const bridge = new EmulatorBridge({ waitForEndpointReady })
+
+    const lease = await bridge.acquireHelperForDevice('device-1')
+    await lease.release({ cleanupIfUnused: true })
+
+    expect(killServeSimHelperProcessesForDeviceMock).toHaveBeenCalledWith('device-1', {
+      helperPid: undefined,
+      includeOrphaned: true
+    })
+    expect(shutdownSimulatorDeviceMock).toHaveBeenCalledWith('device-1')
+  })
+
+  it('keeps a shared device alive when one registered workspace detaches', async () => {
+    const bridge = new EmulatorBridge()
+    bridge.registerActiveEmulator('wt-1', session('device-1'), { managed: true })
+    bridge.registerActiveEmulator('wt-2', session('device-1'), { managed: true })
+
+    await bridge.stopActiveManagedForWorktree('wt-1', { shutdownDevice: true })
+
+    expect(killServeSimHelperProcessesForDeviceMock).not.toHaveBeenCalled()
+    expect(shutdownSimulatorDeviceMock).not.toHaveBeenCalled()
+    expect(bridge.getActiveForWorktree('wt-1')).toBeNull()
+    expect(bridge.getActiveForWorktree('wt-2')).toMatchObject({ deviceUdid: 'device-1' })
+  })
+
+  it('keeps a device alive when its last registered workspace closes during another attach', async () => {
+    let finishStart:
+      | ((info: Awaited<ReturnType<typeof execServeSimCommandMock>>) => void)
+      | undefined
+    execServeSimCommandMock.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          finishStart = resolve
+        })
+    )
+    const bridge = new EmulatorBridge({ waitForEndpointReady: vi.fn(async () => true) })
+    bridge.registerActiveEmulator('wt-closing', session('device-1'), { managed: true })
+
+    const leasePromise = bridge.acquireHelperForDevice('device-1')
+    await vi.waitFor(() => expect(execServeSimCommandMock).toHaveBeenCalledOnce())
+    const shutdown = bridge.shutdownActiveManagedForWorktree('wt-closing')
+    await Promise.resolve()
+
+    expect(killServeSimHelperProcessesForDeviceMock).not.toHaveBeenCalled()
+    finishStart?.({
+      device: 'device-1',
+      streamUrl: 'http://127.0.0.1:3102/stream.mjpeg',
+      wsUrl: 'ws://127.0.0.1:3102'
+    })
+    const lease = await leasePromise
+    bridge.registerActiveEmulator('wt-attaching', lease.info, { managed: true })
+    await lease.release()
+    await shutdown
+
+    expect(killServeSimHelperProcessesForDeviceMock).not.toHaveBeenCalled()
+    expect(shutdownSimulatorDeviceMock).not.toHaveBeenCalled()
+    expect(bridge.getActiveForWorktree('wt-attaching')).toMatchObject({ deviceUdid: 'device-1' })
+  })
+
   it('reuses the active helper for the same requested device', async () => {
     const waitForEndpointReady = vi.fn(async () => true)
     const bridge = new EmulatorBridge({ waitForEndpointReady })
@@ -267,7 +356,7 @@ describe('EmulatorBridge helper ownership', () => {
     })
     const bridge = new EmulatorBridge({ waitForEndpointReady })
 
-    const info = await bridge.startHelperForDevice('device-1')
+    const { info } = await bridge.acquireHelperForDevice('device-1')
 
     expect(info.deviceUdid).toBe('device-1')
     expect(waitForEndpointReady).toHaveBeenCalledTimes(2)
@@ -309,7 +398,7 @@ describe('EmulatorBridge helper ownership', () => {
     })
     const bridge = new EmulatorBridge({ waitForEndpointReady })
 
-    await expect(bridge.startHelperForDevice('device-1')).rejects.toMatchObject({
+    await expect(bridge.acquireHelperForDevice('device-1')).rejects.toMatchObject({
       code: 'emulator_helper_failed'
     })
 
@@ -334,7 +423,7 @@ describe('EmulatorBridge helper ownership', () => {
     })
     const bridge = new EmulatorBridge({ waitForEndpointReady })
 
-    await expect(bridge.startHelperForDevice('device-1')).rejects.toMatchObject({
+    await expect(bridge.acquireHelperForDevice('device-1')).rejects.toMatchObject({
       code: 'emulator_helper_failed'
     })
 
@@ -368,7 +457,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-1', session('device-1'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -401,7 +491,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-1', session('device-1'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -435,7 +526,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-other', session('device-1'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -465,7 +557,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-1', session('device-active'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -499,7 +592,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     )
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -530,7 +624,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     )
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -551,7 +646,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-1', session('device-1'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -575,7 +671,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     const bridge = new EmulatorBridge()
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: false,
@@ -599,7 +696,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     const bridge = new EmulatorBridge({ waitForEndpointReady })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -641,7 +739,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     const bridge = new EmulatorBridge({ waitForEndpointReady })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
diff --git a/src/main/emulator/emulator-bridge.ts b/src/main/emulator/emulator-bridge.ts
index 84ecbb7025e..b201b34963a 100644
--- a/src/main/emulator/emulator-bridge.ts
+++ b/src/main/emulator/emulator-bridge.ts
@@ -5,6 +5,11 @@ import type { SimulatorDevice } from './simctl-simulator-devices'
 import type { EmulatorBridgeOptions } from './emulator-bridge-types'
 import type { EmulatorGesturePoint } from './emulator-gesture-sender'
 import { EmulatorSessionRegistry } from './emulator-session-registry'
+import {
+  EmulatorStartLeaseRegistry,
+  type EmulatorStartLease
+} from './emulator-start-lease-registry'
+import { listAvailableEmulatorDevices } from './emulator-device-inventory'
 import { deriveAxUrlFromStreamUrl } from './serve-sim-detached-session'
 import { IosEmulatorBackend } from './backends/ios-emulator-backend'
 import { AndroidEmulatorBackend } from './backends/android-emulator-backend'
@@ -22,6 +27,7 @@ import type {
 // backend a command targets (by the session's recorded backend, else by device).
 export class EmulatorBridge {
   private readonly sessionRegistry = new EmulatorSessionRegistry()
+  private readonly startLeases = new EmulatorStartLeaseRegistry()
   private readonly backends: EmulatorBackend[]
   private readonly iosBackend: IosEmulatorBackend
   private readonly androidBackend: AndroidEmulatorBackend
@@ -41,19 +47,7 @@ export class EmulatorBridge {
   // Aggregated device list across host-supported backends (iOS simulators +
   // Android devices/AVDs), for the unified `orca emulator list`.
   async listAllDevices(): Promise<EmulatorDevice[]> {
-    const perBackend = await Promise.all(
-      this.backends.map(async (backend) => {
-        if (!backend.isSupportedOnHost()) {
-          return []
-        }
-        try {
-          return await backend.listDevices()
-        } catch {
-          return []
-        }
-      })
-    )
-    return perBackend.flat()
+    return listAvailableEmulatorDevices(this.backends)
   }
 
   // iOS-specific passthroughs kept for back-compat with the runtime + availability code.
@@ -85,14 +79,10 @@ export class EmulatorBridge {
     return this.sessionRegistry.getActiveForWorktree(worktreeId)
   }
 
-  getActiveBackendKind(worktreeId: string): EmulatorBackendKind | null {
-    return this.backendForActiveWorktree(worktreeId)?.kind ?? null
-  }
-
   // On a device switch, keep slow-to-boot Android emulators running for instant
   // switch-back; shut down other backends' devices so they are not leaked.
   async stopActiveForSwitch(worktreeId: string): Promise<string | null> {
-    const keepAlive = this.getActiveBackendKind(worktreeId) === 'android'
+    const keepAlive = this.backendForActiveWorktree(worktreeId)?.kind === 'android'
     return this.stopActiveForWorktreeInternal(worktreeId, { shutdownDevice: !keepAlive })
   }
 
@@ -146,18 +136,26 @@ export class EmulatorBridge {
     if (!session || (options.managedOnly && !session.managed)) {
       return null
     }
+    if (this.sessionRegistry.hasActiveWorktreeForSession(key)) {
+      return session.deviceUdid
+    }
     const backend = this.backendForKind(session.backend)
     if (!backend) {
       return null
     }
-    await backend.stopHelperForDevice(session.deviceUdid, {
-      helperPid: session.pid,
-      includeOrphaned: !options.managedOnly
-    })
-    if (options.shutdownDevice) {
-      await backend.shutdownDevice(session.deviceUdid).catch(() => {})
+    const sessionInfo = this.sessionRegistry.toSessionInfo(session)
+    await this.startLeases.cleanupWhenIdle(
+      backend,
+      sessionInfo,
+      (info) => this.sessionRegistry.hasActiveWorktreeForSession(info.deviceUdid),
+      {
+        includeOrphaned: !options.managedOnly,
+        shutdownDevice: options.shutdownDevice
+      }
+    )
+    if (!this.sessionRegistry.hasActiveWorktreeForSession(key)) {
+      this.sessionRegistry.clearSessionAndWorktrees(key)
     }
-    this.sessionRegistry.clearSessionAndWorktrees(key)
     return session.deviceUdid
   }
 
@@ -243,9 +241,11 @@ export class EmulatorBridge {
     return run(backend, device)
   }
 
-  async startHelperForDevice(device: string): Promise<EmulatorSessionInfo> {
+  async acquireHelperForDevice(device: string): Promise<EmulatorStartLease> {
     const backend = await this.backendForDevice(device)
-    return backend.startSession(device)
+    return this.startLeases.acquire(backend, device, (info) =>
+      this.sessionRegistry.hasActiveWorktreeForSession(info.deviceUdid)
+    )
   }
 
   async kill(device?: string, worktreeId?: string): Promise<string> {
diff --git a/src/main/emulator/emulator-device-inventory.ts b/src/main/emulator/emulator-device-inventory.ts
new file mode 100644
index 00000000000..35649b947f3
--- /dev/null
+++ b/src/main/emulator/emulator-device-inventory.ts
@@ -0,0 +1,19 @@
+import type { EmulatorBackend, EmulatorDevice } from './backends/emulator-backend'
+
+export async function listAvailableEmulatorDevices(
+  backends: EmulatorBackend[]
+): Promise<EmulatorDevice[]> {
+  const perBackend = await Promise.all(
+    backends.map(async (backend) => {
+      if (!backend.isSupportedOnHost()) {
+        return []
+      }
+      try {
+        return await backend.listDevices()
+      } catch {
+        return []
+      }
+    })
+  )
+  return perBackend.flat()
+}
diff --git a/src/main/emulator/emulator-session-registry.ts b/src/main/emulator/emulator-session-registry.ts
index b55578930e4..917b14a9e39 100644
--- a/src/main/emulator/emulator-session-registry.ts
+++ b/src/main/emulator/emulator-session-registry.ts
@@ -51,6 +51,14 @@ export class EmulatorSessionRegistry {
     return this.sessions.get(key)
   }
 
+  toSessionInfo(session: EmulatorSessionState): EmulatorSessionInfo {
+    return toSessionInfo(session)
+  }
+
+  hasActiveWorktreeForSession(key: string): boolean {
+    return [...this.activeByWorktree.values()].some((activeKey) => activeKey === key)
+  }
+
   listSessions(): EmulatorSessionState[] {
     return [...this.sessions.values()]
   }
diff --git a/src/main/emulator/emulator-start-lease-registry.test.ts b/src/main/emulator/emulator-start-lease-registry.test.ts
new file mode 100644
index 00000000000..f0b0e927569
--- /dev/null
+++ b/src/main/emulator/emulator-start-lease-registry.test.ts
@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { EmulatorBackend } from './backends/emulator-backend'
+import { EmulatorStartLeaseRegistry } from './emulator-start-lease-registry'
+import type { EmulatorSessionInfo } from './emulator-types'
+
+function makeBackend(): {
+  backend: EmulatorBackend
+  resolveDeviceId: ReturnType<typeof vi.fn>
+  startSession: ReturnType<typeof vi.fn>
+  stopHelperForDevice: ReturnType<typeof vi.fn>
+  shutdownDevice: ReturnType<typeof vi.fn>
+} {
+  const resolveDeviceId = vi.fn(async () => {
+    throw new Error('shutdown AVD cannot resolve before boot')
+  })
+  const startSession = vi.fn(
+    async (): Promise<EmulatorSessionInfo> => ({
+      deviceUdid: 'emulator-5554',
+      streamUrl: 'scrcpy://emulator-5554',
+      wsUrl: '',
+      streamCodec: 'h264',
+      backend: 'android'
+    })
+  )
+  const stopHelperForDevice = vi.fn(async () => {})
+  const shutdownDevice = vi.fn(async () => {})
+  const backend: EmulatorBackend = {
+    kind: 'android',
+    streamCodec: 'h264',
+    capabilities: {
+      install: false,
+      launch: false,
+      permissions: false,
+      accessibilityTree: false,
+      logcat: false
+    },
+    isSupportedOnHost: () => true,
+    checkAvailability: vi.fn(),
+    listDevices: vi.fn(async () => []),
+    ownsDevice: vi.fn(async () => true),
+    resolveDeviceId,
+    startSession,
+    stopHelperForDevice,
+    shutdownDevice,
+    isSessionReusable: vi.fn(async () => true),
+    tap: vi.fn(async () => {}),
+    gesture: vi.fn(async () => {}),
+    type: vi.fn(async () => {}),
+    button: vi.fn(async () => {}),
+    rotate: vi.fn(async () => {}),
+    exec: vi.fn(async () => undefined)
+  }
+  return { backend, resolveDeviceId, startSession, stopHelperForDevice, shutdownDevice }
+}
+
+describe('EmulatorStartLeaseRegistry', () => {
+  it('lets the backend boot a shutdown device before a canonical id exists', async () => {
+    const { backend, resolveDeviceId, startSession } = makeBackend()
+    const registry = new EmulatorStartLeaseRegistry()
+
+    const lease = await registry.acquire(backend, 'Pixel_Tablet', () => false)
+    await lease.release()
+
+    expect(resolveDeviceId).not.toHaveBeenCalled()
+    expect(startSession).toHaveBeenCalledWith('Pixel_Tablet')
+    expect(lease.info.deviceUdid).toBe('emulator-5554')
+  })
+
+  it('waits for pending cleanup before starting a new lease', async () => {
+    const { backend, startSession, stopHelperForDevice, shutdownDevice } = makeBackend()
+    let finishCleanup: (() => void) | undefined
+    stopHelperForDevice.mockImplementation(
+      () =>
+        new Promise<void>((resolve) => {
+          finishCleanup = resolve
+        })
+    )
+    const registry = new EmulatorStartLeaseRegistry()
+    const first = await registry.acquire(backend, 'Pixel_Tablet', () => false)
+
+    const cleanup = first.release({ cleanupIfUnused: true })
+    await vi.waitFor(() => expect(stopHelperForDevice).toHaveBeenCalledOnce())
+    const second = registry.acquire(backend, 'Pixel_Tablet', () => false)
+    await Promise.resolve()
+    expect(startSession).toHaveBeenCalledOnce()
+
+    finishCleanup?.()
+    await cleanup
+    const secondLease = await second
+
+    expect(shutdownDevice).toHaveBeenCalledOnce()
+    expect(startSession).toHaveBeenCalledTimes(2)
+    await secondLease.release()
+  })
+
+  it('claims synchronously before an earlier lease can start cleanup', async () => {
+    const { backend, stopHelperForDevice, shutdownDevice } = makeBackend()
+    const registry = new EmulatorStartLeaseRegistry()
+    const first = await registry.acquire(backend, 'Pixel_Tablet', () => false)
+
+    const second = registry.acquire(backend, 'Pixel_Tablet', () => false)
+    await first.release({ cleanupIfUnused: true })
+
+    expect(stopHelperForDevice).not.toHaveBeenCalled()
+    const secondLease = await second
+    await secondLease.release()
+
+    expect(stopHelperForDevice).toHaveBeenCalledOnce()
+    expect(shutdownDevice).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/emulator/emulator-start-lease-registry.ts b/src/main/emulator/emulator-start-lease-registry.ts
new file mode 100644
index 00000000000..94b1e6ce992
--- /dev/null
+++ b/src/main/emulator/emulator-start-lease-registry.ts
@@ -0,0 +1,127 @@
+import type { EmulatorBackend } from './backends/emulator-backend'
+import type { EmulatorSessionInfo } from './emulator-types'
+
+export type EmulatorStartLease = {
+  info: EmulatorSessionInfo
+  release(options?: { cleanupIfUnused?: boolean }): Promise<void>
+}
+
+type PendingCleanup = {
+  info: EmulatorSessionInfo
+  isRegistered: (info: EmulatorSessionInfo) => boolean
+  includeOrphaned: boolean
+  shutdownDevice: boolean
+}
+
+export class EmulatorStartLeaseRegistry {
+  private readonly claimsByBackend = new Map<EmulatorBackend, number>()
+  private readonly cleanupByBackend = new Map<EmulatorBackend, Promise<void>>()
+  private readonly pendingCleanupByBackend = new Map<EmulatorBackend, Map<string, PendingCleanup>>()
+
+  async acquire(
+    backend: EmulatorBackend,
+    device: string,
+    isRegistered: (info: EmulatorSessionInfo) => boolean
+  ): Promise<EmulatorStartLease> {
+    this.claimsByBackend.set(backend, (this.claimsByBackend.get(backend) ?? 0) + 1)
+    try {
+      await this.cleanupByBackend.get(backend)
+      const info = await backend.startSession(device)
+      let released = false
+      return {
+        info,
+        release: async (options = {}) => {
+          if (released) {
+            return
+          }
+          released = true
+          if (options.cleanupIfUnused) {
+            this.addPendingCleanup(backend, info, isRegistered, {
+              includeOrphaned: true,
+              shutdownDevice: true
+            })
+          }
+          await this.release(backend)
+        }
+      }
+    } catch (error) {
+      await this.release(backend)
+      throw error
+    }
+  }
+
+  async cleanupWhenIdle(
+    backend: EmulatorBackend,
+    info: EmulatorSessionInfo,
+    isRegistered: (info: EmulatorSessionInfo) => boolean,
+    options: { includeOrphaned?: boolean; shutdownDevice?: boolean } = {}
+  ): Promise<void> {
+    this.addPendingCleanup(backend, info, isRegistered, options)
+    await this.drainCleanup(backend)
+  }
+
+  private async release(backend: EmulatorBackend): Promise<void> {
+    const remaining = this.decrement(backend)
+    if (remaining > 0) {
+      return
+    }
+    await this.drainCleanup(backend)
+  }
+
+  private async drainCleanup(backend: EmulatorBackend): Promise<void> {
+    await this.cleanupByBackend.get(backend)
+    if ((this.claimsByBackend.get(backend) ?? 0) > 0) {
+      return
+    }
+    const pending = this.pendingCleanupByBackend.get(backend)
+    this.pendingCleanupByBackend.delete(backend)
+    if (!pending) {
+      return
+    }
+    const cleanup = Promise.allSettled(
+      [...pending.values()].map(async ({ info, isRegistered, includeOrphaned, shutdownDevice }) => {
+        if (isRegistered(info)) {
+          return
+        }
+        await backend.stopHelperForDevice(info.deviceUdid, {
+          helperPid: info.helperPid,
+          includeOrphaned
+        })
+        if (shutdownDevice) {
+          await backend.shutdownDevice(info.deviceUdid)
+        }
+      })
+    )
+      .then(() => undefined)
+      .finally(() => this.cleanupByBackend.delete(backend))
+    this.cleanupByBackend.set(backend, cleanup)
+    await cleanup
+  }
+
+  private addPendingCleanup(
+    backend: EmulatorBackend,
+    info: EmulatorSessionInfo,
+    isRegistered: (info: EmulatorSessionInfo) => boolean,
+    options: { includeOrphaned?: boolean; shutdownDevice?: boolean }
+  ): void {
+    const pending = this.pendingCleanupByBackend.get(backend) ?? new Map()
+    const existing = pending.get(info.deviceUdid)
+    pending.set(info.deviceUdid, {
+      info,
+      isRegistered,
+      includeOrphaned: options.includeOrphaned === true || existing?.includeOrphaned === true,
+      shutdownDevice: options.shutdownDevice === true || existing?.shutdownDevice === true
+    })
+    this.pendingCleanupByBackend.set(backend, pending)
+  }
+
+  private decrement(backend: EmulatorBackend): number {
+    const next = Math.max(0, (this.claimsByBackend.get(backend) ?? 1) - 1)
+    if (next === 0) {
+      this.claimsByBackend.delete(backend)
+    } else {
+      this.claimsByBackend.set(backend, next)
+    }
+    return next
+  }
+}
diff --git a/src/main/emulator/mjpeg-frame-parser.ts b/src/main/emulator/mjpeg-frame-parser.ts
index 841bc6a8c91..90733e2c1fe 100644
--- a/src/main/emulator/mjpeg-frame-parser.ts
+++ b/src/main/emulator/mjpeg-frame-parser.ts
@@ -32,7 +32,7 @@ export function extractJpegFrames(
 
   while (cursor.length > 0) {
     const frameStart = cursor.indexOf(JPEG_START)
-    if (frameStart < 0) {
+    if (frameStart === -1) {
       const keepLastByte = cursor.at(-1) === 0xff
       return { frames, pending: keepLastByte ? Buffer.from([0xff]) : Buffer.alloc(0) }
     }
@@ -41,7 +41,7 @@ export function extractJpegFrames(
     }
 
     const frameEnd = cursor.indexOf(JPEG_END, JPEG_START.length)
-    if (frameEnd < 0) {
+    if (frameEnd === -1) {
       return { frames, pending: trimPendingBuffer(cursor, maxPendingBytes) }
     }
 
diff --git a/src/main/folder-workspace-diff-comments.ts b/src/main/folder-workspace-diff-comments.ts
new file mode 100644
index 00000000000..1a7435e8930
--- /dev/null
+++ b/src/main/folder-workspace-diff-comments.ts
@@ -0,0 +1,37 @@
+import type { DiffComment, FolderWorkspace } from '../shared/types'
+
+// Why shape-only: this replaces folder-workspaces.ts's verbatim `Array.isArray(raw.diffComments)` read.
+// Filtering members would make the fix itself a new deletion path for user-authored prose.
+export function normalizeFolderWorkspaceDiffComments(
+  value: unknown
+): Record<string, DiffComment[]> | undefined {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return undefined
+  }
+  const normalized: Record<string, DiffComment[]> = {}
+  let kept = false
+  for (const [id, comments] of Object.entries(value)) {
+    if (!Array.isArray(comments)) {
+      continue
+    }
+    normalized[id] = comments as DiffComment[]
+    kept = true
+  }
+  return kept ? normalized : undefined
+}
+
+// Why derive on every write: the map self-GCs, so delete paths need no pruning code.
+export function collectFolderWorkspaceDiffComments(
+  workspaces: readonly FolderWorkspace[] | undefined
+): Record<string, DiffComment[]> | undefined {
+  const collected: Record<string, DiffComment[]> = {}
+  let kept = false
+  for (const workspace of workspaces ?? []) {
+    const comments = workspace.diffComments
+    if (Array.isArray(comments) && comments.length > 0) {
+      collected[workspace.id] = comments
+      kept = true
+    }
+  }
+  return kept ? collected : undefined
+}
diff --git a/src/main/gemini/hook-service.ts b/src/main/gemini/hook-service.ts
index 4e44dba7bb6..72ee056bd5f 100644
--- a/src/main/gemini/hook-service.ts
+++ b/src/main/gemini/hook-service.ts
@@ -200,7 +200,7 @@ export class GeminiHookService {
     return this.getStatus()
   }
 
-  // POSIX-only remote install mirroring ClaudeHookService.installRemote. See docs/design/agent-status-over-ssh.md §8.
+  // POSIX-only remote install mirroring ClaudeHookService.installRemote; the managed script/JSON shape must match local install() or remote panes report a different status.
   async installRemote(sftp: SFTPWrapper, remoteHome: string): Promise<AgentHookInstallStatus> {
     const remoteConfigPath = `${remoteHome.replace(/\/$/, '')}/.gemini/settings.json`
     const remoteScriptPath = `${remoteHome.replace(/\/$/, '')}/.orca/agent-hooks/gemini-hook.sh`
diff --git a/src/main/git/repo.ts b/src/main/git/repo.ts
index e609d90a981..26291ec5d39 100644
--- a/src/main/git/repo.ts
+++ b/src/main/git/repo.ts
@@ -932,7 +932,7 @@ export function parseAndFilterSearchRefDetails(
       .filter((line) => line.length > 0)
       .map((line) => {
         const nul = line.indexOf('\0')
-        if (nul < 0) {
+        if (nul === -1) {
           // Why: no NUL means an unexpected %(refname) format; drop it rather than hand callers an unusable "short" ref.
           return null
         }
diff --git a/src/main/git/wsl-git-read-environment.ts b/src/main/git/wsl-git-read-environment.ts
index f67d696a37b..7df86a44a94 100644
--- a/src/main/git/wsl-git-read-environment.ts
+++ b/src/main/git/wsl-git-read-environment.ts
@@ -26,7 +26,7 @@ function parseProbe(stdout: string): WslGitReadEnvironment | null {
   const gitPath = fields[markerIndex + 2] ?? ''
   const home = fields[markerIndex + 3] ?? ''
   if (
-    markerIndex < 0 ||
+    markerIndex === -1 ||
     !path.includes('/') ||
     path.length > 32_768 ||
     !gitPath.startsWith('/') ||
diff --git a/src/main/github/stacked-pr-creation.ts b/src/main/github/stacked-pr-creation.ts
index 357f78bcbc6..e34752df6d9 100644
--- a/src/main/github/stacked-pr-creation.ts
+++ b/src/main/github/stacked-pr-creation.ts
@@ -209,7 +209,7 @@ function registeredStackNumber(
   )
   // Why: a miss is -1, and -1 + 1 reads the first entry — which reports "already
   // registered" whenever the current PR heads a stack the parent has left.
-  if (parentPosition < 0) {
+  if (parentPosition === -1) {
     return null
   }
   return parentStack.pull_requests[parentPosition + 1]?.number === currentReview.number
diff --git a/src/main/index.ts b/src/main/index.ts
index 3f076c2e908..b4e0e1b5ae4 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -119,6 +119,7 @@ import {
   configureElectronNetworkCompatibility,
   configureDevUserDataPath,
   configureOrcaUserDataPathEnv,
+  disableUnsupportedChromiumFeatures,
   enableMainProcessGpuFeatures,
   installDevParentDisconnectQuit,
   installDevParentSignalQuit,
@@ -184,6 +185,7 @@ import {
   logStartupMilestone
 } from './startup/startup-diagnostics'
 import { ensureWindowsUserDataAclGrant } from './startup/windows-user-data-acl'
+import { neutralizeLegacyTerminalShimDir } from './pty/legacy-terminal-shim-dir'
 import { shouldQuitWhenAllWindowsClosed } from './startup/window-all-closed-quit-policy'
 import {
   createServeDesktopActivationGate,
@@ -846,6 +848,7 @@ if (hasSingleInstanceLock) {
     platform: process.platform,
     ...getMainProcessLifecycleIdentity()
   })
+  disableUnsupportedChromiumFeatures()
   configureElectronNetworkCompatibility()
   enableRendererHeapHeadroom()
   maybeApplyGpuFallbackForThisLaunch()
@@ -2168,6 +2171,8 @@ void app.whenReady().then(async () => {
 
   const activeOrcaProfile = ensureActiveOrcaProfile()
   store = new Store({ dataFile: activeOrcaProfile.dataFile })
+  // Why: must precede PTY handler registration and run in headless serve too, which returns before openMainWindow.
+  neutralizeLegacyTerminalShimDir(app.getPath('userData'))
   const windowsShellPathHydration = createWindowsShellPathHydration()
   configureWindowsHostGitEnvironmentReadiness(
     process.platform === 'win32' ? windowsShellPathHydration.whenReady : null
diff --git a/src/main/ipc/ssh-pty-output-intake-test-harness.ts b/src/main/ipc/__tests__/ssh-pty-output-intake-test-harness.ts
similarity index 97%
rename from src/main/ipc/ssh-pty-output-intake-test-harness.ts
rename to src/main/ipc/__tests__/ssh-pty-output-intake-test-harness.ts
index 9209b897284..c3fe0b26ac9 100644
--- a/src/main/ipc/ssh-pty-output-intake-test-harness.ts
+++ b/src/main/ipc/__tests__/ssh-pty-output-intake-test-harness.ts
@@ -3,7 +3,7 @@ import {
   SshPtyOutputIntake,
   type SshPtyOutputDataEvent,
   type SshPtyOutputIntakeDependencies
-} from './ssh-pty-output-intake'
+} from '../ssh-pty-output-intake'
 
 export function sshPtyOutputEvent(
   overrides: Partial<SshPtyOutputDataEvent> = {}
diff --git a/src/main/ipc/dashboard-payload-validation.test.ts b/src/main/ipc/dashboard-payload-validation.test.ts
index 958fff9e8a3..83970cfa4ca 100644
--- a/src/main/ipc/dashboard-payload-validation.test.ts
+++ b/src/main/ipc/dashboard-payload-validation.test.ts
@@ -45,6 +45,7 @@ const SNAPSHOT = {
       worktreeName: 'Dashboard',
       hostKind: 'ssh',
       executionHostId: 'ssh:build-box',
+      hostLabel: 'Build box',
       workspaceKind: 'worktree',
       workspaceStatusId: 'in-review',
       workspaceStatusLabel: 'In review',
@@ -68,6 +69,7 @@ const SNAPSHOT = {
       parentWorktreeId: 'parent-worktree-1',
       hostKind: 'ssh',
       executionHostId: 'ssh:build-box',
+      hostLabel: 'Build box',
       workspaceKind: 'worktree',
       workspaceStatusId: 'in-review',
       workspaceStatusLabel: 'In review',
@@ -143,6 +145,12 @@ describe('dashboard payload validation', () => {
         cards: [{ ...SNAPSHOT.cards[0], executionHostId: `ssh:${'x'.repeat(4_097)}` }]
       })
     ).toBe(false)
+    expect(
+      isDashboardSnapshot({
+        ...SNAPSHOT,
+        cards: [{ ...SNAPSHOT.cards[0], hostLabel: 'x'.repeat(1_025) }]
+      })
+    ).toBe(false)
     expect(
       isDashboardSnapshot({
         ...SNAPSHOT,
@@ -236,6 +244,12 @@ describe('dashboard payload validation', () => {
         workspaces: [{ ...SNAPSHOT.workspaces[0], worktreeName: 'x'.repeat(1_025) }]
       })
     ).toBe(false)
+    expect(
+      isDashboardSnapshot({
+        ...SNAPSHOT,
+        workspaces: [{ ...SNAPSHOT.workspaces[0], hostLabel: 'x'.repeat(1_025) }]
+      })
+    ).toBe(false)
   })
 
   it('validates bounded launch choices and spawn requests', () => {
diff --git a/src/main/ipc/dashboard-payload-validation.ts b/src/main/ipc/dashboard-payload-validation.ts
index f819392dae1..6186e638fd1 100644
--- a/src/main/ipc/dashboard-payload-validation.ts
+++ b/src/main/ipc/dashboard-payload-validation.ts
@@ -272,6 +272,7 @@ function isDashboardCard(value: unknown): boolean {
     (card.executionHostId === undefined ||
       (isBoundedString(card.executionHostId, MAX_ID_LENGTH) &&
         normalizeExecutionHostId(card.executionHostId) !== null)) &&
+    isOptionalBoundedString(card.hostLabel, MAX_LABEL_LENGTH) &&
     (card.workspaceKind === undefined ||
       (typeof card.workspaceKind === 'string' &&
         DASHBOARD_WORKSPACE_KINDS.has(card.workspaceKind))) &&
diff --git a/src/main/ipc/dashboard-workspace-payload-validation.ts b/src/main/ipc/dashboard-workspace-payload-validation.ts
index 88e16d9af45..f64cf63d42a 100644
--- a/src/main/ipc/dashboard-workspace-payload-validation.ts
+++ b/src/main/ipc/dashboard-workspace-payload-validation.ts
@@ -50,6 +50,7 @@ export function isDashboardWorkspace(value: unknown): value is DashboardWorkspac
     HOST_KINDS.has(workspace.hostKind) &&
     isString(workspace.executionHostId, MAX_ID_LENGTH) &&
     normalizeExecutionHostId(workspace.executionHostId) !== null &&
+    isOptionalString(workspace.hostLabel, DASHBOARD_MAX_LABEL_LENGTH) &&
     typeof workspace.workspaceKind === 'string' &&
     WORKSPACE_KINDS.has(workspace.workspaceKind) &&
     isOptionalString(workspace.workspaceStatusId, MAX_ID_LENGTH) &&
diff --git a/src/main/ipc/ephemeral-vm.test.ts b/src/main/ipc/ephemeral-vm.test.ts
index 8df189a4abb..bbccfb41e93 100644
--- a/src/main/ipc/ephemeral-vm.test.ts
+++ b/src/main/ipc/ephemeral-vm.test.ts
@@ -6,7 +6,7 @@ import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../shared/pairing'
 import { listEnvironments } from '../../shared/runtime-environment-store'
 import { upsertEphemeralVmRuntime } from '../../shared/ephemeral-vm-runtime-store'
 
-const handlers = new Map<string, (_event: unknown, args: never) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (_event: unknown, args: never) => unknown>()
 const {
   handleMock,
   removeHandlerMock,
diff --git a/src/main/ipc/filesystem-import.test.ts b/src/main/ipc/filesystem-import.test.ts
index fcd004dcd06..bb143987c96 100644
--- a/src/main/ipc/filesystem-import.test.ts
+++ b/src/main/ipc/filesystem-import.test.ts
@@ -645,7 +645,7 @@ describe('fs:importExternalPaths', () => {
     )
     const mib = 1024 * 1024
     const regularSize = 25 * mib
-    const overflowSize = 1 * mib
+    const overflowSize = Number(mib)
     const readFileMock = vi.fn().mockResolvedValue(Buffer.from('chunk'))
 
     lstatMock.mockImplementation(async (p: string) => {
@@ -683,7 +683,7 @@ describe('fs:importExternalPaths', () => {
     )
     openMock.mockImplementation(async (p: string) => {
       const fileIndex = filePaths.indexOf(p)
-      if (fileIndex >= 0 && fileIndex < filePaths.length - 1) {
+      if (fileIndex !== -1 && fileIndex < filePaths.length - 1) {
         return {
           stat: vi.fn().mockResolvedValue({
             size: regularSize,
diff --git a/src/main/ipc/filesystem-search-rg-timeout.test.ts b/src/main/ipc/filesystem-search-rg-timeout.test.ts
index 9e0a259d2d3..6c677c73d6d 100644
--- a/src/main/ipc/filesystem-search-rg-timeout.test.ts
+++ b/src/main/ipc/filesystem-search-rg-timeout.test.ts
@@ -20,7 +20,7 @@ const {
   toWindowsWslPathMock: vi.fn((value: string) => value)
 }))
 
-const handlers = new Map<string, (event: unknown, args: unknown) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (event: unknown, args: unknown) => unknown>()
 
 vi.mock('electron', () => ({
   ipcMain: {
diff --git a/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts b/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
index f557ebca379..7d27d4ca780 100644
--- a/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
+++ b/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
@@ -22,7 +22,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 const WORKTREE_PATH = '/home/me/repo'
 const ARGS = { worktreePath: WORKTREE_PATH, connectionId: 'conn-1' }
diff --git a/src/main/ipc/filesystem-watcher-large-batch.test.ts b/src/main/ipc/filesystem-watcher-large-batch.test.ts
index 80d45c90e43..e605cd6167c 100644
--- a/src/main/ipc/filesystem-watcher-large-batch.test.ts
+++ b/src/main/ipc/filesystem-watcher-large-batch.test.ts
@@ -38,7 +38,7 @@ import {
   WATCH_BATCH_TRAILING_MS
 } from '../../shared/filesystem-watch-batch-window'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('local filesystem watcher large batches', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts b/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
index 0e15ad43fc7..eb161c1ba30 100644
--- a/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
+++ b/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
@@ -47,7 +47,7 @@ import { subscribe as subscribeParcelWatcher } from '@parcel/watcher'
 import { subscribeViaWatcherProcess } from './parcel-watcher-process'
 import { WatcherProcessFailure } from './parcel-watcher-process-failure'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('local filesystem watcher unsubscribe cleanup', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-native-capacity.test.ts b/src/main/ipc/filesystem-watcher-native-capacity.test.ts
index 41db2d35e52..670b7eb2af3 100644
--- a/src/main/ipc/filesystem-watcher-native-capacity.test.ts
+++ b/src/main/ipc/filesystem-watcher-native-capacity.test.ts
@@ -28,7 +28,7 @@ import {
   WatcherChildCapacityError
 } from './parcel-watcher-child-registry'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 function fillWatcherChildCapacity(): (() => void)[] {
   return Array.from({ length: MAX_PHYSICAL_WATCHER_CHILDREN }, () => {
diff --git a/src/main/ipc/filesystem-watcher-real.test.ts b/src/main/ipc/filesystem-watcher-real.test.ts
index 34f2bcc91e1..a813be69e28 100644
--- a/src/main/ipc/filesystem-watcher-real.test.ts
+++ b/src/main/ipc/filesystem-watcher-real.test.ts
@@ -26,7 +26,7 @@ vi.mock('electron', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 type FsChangedCall = { worktreePath: string; events: { kind: string; absolutePath: string }[] }
 
diff --git a/src/main/ipc/filesystem-watcher-remote-batch.test.ts b/src/main/ipc/filesystem-watcher-remote-batch.test.ts
index 6d964c2b2d4..8666a40c906 100644
--- a/src/main/ipc/filesystem-watcher-remote-batch.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-batch.test.ts
@@ -23,7 +23,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 type WatchCallback = (events: FsChangeEvent[]) => void
 
 const WORKTREE_PATH = '/home/me/repo'
diff --git a/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts b/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
index 6a67f3a8fb7..60e25db9040 100644
--- a/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
@@ -19,7 +19,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('remote filesystem watcher cancellation', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-remote-rearm.test.ts b/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
index 869c8bebf45..0eecfbd82e9 100644
--- a/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
@@ -29,7 +29,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('remote filesystem watcher re-arm', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-removal-deadline.test.ts b/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
index 52a48e9a06d..9eabdb8964e 100644
--- a/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
+++ b/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
@@ -52,7 +52,7 @@ import { stat } from 'node:fs/promises'
 import { subscribe as subscribeParcelWatcher } from '@parcel/watcher'
 import { subscribeViaWatcherProcess } from './parcel-watcher-process'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('local filesystem watcher removal deadline', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-terminal-resync.test.ts b/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
index 8a08c5f07d5..31e87d7a4c9 100644
--- a/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
+++ b/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
@@ -28,7 +28,7 @@ import {
   restoreRemoteWatcherAfterFailedRemoval
 } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 type TerminalErrorHandler = (error: Error) => void
 
 const WORKTREE_PATH = '/home/me/repo'
diff --git a/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts b/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
index d629d74dc02..3473caa8a73 100644
--- a/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
+++ b/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
@@ -30,7 +30,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 import { stat } from 'node:fs/promises'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('filesystem watcher unwatchable root cache', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher.test.ts b/src/main/ipc/filesystem-watcher.test.ts
index 1e9e3cf509a..6fff613e0d9 100644
--- a/src/main/ipc/filesystem-watcher.test.ts
+++ b/src/main/ipc/filesystem-watcher.test.ts
@@ -60,7 +60,7 @@ import {
 import { acquireWatcherRemovalGate } from './watcher-removal-gate'
 import { WATCH_BATCH_TRAILING_MS } from '../../shared/filesystem-watch-batch-window'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 /** Remote fs:changed rides the shared debounce window, so drain it before asserting sends. */
 const emitRemote = async (onEvents: (e: unknown[]) => void, events: unknown[]) => {
diff --git a/src/main/ipc/filesystem.test.ts b/src/main/ipc/filesystem.test.ts
index 2c66ab9ad09..f96667751d2 100644
--- a/src/main/ipc/filesystem.test.ts
+++ b/src/main/ipc/filesystem.test.ts
@@ -3,7 +3,7 @@ import path from 'node:path'
 import { EventEmitter } from 'node:events'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const handlers = new Map<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (_event: unknown, args: unknown) => unknown>()
 const {
   handleMock,
   showSaveDialogMock,
diff --git a/src/main/ipc/notebook.test.ts b/src/main/ipc/notebook.test.ts
index d68668038bd..cdffcb8b913 100644
--- a/src/main/ipc/notebook.test.ts
+++ b/src/main/ipc/notebook.test.ts
@@ -2,7 +2,7 @@ import { EventEmitter } from 'node:events'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ChildProcessWithoutNullStreams } from 'node:child_process'
 
-const handlers = new Map<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (_event: unknown, args: unknown) => unknown>()
 const { spawnMock, handleMock, resolveAuthorizedPathMock } = vi.hoisted(() => ({
   spawnMock: vi.fn(),
   handleMock: vi.fn((channel: string, handler: (event: unknown, args: unknown) => unknown) => {
diff --git a/src/main/ipc/pty-hidden-delivery-gate.ts b/src/main/ipc/pty-hidden-delivery-gate.ts
index b1f089e385e..43fa8567b88 100644
--- a/src/main/ipc/pty-hidden-delivery-gate.ts
+++ b/src/main/ipc/pty-hidden-delivery-gate.ts
@@ -18,8 +18,7 @@ export type HiddenPtyDeliveryGateSettings = Pick<
 
 const hiddenRendererPtys = new Set<string>()
 // Why: sidecar consumers (paste-draft pacing, background agent launches,
-// automation observers, and the kill-switch-off parked 2031 responder) need
-// live bytes even while no visible view exists. Any
+// automation observers) need live bytes even while no visible view exists. Any
 // registered interest suppresses the gate for that PTY.
 const deliveryInterestRendererPtys = new Set<string>()
 // Why: reveal must restore from the model only when bytes were actually
diff --git a/src/main/ipc/pty-superseded-operation-fence.test.ts b/src/main/ipc/pty-superseded-operation-fence.test.ts
new file mode 100644
index 00000000000..f357954bc26
--- /dev/null
+++ b/src/main/ipc/pty-superseded-operation-fence.test.ts
@@ -0,0 +1,118 @@
+/**
+ * A mutating operation must not reach a PTY that has been superseded for its
+ * pane. Main keeps `ptyPaneKey` and `paneKeyPtyId` in lock-step, so their
+ * disagreement is proof the caller's id is stale — not an inference from
+ * absence, which is why an id with no recorded pane stays permitted.
+ *
+ * The fence lives in the main process because the renderer queues input: a
+ * keystroke buffered before a reattach would otherwise land on the successor.
+ */
+import { describe, expect, it } from 'vitest'
+
+/** Mirrors the maps and predicate in pty.ts. Kept structural so the oracle
+ *  tests the RULE, not one implementation of it. */
+function makeFence() {
+  const ptyPaneKey = new Map<string, string>()
+  const paneKeyPtyId = new Map<string, string>()
+  const bind = (paneKey: string, ptyId: string): void => {
+    ptyPaneKey.set(ptyId, paneKey)
+    paneKeyPtyId.set(paneKey, ptyId)
+  }
+  const isSuperseded = (ptyId: string): boolean => {
+    const paneKey = ptyPaneKey.get(ptyId)
+    if (paneKey === undefined) {
+      return false
+    }
+    const currentPtyId = paneKeyPtyId.get(paneKey)
+    return currentPtyId !== undefined && currentPtyId !== ptyId
+  }
+  return { bind, isSuperseded, ptyPaneKey, paneKeyPtyId }
+}
+
+const PANE = 'tab-1:3f1c9a2e-7b4d-4e1a-9c8f-2d5e6a7b8c90'
+
+describe('superseded PTY operation fence', () => {
+  it('refuses an operation whose pane has since bound a different PTY', () => {
+    const fence = makeFence()
+    fence.bind(PANE, 'pty-old')
+    // The pane reattaches onto a fresh PTY; the renderer still holds pty-old.
+    fence.bind(PANE, 'pty-new')
+
+    expect(fence.isSuperseded('pty-old')).toBe(true)
+    expect(fence.isSuperseded('pty-new')).toBe(false)
+  })
+
+  it('permits the current PTY for its own pane', () => {
+    const fence = makeFence()
+    fence.bind(PANE, 'pty-live')
+
+    expect(fence.isSuperseded('pty-live')).toBe(false)
+  })
+
+  // Unknown is not stale. Orphan cleanup targets exactly these ids, so refusing
+  // them would break the operation that reclaims leaked shells.
+  it('permits a PTY that owns no pane', () => {
+    const fence = makeFence()
+
+    expect(fence.isSuperseded('pty-orphan')).toBe(false)
+  })
+
+  it('permits a PTY whose pane record was dropped', () => {
+    const fence = makeFence()
+    fence.bind(PANE, 'pty-live')
+    fence.paneKeyPtyId.delete(PANE)
+
+    expect(fence.isSuperseded('pty-live')).toBe(false)
+  })
+
+  it('keeps sibling panes independent', () => {
+    const fence = makeFence()
+    const other = 'tab-1:8a2b4c6d-1e3f-4a5b-8c7d-9e0f1a2b3c4d'
+    fence.bind(PANE, 'pty-a')
+    fence.bind(other, 'pty-b')
+    fence.bind(PANE, 'pty-a2')
+
+    expect(fence.isSuperseded('pty-a')).toBe(true)
+    expect(fence.isSuperseded('pty-b')).toBe(false)
+  })
+})
+
+describe('the fence is wired into every mutating handler', () => {
+  it('combines supersession and incarnation in the write fence', async () => {
+    const { readFileSync } = await import('node:fs')
+    const source = readFileSync('src/main/ipc/pty.ts', 'utf-8')
+    const start = source.indexOf('const isCurrentPtyWrite')
+
+    expect(start).toBeGreaterThan(0)
+    expect(source.slice(start, start + 300)).toContain('isSupersededPtyId')
+    expect(source.slice(start, start + 300)).toContain('ptyIncarnationById')
+  })
+
+  // The capability existed for months and was never called from these handlers.
+  // Pin the call site, not the capability — that is the failure this program hit.
+  it.each(['pty:write', 'pty:writeAccepted', 'pty:resize', 'pty:signal'])(
+    '%s consults the fence',
+    async (channel) => {
+      const { readFileSync } = await import('node:fs')
+      const source = readFileSync('src/main/ipc/pty.ts', 'utf-8')
+      // Anchor on the registration, not the first mention of the name.
+      const start = source.search(
+        new RegExp(`ipcMain\\.(?:on|handle)\\(\\s*'${channel.replace(':', ':')}'`)
+      )
+      expect(start, `${channel} handler not found`).toBeGreaterThan(0)
+      expect(source.slice(start, start + 700)).toContain(
+        channel.startsWith('pty:write') ? 'isCurrentPtyWrite' : 'isSupersededPtyId'
+      )
+    }
+  )
+
+  // pty:kill is deliberately NOT fenced: a superseded PTY is orphaned, and
+  // reclaiming it is exactly what the orphan-cleanup callers ask for.
+  it('leaves pty:kill unfenced on purpose', async () => {
+    const { readFileSync } = await import('node:fs')
+    const source = readFileSync('src/main/ipc/pty.ts', 'utf-8')
+    const start = source.search(/ipcMain\.handle\(\s*'pty:kill'/)
+    expect(start).toBeGreaterThan(0)
+    expect(source.slice(start, start + 500)).not.toContain('isSupersededPtyId')
+  })
+})
diff --git a/src/main/ipc/pty.test.ts b/src/main/ipc/pty.test.ts
index 1a75fcc70ff..29d2feb10b9 100644
--- a/src/main/ipc/pty.test.ts
+++ b/src/main/ipc/pty.test.ts
@@ -26,14 +26,6 @@ const expectedOmpStatusExtension = posix.join(
   'omp-managed-status-extension',
   'orca-agent-status.ts'
 )
-function expectedAttributionShimDir(): string {
-  return join(
-    '/tmp/orca-user-data',
-    'orca-terminal-attribution',
-    process.platform === 'win32' ? 'win32' : 'posix'
-  )
-}
-
 const {
   handleMock,
   onMock,
@@ -56,7 +48,6 @@ const {
   clearAgentHookPaneStateMock,
   registerPaneKeyAliasMock,
   piBuildPtyEnvMock,
-  piBuildStatusOnlyPtyEnvMock,
   piClearPtyMock,
   isPwshAvailableMock,
   wslUncDirectoryExistsAsyncMock,
@@ -96,7 +87,6 @@ const {
   clearAgentHookPaneStateMock: vi.fn(),
   registerPaneKeyAliasMock: vi.fn(),
   piBuildPtyEnvMock: vi.fn(),
-  piBuildStatusOnlyPtyEnvMock: vi.fn(),
   piClearPtyMock: vi.fn(),
   trackMock: vi.fn(),
   classifyErrorMock: vi.fn(),
@@ -182,7 +172,6 @@ vi.mock('../agent-hooks/server', () => ({
 vi.mock('../pi/titlebar-extension-service', () => ({
   piTitlebarExtensionService: {
     buildPtyEnv: piBuildPtyEnvMock,
-    buildStatusOnlyPtyEnv: piBuildStatusOnlyPtyEnvMock,
     clearPty: piClearPtyMock
   }
 }))
@@ -256,9 +245,11 @@ import {
   getLocalPtyProvider,
   isCurrentPtyExit,
   restorePtyIncarnation,
+  bindPaneShell,
   type PrepareCodexSessionResume
 } from './pty'
 import { __resetPersistedWindowsPathCacheForTests } from '../pty/windows-environment-path'
+import { LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS } from '../pty/legacy-terminal-shim-dir'
 import { __setWindowsPathRegistryLoaderForTests } from '../pty/windows-path-registry-reader'
 import { resetMacosLoginShellPreflightForTests } from '../providers/macos-tcc-login-shell'
 import {
@@ -401,7 +392,6 @@ describe('registerPtyHandlers', () => {
     clearAgentHookPaneStateMock.mockReset()
     registerPaneKeyAliasMock.mockReset()
     piBuildPtyEnvMock.mockReset()
-    piBuildStatusOnlyPtyEnvMock.mockReset()
     piClearPtyMock.mockReset()
     isPwshAvailableMock.mockReset()
     wslUncDirectoryExistsAsyncMock.mockReset()
@@ -504,10 +494,6 @@ describe('registerPtyHandlers', () => {
         }
       }
     )
-    piBuildStatusOnlyPtyEnvMock.mockReturnValue({
-      ORCA_PRIME_AGENT_STATUS_EXTENSION:
-        'C:\\Users\\test\\AppData\\Roaming\\Orca\\prime-agent-managed-status-extension\\orca-agent-status.ts'
-    })
     isPwshAvailableMock.mockReturnValue(false)
     spawnMock.mockReturnValue({
       onData: vi.fn(() => makeDisposable()),
@@ -1881,7 +1867,6 @@ describe('registerPtyHandlers', () => {
       launchContext?: { workspacePath?: string; launchAgent?: TuiAgent }
     ) => string | null,
     getSettings?: () => {
-      enableGitHubAttribution?: boolean
       agentStatusHooksEnabled?: boolean
       httpProxyUrl?: string
       httpProxyBypassRules?: string
@@ -1979,7 +1964,6 @@ describe('registerPtyHandlers', () => {
               isPackaged: true,
               userDataPath: '/tmp/orca-user-data',
               selectedCodexHomePath: null,
-              githubAttributionEnabled: false,
               agentStatusHooksEnabled: false,
               isWsl: context?.isWsl,
               wslDistro: context?.wslDistro
@@ -3143,59 +3127,6 @@ describe('registerPtyHandlers', () => {
       expect(env.ORCA_CLAUDE_AGENT_STATUS_SETTINGS).toBeUndefined()
     })
 
-    it('prepends local git/gh attribution shims when attribution is enabled', async () => {
-      const env = await spawnAndGetEnv(undefined, undefined, undefined, () => ({
-        enableGitHubAttribution: true
-      }))
-
-      expect(env.ORCA_ENABLE_GIT_ATTRIBUTION).toBe('1')
-      expect(env.ORCA_GIT_COMMIT_TRAILER).toBe('Co-authored-by: Orca <help@stably.ai>')
-      expect(env.ORCA_GH_PR_FOOTER).toBe('Made with [Orca](https://github.com/stablyai/orca) 🐋')
-      expect(env.ORCA_GH_ISSUE_FOOTER).toBe('Made with [Orca](https://github.com/stablyai/orca) 🐋')
-      expect(env.PATH).toContain(expectedAttributionShimDir())
-    })
-
-    it('skips git/gh attribution shims when attribution is disabled', async () => {
-      const env = await spawnAndGetEnv(undefined, undefined, undefined, () => ({
-        enableGitHubAttribution: false
-      }))
-
-      expect(env.ORCA_ENABLE_GIT_ATTRIBUTION).toBeUndefined()
-      expect(env.ORCA_GIT_COMMIT_TRAILER).toBeUndefined()
-      expect(env.ORCA_GH_PR_FOOTER).toBeUndefined()
-      expect(env.ORCA_GH_ISSUE_FOOTER).toBeUndefined()
-      expect(env.PATH ?? '').not.toContain(expectedAttributionShimDir())
-    })
-
-    it('prepends git/gh attribution shims for daemon-backed local PTYs', async () => {
-      const daemonSpawn = vi.fn(async (options) => ({ id: 'daemon-pty', pid: 123, ...options }))
-      setLocalPtyProvider({
-        spawn: daemonSpawn,
-        write: vi.fn(),
-        resize: vi.fn(),
-        kill: vi.fn(),
-        shutdown: vi.fn(),
-        onData: vi.fn(() => vi.fn()),
-        onExit: vi.fn(() => vi.fn()),
-        listProcesses: vi.fn(async () => []),
-        getForegroundProcess: vi.fn(async () => null)
-      } as never)
-      handlers.clear()
-      registerPtyHandlers(mainWindow as never, undefined, undefined, (() => ({
-        enableGitHubAttribution: true
-      })) as never)
-
-      await handlers.get('pty:spawn')!(null, {
-        cols: 80,
-        rows: 24,
-        env: {}
-      })
-
-      const env = daemonSpawn.mock.calls.at(-1)![0].env
-      expect(env.ORCA_ENABLE_GIT_ATTRIBUTION).toBe('1')
-      expect(env.PATH).toContain(expectedAttributionShimDir())
-    })
-
     it('overrides ambient CODEX_HOME with the Orca-managed home for system default', async () => {
       const env = await spawnAndGetEnv(
         undefined,
@@ -3497,7 +3428,6 @@ describe('registerPtyHandlers', () => {
           launchContext?: { workspacePath?: string; launchAgent?: TuiAgent }
         ) => string | null,
         getSettings?: () => {
-          enableGitHubAttribution?: boolean
           httpProxyUrl?: string
           httpProxyBypassRules?: string
         },
@@ -3559,7 +3489,6 @@ describe('registerPtyHandlers', () => {
           launchContext?: { workspacePath?: string; launchAgent?: TuiAgent }
         ) => string | null,
         getSettings?: () => {
-          enableGitHubAttribution?: boolean
           httpProxyUrl?: string
           httpProxyBypassRules?: string
         },
@@ -4287,10 +4216,13 @@ describe('registerPtyHandlers', () => {
         })
       })
 
-      it('bridges a host-managed Prime status extension into WSL without redirecting Prime home', async () => {
+      it('does not install or inject a Prime extension for an explicit WSL launch', async () => {
         await withWin32Platform(async () => {
           const env = await daemonSpawnAndGetEnv(
-            { PRIME_AGENT_CODING_AGENT_DIR: 'C:\\Users\\test\\.prime\\agent' },
+            {
+              PRIME_AGENT_CODING_AGENT_DIR: 'C:\\Users\\test\\.prime\\agent',
+              ORCA_PRIME_AGENT_STATUS_EXTENSION: 'C:\\stale\\orca-agent-status.ts'
+            },
             undefined,
             undefined,
             undefined,
@@ -4298,26 +4230,23 @@ describe('registerPtyHandlers', () => {
           )
 
           expect(piBuildPtyEnvMock).not.toHaveBeenCalled()
-          expect(piBuildStatusOnlyPtyEnvMock).toHaveBeenCalledWith('prime-agent')
           expect(env.ORCA_PRIME_AGENT_SOURCE_AGENT_DIR).toBeUndefined()
-          expect(env.ORCA_PRIME_AGENT_STATUS_EXTENSION).toBe(
-            'C:\\Users\\test\\AppData\\Roaming\\Orca\\prime-agent-managed-status-extension\\orca-agent-status.ts'
-          )
-          expect(env.ORCA_WSL_HOOK_INSTANCE).toBe('port5678')
+          expect(env.ORCA_PRIME_AGENT_STATUS_EXTENSION).toBeUndefined()
+          expect(env.ORCA_WSL_HOOK_INSTANCE).toBeUndefined()
           expect(env.PRIME_AGENT_CODING_AGENT_DIR).toBe('C:\\Users\\test\\.prime\\agent')
         })
       })
 
-      it('prepares the Prime bridge for a typed launch in a bare WSL shell', async () => {
+      it('does not prepare a Prime extension for a typed launch in a bare WSL shell', async () => {
         await withWin32Platform(async () => {
           const env = await daemonSpawnAndGetEnv({}, undefined, undefined, undefined, {
             shellOverride: 'wsl.exe'
           })
 
-          expect(piBuildStatusOnlyPtyEnvMock).toHaveBeenCalledWith('prime-agent')
-          expect(env.ORCA_PRIME_AGENT_STATUS_EXTENSION).toContain(
-            'prime-agent-managed-status-extension'
+          expect(piBuildPtyEnvMock.mock.calls.some(([, , kind]) => kind === 'prime-agent')).toBe(
+            false
           )
+          expect(env.ORCA_PRIME_AGENT_STATUS_EXTENSION).toBeUndefined()
           expect(env.PRIME_AGENT_CODING_AGENT_DIR).toBeUndefined()
         })
       })
@@ -4472,6 +4401,16 @@ describe('registerPtyHandlers', () => {
         expect(spawnOptions.env.ORCA_AGENT_HOOK_TOKEN).toBe('agent-token')
       })
 
+      it('asks surviving pre-upgrade daemons to delete legacy attribution env', async () => {
+        const spawnOptions = await daemonSpawnAndGetOptions({})
+
+        expect(spawnOptions.envToDelete).toEqual(
+          expect.arrayContaining([...LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS])
+        )
+        expect(spawnOptions.envToDelete).not.toContain('ORCA_REAL_GIT')
+        expect(spawnOptions.envToDelete).not.toContain('ORCA_REAL_GH')
+      })
+
       it('deletes stale Claude scoped settings env from runtime-created daemon PTYs', async () => {
         type RuntimeSpawnController = {
           spawn(args: {
@@ -4509,6 +4448,38 @@ describe('registerPtyHandlers', () => {
         expect(spawnOptions.env.ORCA_AGENT_HOOK_TOKEN).toBe('agent-token')
       })
 
+      it('asks surviving pre-upgrade daemons to delete legacy attribution env for runtime PTYs', async () => {
+        type RuntimeSpawnController = {
+          spawn(args: {
+            cols: number
+            rows: number
+            worktreeId?: string
+            env?: Record<string, string>
+          }): Promise<{ id: string }>
+        }
+        const daemonSpawn = setupDaemonAdapter()
+        const runtime = {
+          setPtyController: vi.fn(),
+          registerPty: vi.fn(),
+          noteTerminalSpawnCommand: vi.fn(),
+          onPtySpawned: vi.fn(),
+          onPtyExit: vi.fn(),
+          onPtyData: vi.fn()
+        }
+        handlers.clear()
+        registerPtyHandlers(mainWindow as never, runtime as never)
+        const controller = runtime.setPtyController.mock.calls[0]?.[0] as RuntimeSpawnController
+
+        await controller.spawn({ cols: 80, rows: 24, worktreeId: 'wt-runtime', env: {} })
+
+        const spawnOptions = daemonSpawn.mock.calls.at(-1)?.[0] as DaemonSpawnCall
+        expect(spawnOptions.envToDelete).toEqual(
+          expect.arrayContaining([...LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS])
+        )
+        expect(spawnOptions.envToDelete).not.toContain('ORCA_REAL_GIT')
+        expect(spawnOptions.envToDelete).not.toContain('ORCA_REAL_GH')
+      })
+
       it('strips inherited Claude child-session stamps from runtime-created PTYs', async () => {
         // Why: the runtime controller is the `orca` CLI / automation spawn path and
         // assembles envToDelete separately from the renderer's pty:spawn handler;
@@ -4884,33 +4855,38 @@ describe('registerPtyHandlers', () => {
           onPtyData: vi.fn()
         }
         handlers.clear()
-        registerPtyHandlers(mainWindow as never, runtime as never, undefined, (() => ({
-          enableGitHubAttribution: true
-        })) as never)
+        registerPtyHandlers(mainWindow as never, runtime as never)
         const controller = runtime.setPtyController.mock.calls[0]?.[0] as RuntimeSpawnController
 
-        await controller.spawn({
-          cols: 80,
-          rows: 24,
-          worktreeId: 'wt-runtime',
-          command: 'claude',
-          env: {
-            PATH: `/tmp/orca-agent-teams-bin${delimiter}/usr/bin`,
-            ORCA_AGENT_TEAMS_TEAM_ID: 'team-test',
-            TERM_PROGRAM: 'Orca',
-            ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/stale-attribution'
-          },
-          envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
-        })
+        // Why: dev mode makes buildPtyHostEnv prepend its own CLI shim on every platform, so
+        // the promotion below has something to beat instead of passing trivially.
+        const { app } = await import('electron')
+        const mockedApp = app as unknown as { isPackaged: boolean }
+        const prevPackaged = mockedApp.isPackaged
+        mockedApp.isPackaged = false
+        try {
+          await controller.spawn({
+            cols: 80,
+            rows: 24,
+            worktreeId: 'wt-runtime',
+            command: 'claude',
+            env: {
+              PATH: `/tmp/orca-agent-teams-bin${delimiter}/usr/bin`,
+              ORCA_AGENT_TEAMS_TEAM_ID: 'team-test',
+              TERM_PROGRAM: 'Orca'
+            },
+            envToDelete: ['TERM_PROGRAM']
+          })
+        } finally {
+          mockedApp.isPackaged = prevPackaged
+        }
 
         const spawnOptions = daemonSpawn.mock.calls.at(-1)?.[0] as DaemonSpawnCall
-        expect(spawnOptions.env.PATH.split(delimiter)[0]).toBe('/tmp/orca-agent-teams-bin')
-        expect(spawnOptions.env.PATH).toContain(expectedAttributionShimDir())
+        const spawnedPath = spawnOptions.env.PATH.split(delimiter)
+        expect(spawnedPath[0]).toBe('/tmp/orca-agent-teams-bin')
+        expect(spawnedPath.some((entry) => entry.includes(join('cli', 'bin')))).toBe(true)
         expect(spawnOptions.env.TERM_PROGRAM).toBeUndefined()
-        expect(spawnOptions.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
-        expect(spawnOptions.envToDelete).toEqual(
-          expect.arrayContaining(['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR'])
-        )
+        expect(spawnOptions.envToDelete).toEqual(expect.arrayContaining(['TERM_PROGRAM']))
       })
 
       it('strips inherited agent-hook endpoint env from development daemon PTYs', async () => {
@@ -4930,38 +4906,38 @@ describe('registerPtyHandlers', () => {
         }
       })
 
-      it('prepends attribution shims on the daemon path', async () => {
-        const env = await daemonSpawnAndGetEnv({}, undefined, () => ({
-          enableGitHubAttribution: true
-        }))
-        expect(env.ORCA_ENABLE_GIT_ATTRIBUTION).toBe('1')
-        expect(env.PATH).toContain(expectedAttributionShimDir())
-      })
-
       it('keeps the Agent Teams tmux shim ahead of host PATH shims on daemon pty:spawn', async () => {
-        const spawnOptions = await daemonSpawnAndGetOptions(
-          {
-            PATH: `/tmp/orca-agent-teams-bin${delimiter}/usr/bin`,
-            ORCA_AGENT_TEAMS_TEAM_ID: 'team-test',
-            TERM_PROGRAM: 'Orca',
-            ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/stale-attribution'
-          },
-          undefined,
-          () => ({ enableGitHubAttribution: true }),
-          undefined,
-          {
-            command: 'claude',
-            envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
-          }
-        )
+        // Why: dev mode makes buildPtyHostEnv prepend its own CLI shim on every platform, so
+        // the promotion below has something to beat instead of passing trivially.
+        const { app } = await import('electron')
+        const mockedApp = app as unknown as { isPackaged: boolean }
+        const prevPackaged = mockedApp.isPackaged
+        mockedApp.isPackaged = false
+        let spawnOptions: Awaited<ReturnType<typeof daemonSpawnAndGetOptions>>
+        try {
+          spawnOptions = await daemonSpawnAndGetOptions(
+            {
+              PATH: `/tmp/orca-agent-teams-bin${delimiter}/usr/bin`,
+              ORCA_AGENT_TEAMS_TEAM_ID: 'team-test',
+              TERM_PROGRAM: 'Orca'
+            },
+            undefined,
+            undefined,
+            undefined,
+            {
+              command: 'claude',
+              envToDelete: ['TERM_PROGRAM']
+            }
+          )
+        } finally {
+          mockedApp.isPackaged = prevPackaged
+        }
 
-        expect(spawnOptions.env.PATH.split(delimiter)[0]).toBe('/tmp/orca-agent-teams-bin')
-        expect(spawnOptions.env.PATH).toContain(expectedAttributionShimDir())
+        const spawnedPath = spawnOptions.env.PATH.split(delimiter)
+        expect(spawnedPath[0]).toBe('/tmp/orca-agent-teams-bin')
+        expect(spawnedPath.some((entry) => entry.includes(join('cli', 'bin')))).toBe(true)
         expect(spawnOptions.env.TERM_PROGRAM).toBeUndefined()
-        expect(spawnOptions.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
-        expect(spawnOptions.envToDelete).toEqual(
-          expect.arrayContaining(['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR'])
-        )
+        expect(spawnOptions.envToDelete).toEqual(expect.arrayContaining(['TERM_PROGRAM']))
       })
 
       it('injects dev-mode ORCA_USER_DATA_PATH + dev CLI PATH on the daemon path', async () => {
@@ -4997,6 +4973,24 @@ describe('registerPtyHandlers', () => {
         }
       })
 
+      it('drops a legacy shim PATH entry inherited from the host process on the daemon path', async () => {
+        // Why: the daemon path passes a sparse env, so the prepends re-read PATH from
+        // process.env — the scrub must outlive that fallback (pre-upgrade host or parent pane).
+        const { app } = await import('electron')
+        const mockedApp = app as unknown as { isPackaged: boolean }
+        const prev = mockedApp.isPackaged
+        mockedApp.isPackaged = false
+        try {
+          const env = await daemonSpawnAndGetEnv({}, undefined, undefined, {
+            PATH: `/tmp/orca-user-data/orca-terminal-attribution/posix${delimiter}/system/bin`
+          })
+          expect(env.PATH).not.toContain('orca-terminal-attribution')
+          expect(env.PATH).toContain('/system/bin')
+        } finally {
+          mockedApp.isPackaged = prev
+        }
+      })
+
       it('defers indexed Git prompt guards from the daemon wire environment', async () => {
         const env = await daemonSpawnAndGetEnv(
           {
@@ -5176,14 +5170,6 @@ describe('registerPtyHandlers', () => {
         expect(env.ORCA_PI_SOURCE_AGENT_DIR).toBe('/ambient/pi/agent')
       })
 
-      it('skips attribution shims on the daemon path when the setting is disabled', async () => {
-        const env = await daemonSpawnAndGetEnv({ PATH: '/usr/bin' }, undefined, () => ({
-          enableGitHubAttribution: false
-        }))
-        expect(env.ORCA_ENABLE_GIT_ATTRIBUTION).toBeUndefined()
-        expect(env.PATH ?? '').not.toContain(expectedAttributionShimDir())
-      })
-
       it('does not mutate the caller-provided args.env on the daemon path', async () => {
         // Why: the handler clones baseEnv so IPC-provided env stays pristine; a regression would leak Orca host env back into the renderer's reused copy.
         const daemonSpawn = setupDaemonAdapter()
@@ -5304,7 +5290,10 @@ describe('registerPtyHandlers', () => {
             paneKey?: string
             tabId?: string
           }) => ({
-            id: 'ssh-pty'
+            id: 'ssh-pty',
+            // The host attests the shell's identity at spawn; the lease has to carry it or the
+            // reconnect fence has nothing to compare and attaches by pty id alone.
+            incarnationId: 'inc-host-ssh-pty'
           })
         )
         const store = {
@@ -5361,7 +5350,6 @@ describe('registerPtyHandlers', () => {
         // Why: host-local vars must be absent over SSH (they point at the local host/disk) — shipping them is useless or a credential leak.
         expect(env.ORCA_AGENT_HOOK_PORT).toBeUndefined()
         expect(env.ORCA_AGENT_HOOK_TOKEN).toBeUndefined()
-        expect(env.ORCA_ENABLE_GIT_ATTRIBUTION).toBeUndefined()
         expect(env.OPENCODE_CONFIG_DIR).toBeUndefined()
         expect(env.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
         expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
@@ -5391,18 +5379,23 @@ describe('registerPtyHandlers', () => {
             worktreeId: 'wt-1',
             tabId: 'tab-1',
             leafId,
+            // Without this the field exists, loads and is read — and is never written, so the
+            // reconnect fence silently permits everything while every other clause stays green.
+            incarnationId: 'inc-host-ssh-pty',
             state: 'attached'
           })
         )
-        expect(store.persistPtyBinding).toHaveBeenCalledWith(
-          {
-            worktreeId: 'wt-1',
-            tabId: 'tab-1',
-            leafId,
-            ptyId: 'ssh-pty'
-          },
-          'ssh:ssh-1'
-        )
+        // STA-3077 step P inverted this: SSH pane bindings no longer go to a
+        // per-target `ssh:<target>` partition. One home (`local`) only, so the
+        // hostId argument is gone — pin its absence, not its old value.
+        expect(store.persistPtyBinding).toHaveBeenCalledWith({
+          worktreeId: 'wt-1',
+          tabId: 'tab-1',
+          leafId,
+          ptyId: 'ssh-pty',
+          incarnationId: 'inc-host-ssh-pty'
+        })
+        expect(store.persistPtyBinding.mock.calls.at(-1)).toHaveLength(1)
 
         store.upsertSshRemotePtyLease.mockClear()
         store.persistPtyBinding.mockClear()
@@ -6312,7 +6305,7 @@ describe('registerPtyHandlers', () => {
         expect(runtime.onPtyExit).toHaveBeenCalledWith('remote-pty', -1, undefined)
       })
 
-      it('preserves an SSH lease when runtime controller kill shutdown fails transiently', async () => {
+      it('retires a rejected SSH PTY after generic kill shutdown fails transiently', async () => {
         const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
         const store = {
           markSshRemotePtyLease: vi.fn()
@@ -6355,22 +6348,30 @@ describe('registerPtyHandlers', () => {
         )
         const controller = runtime.setPtyController.mock.calls[0]?.[0] as {
           kill: (ptyId: string) => boolean
+          retireRejectedPty: (ptyId: string) => void
         }
 
         try {
           expect(controller.kill('remote-pty')).toBe(true)
           await new Promise((resolve) => setImmediate(resolve))
+          expect(store.markSshRemotePtyLease).not.toHaveBeenCalledWith(
+            'ssh-1',
+            'remote-pty',
+            'terminated'
+          )
+          controller.retireRejectedPty('remote-pty')
         } finally {
           warnSpy.mockRestore()
           deletePtyOwnership('remote-pty')
         }
 
-        expect(store.markSshRemotePtyLease).not.toHaveBeenCalledWith(
+        expect(store.markSshRemotePtyLease).toHaveBeenCalledWith(
           'ssh-1',
           'remote-pty',
           'terminated'
         )
         expect(runtime.onPtyExit).toHaveBeenCalledWith('remote-pty', -1, undefined)
+        expect(runtime.onPtyExit).toHaveBeenCalledWith('remote-pty', 0, undefined)
       })
 
       it('strips ORCA_PANE_KEY/TAB_ID/WORKTREE_ID from SSH spawn env when remote agent hooks are disabled', async () => {
@@ -6828,6 +6829,38 @@ describe('registerPtyHandlers', () => {
     expect(fallbackShutdown).not.toHaveBeenCalled()
   })
 
+  // Why: before the swap lands the pre-swap local provider owns no daemon id, so its
+  // "not in my table" would answer an authoritative dead for every restored session.
+  it('waits for the desktop startup barrier before pty:hasPty answers for a daemon id', async () => {
+    const barrier = makeDeferred()
+    const awaitLocalPtyProviderStartup = vi.fn(() => barrier.promise)
+    registerPtyHandlers(
+      mainWindow as never,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      {
+        awaitLocalPtyProviderStartup
+      }
+    )
+
+    const pending = handlers.get('pty:hasPty')!(null, { id: 'daemon-session' }) as Promise<
+      boolean | null
+    >
+    await Promise.resolve()
+    expect(awaitLocalPtyProviderStartup).toHaveBeenCalledTimes(1)
+
+    installObservableDaemonTestProvider()
+    ;(getLocalPtyProvider() as { hasPty?: (id: string) => boolean | null }).hasPty = vi.fn(
+      (id: string) => id === 'daemon-session'
+    )
+    barrier.resolve()
+
+    await expect(pending).resolves.toBe(true)
+  })
+
   it('waits for the desktop startup barrier before runtime local kills resolve the provider', async () => {
     const barrier = makeDeferred()
     const awaitLocalPtyProviderStartup = vi.fn(() => barrier.promise)
@@ -7848,6 +7881,7 @@ describe('registerPtyHandlers', () => {
           id: opts.sessionId ?? 'daemon-pty'
         })),
         write,
+        hasPty: vi.fn(() => true),
         resize: vi.fn(args.resize ?? (() => {})),
         getAppliedSize: vi.fn(args.getAppliedSize ?? (async () => args.applied)),
         kill: vi.fn(),
@@ -8072,6 +8106,107 @@ describe('registerPtyHandlers', () => {
       expect(write).not.toHaveBeenCalled()
     })
 
+    it('does not forward queued host input after the pane rebinds', async () => {
+      const write = setupProviderWithAppliedSize({ applied: { cols: 80, rows: 24 } })
+      let resolveClaim: (claimed: boolean) => void = () => {}
+      const claimRemoteDesktopHost = vi.fn(
+        () =>
+          new Promise<boolean>((resolve) => {
+            resolveClaim = resolve
+          })
+      )
+      const runtime = {
+        setPtyController: vi.fn(),
+        createPreAllocatedTerminalHandle: vi.fn(() => null),
+        registerPty: vi.fn(),
+        getDriver: vi.fn(() => ({ kind: 'idle' })),
+        claimRemoteDesktopHost,
+        onPtySpawned: vi.fn(),
+        onPtyExit: vi.fn(),
+        onPtyData: vi.fn()
+      }
+      handlers.clear()
+      registerPtyHandlers(mainWindow as never, runtime as never)
+      const spawn = await handlers.get('pty:spawn')!(null, { cols: 80, rows: 24, env: {} })
+      const id = (spawn as { id: string }).id
+      const leafId = '3f1c9a2e-7b4d-4e1a-9c8f-2d5e6a7b8c90'
+      const bindingStore = {
+        persistPtyBinding: vi.fn(() => true),
+        getWorkspaceSession: vi.fn(() => getDefaultWorkspaceSession())
+      }
+      bindPaneShell({
+        store: bindingStore,
+        worktreeId: 'repo-1:wt-1',
+        tabId: 'tab-1',
+        leafId,
+        ptyId: id
+      })
+      const claim = onMock.mock.calls.find((entry: unknown[]) => entry[0] === 'pty:claimViewport')
+      const writeEvent = onMock.mock.calls.find((entry: unknown[]) => entry[0] === 'pty:write')
+
+      claim?.[1](mainWindowIpcEvent, { id, cols: 125, rows: 48 })
+      writeEvent?.[1](mainWindowIpcEvent, { id, data: 'queued' })
+      const accepted = handlers.get('pty:writeAccepted')!(mainWindowIpcEvent, {
+        id,
+        data: 'accepted'
+      })
+      bindPaneShell({
+        store: bindingStore,
+        worktreeId: 'repo-1:wt-1',
+        tabId: 'tab-1',
+        leafId,
+        ptyId: 'pty-successor'
+      })
+      resolveClaim(true)
+
+      await expect(accepted).resolves.toBe(false)
+      await Promise.resolve()
+      expect(write).not.toHaveBeenCalled()
+      clearProviderPtyState(id)
+      clearProviderPtyState('pty-successor')
+    })
+
+    it('does not forward queued host input after the PTY incarnation changes', async () => {
+      const write = setupProviderWithAppliedSize({ applied: { cols: 80, rows: 24 } })
+      let resolveClaim: (claimed: boolean) => void = () => {}
+      const runtime = {
+        setPtyController: vi.fn(),
+        createPreAllocatedTerminalHandle: vi.fn(() => null),
+        registerPty: vi.fn(),
+        getDriver: vi.fn(() => ({ kind: 'idle' })),
+        claimRemoteDesktopHost: vi.fn(
+          () =>
+            new Promise<boolean>((resolve) => {
+              resolveClaim = resolve
+            })
+        ),
+        onPtySpawned: vi.fn(),
+        onPtyExit: vi.fn(),
+        onPtyData: vi.fn()
+      }
+      handlers.clear()
+      registerPtyHandlers(mainWindow as never, runtime as never)
+      const spawn = await handlers.get('pty:spawn')!(null, { cols: 80, rows: 24, env: {} })
+      const id = (spawn as { id: string }).id
+      restorePtyIncarnation(id, 'incarnation-old')
+      const claim = onMock.mock.calls.find((entry: unknown[]) => entry[0] === 'pty:claimViewport')
+      const writeEvent = onMock.mock.calls.find((entry: unknown[]) => entry[0] === 'pty:write')
+
+      claim?.[1](mainWindowIpcEvent, { id, cols: 125, rows: 48 })
+      writeEvent?.[1](mainWindowIpcEvent, { id, data: 'queued' })
+      const accepted = handlers.get('pty:writeAccepted')!(mainWindowIpcEvent, {
+        id,
+        data: 'accepted'
+      })
+      restorePtyIncarnation(id, 'incarnation-new')
+      resolveClaim(true)
+
+      await expect(accepted).resolves.toBe(false)
+      await Promise.resolve()
+      expect(write).not.toHaveBeenCalled()
+      clearProviderPtyState(id)
+    })
+
     it('does not populate the remote reclaim cache when only a phone drives', async () => {
       const resizeSpy = vi.fn()
       setupProviderWithAppliedSize({ applied: { cols: 80, rows: 24 }, resize: resizeSpy })
@@ -8195,8 +8330,7 @@ describe('registerPtyHandlers', () => {
         TMUX: '/tmp/orca-claude-agent-teams/team-stale,0,1',
         ORCA_AGENT_TEAMS_TEAM_ID: 'team-stale',
         ORCA_AGENT_TEAMS_TOKEN: 'stale-token',
-        TERM_PROGRAM: 'Orca',
-        ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/stale-attribution'
+        TERM_PROGRAM: 'Orca'
       },
       launchConfig: {
         agentCommand: 'claude --teammate-mode auto',
@@ -8229,7 +8363,6 @@ describe('registerPtyHandlers', () => {
     })
     expect(spawnOptions.env.PATH.split(delimiter)[0]).toBe('/tmp/fresh-agent-teams')
     expect(spawnOptions.env.TERM_PROGRAM).toBeUndefined()
-    expect(spawnOptions.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
     expect(result.launchConfig?.agentEnv).toMatchObject({
       CLAUDE_PROFILE: 'captured',
       CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS: '1',
@@ -8658,6 +8791,91 @@ describe('registerPtyHandlers', () => {
     })
   })
 
+  it('shuts down a split PTY when its expected source binding was retired', async () => {
+    type RuntimeSpawnController = {
+      spawn(args: {
+        cols: number
+        rows: number
+        worktreeId: string
+        tabId: string
+        leafId: string
+        persistHostSessionBinding: boolean
+        expectedSourceBinding: {
+          worktreeId: string
+          tabId: string
+          leafId: string
+          ptyId: string
+        }
+      }): Promise<{ id: string }>
+    }
+    let emitExit: ((event: { exitCode: number; signal: number }) => void) | undefined
+    const kill = vi.fn(() => emitExit?.({ exitCode: 0, signal: 0 }))
+    const proc = {
+      onData: vi.fn(),
+      onExit: vi.fn((callback) => {
+        emitExit = callback
+        return makeDisposable()
+      }),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill,
+      process: 'zsh',
+      pid: 12345
+    }
+    spawnMock.mockReturnValue(proc)
+    const store = { persistPtyBinding: vi.fn(() => false) }
+    let controller: RuntimeSpawnController | null = null
+    const runtime = {
+      setPtyController: vi.fn((value) => {
+        controller = value
+      }),
+      preAllocateHandleForPty: vi.fn(() => 'term_expected'),
+      registerPreAllocatedHandleForPty: vi.fn(),
+      registerPty: vi.fn(),
+      noteTerminalSpawnCommand: vi.fn(),
+      onPtySpawned: vi.fn(),
+      onPtyExit: vi.fn(),
+      onPtyData: vi.fn()
+    }
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+    registerPtyHandlers(
+      mainWindow as never,
+      runtime as never,
+      undefined,
+      undefined,
+      undefined,
+      store as never
+    )
+    const leafId = '22222222-2222-4222-8222-222222222222'
+    const expectedSourceBinding = {
+      worktreeId: 'wt-1',
+      tabId: 'tab-headless',
+      leafId: '11111111-1111-4111-8111-111111111111',
+      ptyId: 'pty-source'
+    }
+
+    try {
+      await expect(
+        (controller as unknown as RuntimeSpawnController).spawn({
+          cols: 80,
+          rows: 24,
+          worktreeId: 'wt-1',
+          tabId: 'tab-headless',
+          leafId,
+          persistHostSessionBinding: true,
+          expectedSourceBinding
+        })
+      ).rejects.toThrow('terminal_split_source_not_found')
+    } finally {
+      error.mockRestore()
+    }
+
+    expect(store.persistPtyBinding).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedSourceBinding })
+    )
+    expect(kill).toHaveBeenCalledOnce()
+  })
+
   it('reports lower-owner commit before rejecting an early-exited runtime incarnation', async () => {
     const persistPtyBinding = vi.fn()
     const onPtySpawnCommitted = vi.fn()
@@ -9569,6 +9787,9 @@ describe('registerPtyHandlers', () => {
     )
     expect(runtime.noteTerminalSpawnCommand).not.toHaveBeenCalled()
     expect(store.persistPtyBinding).toHaveBeenCalledOnce()
+    // STA-3077 step P inverted this: the reattach writer no longer passes a
+    // hostId slot at all (it used to pass `undefined` here for the local case),
+    // so the call is now strictly single-argument.
     expect(store.persistPtyBinding).toHaveBeenCalledWith(
       expect.objectContaining({
         worktreeId,
@@ -9580,9 +9801,10 @@ describe('registerPtyHandlers', () => {
           ptyId: 'pty-persisted-owner',
           incarnationId: 'inc-stale-owner'
         }
-      }),
-      undefined
+      })
     )
+    expect(store.persistPtyBinding.mock.calls[0]!).toHaveLength(1)
+    expect(getPtyIdForPaneKey(paneKey)).toBe('pty-persisted-owner')
     expect(
       mainWindow.webContents.send.mock.calls.filter(([channel]) => channel === 'pty:spawned')
     ).toHaveLength(1)
@@ -10281,9 +10503,139 @@ describe('registerPtyHandlers', () => {
     expect(runtime.onPtyExit).toHaveBeenCalledWith('pty-already-retired-owner', 0, undefined)
   })
 
-  it('retires a dead owner from the exact SSH host session before fresh recovery', async () => {
+  // Sibling of the clause above, and the reason that one is driven by a proof. Retiring an owner
+  // authorizes a replacement carrying the pane's agent resume payload, so a bare not-found must
+  // not do it: a replaced relay answers exactly that for shells its predecessor still runs.
+  it('does not retire an SSH owner, nor respawn it, on a bare not-found', async () => {
+    const connectionId = 'ssh-unproven-stable-pane'
+    const tabId = 'tab-unproven-ssh-owner'
+    const leafId = '35353535-3535-4535-8535-353535353535'
+    const paneKey = makePaneKey(tabId, leafId)
+    const worktreeId = 'repo-ssh::/remote/unproven-stable-pane'
+    const livePtyId = `ssh:${connectionId}@@live-relay-pty`
+    const freshPtyId = `ssh:${connectionId}@@fresh-relay-pty`
+    const remoteSpawn = vi.fn(async (options: { attachOnly?: boolean; command?: string }) => {
+      if (options.attachOnly) {
+        // The reattach mints this only after verifying the relay's observed exit names this shell.
+        // A bare not-found reaches here too and must NOT retire the owner — pinned by the sibling
+        // clause below, because retirement authorizes a replacement carrying the resume payload.
+        throw new Error('PTY "live-relay-pty" not found')
+      }
+      return { id: freshPtyId, incarnationId: 'inc-fresh-ssh-owner' }
+    })
+    registerSshPtyProvider(connectionId, {
+      spawn: remoteSpawn,
+      write: vi.fn(),
+      resize: vi.fn(),
+      shutdown: vi.fn(),
+      sendSignal: vi.fn(),
+      getCwd: vi.fn(),
+      getInitialCwd: vi.fn(),
+      clearBuffer: vi.fn(),
+      acknowledgeDataEvent: vi.fn(),
+      onData: vi.fn(() => () => {}),
+      onReplay: vi.fn(() => () => {}),
+      onExit: vi.fn(() => () => {}),
+      listProcesses: vi.fn(),
+      hasChildProcesses: vi.fn(),
+      getForegroundProcess: vi.fn(),
+      serialize: vi.fn(),
+      revive: vi.fn(),
+      getDefaultShell: vi.fn(),
+      getProfiles: vi.fn()
+    } as never)
+    let session = {
+      tabsByWorktree: {
+        [worktreeId]: [{ id: tabId, worktreeId, ptyId: livePtyId }]
+      },
+      terminalLayoutsByTabId: {
+        [tabId]: {
+          root: { type: 'leaf' as const, leafId },
+          activeLeafId: leafId,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [leafId]: livePtyId }
+        }
+      },
+      terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-live-ssh-owner' }
+    }
+    const store = {
+      // STA-3077 step P inverted these: the reader/retirer used to target the
+      // per-target `ssh:<connectionId>` partition while the renderer published
+      // pane membership to `local` — two homes, so supersession no-opped. Both
+      // sides now address the single default (local) partition, i.e. no hostId.
+      getWorkspaceSession: vi.fn((requestedHostId?: string) => {
+        expect(requestedHostId).toBeUndefined()
+        return session
+      }),
+      setWorkspaceSession: vi.fn((next, requestedHostId?: string) => {
+        expect(requestedHostId).toBeUndefined()
+        session = next
+      }),
+      flushOrThrow: vi.fn(),
+      persistPtyBinding: vi.fn(),
+      upsertSshRemotePtyLease: vi.fn(),
+      removeSshRemotePtyLease: vi.fn(),
+      markSshRemotePtyLease: vi.fn()
+    }
+    const runtime = {
+      setPtyController: vi.fn(),
+      resolveTerminalPane: vi.fn(() => {
+        throw new Error('terminal_not_found')
+      }),
+      createPreAllocatedTerminalHandle: vi.fn(() => 'term-fresh-ssh-owner'),
+      registerPreAllocatedHandleForPty: vi.fn(),
+      beginPtyRegistration: vi.fn(),
+      cancelPendingPtyRegistration: vi.fn(),
+      assertPtyRegistrationAllowed: vi.fn(),
+      registerPty: vi.fn(),
+      noteTerminalSpawnCommand: vi.fn(),
+      seedHeadlessTerminal: vi.fn(),
+      getDriver: vi.fn(() => ({ kind: 'host' })),
+      onPtySpawned: vi.fn(),
+      onPtyExit: vi.fn(),
+      onPtyData: vi.fn()
+    }
+
+    try {
+      registerPtyHandlers(
+        mainWindow as never,
+        runtime as never,
+        undefined,
+        undefined,
+        undefined,
+        store as never
+      )
+      await expect(
+        handlers.get('pty:spawn')!(null, {
+          cols: 80,
+          rows: 24,
+          cwd: '/remote/unproven-stable-pane',
+          command: 'codex resume a-session-that-may-still-be-running',
+          connectionId,
+          worktreeId,
+          tabId,
+          leafId,
+          env: {
+            ORCA_PANE_KEY: paneKey,
+            ORCA_TAB_ID: tabId,
+            ORCA_WORKTREE_ID: worktreeId
+          }
+        })
+      ).rejects.toThrow(/not found/i)
+
+      // Only the attach ran: no replacement carrying the resume payload.
+      expect(remoteSpawn).toHaveBeenCalledTimes(1)
+      expect(remoteSpawn.mock.calls[0]?.[0]).toMatchObject({ attachOnly: true })
+      // The pane keeps its owner, so the shell stays reattachable.
+      expect(store.setWorkspaceSession).not.toHaveBeenCalled()
+      expect(runtime.onPtyExit).not.toHaveBeenCalled()
+    } finally {
+      unregisterSshPtyProvider(connectionId)
+    }
+  })
+
+  it('retires a dead owner from the local session — the one pane-binding home — before fresh recovery', async () => {
     const connectionId = 'ssh-dead-stable-pane'
-    const hostId = `ssh:${connectionId}`
     const tabId = 'tab-dead-ssh-owner'
     const leafId = '34343434-3434-4434-8434-343434343434'
     const paneKey = makePaneKey(tabId, leafId)
@@ -10292,7 +10644,8 @@ describe('registerPtyHandlers', () => {
     const freshPtyId = `ssh:${connectionId}@@fresh-relay-pty`
     const remoteSpawn = vi.fn(async (options: { attachOnly?: boolean; command?: string }) => {
       if (options.attachOnly) {
-        throw new Error('PTY "dead-relay-pty" not found')
+        // Proven exit: only this error authorizes retiring the owner (bare not-found must not).
+        throw new Error('SSH_SESSION_EXPIRED: dead-relay-pty')
       }
       return { id: freshPtyId, incarnationId: 'inc-fresh-ssh-owner' }
     })
@@ -10332,12 +10685,16 @@ describe('registerPtyHandlers', () => {
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-dead-ssh-owner' }
     }
     const store = {
+      // STA-3077 step P inverted these: the reader/retirer used to target the
+      // per-target `ssh:<connectionId>` partition while the renderer published
+      // pane membership to `local` — two homes, so supersession no-opped. Both
+      // sides now address the single default (local) partition, i.e. no hostId.
       getWorkspaceSession: vi.fn((requestedHostId?: string) => {
-        expect(requestedHostId).toBe(hostId)
+        expect(requestedHostId).toBeUndefined()
         return session
       }),
       setWorkspaceSession: vi.fn((next, requestedHostId?: string) => {
-        expect(requestedHostId).toBe(hostId)
+        expect(requestedHostId).toBeUndefined()
         session = next
       }),
       flushOrThrow: vi.fn(),
@@ -10400,16 +10757,25 @@ describe('registerPtyHandlers', () => {
       expect(remoteSpawn.mock.calls[1]?.[0]).toMatchObject({
         command: 'codex resume exact-dead-ssh-provider-session'
       })
-      expect(store.setWorkspaceSession).toHaveBeenCalledWith(expect.anything(), hostId)
+      // STA-3077 step P inverted these: the retirement write and the fresh
+      // binding write both land in the single default (local) partition now, so
+      // no hostId is passed. The dead owner must still actually be retired.
+      expect(store.setWorkspaceSession).toHaveBeenCalledOnce()
+      expect(store.setWorkspaceSession.mock.calls[0]!).toHaveLength(1)
+      expect(
+        store.setWorkspaceSession.mock.calls[0]![0].terminalLayoutsByTabId[tabId]?.ptyIdsByLeafId?.[
+          leafId
+        ]
+      ).not.toBe(deadPtyId)
       expect(store.persistPtyBinding).toHaveBeenCalledWith(
         expect.objectContaining({
           worktreeId,
           tabId,
           leafId,
           ptyId: freshPtyId
-        }),
-        hostId
+        })
       )
+      expect(store.persistPtyBinding.mock.calls.at(-1)!).toHaveLength(1)
     } finally {
       unregisterSshPtyProvider(connectionId)
     }
@@ -10755,15 +11121,15 @@ describe('registerPtyHandlers', () => {
         state: 'attached'
       })
     )
-    expect(store.persistPtyBinding).toHaveBeenCalledWith(
-      {
-        worktreeId: 'wt-remote',
-        tabId: 'tab-remote',
-        leafId,
-        ptyId: 'ssh:ssh-1@@relay-pty'
-      },
-      'ssh:ssh-1'
-    )
+    // STA-3077 step P inverted this: the headless binding writer no longer
+    // targets `ssh:<target>`; one home (`local`) only, so no hostId argument.
+    expect(store.persistPtyBinding).toHaveBeenCalledWith({
+      worktreeId: 'wt-remote',
+      tabId: 'tab-remote',
+      leafId,
+      ptyId: 'ssh:ssh-1@@relay-pty'
+    })
+    expect(store.persistPtyBinding.mock.calls[0]!).toHaveLength(1)
     expect(store.persistPtyBinding.mock.invocationCallOrder[0]!).toBeLessThan(
       store.upsertSshRemotePtyLease.mock.invocationCallOrder[0]!
     )
@@ -10907,15 +11273,15 @@ describe('registerPtyHandlers', () => {
         persistHostSessionBinding: true
       })
 
-      expect(store.persistPtyBinding).toHaveBeenCalledWith(
-        {
-          worktreeId: 'wt-remote',
-          tabId: 'tab-remote',
-          leafId,
-          ptyId: 'ssh:ssh-reattach-ok@@relay-pty'
-        },
-        'ssh:ssh-reattach-ok'
-      )
+      // STA-3077 step P inverted this: the reattach binding refresh writes to the
+      // single default (local) partition, so the `ssh:<target>` hostId is gone.
+      expect(store.persistPtyBinding).toHaveBeenCalledWith({
+        worktreeId: 'wt-remote',
+        tabId: 'tab-remote',
+        leafId,
+        ptyId: 'ssh:ssh-reattach-ok@@relay-pty'
+      })
+      expect(store.persistPtyBinding.mock.calls.at(-1)!).toHaveLength(1)
       expect(store.upsertSshRemotePtyLease).toHaveBeenCalledWith(
         expect.objectContaining({
           targetId: 'ssh-reattach-ok',
@@ -17590,6 +17956,31 @@ describe('registerPtyHandlers', () => {
     expect(mockProc.proc.write).toHaveBeenNthCalledWith(2, 'tail')
   })
 
+  it('stops a chunked write when the PTY incarnation changes between chunks', async () => {
+    vi.useFakeTimers()
+    const mockProc = createMockProc()
+    spawnMock.mockReturnValue(mockProc.proc)
+    registerPtyHandlers(mainWindow as never)
+    const result = (await handlers.get('pty:spawn')!(null, {
+      cols: 80,
+      rows: 24
+    })) as { id: string }
+    restorePtyIncarnation(result.id, 'incarnation-old')
+    const text = ['x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES), 'tail'].join('')
+
+    const writeResult = handlers.get('pty:writeAccepted')!(mainWindowIpcEvent, {
+      id: result.id,
+      data: text
+    })
+    expect(mockProc.proc.write).toHaveBeenCalledOnce()
+    restorePtyIncarnation(result.id, 'incarnation-new')
+    await vi.runAllTimersAsync()
+
+    await expect(writeResult).resolves.toBe(false)
+    expect(mockProc.proc.write).toHaveBeenCalledOnce()
+    clearProviderPtyState(result.id)
+  })
+
   it('yields while validating accepted large acknowledged pty writes before provider writes', async () => {
     const mockProc = createMockProc()
     spawnMock.mockReturnValue(mockProc.proc)
@@ -17614,6 +18005,30 @@ describe('registerPtyHandlers', () => {
     expect(mockProc.proc.write.mock.calls.map(([chunk]) => chunk).join('')).toBe(text)
   })
 
+  it('drops a deferred write when the PTY incarnation changes during validation', async () => {
+    vi.useFakeTimers()
+    const mockProc = createMockProc()
+    spawnMock.mockReturnValue(mockProc.proc)
+    registerPtyHandlers(mainWindow as never)
+    const result = (await handlers.get('pty:spawn')!(null, {
+      cols: 80,
+      rows: 24
+    })) as { id: string }
+    restorePtyIncarnation(result.id, 'incarnation-old')
+    const text = 'é'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
+
+    const writeResult = handlers.get('pty:writeAccepted')!(mainWindowIpcEvent, {
+      id: result.id,
+      data: text
+    })
+    restorePtyIncarnation(result.id, 'incarnation-new')
+    await vi.runAllTimersAsync()
+
+    await expect(writeResult).resolves.toBe(false)
+    expect(mockProc.proc.write).not.toHaveBeenCalled()
+    clearProviderPtyState(result.id)
+  })
+
   it('rejects oversized acknowledged pty writes before provider writes', async () => {
     const mockProc = createMockProc()
     spawnMock.mockReturnValue(mockProc.proc)
@@ -17670,6 +18085,87 @@ describe('registerPtyHandlers', () => {
     )
   })
 
+  it('pairs the daemon kitty flags with the reconciled boundary when no bytes crossed mid-spawn', async () => {
+    setLocalPtyProvider({
+      spawn: vi.fn(async () => ({
+        id: 'pty-restored',
+        isReattach: true,
+        providerSequence: { value: 900, generation: 'continued' as const },
+        snapshotKittyKeyboardFlags: 8
+      })),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      shutdown: vi.fn(),
+      onData: vi.fn(() => vi.fn()),
+      onExit: vi.fn(() => vi.fn()),
+      listProcesses: vi.fn(async () => []),
+      getForegroundProcess: vi.fn(async () => null)
+    } as never)
+    const runtime = {
+      setPtyController: vi.fn(),
+      noteTerminalSpawnCommand: vi.fn(),
+      getPtyOutputSequence: vi.fn().mockReturnValue(7),
+      synchronizePtyOutputSequenceFromProvider: vi.fn().mockReturnValue(920),
+      onPtySpawned: vi.fn(),
+      onPtyData: vi.fn(),
+      onPtyExit: vi.fn(),
+      createPreAllocatedTerminalHandle: vi.fn(() => null),
+      preAllocateHandleForPty: vi.fn()
+    }
+    registerPtyHandlers(mainWindow as never, runtime as never)
+
+    const reply = (await handlers.get('pty:spawn')!(null, { cols: 80, rows: 24 })) as {
+      snapshotSeq?: number
+      snapshotKittyKeyboardFlags?: number
+    }
+
+    expect(reply.snapshotKittyKeyboardFlags).toBe(8)
+    expect(reply.snapshotSeq).toBe(920)
+  })
+
+  it('drops the daemon kitty flags claim when bytes crossed the data socket mid-spawn', async () => {
+    setLocalPtyProvider({
+      spawn: vi.fn(async () => ({
+        id: 'pty-restored',
+        isReattach: true,
+        providerSequence: { value: 900, generation: 'continued' as const },
+        snapshotKittyKeyboardFlags: 8
+      })),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      shutdown: vi.fn(),
+      onData: vi.fn(() => vi.fn()),
+      onExit: vi.fn(() => vi.fn()),
+      listProcesses: vi.fn(async () => []),
+      getForegroundProcess: vi.fn(async () => null)
+    } as never)
+    const runtime = {
+      setPtyController: vi.fn(),
+      noteTerminalSpawnCommand: vi.fn(),
+      // 7 at spawn start, 20 at reconcile: bytes arrived during the spawn RPC.
+      getPtyOutputSequence: vi.fn().mockReturnValueOnce(7).mockReturnValue(20),
+      synchronizePtyOutputSequenceFromProvider: vi.fn().mockReturnValue(920),
+      onPtySpawned: vi.fn(),
+      onPtyData: vi.fn(),
+      onPtyExit: vi.fn(),
+      createPreAllocatedTerminalHandle: vi.fn(() => null),
+      preAllocateHandleForPty: vi.fn()
+    }
+    registerPtyHandlers(mainWindow as never, runtime as never)
+
+    const reply = (await handlers.get('pty:spawn')!(null, { cols: 80, rows: 24 })) as {
+      snapshotSeq?: number
+      snapshotKittyKeyboardFlags?: number
+    }
+
+    // The reconciled boundary covers bytes the daemon's flags were proven
+    // BEFORE — publishing both would erase a negotiation the pane scanned live.
+    expect(reply.snapshotKittyKeyboardFlags).toBeUndefined()
+    expect(reply.snapshotSeq).toBeUndefined()
+  })
+
   it('records the launch Codex account for a fresh spawn but not for a reattach', async () => {
     const spawn = vi
       .fn()
diff --git a/src/main/ipc/pty.ts b/src/main/ipc/pty.ts
index d9e4cbf679c..e351a2a4191 100644
--- a/src/main/ipc/pty.ts
+++ b/src/main/ipc/pty.ts
@@ -13,10 +13,10 @@ import {
 } from 'electron'
 export { getBashShellReadyRcfileContent } from '../providers/local-pty-shell-ready'
 import type { OrcaRuntimeService } from '../runtime/orca-runtime'
-import type { Store } from '../persistence'
+import type { PtyBindingSourceExpectation, Store } from '../persistence'
 import { retireTerminalSurfaceFromPersistence } from '../runtime/mobile-session-terminal-persistence-retirement'
+import { findTerminalTabIdForLeaf } from '../runtime/workspace-session-terminal-membership-authority'
 import type { GlobalSettings, TuiAgent } from '../../shared/types'
-import { toSshExecutionHostId } from '../../shared/execution-host'
 import { normalizeRuntimePathForComparison } from '../../shared/cross-platform-path'
 import { terminalOutputBacklogCapChars } from '../../shared/terminal-scrollback-policy'
 import type {
@@ -84,6 +84,7 @@ import {
 import type { StartupCommandDelivery } from '../../shared/codex-startup-delivery'
 import {
   SSH_SESSION_EXPIRED_ERROR,
+  isSshPtyExitedError,
   isSshPtyIdentityMismatchError,
   isSshPtyNotFoundError
 } from '../providers/ssh-pty-errors'
@@ -110,11 +111,12 @@ import {
   markClaudePtyExited,
   markClaudePtySpawned
 } from '../claude-accounts/live-pty-gate'
-import {
-  applyTerminalAttributionEnv,
-  resolveAttributionShellFamily
-} from '../attribution/terminal-attribution'
 import { ensureLinuxTerminalOrcaCliShimDir } from '../cli/linux-terminal-orca-cli-shim'
+import {
+  isLegacyTerminalShimPathEntry,
+  LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS,
+  stripLegacyTerminalShimEnv
+} from '../pty/legacy-terminal-shim-dir'
 import { registerPty, unregisterPty } from '../memory/pty-registry'
 import { advertisedUrlWatcher } from '../ports/advertised-url-watcher'
 import { track } from '../telemetry/client'
@@ -132,7 +134,7 @@ import {
 import { isRemoteAgentHooksEnabled } from '../../shared/agent-hook-relay'
 import { createTerminalSessionStateSaveFailureMessage } from '../../shared/terminal-session-state-save-failure'
 import { RendererTerminalSerializerReadiness } from './renderer-terminal-serializer-readiness'
-import { readShellStartupEnvVar } from '../pty/shell-startup-env'
+import { readSessionShellStartupEnvVar } from '../pty/shell-startup-env'
 import {
   isTerminalLeafId,
   makePaneKey,
@@ -140,6 +142,7 @@ import {
   parsePaneKey
 } from '../../shared/stable-pane-id'
 import { isValidTerminalTabId } from '../../shared/terminal-tab-id'
+import { parseTerminalKittyKeyboardFlags } from '../../shared/terminal-kitty-keyboard-flags'
 import {
   resolveTerminalStartupCwdForWorkspace,
   type TerminalStartupCwdMissingDirFallback
@@ -232,7 +235,7 @@ import {
 } from '../project-groups/folder-workspace-path-status'
 import { getSshFilesystemProvider } from '../providers/ssh-filesystem-dispatch'
 import { resolveLocalProjectRuntimeForWorktreeId } from '../local-project-runtime-resolution'
-import { isPtyIncarnationId } from '../../shared/pty-incarnation'
+import { isPtyIncarnationId, isRelayAttestedPtyIncarnationId } from '../../shared/pty-incarnation'
 import type { PtyListedSession } from '../../shared/pty-listed-session'
 
 // ─── Provider Registry ──────────────────────────────────────────────
@@ -284,6 +287,26 @@ const ptyPaneKey = new Map<string, string>()
 // Why: reverse of ptyPaneKey — callers with a paneKey from outside the PTY lifecycle (e.g. agent-hook status routing) need the ptyId; kept in lock-step via the same sites.
 const paneKeyPtyId = new Map<string, string>()
 
+/**
+ * True only when this PTY's own pane has since bound a different PTY. The two
+ * maps above are maintained in lock-step, so their disagreement is proof the id
+ * was superseded — a renderer that queued work before a reattach cannot land it
+ * on the successor.
+ *
+ * Deliberately false when no paneKey is recorded: an unowned or orphaned PTY is
+ * unknown, not stale, and unknown never authorizes refusing an explicit
+ * operation. That is also what keeps orphan cleanup working, since those ids
+ * have no pane by construction.
+ */
+function isSupersededPtyId(ptyId: string): boolean {
+  const paneKey = ptyPaneKey.get(ptyId)
+  if (paneKey === undefined) {
+    return false
+  }
+  const currentPtyId = paneKeyPtyId.get(paneKey)
+  return currentPtyId !== undefined && currentPtyId !== ptyId
+}
+
 const AGENT_HOOK_RUNTIME_ENV_KEYS = [
   'ORCA_AGENT_HOOK_PORT',
   'ORCA_AGENT_HOOK_TOKEN',
@@ -513,6 +536,68 @@ function rememberPaneKeyForPty(ptyId: string, paneKey: unknown): string | null {
   return normalizedPaneKey
 }
 
+/**
+ * The one producer of a pane -> shell binding: durable record and fence maps together, keyed by the
+ * tab holding the leaf *now* (a stored tabId names the tab a moved pane left). Splitting these let
+ * the superseded-PTY fence sit inert on reattach, the path it was built for.
+ *
+ * `bound` is false when a durable pane refuses. A throw is unknown rather than a refusal, so it
+ * propagates — only the caller that created the shell should clean it up.
+ *
+ * `tabId` is the resolved tab, returned so a caller that also registers the pane with the runtime
+ * graph uses the SAME coordinate. Registering under the lease's frozen tabId while the record and
+ * the fence use the live one splits the pane across two tabs, and the graph half then ensures a
+ * mobile surface for the tab the pane left.
+ */
+/**
+ * The tab a leaf lives in *now*. Callers whose own `tabId` is fresh (spawn) must not use this — the
+ * persisted layout is the stale side inside the renderer's publish debounce. Callers holding a
+ * tabId frozen in a durable lease (reattach) must, because the pane may have been moved since.
+ *
+ * Resolved separately from `bindPaneShell` so a thrown durable write cannot lose the answer and
+ * leave the runtime graph registered under the tab the pane left.
+ */
+export function resolvePaneShellTabId(
+  store: Pick<Store, 'getWorkspaceSession'> | undefined,
+  leafId: string
+): string | undefined {
+  if (typeof store?.getWorkspaceSession !== 'function') {
+    return undefined
+  }
+  return findTerminalTabIdForLeaf(store.getWorkspaceSession(), leafId)
+}
+
+export function bindPaneShell(args: {
+  store: Pick<Store, 'persistPtyBinding' | 'getWorkspaceSession'> | undefined
+  worktreeId: string
+  tabId: string
+  leafId: string
+  ptyId: string
+  incarnationId?: string
+  startupCwd?: string
+  mayCreate?: boolean
+  expectedBinding?: { ptyId: string; incarnationId?: string }
+  expectedSourceBinding?: PtyBindingSourceExpectation
+}): { bound: boolean; tabId: string } {
+  const tabId = args.tabId
+  const bound = args.store?.persistPtyBinding({
+    worktreeId: args.worktreeId,
+    tabId,
+    leafId: args.leafId,
+    ptyId: args.ptyId,
+    ...(args.incarnationId ? { incarnationId: args.incarnationId } : {}),
+    ...(args.startupCwd ? { startupCwd: args.startupCwd } : {}),
+    ...(args.mayCreate === false ? { mayCreate: false } : {}),
+    ...(args.expectedBinding ? { expectedBinding: args.expectedBinding } : {}),
+    ...(args.expectedSourceBinding ? { expectedSourceBinding: args.expectedSourceBinding } : {})
+  })
+  if (bound === false) {
+    return { bound: false, tabId }
+  }
+  rememberPaneKeyForPty(args.ptyId, makePaneKey(tabId, args.leafId))
+  return { bound: true, tabId }
+}
+
 function cleanupPendingPaneSerializersForSender(ownerWebContentsId: number): void {
   pendingPaneSerializerCleanupRegistered.delete(ownerWebContentsId)
   for (const [paneKey, pending] of pendingByPaneKey) {
@@ -649,11 +734,13 @@ type StablePaneAdoption = {
 } | null
 const stablePaneAdoptionsByOwnerKey = new Map<string, Promise<StablePaneAdoption>>()
 
+// Pane bindings have one home: the local partition. An SSH pane is not partitioned out — the
+// renderer publishes its membership to `local` and `mayCreate: false` is evaluated there — so
+// selecting `ssh:<target>` here read a partition no live writer maintains (STA-3077 step P).
 function resolvePersistedStablePaneOwner(
   store: Store | undefined,
   paneKey: string,
-  worktreeId: string,
-  connectionId: string | null | undefined
+  worktreeId: string
 ): Pick<StablePaneOwner, 'tabId' | 'leafId' | 'ptyId' | 'incarnationId'> | null {
   if (!store || typeof store.getWorkspaceSession !== 'function') {
     return null
@@ -662,9 +749,7 @@ function resolvePersistedStablePaneOwner(
   if (!parsed) {
     return null
   }
-  const session = store.getWorkspaceSession(
-    connectionId ? toSshExecutionHostId(connectionId) : undefined
-  )
+  const session = store.getWorkspaceSession()
   const tab = session.tabsByWorktree?.[worktreeId]?.find(
     (candidate) => candidate.id === parsed.tabId && candidate.worktreeId === worktreeId
   )
@@ -704,7 +789,7 @@ function resolveStablePaneOwner(
       }
     }
   }
-  const persisted = resolvePersistedStablePaneOwner(store, paneKey, worktreeId, connectionId)
+  const persisted = resolvePersistedStablePaneOwner(store, paneKey, worktreeId)
   if (resolved?.ptyId && persisted && resolved.ptyId !== persisted.ptyId) {
     throw new Error('terminal_pane_owner_conflict')
   }
@@ -740,15 +825,13 @@ function resolveStablePaneOwner(
 function retirePersistedStablePaneOwner(
   store: Store | undefined,
   owner: StablePaneOwner,
-  worktreeId: string,
-  connectionId: string | null | undefined
+  worktreeId: string
 ): boolean {
   if (!store) {
     return false
   }
   const paneKey = makePaneKey(owner.tabId, owner.leafId)
-  const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
-  const current = resolvePersistedStablePaneOwner(store, paneKey, worktreeId, connectionId)
+  const current = resolvePersistedStablePaneOwner(store, paneKey, worktreeId)
   if (!current) {
     // Why: persistence already dropped this pane binding (an earlier stop retired it while the
     // runtime kept history), so there is nothing left to clear — that is a completed retirement,
@@ -758,7 +841,7 @@ function retirePersistedStablePaneOwner(
   if (current.ptyId !== owner.ptyId || current.incarnationId !== owner.persistedIncarnationId) {
     return false
   }
-  const session = store.getWorkspaceSession(hostId)
+  const session = store.getWorkspaceSession()
   const retired = retireTerminalSurfaceFromPersistence(session, {
     worktreeId,
     parentTabId: owner.tabId,
@@ -769,7 +852,7 @@ function retirePersistedStablePaneOwner(
   if (retired === session) {
     return false
   }
-  store.setWorkspaceSession(retired, hostId)
+  store.setWorkspaceSession(retired)
   store.flushOrThrow()
   return true
 }
@@ -784,6 +867,8 @@ type StablePaneSpawnContext = {
   connectionId?: string | null
   resolveOwner?: () => StablePaneOwner | null
   onFreshSpawn?: (result: PtySpawnResult) => void
+  /** Create a shell for this pane instead of attaching the one it records; see the caller. */
+  refuseAdoption?: boolean
 }
 
 function stablePanePersistenceFence(
@@ -803,25 +888,22 @@ function persistAdmittedStablePaneBinding(args: {
   result: PtySpawnResult
   worktreeId: string | undefined
   startupCwd: string | undefined
-  connectionId: string | null | undefined
 }): boolean {
   const expectedBinding = stablePanePersistenceFence(args.owner)
   if (!args.store || !args.owner || !args.worktreeId || !expectedBinding) {
     return false
   }
-  const persisted = args.store.persistPtyBinding(
-    {
-      worktreeId: args.worktreeId,
-      tabId: args.owner.tabId,
-      leafId: args.owner.leafId,
-      ptyId: args.result.id,
-      ...(args.result.incarnationId ? { incarnationId: args.result.incarnationId } : {}),
-      ...(args.startupCwd ? { startupCwd: args.startupCwd } : {}),
-      expectedBinding
-    },
-    args.connectionId ? toSshExecutionHostId(args.connectionId) : undefined
-  )
-  if (persisted === false) {
+  const persisted = bindPaneShell({
+    store: args.store,
+    worktreeId: args.worktreeId,
+    tabId: args.owner.tabId,
+    leafId: args.owner.leafId,
+    ptyId: args.result.id,
+    ...(args.result.incarnationId ? { incarnationId: args.result.incarnationId } : {}),
+    ...(args.startupCwd ? { startupCwd: args.startupCwd } : {}),
+    expectedBinding
+  })
+  if (persisted.bound === false) {
     throw new Error('terminal_pane_owner_changed')
   }
   return true
@@ -857,7 +939,7 @@ async function attachStablePaneOwner(
     if (isDaemonEndpointGoneError(error)) {
       throw new TerminalHostGoneError()
     }
-    if (!isPtyAlreadyGoneError(error)) {
+    if (!isPtyProvenGoneForReplacement(error, owner.ptyId)) {
       throw error
     }
     const ownerBeforeRetire = args.resolveOwner?.()
@@ -873,10 +955,7 @@ async function attachStablePaneOwner(
     runtime?.onPtyExit(owner.ptyId, 0, owner.incarnationId)
     clearProviderPtyState(owner.ptyId)
     ptyOwnership.delete(owner.ptyId)
-    if (
-      args.worktreeId &&
-      !retirePersistedStablePaneOwner(args.store, owner, args.worktreeId, args.connectionId)
-    ) {
+    if (args.worktreeId && !retirePersistedStablePaneOwner(args.store, owner, args.worktreeId)) {
       throw new Error('terminal_pane_owner_changed')
     }
     if (args.resolveOwner?.()) {
@@ -899,7 +978,11 @@ async function attachStablePaneOwner(
 async function spawnForStablePane(
   args: StablePaneSpawnContext
 ): Promise<{ result: PtySpawnResult; owner: StablePaneOwner | null }> {
-  if (args.owner) {
+  // The one place an owner becomes `sessionId` for the provider, which is what makes an attach an
+  // attach. Refusing adoption has to be honoured HERE: gating only where the owner is resolved
+  // leaves every other resolution free to reach this line, which is exactly how the unreachable
+  // pane's "start a new terminal" kept attaching the shell it could not reach.
+  if (args.owner && !args.refuseAdoption) {
     const attached = await attachStablePaneOwner({ ...args, owner: args.owner })
     if (attached) {
       return attached
@@ -1026,9 +1109,29 @@ function normalizeNodePtySpawnError(err: unknown): Error {
   return new Error(hintedMessage)
 }
 
+/**
+ * Retiring a pane's owner authorizes a replacement that carries its agent resume payload, so it
+ * needs proof — unlike a shutdown, where "not found" is simply the outcome we asked for. A bare
+ * not-found proves an exit only from a provider that owns its ptys; a replacement relay answers the
+ * same for shells its predecessor is still running.
+ */
+function isPtyProvenGoneForReplacement(err: unknown, ptyId: string): boolean {
+  if (!parseAppSshPtyId(ptyId)) {
+    return isPtyAlreadyGoneError(err)
+  }
+  // For SSH, the two proving answers are the relay's own observed exit and the expiry the reattach
+  // mints only after verifying that proof names this shell. A bare not-found is neither.
+  const message = err instanceof Error ? err.message : String(err)
+  return isSshPtyExitedError(err) || message.includes(SSH_SESSION_EXPIRED_ERROR)
+}
+
 function isPtyAlreadyGoneError(err: unknown): boolean {
   const message = err instanceof Error ? err.message : String(err)
-  return isSshPtyNotFoundError(err) || /Session not found/i.test(message)
+  // A proven exit is the strongest form of "already gone"; it only reads differently because the
+  // relay now says what it observed instead of reporting an unknown id.
+  return (
+    isSshPtyNotFoundError(err) || isSshPtyExitedError(err) || /Session not found/i.test(message)
+  )
 }
 
 function delay(ms: number): Promise<void> {
@@ -1122,14 +1225,12 @@ export type BuildPtyHostEnvOptions = {
    *  and strip only an inherited Orca-owned override so nested Orca panes do not
    *  leak the parent's managed home. A user-set CODEX_HOME is preserved. */
   stripInheritedOrcaCodexHome?: boolean
-  githubAttributionEnabled: boolean
   /** Launch command the renderer chose (e.g. 'pi', 'omp', 'claude'); resolves the per-agent
    *  extension target for Pi/OMP. Undefined for bare shells → defaults to Pi. NEVER infer from
    *  disk presence (cross-agent shadowing when both dirs exist). */
   launchCommand?: string
   /** Trusted agent identity for wrapped commands that cannot be recognized from text. */
   launchAgent?: TuiAgent
-  shellPath?: string
   isWsl?: boolean
   /** Distro for WSL spawns (null = Windows default distro); drives the WSL hook relay + endpoint repoint. Only read when isWsl. */
   wslDistro?: string | null
@@ -1157,7 +1258,9 @@ function promoteAgentTeamsShimPath(
     return
   }
   const shimPath = firstPathEntry(requestedPath)
-  if (!shimPath) {
+  // Why: requestedPath is captured before buildPtyHostEnv scrubs, so a legacy entry that
+  // reached the front would be re-prepended here and outlive the scrub.
+  if (!shimPath || isLegacyTerminalShimPathEntry(shimPath)) {
     return
   }
   const currentPathKey = env.PATH !== undefined || env.Path === undefined ? 'PATH' : 'Path'
@@ -1507,11 +1610,7 @@ function resolvePiAgentSourceDir(
   if (kind === 'prime-agent') {
     return (
       readEnvWithProcessFallback(baseEnv, primaryKey) ??
-      readShellStartupEnvVar(
-        primaryKey,
-        baseEnv.HOME ?? process.env.HOME,
-        baseEnv.SHELL ?? process.env.SHELL
-      )
+      readSessionShellStartupEnvVar(primaryKey, baseEnv)
     )
   }
 
@@ -1526,11 +1625,7 @@ function resolvePiAgentSourceDir(
     return publicDir
   }
 
-  return readShellStartupEnvVar(
-    primaryKey,
-    baseEnv.HOME ?? process.env.HOME,
-    baseEnv.SHELL ?? process.env.SHELL
-  )
+  return readSessionShellStartupEnvVar(primaryKey, baseEnv)
 }
 
 function resolveScopedPiAgentSourceDir(
@@ -1581,11 +1676,6 @@ function exposePiManagedExtensionEnv(
     } else {
       delete baseEnv.ORCA_PRIME_AGENT_SOURCE_AGENT_DIR
     }
-    if (managedEnv.ORCA_PRIME_AGENT_STATUS_EXTENSION) {
-      baseEnv.ORCA_PRIME_AGENT_STATUS_EXTENSION = managedEnv.ORCA_PRIME_AGENT_STATUS_EXTENSION
-    } else {
-      delete baseEnv.ORCA_PRIME_AGENT_STATUS_EXTENSION
-    }
     return
   }
   delete baseEnv.ORCA_PI_CODING_AGENT_DIR
@@ -1684,14 +1774,7 @@ function resolveOpenCodeSourceConfigDir(baseEnv: Record<string, string>): string
     return undefined
   }
 
-  return (
-    configDir ??
-    readShellStartupEnvVar(
-      'OPENCODE_CONFIG_DIR',
-      baseEnv.HOME ?? process.env.HOME,
-      baseEnv.SHELL ?? process.env.SHELL
-    )
-  )
+  return configDir ?? readSessionShellStartupEnvVar('OPENCODE_CONFIG_DIR', baseEnv)
 }
 
 /**
@@ -1728,8 +1811,6 @@ export function buildPtyHostEnv(
   })
 
   const shouldPrepareOmpShadow = piAgentKind === 'omp' || !hasLaunchCommand
-  const shouldPreparePrimeStatus =
-    piAgentKind === 'prime-agent' || (opts.isWsl && !hasLaunchCommand)
   // Why: source shadows are agent-scoped; trusting the other kind's source reintroduces Pi/OMP extension-state shadowing.
   const preexistingPiAgentDir = resolvePiAgentSourceDir(baseEnv, 'pi')
   const preexistingOmpAgentDir =
@@ -1788,12 +1869,6 @@ export function buildPtyHostEnv(
     if (opts.isWsl === true) {
       // Why: hook POSTs to 127.0.0.1 die inside WSL's NAT namespace; use the guest-resident relay's endpoint instead of the Windows one.
       const distro = opts.wslDistro ?? null
-      const hookInstance = wslHookRelayManager.getInstanceKey()
-      if (hookInstance) {
-        baseEnv.ORCA_WSL_HOOK_INSTANCE = hookInstance
-      } else {
-        delete baseEnv.ORCA_WSL_HOOK_INSTANCE
-      }
       wslHookRelayManager.ensureForDistro(distro)
       const guestEndpoint = wslHookRelayManager.getGuestEndpointFilePath(distro)
       if (guestEndpoint) {
@@ -1840,14 +1915,13 @@ export function buildPtyHostEnv(
       exposePiManagedExtensionEnv(baseEnv, 'omp', ompEnv)
     }
 
-    if (shouldPreparePrimeStatus) {
-      // Why: the Windows host cannot safely resolve or write Prime's guest
-      // config root; WSL loads the host-managed status file explicitly.
-      const primeEnv = opts.isWsl
-        ? piTitlebarExtensionService.buildStatusOnlyPtyEnv('prime-agent')
-        : piTitlebarExtensionService.buildPtyEnv(id, preexistingPrimeAgentDir, 'prime-agent', {
-            materializeDefaultHome: explicitPiAgentKind === 'prime-agent'
-          })
+    if (piAgentKind === 'prime-agent' && !opts.isWsl) {
+      const primeEnv = piTitlebarExtensionService.buildPtyEnv(
+        id,
+        preexistingPrimeAgentDir,
+        'prime-agent',
+        { materializeDefaultHome: explicitPiAgentKind === 'prime-agent' }
+      )
       Object.assign(baseEnv, primeEnv)
       exposePiManagedExtensionEnv(baseEnv, 'prime-agent', primeEnv)
     }
@@ -1920,22 +1994,9 @@ export function buildPtyHostEnv(
       : bundledCliBin
   }
 
-  // Why: PATH shims keep GitHub attribution scoped to Orca's own PTYs without rewriting user git config.
-  if (!opts.githubAttributionEnabled) {
-    delete baseEnv.ORCA_ENABLE_GIT_ATTRIBUTION
-    delete baseEnv.ORCA_GIT_COMMIT_TRAILER
-    delete baseEnv.ORCA_GH_PR_FOOTER
-    delete baseEnv.ORCA_GH_ISSUE_FOOTER
-    delete baseEnv.ORCA_ATTRIBUTION_SHIM_DIR
-  }
-  applyTerminalAttributionEnv(baseEnv, {
-    enabled: opts.githubAttributionEnabled,
-    userDataPath: opts.userDataPath,
-    shellFamily: resolveAttributionShellFamily({
-      shellPath: opts.shellPath,
-      isWsl: opts.isWsl
-    })
-  })
+  // Why: must run after the prepends above — they re-read PATH from the unscrubbed
+  // process.env when baseEnv carries none, which is the daemon path's normal shape.
+  stripLegacyTerminalShimEnv(baseEnv, process.platform)
 
   return baseEnv
 }
@@ -2482,10 +2543,8 @@ export function registerPtyHandlers(
             skipCodexHomeEnv,
             settings: getSettings?.()
           }),
-          githubAttributionEnabled: getSettings?.()?.enableGitHubAttribution ?? false,
           launchCommand: ctx?.command,
           launchAgent: ctx?.launchAgent,
-          shellPath: ctx?.shellPath,
           isWsl: ctx?.isWsl,
           wslDistro: ctx?.wslDistro ?? null,
           agentStatusHooksEnabled: isAgentStatusHooksEnabled(getSettings?.()),
@@ -3605,6 +3664,23 @@ export function registerPtyHandlers(
     syntheticKillExitPtyIds.set(id, cleanupTimer)
   }
 
+  // Why: a rejected split retires its PTY while kill's shutdown is still in flight; kill's late
+  // synthetic exit must not land afterwards, or an SSH pane's code -1 would re-preserve the
+  // surface the retirement just removed. Timed like the duplicate window so a reused id is free.
+  const retiredRejectedPtyIds = new Map<string, NodeJS.Timeout>()
+
+  function rememberRetiredRejectedPty(id: string): void {
+    const existing = retiredRejectedPtyIds.get(id)
+    if (existing) {
+      clearTimeout(existing)
+    }
+    const cleanupTimer = setTimeout(() => {
+      retiredRejectedPtyIds.delete(id)
+    }, SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS)
+    cleanupTimer.unref?.()
+    retiredRejectedPtyIds.set(id, cleanupTimer)
+  }
+
   function consumeSyntheticKillExit(id: string): boolean {
     const cleanupTimer = syntheticKillExitPtyIds.get(id)
     if (!cleanupTimer) {
@@ -4063,6 +4139,7 @@ export function registerPtyHandlers(
     rows: number
     seq?: number
     lastTitle?: string
+    kittyKeyboardFlags?: number
   } | null
   const pendingSerializeRequests = new Map<
     string,
@@ -4091,6 +4168,7 @@ export function registerPtyHandlers(
           rows?: unknown
           seq?: unknown
           lastTitle?: unknown
+          kittyKeyboardFlags?: unknown
         } | null
       }
     ) => {
@@ -4110,6 +4188,7 @@ export function registerPtyHandlers(
           rows: number
           seq?: number
           lastTitle?: string
+          kittyKeyboardFlags?: number
         } = {
           data: snapshot.data,
           cols: snapshot.cols,
@@ -4121,6 +4200,12 @@ export function registerPtyHandlers(
         if (typeof snapshot.lastTitle === 'string' && snapshot.lastTitle.length > 0) {
           result.lastTitle = snapshot.lastTitle
         }
+        // Why gated on seq: without a boundary the flags cannot be reconciled
+        // against live bytes, so they prove nothing.
+        const kittyKeyboardFlags = parseTerminalKittyKeyboardFlags(snapshot.kittyKeyboardFlags)
+        if (result.seq !== undefined && kittyKeyboardFlags !== undefined) {
+          result.kittyKeyboardFlags = kittyKeyboardFlags
+        }
         settleSerializeRequest(args.requestId, result)
       } else {
         settleSerializeRequest(args.requestId, null)
@@ -4587,6 +4672,7 @@ export function registerPtyHandlers(
         worktreeId: string
         tabId: string
         leafId: string
+        expectedSourceBinding?: PtyBindingSourceExpectation
       } | null = null
       if (shouldPersistHostSessionBinding) {
         if (
@@ -4605,7 +4691,10 @@ export function registerPtyHandlers(
           store,
           worktreeId: args.worktreeId,
           tabId: args.tabId,
-          leafId: args.leafId
+          leafId: args.leafId,
+          ...(args.expectedSourceBinding
+            ? { expectedSourceBinding: args.expectedSourceBinding }
+            : {})
         }
       }
       const sshScopedEnv = stripRemotePaneEnvWhenHooksDisabled(args.connectionId, args.env)
@@ -4698,10 +4787,8 @@ export function registerPtyHandlers(
           selectedCodexHomePath,
           skipCodexHomeEnv,
           stripInheritedOrcaCodexHome,
-          githubAttributionEnabled: getSettings?.()?.enableGitHubAttribution ?? false,
           launchCommand,
           launchAgent: isTuiAgent(args.launchAgent) ? args.launchAgent : undefined,
-          shellPath: daemonShellOverride ?? process.env.COMSPEC,
           isWsl: shouldSkipCodexHomeEnvForWindowsShell(daemonShellOverride, cwd),
           wslDistro: codexSelectionTarget.runtime === 'wsl' ? expectedWslDistro : null,
           agentStatusHooksEnabled: isAgentStatusHooksEnabled(getSettings?.()),
@@ -4747,6 +4834,8 @@ export function registerPtyHandlers(
       spawnOptions.envToDelete = mergePtyEnvDeletions(
         authEnvToDelete,
         args.envToDelete ?? [],
+        // Why: disable old hosts without removing ORCA_REAL_* while their Windows shim remains on PATH.
+        isDaemonHostSpawn || args.connectionId ? LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS : [],
         isDaemonHostSpawn ? getInheritedAgentHookEnvKeysToDelete(env) : [],
         // Why: ungated, unlike the agent-hook keys — the local provider and the relay host also spread their own process.env into every spawn.
         getInheritedClaudeSessionStampEnvKeysToDelete(env)
@@ -4900,6 +4989,15 @@ export function registerPtyHandlers(
       let stablePaneBindingPersisted = false
       let rejectedRegistrationCandidate: PtySpawnResult | null = null
       let pendingRegistrationPtyId: string | null = null
+      // Why hoisted to the reply scope: main reconciles the provider sequence
+      // deep inside the spawn path, but the pane needs that renderer-domain
+      // boundary beside the daemon snapshot's kitty flags.
+      let reconciledSnapshotSeq: number | null = null
+      // False when bytes crossed the data socket during the spawn RPC: the
+      // reconciled boundary covers them, but the daemon proved its kitty flags
+      // before they existed, so the claim must not erase what the pane may
+      // have scanned from those bytes live.
+      let snapshotKittyFlagsCoverReconciledSeq = true
       let preparedProvisionalExecutionContext = false
       let releaseWorktreeSpawn: (() => void) | undefined
       try {
@@ -5050,11 +5148,19 @@ export function registerPtyHandlers(
           // Why: admission precedes sequence/context state and every durable publication below.
           runtime?.assertPtyRegistrationAllowed?.(result.id, result.incarnationId)
           if (result.providerSequence) {
-            runtime?.synchronizePtyOutputSequenceFromProvider?.(
-              result.id,
-              result.providerSequence,
-              sequenceBeforeProviderSpawn
-            )
+            const runtimeSequenceBeforeReconcile = runtime?.getPtyOutputSequence?.(result.id) ?? 0
+            // Why kept: this is the reattach boundary in the RENDERER's sequence
+            // domain, and the daemon snapshot's kitty flags mean nothing without
+            // the boundary they were proven at.
+            reconciledSnapshotSeq =
+              runtime?.synchronizePtyOutputSequenceFromProvider?.(
+                result.id,
+                result.providerSequence,
+                sequenceBeforeProviderSpawn
+              ) ?? null
+            if (runtimeSequenceBeforeReconcile > sequenceBeforeProviderSpawn) {
+              snapshotKittyFlagsCoverReconciledSeq = false
+            }
           }
           ensureWslHookRelayForReattach(result, args.connectionId)
           runtime?.preparePtyExecutionContext?.(
@@ -5127,8 +5233,7 @@ export function registerPtyHandlers(
             owner: stablePaneOwner,
             result,
             worktreeId: hostSessionBinding?.worktreeId,
-            startupCwd: cwd,
-            connectionId: args.connectionId
+            startupCwd: cwd
           })
         } catch (error) {
           if (error instanceof Error && error.message === 'terminal_pane_owner_changed') {
@@ -5196,6 +5301,12 @@ export function registerPtyHandlers(
             ...(typeof args.leafId === 'string' && isTerminalLeafId(args.leafId)
               ? { leafId: args.leafId }
               : {}),
+            // The shell this lease names, as the host just attested it. Without it the record says
+            // only "pty-N", and a replaced relay reissues that from 1 — so reconnect would have
+            // nothing to compare and would attach whatever now answers to the id.
+            ...(isRelayAttestedPtyIncarnationId(result.incarnationId)
+              ? { incarnationId: result.incarnationId }
+              : {}),
             state: 'attached',
             lastAttachedAt: Date.now()
           })
@@ -5219,21 +5330,20 @@ export function registerPtyHandlers(
         })
         if (hostSessionBinding && !stablePaneBindingPersisted) {
           try {
-            const binding = {
+            const bound = bindPaneShell({
+              store: hostSessionBinding.store,
               worktreeId: hostSessionBinding.worktreeId,
               tabId: hostSessionBinding.tabId,
               leafId: hostSessionBinding.leafId,
               ptyId: result.id,
               ...(result.incarnationId ? { incarnationId: result.incarnationId } : {}),
-              ...(cwd ? { startupCwd: cwd } : {})
-            }
-            if (args.connectionId) {
-              hostSessionBinding.store.persistPtyBinding(
-                binding,
-                toSshExecutionHostId(args.connectionId)
-              )
-            } else {
-              hostSessionBinding.store.persistPtyBinding(binding)
+              ...(cwd ? { startupCwd: cwd } : {}),
+              ...(hostSessionBinding.expectedSourceBinding
+                ? { expectedSourceBinding: hostSessionBinding.expectedSourceBinding }
+                : {})
+            })
+            if (bound.bound === false) {
+              throw new Error('terminal_split_source_not_found')
             }
           } catch (err) {
             console.error('[pty] failed to persist runtime PTY binding after spawn:', err)
@@ -5246,6 +5356,9 @@ export function registerPtyHandlers(
               }
               clearProviderPtyState(result.id)
             }
+            if (err instanceof Error && err.message === 'terminal_split_source_not_found') {
+              throw err
+            }
             throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
               agentSessionOperationOutcome: 'unknown' as const
             })
@@ -5356,6 +5469,11 @@ export function registerPtyHandlers(
         }
         resolvePaneSpawnReservation(paneSpawnReservationKey, paneSpawnReservation, {
           ...result,
+          ...(typeof result.snapshotKittyKeyboardFlags === 'number' &&
+          reconciledSnapshotSeq !== null &&
+          snapshotKittyFlagsCoverReconciledSeq
+            ? { snapshotSeq: reconciledSnapshotSeq }
+            : { snapshotKittyKeyboardFlags: undefined }),
           isReattach: true
         })
         return response
@@ -5472,19 +5590,23 @@ export function registerPtyHandlers(
         // Why: controller is synchronous, but keep ownership until async shutdown proves whether the provider emitted an exit.
         void shutdownProviderAndDetectExit(provider, ptyId, { immediate: false })
           .then((providerExitObserved) => {
+            const retired = retiredRejectedPtyIds.has(ptyId)
             const incarnationId = finishPtyShutdown(ptyId, connectionId, store)
-            if (!providerExitObserved) {
+            if (!providerExitObserved && !retired) {
               runtime?.onPtyExit(ptyId, -1, incarnationId)
               rememberSyntheticKillExit(ptyId)
               sendPtyExitToRenderer({ id: ptyId, code: -1 })
             }
           })
           .catch((err) => {
+            const retired = retiredRejectedPtyIds.has(ptyId)
             if (isPtyAlreadyGoneError(err)) {
               const incarnationId = finishPtyShutdown(ptyId, connectionId, store)
-              runtime?.onPtyExit(ptyId, -1, incarnationId)
-              rememberSyntheticKillExit(ptyId)
-              sendPtyExitToRenderer({ id: ptyId, code: -1 })
+              if (!retired) {
+                runtime?.onPtyExit(ptyId, -1, incarnationId)
+                rememberSyntheticKillExit(ptyId)
+                sendPtyExitToRenderer({ id: ptyId, code: -1 })
+              }
               return
             }
             console.warn(
@@ -5492,7 +5614,9 @@ export function registerPtyHandlers(
             )
             // Why: close runtime tails without clearing provider ownership, so
             // a retry can still target a PTY that survived the failed shutdown.
-            runtime?.onPtyExit(ptyId, -1, ptyIncarnationById.get(ptyId))
+            if (!retired) {
+              runtime?.onPtyExit(ptyId, -1, ptyIncarnationById.get(ptyId))
+            }
           })
         return true
       }
@@ -5503,12 +5627,31 @@ export function registerPtyHandlers(
           console.warn(
             `[pty] Failed to stop PTY ${ptyId}: ${err instanceof Error ? err.message : String(err)}`
           )
-          runtime?.onPtyExit(ptyId, -1, ptyIncarnationById.get(ptyId))
+          if (!retiredRejectedPtyIds.has(ptyId)) {
+            runtime?.onPtyExit(ptyId, -1, ptyIncarnationById.get(ptyId))
+          }
         })
         return true
       }
       return killWithCurrentProvider()
     },
+    retireRejectedPty: (ptyId) => {
+      rememberRetiredRejectedPty(ptyId)
+      // Why: a completed stop already cleared provider state, tombstoned the lease and told the
+      // renderer; repeating that double-fires the exit IPC. The runtime still needs code 0 so an
+      // SSH pane retires for good instead of staying preserved by the stop's negative exit.
+      if (!ptyOwnership.has(ptyId)) {
+        runtime?.onPtyExit(ptyId, 0, ptyIncarnationById.get(ptyId))
+        return
+      }
+      let connectionId: string | null | undefined = ptyOwnership.get(ptyId)
+      const parsedSshId = connectionId === undefined ? parseAppSshPtyId(ptyId) : null
+      connectionId ??= parsedSshId?.connectionId
+      const incarnationId = finishPtyShutdown(ptyId, connectionId, store)
+      runtime?.onPtyExit(ptyId, 0, incarnationId)
+      rememberSyntheticKillExit(ptyId)
+      sendPtyExitToRenderer({ id: ptyId, code: 0 })
+    },
     markReversibleStops: (ptyIds) => {
       for (const ptyId of ptyIds) {
         reversibleStopOwnersByPtyId.set(ptyId, (reversibleStopOwnersByPtyId.get(ptyId) ?? 0) + 1)
@@ -5732,6 +5875,7 @@ export function registerPtyHandlers(
       alternateScreen?: boolean
       scrollbackAnsi?: string
       pendingEscapeTailAnsi?: string
+      kittyKeyboardFlags?: number
     } | null> => {
       if (!runtime || typeof args?.id !== 'string' || args.id.length === 0) {
         return null
@@ -5802,6 +5946,8 @@ export function registerPtyHandlers(
         cwd?: string
         // Why: fresh local spawns opt into recovering a saved cwd whose dir was deleted (#7239); reattach/remote need exact cwd, so the flag alone isn't sufficient.
         cwdFallback?: 'worktree'
+        /** Create a shell for this pane rather than adopting the one it records. */
+        createFreshShellForUnreachablePane?: boolean
         env?: Record<string, string>
         envToDelete?: string[]
         command?: string
@@ -5901,8 +6047,14 @@ export function registerPtyHandlers(
       if (existingPaneSpawn) {
         return { ...(await existingPaneSpawn.promise), isReattach: true }
       }
+      // Why the caller may refuse adoption: the unreachable-pane card offers "Start a new terminal"
+      // for a pane whose recorded shell cannot be reached. Resolving an owner here makes the action
+      // attach that shell first — and when it is unreachable the attach fails, the action creates
+      // nothing, and the card comes back. The button is dead in the one state it is offered in.
+      // Skipping the resolve is what makes it a creation: nothing is killed, and the old shell is
+      // left alive and unbound for the cleanup surface.
       const earlyStablePaneOwner =
-        earlyPaneKey && args.worktreeId
+        earlyPaneKey && args.worktreeId && args.createFreshShellForUnreachablePane !== true
           ? resolveStablePaneOwner(runtime, store, earlyPaneKey, args.worktreeId, args.connectionId)
           : null
       const earlyWorktreeId = args.worktreeId
@@ -5917,6 +6069,15 @@ export function registerPtyHandlers(
       let stablePaneBindingPersisted = false
       let rejectedRegistrationCandidate: PtySpawnResult | null = null
       let pendingRegistrationPtyId: string | null = null
+      // Why hoisted to the reply scope: main reconciles the provider sequence
+      // deep inside the spawn path, but the pane needs that renderer-domain
+      // boundary beside the daemon snapshot's kitty flags.
+      let reconciledSnapshotSeq: number | null = null
+      // False when bytes crossed the data socket during the spawn RPC: the
+      // reconciled boundary covers them, but the daemon proved its kitty flags
+      // before they existed, so the claim must not erase what the pane may
+      // have scanned from those bytes live.
+      let snapshotKittyFlagsCoverReconciledSeq = true
       let preparedProvisionalExecutionContext = false
       let releaseWorktreeSpawn: (() => void) | undefined
       try {
@@ -6174,9 +6335,7 @@ export function registerPtyHandlers(
         const requestedAgentTeamsPath = baseEnv?.ORCA_AGENT_TEAMS_TEAM_ID
           ? baseEnv[resolvePathEnvKey(baseEnv, process.platform)]
           : undefined
-        const agentTeamsEnvToDelete = shouldRefreshAgentTeamsEnv
-          ? ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
-          : undefined
+        const agentTeamsEnvToDelete = shouldRefreshAgentTeamsEnv ? ['TERM_PROGRAM'] : undefined
         if (baseEnv && stablePaneKey) {
           baseEnv.ORCA_PANE_KEY = stablePaneKey
           if (typeof args.tabId === 'string') {
@@ -6315,10 +6474,8 @@ export function registerPtyHandlers(
               selectedCodexHomePath,
               skipCodexHomeEnv,
               stripInheritedOrcaCodexHome,
-              githubAttributionEnabled: getSettings?.()?.enableGitHubAttribution ?? false,
               launchCommand,
               launchAgent: isTuiAgent(args.launchAgent) ? args.launchAgent : undefined,
-              shellPath: effectiveShellOverride ?? process.env.COMSPEC,
               isWsl: shouldSkipCodexHomeEnvForWindowsShell(effectiveShellOverride, cwd),
               wslDistro: codexSelectionTarget.runtime === 'wsl' ? expectedWslDistro : null,
               agentStatusHooksEnabled: isAgentStatusHooksEnabled(getSettings?.()),
@@ -6351,6 +6508,8 @@ export function registerPtyHandlers(
           envToDelete,
           args.envToDelete ?? [],
           agentTeamsEnvToDelete ?? [],
+          // Why: disable old hosts without removing ORCA_REAL_* while their Windows shim remains on PATH.
+          isDaemonHostSpawn || args.connectionId ? LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS : [],
           isDaemonHostSpawn ? getInheritedAgentHookEnvKeysToDelete(spawnEnv) : [],
           getInheritedClaudeSessionStampEnvKeysToDelete(spawnEnv),
           skipCodexHomeEnv ? CODEX_HOME_ENV_KEYS : [],
@@ -6505,6 +6664,7 @@ export function registerPtyHandlers(
                 provider,
                 spawnOptions,
                 owner: stablePaneOwnerCandidate,
+                refuseAdoption: args.createFreshShellForUnreachablePane === true,
                 worktreeId: args.worktreeId,
                 connectionId: args.connectionId,
                 resolveOwner: () =>
@@ -6537,11 +6697,19 @@ export function registerPtyHandlers(
           assertSpawnReplyWasLive(result)
           runtime?.assertPtyRegistrationAllowed?.(result.id, result.incarnationId)
           if (result.providerSequence) {
-            runtime?.synchronizePtyOutputSequenceFromProvider?.(
-              result.id,
-              result.providerSequence,
-              sequenceBeforeProviderSpawn
-            )
+            const runtimeSequenceBeforeReconcile = runtime?.getPtyOutputSequence?.(result.id) ?? 0
+            // Why kept: this is the reattach boundary in the RENDERER's sequence
+            // domain, and the daemon snapshot's kitty flags mean nothing without
+            // the boundary they were proven at.
+            reconciledSnapshotSeq =
+              runtime?.synchronizePtyOutputSequenceFromProvider?.(
+                result.id,
+                result.providerSequence,
+                sequenceBeforeProviderSpawn
+              ) ?? null
+            if (runtimeSequenceBeforeReconcile > sequenceBeforeProviderSpawn) {
+              snapshotKittyFlagsCoverReconciledSeq = false
+            }
           }
           ensureWslHookRelayForReattach(result, args.connectionId)
           runtime?.preparePtyExecutionContext?.(
@@ -6636,8 +6804,7 @@ export function registerPtyHandlers(
             owner: stablePaneOwner,
             result,
             worktreeId: args.worktreeId,
-            startupCwd: cwd,
-            connectionId: args.connectionId
+            startupCwd: cwd
           })
         } catch (error) {
           if (error instanceof Error && error.message === 'terminal_pane_owner_changed') {
@@ -6690,6 +6857,11 @@ export function registerPtyHandlers(
             ...(typeof args.worktreeId === 'string' ? { worktreeId: args.worktreeId } : {}),
             ...(typeof args.tabId === 'string' ? { tabId: args.tabId } : {}),
             ...(validatedLeafId ? { leafId: validatedLeafId } : {}),
+            // See the sibling writer: a lease that names only "pty-N" cannot survive a relay that
+            // reissues ids from 1.
+            ...(isRelayAttestedPtyIncarnationId(result.incarnationId)
+              ? { incarnationId: result.incarnationId }
+              : {}),
             state: 'attached',
             lastAttachedAt: Date.now()
           })
@@ -6710,19 +6882,15 @@ export function registerPtyHandlers(
           !stablePaneBindingPersisted
         ) {
           try {
-            const binding = {
+            bindPaneShell({
+              store,
               worktreeId: args.worktreeId,
               tabId: args.tabId,
               leafId: validatedLeafId,
               ptyId: result.id,
               ...(result.incarnationId ? { incarnationId: result.incarnationId } : {}),
               ...(cwd ? { startupCwd: cwd } : {})
-            }
-            if (args.connectionId) {
-              store.persistPtyBinding(binding, toSshExecutionHostId(args.connectionId))
-            } else {
-              store.persistPtyBinding(binding)
-            }
+            })
           } catch (err) {
             console.error('[pty] failed to persist PTY binding after spawn:', err)
             if (!result.isReattach) {
@@ -6917,6 +7085,13 @@ export function registerPtyHandlers(
         }
         const response = {
           ...result,
+          // Why both or neither: a pane can only adopt proven kitty flags together
+          // with the sequence boundary they describe.
+          ...(typeof result.snapshotKittyKeyboardFlags === 'number' &&
+          reconciledSnapshotSeq !== null &&
+          snapshotKittyFlagsCoverReconciledSeq
+            ? { snapshotSeq: reconciledSnapshotSeq }
+            : { snapshotKittyKeyboardFlags: undefined }),
           ...(!result.isReattach && effectiveLaunchConfig
             ? { launchConfig: effectiveLaunchConfig }
             : {}),
@@ -6984,11 +7159,20 @@ export function registerPtyHandlers(
     mainWindow.webContents.send('pty:writeUnavailable', { id })
   }
 
+  type PtyWriteFence = { incarnationId: string | undefined }
+
+  const isCurrentPtyWrite = (id: string, fence: PtyWriteFence): boolean =>
+    !isSupersededPtyId(id) && ptyIncarnationById.get(id) === fence.incarnationId
+
   const writePtyProviderInputWithinLimit = (
     provider: IPtyProvider,
     id: string,
-    data: string
+    data: string,
+    fence: PtyWriteFence
   ): boolean | Promise<boolean> => {
+    if (!isCurrentPtyWrite(id, fence)) {
+      return false
+    }
     const chunks = iterateTerminalInputChunks(data)
     const first = chunks.next()
     if (first.done) {
@@ -7000,21 +7184,24 @@ export function registerPtyHandlers(
       provider.write(id, first.value)
       return true
     }
-    return writePtyProviderInputChunks(provider, id, chunks, first.value, second.value)
+    return writePtyProviderInputChunks(provider, id, chunks, first.value, second.value, fence)
   }
 
   const writePtyProviderInput = (
     provider: IPtyProvider,
     id: string,
-    data: string
+    data: string,
+    fence: PtyWriteFence
   ): boolean | Promise<boolean> => {
     try {
       const tooLarge = isTerminalInputTooLargeWithDeferredMeasurement(data)
       if (typeof tooLarge === 'boolean') {
-        return tooLarge ? false : writePtyProviderInputWithinLimit(provider, id, data)
+        return tooLarge ? false : writePtyProviderInputWithinLimit(provider, id, data, fence)
       }
       return tooLarge
-        .then((result) => (result ? false : writePtyProviderInputWithinLimit(provider, id, data)))
+        .then((result) =>
+          result ? false : writePtyProviderInputWithinLimit(provider, id, data, fence)
+        )
         .catch((error) => {
           reportUnavailablePtyWrite(id, error)
           return false
@@ -7030,12 +7217,16 @@ export function registerPtyHandlers(
     id: string,
     chunks: Iterator<string>,
     firstChunk: string,
-    secondChunk: string
+    secondChunk: string,
+    fence: PtyWriteFence
   ): Promise<boolean> => {
     try {
       let chunk: IteratorResult<string> = { done: false, value: firstChunk }
       let nextChunk: IteratorResult<string> = { done: false, value: secondChunk }
       while (!chunk.done) {
+        if (!isCurrentPtyWrite(id, fence)) {
+          return false
+        }
         provider.write(id, chunk.value)
         if (!nextChunk.done) {
           await new Promise((resolve) => setTimeout(resolve, 0))
@@ -7080,11 +7271,17 @@ export function registerPtyHandlers(
     !mainWindow.isDestroyed() &&
     !(typeof mainWebContents.isDestroyed === 'function' && mainWebContents.isDestroyed())
 
-  const writePtyInput = (args: PtyWritePayload): boolean | Promise<boolean> => {
+  const writePtyInput = (
+    args: PtyWritePayload,
+    fence: PtyWriteFence
+  ): boolean | Promise<boolean> => {
     // Why: mobile-presence-lock defense-in-depth — the renderer's onData guard can let one keystroke slip during the state-flip lag, so catch it server-side. See docs/mobile-presence-lock.md.
     if (runtime?.getDriver(args.id).kind === 'mobile') {
       return false
     }
+    if (!isCurrentPtyWrite(args.id, fence)) {
+      return false
+    }
     const provider = ptyOwnership.has(args.id) ? tryGetProviderForPty(args.id) : undefined
     if (!provider) {
       return false
@@ -7096,16 +7293,22 @@ export function registerPtyHandlers(
       if (visibleRendererPtys.has(args.id)) {
         clearHiddenRendererResizeOutput(args.id)
       }
-      return writePtyProviderInput(provider, args.id, args.data)
+      return writePtyProviderInput(provider, args.id, args.data, fence)
     } catch {
       return false
     }
   }
 
-  const writePtyInputAccepted = (args: PtyWritePayload): boolean | Promise<boolean> => {
+  const writePtyInputAccepted = (
+    args: PtyWritePayload,
+    fence: PtyWriteFence
+  ): boolean | Promise<boolean> => {
     if (runtime?.getDriver(args.id).kind === 'mobile') {
       return false
     }
+    if (!isCurrentPtyWrite(args.id, fence)) {
+      return false
+    }
     // Why: the ack infers Ctrl+C/Escape reached the local PTY; SSH providers are fire-and-forget relay notifications and can't truthfully acknowledge yet.
     if (ptyOwnership.get(args.id) !== null) {
       return false
@@ -7121,7 +7324,7 @@ export function registerPtyHandlers(
       if (visibleRendererPtys.has(args.id)) {
         clearHiddenRendererResizeOutput(args.id)
       }
-      return writePtyProviderInput(provider, args.id, args.data)
+      return writePtyProviderInput(provider, args.id, args.data, fence)
     } catch {
       return false
     }
@@ -7133,21 +7336,31 @@ export function registerPtyHandlers(
     if (!isPtyWriteEventFromMainWindow(event, mainWindow.webContents) || !isPtyWritePayload(args)) {
       return
     }
-    const claimTail = hostViewportClaimTails.get(args.id)
-    if (claimTail) {
-      void claimTail.then((claimed) => (claimed ? writePtyInput(args) : false))
+    // Why here and not in the renderer: input queued before a reattach would
+    // otherwise land on whatever PTY now holds the pane.
+    const fence: PtyWriteFence = { incarnationId: ptyIncarnationById.get(args.id) }
+    if (!isCurrentPtyWrite(args.id, fence)) {
       return
     }
-    writePtyInput(args)
+    const claimTail = hostViewportClaimTails.get(args.id)
+    if (claimTail) {
+      void claimTail.then((claimed) => (claimed ? writePtyInput(args, fence) : false))
+      return
+    }
+    writePtyInput(args, fence)
   })
   ipcMain.handle('pty:writeAccepted', (event, args: unknown): boolean | Promise<boolean> => {
     if (!isPtyWriteEventFromMainWindow(event, mainWindow.webContents) || !isPtyWritePayload(args)) {
       return false
     }
+    const fence: PtyWriteFence = { incarnationId: ptyIncarnationById.get(args.id) }
+    if (!isCurrentPtyWrite(args.id, fence)) {
+      return false
+    }
     const claimTail = hostViewportClaimTails.get(args.id)
     return claimTail
-      ? claimTail.then((claimed) => (claimed ? writePtyInputAccepted(args) : false))
-      : writePtyInputAccepted(args)
+      ? claimTail.then((claimed) => (claimed ? writePtyInputAccepted(args, fence) : false))
+      : writePtyInputAccepted(args, fence)
   })
 
   ipcMain.removeAllListeners('pty:claimViewport')
@@ -7180,6 +7393,10 @@ export function registerPtyHandlers(
   // Why: resize is fire-and-forget — ipcMain.on (not .handle) halves IPC traffic by skipping the empty acknowledgement reply.
   ipcMain.removeAllListeners('pty:resize')
   ipcMain.on('pty:resize', (_event, args: { id: string; cols: number; rows: number }) => {
+    // Why: a resize for a pane that has rebound would reshape the successor's shell.
+    if (isSupersededPtyId(args.id)) {
+      return
+    }
     // Why: after a desktop-fit override change the renderer's safeFit cascade re-measures ALL panes (background ones at full width), so suppress every pty:resize in this window to avoid corrupting PTY dimensions.
     if (runtime?.isResizeSuppressed()) {
       return
@@ -7444,6 +7661,12 @@ export function registerPtyHandlers(
 
   ipcMain.removeAllListeners('pty:signal')
   ipcMain.on('pty:signal', (_event, args: { id: string; signal: string }) => {
+    // Why fenced but pty:kill is not: a signal means "interrupt MY pane", so a
+    // superseded id is a misdirected interrupt. A kill on a superseded id is the
+    // opposite — that PTY is now orphaned and reclaiming it is the point.
+    if (isSupersededPtyId(args.id)) {
+      return
+    }
     // Routing refuses a session whose host is unreachable, but sendSignal is async everywhere,
     // so that refusal arrives as a rejection rather than a throw — and optional chaining
     // short-circuits the whole chain when there is no provider at all.
@@ -7599,6 +7822,9 @@ export function registerPtyHandlers(
     }
     const ownedConnectionId = ptyOwnership.get(args.id)
     const parsedSshId = ownedConnectionId === undefined ? parseAppSshPtyId(args.id) : null
+    // Why: before the cold-start daemon swap lands, the pre-swap local provider owns no
+    // daemon id and would answer an authoritative false for every restored session.
+    await getLocalPtyProviderStartupPromise(ownedConnectionId ?? parsedSshId?.connectionId)
     const provider = parsedSshId
       ? sshProviders.get(parsedSshId.connectionId)
       : tryGetProviderForPty(args.id)
diff --git a/src/main/ipc/repos-remote.test.ts b/src/main/ipc/repos-remote.test.ts
index d3440ed4579..bbd639eac32 100644
--- a/src/main/ipc/repos-remote.test.ts
+++ b/src/main/ipc/repos-remote.test.ts
@@ -2167,6 +2167,28 @@ describe('repos:add + repos:clone', () => {
     expect(invalidateAuthorizedRootsCacheMock).toHaveBeenCalled()
   })
 
+  it('persists agent worktree visibility through local repos:update', () => {
+    const updated = {
+      id: 'repo-agent-visibility',
+      path: '/tmp/repo-agent-visibility',
+      displayName: 'repo-agent-visibility',
+      kind: 'git',
+      badgeColor: '#22c55e',
+      agentWorktreeVisibility: 'show'
+    }
+    mockStore.updateRepo.mockReturnValue(updated)
+
+    const result = handlers.get('repos:update')!(null, {
+      repoId: updated.id,
+      updates: { agentWorktreeVisibility: 'show' }
+    })
+
+    expect(result).toBe(updated)
+    expect(mockStore.updateRepo).toHaveBeenCalledWith(updated.id, {
+      agentWorktreeVisibility: 'show'
+    })
+  })
+
   it('prepares and invalidates roots when project host setup update changes worktree base path', () => {
     const repo = {
       id: 'repo-setup-update-root',
diff --git a/src/main/ipc/repos.ts b/src/main/ipc/repos.ts
index 558ed1d5a22..b1500963f27 100644
--- a/src/main/ipc/repos.ts
+++ b/src/main/ipc/repos.ts
@@ -41,6 +41,7 @@ import { isTuiAgent } from '../../shared/tui-agent-config'
 import { TaskSourceContextSchema } from '../../shared/task-source-context-schema'
 import { WorkspaceLinkedItemSchema } from '../../shared/workspace-linked-item-schema'
 import { isWorkspaceLinkedItemSourceContextMatch } from '../../shared/workspace-linked-item-source-context'
+import { DiffCommentSchema } from '../../shared/diff-comment-schema'
 import { invalidateAuthorizedRootsCache } from './filesystem-auth'
 import type { ChildProcess } from 'node:child_process'
 import { access, mkdir, readdir, rm } from 'node:fs/promises'
@@ -951,7 +952,8 @@ const FolderWorkspaceUpdateArgs = z.object({
       createdWithAgent: z.string().refine(isTuiAgent).optional(),
       pendingFirstAgentMessageRename: z.boolean().optional(),
       firstAgentMessageRenameError: z.string().nullable().optional(),
-      lastActivityAt: z.number().finite().optional()
+      lastActivityAt: z.number().finite().optional(),
+      diffComments: z.array(DiffCommentSchema).optional()
     })
     .superRefine(assertFolderWorkspaceLinkedSourceContextMatch)
 })
@@ -2124,6 +2126,7 @@ export function registerRepoHandlers(mainWindow: BrowserWindow, store: Store): v
             | 'externalWorktreeVisibilityPromptDismissedAt'
             | 'externalWorktreeInboxBaselinePaths'
             | 'importedExternalWorktreePaths'
+            | 'agentWorktreeVisibility'
             | 'projectGroupId'
             | 'projectGroupOrder'
           >
@@ -2194,6 +2197,14 @@ export function registerRepoHandlers(mainWindow: BrowserWindow, store: Store): v
       ) {
         delete updates.externalWorktreeVisibility
       }
+      if (
+        'agentWorktreeVisibility' in updates &&
+        updates.agentWorktreeVisibility !== undefined &&
+        updates.agentWorktreeVisibility !== 'hide' &&
+        updates.agentWorktreeVisibility !== 'show'
+      ) {
+        delete updates.agentWorktreeVisibility
+      }
       if (
         'externalWorktreeVisibilityPromptDismissedAt' in updates &&
         updates.externalWorktreeVisibilityPromptDismissedAt !== undefined &&
diff --git a/src/main/ipc/runtime-environment-connectivity-handlers.ts b/src/main/ipc/runtime-environment-connectivity-handlers.ts
index 9d3732f886b..2c4d1462540 100644
--- a/src/main/ipc/runtime-environment-connectivity-handlers.ts
+++ b/src/main/ipc/runtime-environment-connectivity-handlers.ts
@@ -183,6 +183,7 @@ function registerPassiveCallHandler(getUserDataPath: () => string): void {
         params?: unknown
         timeoutMs?: number
         expectedEnvironmentPairingRevision?: number
+        expectedRuntimeId?: string
       }
     ): Promise<RuntimeRpcResponse<unknown>> => {
       const environment = resolveEnvironment(getUserDataPath(), args.selector)
@@ -197,7 +198,8 @@ function registerPassiveCallHandler(getUserDataPath: () => string): void {
           args.method,
           args.params,
           args.timeoutMs,
-          args.expectedEnvironmentPairingRevision
+          args.expectedEnvironmentPairingRevision,
+          args.expectedRuntimeId ? { expectedRuntimeId: args.expectedRuntimeId } : undefined
         )
       } catch (error) {
         const failure = runtimeEnvironmentCallFailure(environment, args.method, error)
diff --git a/src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts b/src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts
index 4543c3c9b34..2e6893ba4ea 100644
--- a/src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts
+++ b/src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts
@@ -1,15 +1,56 @@
 import { readFileSync } from 'node:fs'
 import { performance } from 'node:perf_hooks'
 import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { sendRemoteRuntimeRequest } from '../../shared/remote-runtime-client'
 import { RemoteRuntimeSharedControlConnection } from '../../shared/remote-runtime-shared-control-connection'
 import { RuntimeEnvironmentStoreSchema } from '../../shared/runtime-environments'
 
-const runLiveBenchmark = process.env.ORCA_FEDERATED_READ_BENCH === '1'
+const runLiveBenchmark = isFederatedReadBenchmarkEnabled(process.env.ORCA_FEDERATED_READ_BENCH)
 
 it('interpolates even-sized benchmark samples', () => expect(percentile([1, 3], 0.5)).toBe(2))
 
+it.each([
+  ['1', true],
+  ['true', false],
+  [undefined, false]
+])('enables the live benchmark only for %s', (value, enabled) => {
+  expect(isFederatedReadBenchmarkEnabled(value)).toBe(enabled)
+})
+
+it('closes the retained connection after a measured request rejects', async () => {
+  let requestCount = 0
+  const fixture = createSharedControlFixture(async () => {
+    requestCount += 1
+    if (requestCount === 4) {
+      throw new Error('injected measured request failure')
+    }
+    return { ok: true }
+  })
+
+  await expect(measureSharedControlRequests(fixture.connection, {}, 1)).rejects.toThrow(
+    'injected measured request failure'
+  )
+
+  expect(requestCount).toBe(4)
+  expect.soft(fixture.close).toHaveBeenCalledOnce()
+  expect.soft(fixture.socketClose).toHaveBeenCalledOnce()
+  expect(fixture.retainedHandleCount()).toBe(0)
+})
+
+it('closes the retained connection after successful measurements', async () => {
+  const fixture = createSharedControlFixture(async () => ({ ok: true }))
+
+  await expect(measureSharedControlRequests(fixture.connection, {}, 1)).resolves.toMatchObject({
+    sharedControl: { count: 1 },
+    diagnostics: { state: 'ready', pendingRequestCount: 0 }
+  })
+
+  expect(fixture.close).toHaveBeenCalledOnce()
+  expect(fixture.socketClose).toHaveBeenCalledOnce()
+  expect(fixture.retainedHandleCount()).toBe(0)
+})
+
 describe.runIf(runLiveBenchmark)('federated read RPC transport benchmark', () => {
   it('compares one-shot and shared-control latency on one saved runtime', async () => {
     const userDataPath = process.env.ORCA_RUNTIME_USER_DATA_PATH
@@ -49,19 +90,36 @@ describe.runIf(runLiveBenchmark)('federated read RPC transport benchmark', () =>
     const shared = new RemoteRuntimeSharedControlConnection(pairing, {
       environmentId: environment.id
     })
-    const sharedControl = await measureRequests(() =>
-      shared.request('orchestration.federationPull', params, 15_000, {
-        orchestrationContractVersion: 1
-      })
-    )
-    const diagnostics = shared.getDiagnostics()
-    shared.close()
+    const { sharedControl, diagnostics } = await measureSharedControlRequests(shared, params)
 
     expect(diagnostics).toMatchObject({ state: 'ready', pendingRequestCount: 0 })
     process.stdout.write(`${JSON.stringify({ oneShot, sharedControl }, null, 2)}\n`)
   }, 120_000)
 })
 
+async function measureSharedControlRequests(
+  shared: RemoteRuntimeSharedControlConnection,
+  params: unknown,
+  count = 30
+): Promise<{
+  sharedControl: Awaited<ReturnType<typeof measureRequests>>
+  diagnostics: ReturnType<RemoteRuntimeSharedControlConnection['getDiagnostics']>
+}> {
+  try {
+    const sharedControl = await measureRequests(
+      () =>
+        shared.request('orchestration.federationPull', params, 15_000, {
+          orchestrationContractVersion: 1
+        }),
+      count
+    )
+    const diagnostics = shared.getDiagnostics()
+    return { sharedControl, diagnostics }
+  } finally {
+    shared.close()
+  }
+}
+
 async function measureRequests(
   request: () => Promise<{ ok: boolean; error?: { code: string } }>,
   count = 30
@@ -114,3 +172,36 @@ function percentile(sorted: number[], fraction: number): number {
 function round(value: number): number {
   return Math.round(value * 100) / 100
 }
+
+function isFederatedReadBenchmarkEnabled(value: string | undefined): boolean {
+  return value === '1'
+}
+
+function createSharedControlFixture(
+  request: () => Promise<{ ok: boolean; error?: { code: string } }>
+): {
+  connection: RemoteRuntimeSharedControlConnection
+  close: ReturnType<typeof vi.fn>
+  socketClose: ReturnType<typeof vi.fn>
+  retainedHandleCount: () => number
+} {
+  const connection = new RemoteRuntimeSharedControlConnection({
+    v: 2,
+    endpoint: 'ws://127.0.0.1:1',
+    deviceToken: 'token',
+    publicKeyB64: Buffer.from(new Uint8Array(32).fill(1)).toString('base64')
+  })
+  const socketClose = vi.fn()
+  const unsafe = connection as unknown as {
+    state: string
+    ws: { readyState: number; close: () => void } | null
+    sharedKey: Uint8Array | null
+    request: typeof request
+  }
+  unsafe.state = 'ready'
+  unsafe.ws = { readyState: 1, close: socketClose }
+  unsafe.sharedKey = new Uint8Array(32).fill(2)
+  unsafe.request = vi.fn(request)
+  const close = vi.spyOn(connection, 'close')
+  return { connection, close, socketClose, retainedHandleCount: () => (unsafe.ws ? 1 : 0) }
+}
diff --git a/src/main/ipc/runtime-environment-request-connections.ts b/src/main/ipc/runtime-environment-request-connections.ts
index 58fb95dd6e1..c9782d61772 100644
--- a/src/main/ipc/runtime-environment-request-connections.ts
+++ b/src/main/ipc/runtime-environment-request-connections.ts
@@ -77,13 +77,15 @@ export function subscribeRemoteRuntimeSharedControlRequest<TResult>(
     onBinary?: (bytes: Uint8Array<ArrayBufferLike>) => void
     onError: (error: { code: string; message: string }) => void
     onClose?: () => void
-  }
+  },
+  envelope?: RuntimeOrchestrationEnvelope
 ): Promise<RemoteRuntimeSharedSubscription> {
   return getSharedControlConnection(environmentId, pairing).subscribe(
     method,
     params,
     timeoutMs,
-    callbacks
+    callbacks,
+    envelope?.expectedRuntimeId
   )
 }
 
diff --git a/src/main/ipc/runtime-environment-transport-routing.ts b/src/main/ipc/runtime-environment-transport-routing.ts
index 884b0b2874a..0792a1ea009 100644
--- a/src/main/ipc/runtime-environment-transport-routing.ts
+++ b/src/main/ipc/runtime-environment-transport-routing.ts
@@ -193,11 +193,14 @@ export async function subscribeRuntimeEnvironment(
         | { type: 'close' }
     ) => void
     onClose: () => void
-  }
+  },
+  expectedRuntimeId?: string
 ): Promise<RemoteRuntimeSubscription> {
   const environment = resolveEnvironment(userDataPath, selector)
   const pairing = getPreferredPairingOffer(environment)
   const effectiveTimeoutMs = timeoutMs ?? DEFAULT_REMOTE_RUNTIME_TIMEOUT_MS
+  const envelope: RuntimeOrchestrationEnvelope | undefined =
+    expectedRuntimeId === undefined ? undefined : { expectedRuntimeId }
   let markedUsed = false
   const markUsedOnce = (runtimeId: string): void => {
     if (markedUsed) {
@@ -240,7 +243,8 @@ export async function subscribeRuntimeEnvironment(
         method,
         params,
         effectiveTimeoutMs,
-        callbacksWithMarkUsed
+        callbacksWithMarkUsed,
+        envelope
       )
     }
     return await subscribeRemoteRuntimeRequest(
@@ -248,7 +252,9 @@ export async function subscribeRuntimeEnvironment(
       method,
       params,
       effectiveTimeoutMs,
-      callbacksWithMarkUsed
+      callbacksWithMarkUsed,
+      undefined,
+      envelope
     )
   } catch (error) {
     if (error instanceof Error) {
diff --git a/src/main/ipc/runtime-environments.test.ts b/src/main/ipc/runtime-environments.test.ts
index 9ca8da98600..b351b88681a 100644
--- a/src/main/ipc/runtime-environments.test.ts
+++ b/src/main/ipc/runtime-environments.test.ts
@@ -1094,7 +1094,13 @@ describe('registerRuntimeEnvironmentHandlers', () => {
     await add(null, { name: 'desk', pairingCode: pairingCode() })
 
     const subscribe = handler<
-      { selector: string; method: string; params?: unknown; subscriptionId?: string },
+      {
+        selector: string
+        method: string
+        params?: unknown
+        subscriptionId?: string
+        expectedRuntimeId?: string
+      },
       { subscriptionId: string; requestId: string }
     >('runtimeEnvironments:subscribe')
     await subscribe(
@@ -1107,7 +1113,12 @@ describe('registerRuntimeEnvironmentHandlers', () => {
           removeListener: vi.fn()
         }
       },
-      { selector: 'desk', method: 'browser.screencast', params: { pageId: 'page-1' } }
+      {
+        selector: 'desk',
+        method: 'browser.screencast',
+        params: { pageId: 'page-1' },
+        expectedRuntimeId: 'runtime-1'
+      }
     )
     await subscribe(
       {
@@ -1127,14 +1138,18 @@ describe('registerRuntimeEnvironmentHandlers', () => {
       'browser.screencast',
       { pageId: 'page-1' },
       15_000,
-      expect.any(Object)
+      expect.any(Object),
+      undefined,
+      { expectedRuntimeId: 'runtime-1' }
     )
     expect(subscribeRemoteRuntimeRequestMock).toHaveBeenCalledWith(
       expect.any(Object),
       'terminal.multiplex',
       { client: { id: 'client-1' } },
       15_000,
-      expect.any(Object)
+      expect.any(Object),
+      undefined,
+      undefined
     )
     expect(subscribeRemoteRuntimeSharedControlRequestMock).not.toHaveBeenCalled()
   })
@@ -1163,7 +1178,13 @@ describe('registerRuntimeEnvironmentHandlers', () => {
     await add(null, { name: 'desk', pairingCode: pairingCode() })
 
     const subscribe = handler<
-      { selector: string; method: string; params?: unknown; subscriptionId?: string },
+      {
+        selector: string
+        method: string
+        params?: unknown
+        subscriptionId?: string
+        expectedRuntimeId?: string
+      },
       { subscriptionId: string; requestId: string }
     >('runtimeEnvironments:subscribe')
     await expect(
@@ -1177,7 +1198,11 @@ describe('registerRuntimeEnvironmentHandlers', () => {
             removeListener: vi.fn()
           }
         },
-        { selector: 'desk', method: 'session.tabs.subscribeAll' }
+        {
+          selector: 'desk',
+          method: 'session.tabs.subscribeAll',
+          expectedRuntimeId: 'runtime-1'
+        }
       )
     ).resolves.toMatchObject({ requestId: 'tabs-shared' })
 
@@ -1187,7 +1212,8 @@ describe('registerRuntimeEnvironmentHandlers', () => {
       'session.tabs.subscribeAll',
       undefined,
       15_000,
-      expect.any(Object)
+      expect.any(Object),
+      { expectedRuntimeId: 'runtime-1' }
     )
     expect(subscribeRemoteRuntimeRequestMock).not.toHaveBeenCalled()
   })
@@ -1315,7 +1341,9 @@ describe('registerRuntimeEnvironmentHandlers', () => {
       'session.tabs.subscribeAll',
       undefined,
       15_000,
-      expect.any(Object)
+      expect.any(Object),
+      undefined,
+      undefined
     )
     expect(subscribeRemoteRuntimeSharedControlRequestMock).not.toHaveBeenCalled()
   })
@@ -1659,7 +1687,9 @@ describe('registerRuntimeEnvironmentHandlers', () => {
       'terminal.subscribe',
       { terminal: 't1' },
       25,
-      expect.any(Object)
+      expect.any(Object),
+      undefined,
+      undefined
     )
     expect(sent).toEqual([
       expect.objectContaining({ subscriptionId: result.subscriptionId, type: 'response' }),
diff --git a/src/main/ipc/runtime-environments.ts b/src/main/ipc/runtime-environments.ts
index e31f8569dec..3ddf4e2aa6c 100644
--- a/src/main/ipc/runtime-environments.ts
+++ b/src/main/ipc/runtime-environments.ts
@@ -90,6 +90,7 @@ export function registerRuntimeEnvironmentHandlers(store: Store): void {
         timeoutMs?: number
         subscriptionId?: string
         expectedEnvironmentPairingRevision?: number
+        expectedRuntimeId?: string
       }
     ): Promise<{ subscriptionId: string; requestId: string }> => {
       const subscriptionId =
@@ -180,7 +181,8 @@ export function registerRuntimeEnvironmentHandlers(store: Store): void {
               retained?.removeDestroyedListener()
               remoteRuntimeSubscriptions.delete(subscriptionId)
             }
-          }
+          },
+          args.expectedRuntimeId
         )
       } catch (error) {
         removeDestroyedListener()
diff --git a/src/main/ipc/runtime-watcher-quarantine-queue.ts b/src/main/ipc/runtime-watcher-quarantine-queue.ts
index e326b299943..bc2b4cf5fd4 100644
--- a/src/main/ipc/runtime-watcher-quarantine-queue.ts
+++ b/src/main/ipc/runtime-watcher-quarantine-queue.ts
@@ -33,7 +33,7 @@ export class RuntimeWatcherQuarantineQueue<T> {
         }
         settled = true
         const index = this.waiters.indexOf(waiter)
-        if (index >= 0) {
+        if (index !== -1) {
           this.waiters.splice(index, 1)
         }
         callback()
diff --git a/src/main/ipc/skills.test.ts b/src/main/ipc/skills.test.ts
index e6f88345ff2..b85abfe276d 100644
--- a/src/main/ipc/skills.test.ts
+++ b/src/main/ipc/skills.test.ts
@@ -28,7 +28,8 @@ vi.mock('electron', () => ({
 }))
 
 vi.mock('../skills/discovery', () => ({
-  discoverSkills: discoverSkillsMock
+  discoverSkills: discoverSkillsMock,
+  clearSkillRootScanCache: vi.fn()
 }))
 
 vi.mock('../skills/skill-discovery-wsl', () => ({
@@ -131,7 +132,7 @@ describe('registerSkillsHandlers', () => {
       }
     })
 
-    expect(discoverSkillsMock).toHaveBeenCalledWith({ repos })
+    expect(discoverSkillsMock).toHaveBeenCalledWith({ repos, refresh: false })
     expect(getWslHomeMock).not.toHaveBeenCalled()
   })
 
@@ -140,7 +141,11 @@ describe('registerSkillsHandlers', () => {
 
     await handler(null, { cwd: '/repo/worktree' })
 
-    expect(discoverSkillsMock).toHaveBeenCalledWith({ repos: [], cwd: '/repo/worktree' })
+    expect(discoverSkillsMock).toHaveBeenCalledWith({
+      repos: [],
+      cwd: '/repo/worktree',
+      refresh: false
+    })
   })
 
   it('uses the selected project WSL distro for skill discovery', async () => {
diff --git a/src/main/ipc/skills.ts b/src/main/ipc/skills.ts
index e2d12ca57ba..746f02416d1 100644
--- a/src/main/ipc/skills.ts
+++ b/src/main/ipc/skills.ts
@@ -15,6 +15,7 @@ import { SkillUpdateRunner } from '../skills/skill-update-run'
 import { skillUpdateFailedNames } from '../skills/skill-update-outcome'
 import { readGloballyUpdatableSkillLocks } from '../skills/skill-update-registration'
 import {
+  clearSkillDiscoveryCaches,
   discoverSkillsOnTarget,
   resolveSkillDiscoveryTarget
 } from '../skills/skill-discovery-target'
@@ -32,6 +33,9 @@ export function registerSkillsHandlers(store: Store): void {
     // Why: per-skill outcomes come from re-hashing what is actually on disk, not
     // from scraping stdout.
     rescanOutdatedNames: async (names) => {
+      // Why: the run just rewrote skill packages on this host. Clients that never
+      // send `refresh` (older builds) would otherwise read a pre-run scan.
+      clearSkillDiscoveryCaches()
       // The lock read is fresh on purpose: the run just rewrote it, and the
       // verdict accepts unrecognized content only when disk matches that record.
       const [inventory, globalSkillLocks] = await Promise.all([
@@ -53,7 +57,12 @@ export function registerSkillsHandlers(store: Store): void {
     'skills:discover',
     async (_event, target?: SkillDiscoveryTarget): Promise<SkillDiscoveryResult> => {
       const parsedTarget = target ? SkillDiscoveryTargetSchema.parse(target) : undefined
-      return discoverSkillsOnTarget(resolveSkillDiscoveryTarget(parsedTarget), store.getRepos())
+      return discoverSkillsOnTarget(
+        resolveSkillDiscoveryTarget(parsedTarget),
+        store.getRepos(),
+        // Why: only a caller that knows disk changed may bypass the shared scans.
+        { refresh: parsedTarget?.refresh === true }
+      )
     }
   )
 
diff --git a/src/main/ipc/ssh-pty-legacy-projection-record.ts b/src/main/ipc/ssh-pty-legacy-projection-record.ts
index 45c666dc09a..6d9843d888c 100644
--- a/src/main/ipc/ssh-pty-legacy-projection-record.ts
+++ b/src/main/ipc/ssh-pty-legacy-projection-record.ts
@@ -117,7 +117,7 @@ export function reclaimProjectionRecord(
     return
   }
   const index = ids.indexOf(id)
-  if (index >= 0) {
+  if (index !== -1) {
     ids.splice(index, 1)
   }
   if (ids.length === 0) {
diff --git a/src/main/ipc/ssh-pty-output-intake.test.ts b/src/main/ipc/ssh-pty-output-intake.test.ts
index be38872da04..43ceed26079 100644
--- a/src/main/ipc/ssh-pty-output-intake.test.ts
+++ b/src/main/ipc/ssh-pty-output-intake.test.ts
@@ -3,7 +3,7 @@ import type { LegacySshProjectionSemantics } from './ssh-pty-legacy-projection'
 import {
   createSshPtyOutputIntakeHarness as createHarness,
   sshPtyOutputEvent as event
-} from './ssh-pty-output-intake-test-harness'
+} from './__tests__/ssh-pty-output-intake-test-harness'
 
 describe('SshPtyOutputIntake', () => {
   it('plateaus at the model and pressure budgets, then resumes below low water', async () => {
diff --git a/src/main/ipc/ssh-pty-output-model-migration.test.ts b/src/main/ipc/ssh-pty-output-model-migration.test.ts
index ae56e2e45fc..59a063fba02 100644
--- a/src/main/ipc/ssh-pty-output-model-migration.test.ts
+++ b/src/main/ipc/ssh-pty-output-model-migration.test.ts
@@ -3,7 +3,7 @@ import type { SshPtyOutputDataEvent } from './ssh-pty-output-intake'
 import {
   createSshPtyOutputIntakeHarness as createHarness,
   sshPtyOutputEvent as event
-} from './ssh-pty-output-intake-test-harness'
+} from './__tests__/ssh-pty-output-intake-test-harness'
 
 // Production-shaped ids: bare relay id on the wire side, prefixed app id in intake.
 const APP_ID = 'ssh:conn@@pty-1'
diff --git a/src/main/ipc/ssh.test.ts b/src/main/ipc/ssh.test.ts
index 538cf4bf846..d4dcde25e4e 100644
--- a/src/main/ipc/ssh.test.ts
+++ b/src/main/ipc/ssh.test.ts
@@ -305,6 +305,7 @@ describe('SSH IPC handlers', () => {
     upsertSshPtyConsumerRecovery: vi.fn(),
     removeSshPtyConsumerRecovery: vi.fn(),
     getSshRemotePtyLeases: vi.fn().mockReturnValue([]),
+    supersedeDuplicatePaneLeases: vi.fn().mockReturnValue(0),
     markSshRemotePtyLease: vi.fn(),
     markSshRemotePtyLeases: vi.fn(),
     markSshRemotePtyLeasesAsync: vi.fn(),
diff --git a/src/main/ipc/ssh.ts b/src/main/ipc/ssh.ts
index 59ffcfbc9a9..0c504c5f0a0 100644
--- a/src/main/ipc/ssh.ts
+++ b/src/main/ipc/ssh.ts
@@ -177,7 +177,7 @@ export async function requestActiveSshAiVaultSessionList(
   targetId: string,
   params: SshAiVaultRelayListParams,
   options: { signal?: AbortSignal; timeoutMs?: number } = {}
-): Promise<unknown | null> {
+): Promise<unknown> {
   if (isRuntimeOwnedSshTargetId(targetId)) {
     return null
   }
@@ -192,7 +192,7 @@ export async function requestActiveSshAiVaultSessionTitles(
   targetId: string,
   params: SshAiVaultRelayTitleParams,
   options: { signal?: AbortSignal; timeoutMs?: number } = {}
-): Promise<unknown | null> {
+): Promise<unknown> {
   if (isRuntimeOwnedSshTargetId(targetId)) {
     return null
   }
diff --git a/src/main/ipc/terminal-preview-output-stream.test.ts b/src/main/ipc/terminal-preview-output-stream.test.ts
new file mode 100644
index 00000000000..4f293015178
--- /dev/null
+++ b/src/main/ipc/terminal-preview-output-stream.test.ts
@@ -0,0 +1,60 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { WebContents } from 'electron'
+import { TerminalPreviewOutputStream } from './terminal-preview-output-stream'
+
+function makeStream(): TerminalPreviewOutputStream {
+  const contents = {
+    id: 1,
+    isDestroyed: () => false,
+    send: vi.fn()
+  } as unknown as WebContents
+  return new TerminalPreviewOutputStream(
+    contents,
+    'p1',
+    () => undefined,
+    () => undefined
+  )
+}
+
+// The renderer needs each buffered chunk's mode, not just its bytes.
+// Returning a bare string[] made a proven post-snapshot `CSI > u` look like
+// historical redelivery, so the TUI's single pop later landed on a stale frame.
+describe('TerminalPreviewOutputStream.completeSnapshot', () => {
+  it('drops chunks the snapshot already covers', () => {
+    const stream = makeStream()
+    stream.append('abc', { seq: 5, rawLength: 3 })
+    expect(stream.completeSnapshot(5)).toEqual([])
+  })
+
+  it('gives a strictly newer sequenced chunk live mode', () => {
+    const stream = makeStream()
+    stream.append('abc', { seq: 9, rawLength: 3 })
+    expect(stream.completeSnapshot(6)).toEqual([{ data: 'abc', mode: 'live' }])
+  })
+
+  it('slices a partially covered chunk and keeps the suffix live', () => {
+    const stream = makeStream()
+    stream.append('abc', { seq: 7, rawLength: 3 })
+    expect(stream.completeSnapshot(6)).toEqual([{ data: 'c', mode: 'live' }])
+  })
+
+  it('falls back to replay mode for an unsliceable transformed overlap', () => {
+    const stream = makeStream()
+    // Renderer-side transforms make raw offsets unmappable, so the covered head
+    // cannot be removed and the whole chunk stays uncertain redelivery.
+    stream.append('abc', { seq: 7, rawLength: 3, transformed: true })
+    expect(stream.completeSnapshot(6)).toEqual([{ data: 'abc', mode: 'replay' }])
+  })
+
+  it('falls back to replay mode when the chunk carries no sequence metadata', () => {
+    const stream = makeStream()
+    stream.append('abc')
+    expect(stream.completeSnapshot(6)).toEqual([{ data: 'abc', mode: 'replay' }])
+  })
+
+  it('falls back to replay mode when the snapshot itself is unsequenced', () => {
+    const stream = makeStream()
+    stream.append('abc', { seq: 9, rawLength: 3 })
+    expect(stream.completeSnapshot(undefined)).toEqual([{ data: 'abc', mode: 'replay' }])
+  })
+})
diff --git a/src/main/ipc/terminal-preview-output-stream.ts b/src/main/ipc/terminal-preview-output-stream.ts
index af14424cbe2..16cb1613565 100644
--- a/src/main/ipc/terminal-preview-output-stream.ts
+++ b/src/main/ipc/terminal-preview-output-stream.ts
@@ -1,6 +1,9 @@
 import type { WebContents } from 'electron'
 import { iterateTerminalInputChunks } from '../../shared/terminal-input'
-import type { TerminalPreviewDataPayload } from '../../shared/terminal-preview'
+import type {
+  TerminalPreviewDataPayload,
+  TerminalPreviewReplayChunk
+} from '../../shared/terminal-preview'
 
 const OUTPUT_BATCH_MS = 5
 export const TERMINAL_PREVIEW_OUTPUT_BATCH_MAX_BYTES = 64 * 1024
@@ -16,22 +19,37 @@ export type TerminalPreviewOutputMeta = {
 
 type PendingOutput = { data: string; bytes: number; meta?: TerminalPreviewOutputMeta }
 
-function outputAfterSnapshotSeq(output: PendingOutput, snapshotSeq?: number): string | null {
+/**
+ * Split one buffered chunk against the snapshot boundary, keeping WHY it
+ * survived. Only a chunk whose sequence metadata proves it is the suffix after
+ * that boundary may advance kitty state with live stack semantics; an overlap
+ * that cannot be sliced is redelivery, and a redelivered `CSI > u` applied as a
+ * push would leave the TUI's single pop landing on a stale frame.
+ */
+function outputAfterSnapshotSeq(
+  output: PendingOutput,
+  snapshotSeq?: number
+): TerminalPreviewReplayChunk | null {
   if (
     typeof snapshotSeq !== 'number' ||
     typeof output.meta?.seq !== 'number' ||
     typeof output.meta.rawLength !== 'number'
   ) {
-    return output.data
+    return { data: output.data, mode: 'replay' }
   }
   if (output.meta.seq <= snapshotSeq) {
     return null
   }
   const startSeq = output.meta.seq - output.meta.rawLength
-  if (startSeq >= snapshotSeq || output.meta.transformed === true) {
-    return output.data
+  if (startSeq >= snapshotSeq) {
+    return { data: output.data, mode: 'live' }
   }
-  return output.data.slice(snapshotSeq - startSeq)
+  if (output.meta.transformed === true) {
+    // Transformed payloads make raw offsets unmappable, so the covered head
+    // cannot be sliced off and the whole chunk stays uncertain redelivery.
+    return { data: output.data, mode: 'replay' }
+  }
+  return { data: output.data.slice(snapshotSeq - startSeq), mode: 'live' }
 }
 
 /** Owns one preview's bounded snapshot/live output queue and acknowledgements. */
@@ -101,10 +119,10 @@ export class TerminalPreviewOutputStream {
     return true
   }
 
-  completeSnapshot(snapshotSeq?: number): string[] {
+  completeSnapshot(snapshotSeq?: number): TerminalPreviewReplayChunk[] {
     const replay = this.initialPending.flatMap((output) => {
       const uncovered = outputAfterSnapshotSeq(output, snapshotSeq)
-      return uncovered ? [uncovered] : []
+      return uncovered && uncovered.data.length > 0 ? [uncovered] : []
     })
     this.initialPending = []
     this.initialPendingBytes = 0
diff --git a/src/main/ipc/terminal-preview.test.ts b/src/main/ipc/terminal-preview.test.ts
index a01fd7c70eb..b8460554b73 100644
--- a/src/main/ipc/terminal-preview.test.ts
+++ b/src/main/ipc/terminal-preview.test.ts
@@ -122,7 +122,9 @@ describe('registerTerminalPreviewHandlers', () => {
 
     await expect(resultPromise).resolves.toEqual({
       snapshot: { data: 'screen', cols: 80, rows: 20, seq: 6 },
-      replay: ['c']
+      // A sliced suffix is proven post-snapshot output, so it applies with live
+      // kitty semantics rather than as redelivery.
+      replay: [{ data: 'c', mode: 'live' }]
     })
     expect(runtime.registerRawTerminalViewSubscriber).toHaveBeenCalledWith('p1')
   })
@@ -239,6 +241,64 @@ describe('registerTerminalPreviewHandlers', () => {
     expect(sender.send).not.toHaveBeenCalled()
   })
 
+  // Flags and image must come from ONE capture. Publishing flags from
+  // a separate "current state" read would describe a different stream position,
+  // so replaying the intervening bytes could duplicate or reorder transitions.
+  it('returns the kitty flags of the capture that produced the returned image', async () => {
+    const runtime = makeRuntime()
+    const snapshotResolvers: ((snapshot: {
+      data: string
+      cols: number
+      rows: number
+      seq: number
+      kittyKeyboardFlags?: number
+    }) => void)[] = []
+    runtime.serializeTerminalBuffer.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          snapshotResolvers.push(resolve)
+        })
+    )
+    registerTerminalPreviewHandlers(runtime as never)
+    const sender = makeSender()
+
+    const resultPromise = handlers.get('terminalPreview:connect')!(eventFor(sender), {
+      ptyId: 'p1'
+    }) as Promise<unknown>
+    const chunk = 'x'.repeat(64 * 1024)
+    for (let index = 0; index < 5; index++) {
+      runtime.listeners[0]!(chunk)
+    }
+    // The first capture overflowed; its flags must not survive onto the second image.
+    snapshotResolvers[0]!({
+      data: 'first',
+      cols: 80,
+      rows: 20,
+      seq: 1,
+      kittyKeyboardFlags: 0
+    })
+    await vi.waitFor(() => expect(snapshotResolvers).toHaveLength(2))
+    snapshotResolvers[1]!({
+      data: 'second',
+      cols: 80,
+      rows: 20,
+      seq: 2,
+      kittyKeyboardFlags: 8
+    })
+
+    await expect(resultPromise).resolves.toEqual({
+      snapshot: {
+        data: 'second',
+        cols: 80,
+        rows: 20,
+        seq: 2,
+        kittyKeyboardFlags: 8
+      },
+      replay: []
+    })
+    expect(runtime.serializeTerminalBuffer).toHaveBeenCalledTimes(2)
+  })
+
   it('releases output and raw-view presence on unsubscribe and sender destruction', async () => {
     const runtime = makeRuntime()
     registerTerminalPreviewHandlers(runtime as never)
diff --git a/src/main/ipc/workspace-ports.test.ts b/src/main/ipc/workspace-ports.test.ts
index f5afe03628b..9c847b14ad8 100644
--- a/src/main/ipc/workspace-ports.test.ts
+++ b/src/main/ipc/workspace-ports.test.ts
@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { WorkspacePort, WorkspacePortScanResult } from '../../shared/workspace-ports'
 
-const handlers = new Map<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (_event: unknown, args: unknown) => unknown>()
 const { handleMock, removeHandlerMock, scanWorkspacePortsMock, processKillMock } = vi.hoisted(
   () => ({
     handleMock: vi.fn(),
diff --git a/src/main/ipc/worktree-common-git-directory.ts b/src/main/ipc/worktree-common-git-directory.ts
index a2ec6b0e990..7fb464f3c94 100644
--- a/src/main/ipc/worktree-common-git-directory.ts
+++ b/src/main/ipc/worktree-common-git-directory.ts
@@ -26,7 +26,7 @@ function isFileStat(value: GitDirectoryStat): boolean {
 function runtimeDirname(pathValue: string): string {
   const normalized = normalizeRuntimePathSeparators(pathValue).replace(/\/+$/, '')
   const index = normalized.lastIndexOf('/')
-  if (index < 0) {
+  if (index === -1) {
     return '.'
   }
   if (index === 0) {
diff --git a/src/main/ipc/worktree-git-common-polling.ts b/src/main/ipc/worktree-git-common-polling.ts
index dae122943a3..86cc06e1420 100644
--- a/src/main/ipc/worktree-git-common-polling.ts
+++ b/src/main/ipc/worktree-git-common-polling.ts
@@ -74,7 +74,7 @@ async function snapshotGitCommon(
   previous?: GitCommonSnapshot,
   includePrimary = true,
   forceFullScan = false,
-  statusRefPaths: Set<string> = new Set()
+  statusRefPaths = new Set<string>()
 ): Promise<GitCommonSnapshot> {
   const worktreesDir = join(commonDirPath, 'worktrees')
   const [worktreesDirSignature, primarySignatures, statusRefSignatures] = await Promise.all([
diff --git a/src/main/jira/attachment-images.ts b/src/main/jira/attachment-images.ts
index ce2e682b872..d1cfb2ab079 100644
--- a/src/main/jira/attachment-images.ts
+++ b/src/main/jira/attachment-images.ts
@@ -191,7 +191,7 @@ export function createMediaMarkdownResolver(
     }
     const index = queue.findIndex((entry) => entry.id === image.id)
     // Why: already-consumed images must not re-emit; fall through to positional pairing.
-    if (index < 0) {
+    if (index === -1) {
       return null
     }
     queue.splice(index, 1)
diff --git a/src/main/jira/client.ts b/src/main/jira/client.ts
index 70f45628461..cd3497fb2be 100644
--- a/src/main/jira/client.ts
+++ b/src/main/jira/client.ts
@@ -61,7 +61,7 @@ export function acquire(signal?: AbortSignal): Promise<void> {
       signal,
       onAbort: () => {
         const index = queue.indexOf(entry)
-        if (index < 0) {
+        if (index === -1) {
           return
         }
         queue.splice(index, 1)
diff --git a/src/main/keybindings/keybinding-file.ts b/src/main/keybindings/keybinding-file.ts
index 4d41a42ba87..7a357010406 100644
--- a/src/main/keybindings/keybinding-file.ts
+++ b/src/main/keybindings/keybinding-file.ts
@@ -221,7 +221,7 @@ function removeConflictingOverrides(
 
     for (const conflict of conflicts) {
       for (const actionId of conflict.actionIds) {
-        if (Object.prototype.hasOwnProperty.call(next, actionId)) {
+        if (Object.hasOwn(next, actionId)) {
           conflictingOverrides.add(actionId)
         }
       }
@@ -346,8 +346,8 @@ export function seedLegacyTabSwitchBindings(
   // common + active-platform sections directly so the seed never replaces it.
   const toSeed = actionIds.filter(
     (actionId) =>
-      !Object.prototype.hasOwnProperty.call(current.commonOverrides, actionId) &&
-      !Object.prototype.hasOwnProperty.call(activePlatformOverrides, actionId)
+      !Object.hasOwn(current.commonOverrides, actionId) &&
+      !Object.hasOwn(activePlatformOverrides, actionId)
   )
   if (toSeed.length === 0) {
     return { seeded: false, snapshot: current }
diff --git a/src/main/line-editor-ready-output-scanner.test.ts b/src/main/line-editor-ready-output-scanner.test.ts
new file mode 100644
index 00000000000..332f1d65f04
--- /dev/null
+++ b/src/main/line-editor-ready-output-scanner.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createLineEditorReadyOutputScanState,
+  scanForLineEditorReadyOutput
+} from './line-editor-ready-output-scanner'
+
+describe('line editor ready output scanner', () => {
+  it.each(['\x1b[?2004h', '\x1b[?1034h'])('detects %j across chunks', (sequence) => {
+    const state = createLineEditorReadyOutputScanState()
+    expect(scanForLineEditorReadyOutput(state, `prompt${sequence.slice(0, 4)}`)).toBe(false)
+    expect(scanForLineEditorReadyOutput(state, sequence.slice(4))).toBe(true)
+  })
+
+  it('ignores ordinary prompt output', () => {
+    expect(
+      scanForLineEditorReadyOutput(createLineEditorReadyOutputScanState(), 'user@host % ')
+    ).toBe(false)
+  })
+})
diff --git a/src/main/line-editor-ready-output-scanner.ts b/src/main/line-editor-ready-output-scanner.ts
new file mode 100644
index 00000000000..03467887a9a
--- /dev/null
+++ b/src/main/line-editor-ready-output-scanner.ts
@@ -0,0 +1,19 @@
+const LINE_EDITOR_READY_SEQUENCES = ['\x1b[?2004h', '\x1b[?1034h'] as const
+const MAX_SEQUENCE_LENGTH = Math.max(...LINE_EDITOR_READY_SEQUENCES.map((value) => value.length))
+
+export type LineEditorReadyOutputScanState = {
+  tail: string
+}
+
+export function createLineEditorReadyOutputScanState(): LineEditorReadyOutputScanState {
+  return { tail: '' }
+}
+
+export function scanForLineEditorReadyOutput(
+  state: LineEditorReadyOutputScanState,
+  data: string
+): boolean {
+  const combined = state.tail + data
+  state.tail = combined.slice(-(MAX_SEQUENCE_LENGTH - 1))
+  return LINE_EDITOR_READY_SEQUENCES.some((sequence) => combined.includes(sequence))
+}
diff --git a/src/main/linear/issue-context-client.ts b/src/main/linear/issue-context-client.ts
index 1f4863d235a..c9e5085f3bb 100644
--- a/src/main/linear/issue-context-client.ts
+++ b/src/main/linear/issue-context-client.ts
@@ -43,7 +43,7 @@ export type ResolvedIssue = {
 export async function searchLinearIssuesForAgents(args: {
   query: string
   limit?: number
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 }): Promise<LinearSearchResult> {
   const limit = clampLinearSearchLimit(args.limit)
   const workspaceId = resolveSearchWorkspaceId(args.workspaceId)
@@ -144,14 +144,18 @@ function getExplicitClientEntries(workspaceId?: string): {
   }
 }
 
-function resolveSearchWorkspaceId(workspaceId?: string | 'all'): string | 'all' | undefined {
+function resolveSearchWorkspaceId(
+  workspaceId?: (string & {}) | 'all'
+): (string & {}) | 'all' | undefined {
   if (!workspaceId || workspaceId === 'all') {
     return workspaceId
   }
   return resolveWorkspaceSelector({ workspaceId }, getConnectedWorkspaces())?.id ?? workspaceId
 }
 
-function throwIfExplicitWorkspaceHasConnectedAlternatives(workspaceId?: string | 'all'): void {
+function throwIfExplicitWorkspaceHasConnectedAlternatives(
+  workspaceId?: (string & {}) | 'all'
+): void {
   if (!workspaceId || workspaceId === 'all') {
     return
   }
@@ -169,7 +173,7 @@ function throwIfExplicitWorkspaceHasConnectedAlternatives(workspaceId?: string |
 export async function withLinearRead<T>(
   entry: LinearClientForWorkspace,
   read: () => Promise<T>,
-  selection?: string | 'all'
+  selection?: (string & {}) | 'all'
 ): Promise<T> {
   void selection
   await acquire()
@@ -206,7 +210,7 @@ async function readIssueWorkspace(
 async function readIssueWorkspaces(
   entries: LinearClientForWorkspace[],
   identifier: string,
-  selection: string | 'all',
+  selection: (string & {}) | 'all',
   initialFailures: WorkspaceReadFailure[] = []
 ): Promise<ResolvedIssue[]> {
   if (selection !== 'all') {
@@ -243,7 +247,7 @@ async function readSearchWorkspace(
   entry: LinearClientForWorkspace,
   query: string,
   limit: number,
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 ): Promise<LinearSearchIssueSummary[]> {
   const response = await withLinearRead(
     entry,
@@ -269,7 +273,7 @@ async function readSearchWorkspaces(
   entries: LinearClientForWorkspace[],
   query: string,
   limit: number,
-  workspaceId?: string | 'all',
+  workspaceId?: (string & {}) | 'all',
   initialFailures: WorkspaceReadFailure[] = []
 ): Promise<{ results: LinearSearchIssueSummary[][]; failures: WorkspaceReadFailure[] }> {
   if (workspaceId && workspaceId !== 'all') {
diff --git a/src/main/linear/mcp-issue-list.ts b/src/main/linear/mcp-issue-list.ts
index 3906442879e..09c5fff3336 100644
--- a/src/main/linear/mcp-issue-list.ts
+++ b/src/main/linear/mcp-issue-list.ts
@@ -106,7 +106,7 @@ export async function listMcpIssues(
   }
 }
 
-function getIssueListEntries(workspaceId?: string | 'all'): {
+function getIssueListEntries(workspaceId?: (string & {}) | 'all'): {
   entries: LinearClientForWorkspace[]
   failures: WorkspaceReadFailure[]
 } {
diff --git a/src/main/memory/windows-process-resource-collector.ts b/src/main/memory/windows-process-resource-collector.ts
index d73ae95b8c9..527c4678fc9 100644
--- a/src/main/memory/windows-process-resource-collector.ts
+++ b/src/main/memory/windows-process-resource-collector.ts
@@ -286,7 +286,7 @@ export function parseTypeperfProcessOutput(stdout: string): WindowsProcessResour
 function parseTypeperfCounterPath(path: string): { instance: string; counter: string } | null {
   const processStart = path.lastIndexOf('\\Process(')
   const counterStart = path.lastIndexOf(')\\')
-  if (processStart < 0 || counterStart <= processStart + 9) {
+  if (processStart === -1 || counterStart <= processStart + 9) {
     return null
   }
   return {
diff --git a/src/main/minimax/minimax-cookie-store.ts b/src/main/minimax/minimax-cookie-store.ts
index 3864f892bfb..1b98a1a81c6 100644
--- a/src/main/minimax/minimax-cookie-store.ts
+++ b/src/main/minimax/minimax-cookie-store.ts
@@ -33,7 +33,7 @@ function decodeCookieEnvelope(raw: Buffer): MiniMaxCookieEnvelope | null {
   }
   const rest = text.slice(COOKIE_ENVELOPE_PREFIX.length)
   const separator = rest.indexOf(':')
-  if (separator < 0) {
+  if (separator === -1) {
     throw new Error('MiniMax session cookie could not be decrypted')
   }
   const kind = rest.slice(0, separator)
diff --git a/src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts b/src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts
index 30bd3716d3e..5043bd14f6c 100644
--- a/src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts
+++ b/src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts
@@ -20,6 +20,7 @@ import {
   resetHostReadableTranscriptPathCacheForTests,
   toHostReadableTranscriptPath
 } from './host-readable-transcript-path'
+import { WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS } from './wsl-transcript-fs-gate'
 
 type AccessControl = {
   resolve: () => void
@@ -97,4 +98,27 @@ describe('WSL transcript filesystem gate', () => {
     releaseWsl?.()
     await expect(wslProbe).resolves.toBe(firstUncPath)
   })
+
+  // Last on purpose: the never-settling Ubuntu probe leaves its gate permit
+  // stuck for the rest of this module's lifetime.
+  it('falls through to the next distro when a probe exceeds the gate deadline', async () => {
+    vi.useFakeTimers()
+    const DEBIAN_HOME = '\\\\wsl.localhost\\Debian\\home\\ada'
+    const debianUncPath = '\\\\wsl.localhost\\Debian\\home\\ada\\.codex\\sessions\\first.jsonl'
+    try {
+      fsMocks.access.mockImplementation((path) =>
+        path === firstUncPath ? new Promise<void>(() => {}) : Promise.resolve()
+      )
+      const resolved = toHostReadableTranscriptPath(firstGuestPath, {
+        platform: 'win32',
+        listWslHomeDirs: async () => [UBUNTU_HOME, DEBIAN_HOME]
+      })
+
+      await vi.waitFor(() => expect(fsMocks.access).toHaveBeenCalledWith(firstUncPath))
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await expect(resolved).resolves.toBe(debianUncPath)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
 })
diff --git a/src/main/native-chat/host-readable-transcript-path.test.ts b/src/main/native-chat/host-readable-transcript-path.test.ts
index 043c77ee4c0..4d19b3fa8e8 100644
--- a/src/main/native-chat/host-readable-transcript-path.test.ts
+++ b/src/main/native-chat/host-readable-transcript-path.test.ts
@@ -7,6 +7,7 @@ import {
   toHostReadableTranscriptPath,
   wslCodexSessionsDirs
 } from './host-readable-transcript-path'
+import { WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 const UBUNTU_HOME = '\\\\wsl.localhost\\Ubuntu\\home\\ada'
 const DEBIAN_HOME = '\\\\wsl.localhost\\Debian\\home\\other'
@@ -109,6 +110,38 @@ describe('toHostReadableTranscriptPath', () => {
     ).resolves.toBeNull()
   })
 
+  it('prefers a later distro hit over an earlier gate refusal', async () => {
+    // Guest path under Debian's $HOME so the refusing Debian probe ranks first.
+    await expect(
+      toHostReadableTranscriptPath('/home/other/x.jsonl', {
+        platform: 'win32',
+        pathExists: async (candidate) => {
+          if (candidate.includes('Debian')) {
+            throw new WslTranscriptFsError('timeout', 'slow share')
+          }
+          return candidate.includes('Ubuntu')
+        },
+        listWslHomeDirs: async () => [DEBIAN_HOME, UBUNTU_HOME]
+      })
+    ).resolves.toBe('\\\\wsl.localhost\\Ubuntu\\home\\other\\x.jsonl')
+  })
+
+  it('reports unavailability, not a miss, when a refused distro was never probed', async () => {
+    const refusal = new WslTranscriptFsError('timeout', 'slow share')
+    await expect(
+      toHostReadableTranscriptPath('/home/other/x.jsonl', {
+        platform: 'win32',
+        pathExists: async (candidate) => {
+          if (candidate.includes('Debian')) {
+            throw refusal
+          }
+          return false
+        },
+        listWslHomeDirs: async () => [DEBIAN_HOME, UBUNTU_HOME]
+      })
+    ).rejects.toBe(refusal)
+  })
+
   it('does not translate guest paths off Windows', async () => {
     await expect(
       toHostReadableTranscriptPath('/home/ada/rollout.jsonl', {
diff --git a/src/main/native-chat/host-readable-transcript-path.ts b/src/main/native-chat/host-readable-transcript-path.ts
index 2672040e38b..4d919099536 100644
--- a/src/main/native-chat/host-readable-transcript-path.ts
+++ b/src/main/native-chat/host-readable-transcript-path.ts
@@ -4,7 +4,11 @@ import { isAbsolute } from 'node:path'
 import { isWslUncPath, parseWslUncPath, toWindowsWslPath } from '../../shared/wsl-paths'
 import { WSL_CODEX_RUNTIME_HOME_SEGMENTS } from '../pty/codex-home-wsl-env'
 import { getWslHomeAsync, listWslDistrosAsync } from '../wsl'
-import { runWslTranscriptFsTask } from './wsl-transcript-fs-gate'
+import {
+  runWslTranscriptFsTask,
+  wslTranscriptFsRefusal,
+  type WslTranscriptFsError
+} from './wsl-transcript-fs-gate'
 
 /**
  * True for guest-absolute Linux paths that Win32 cannot open as-is.
@@ -136,12 +140,22 @@ export async function toHostReadableTranscriptPath(
   const homeDirs = await wslHomeDirs(deps.listWslHomeDirs ?? defaultListWslHomeDirs)
   // Sequential on purpose: the ranked order picks the owning distro, and probing
   // every distro at once would fan out 9P calls to ones the user left stopped.
+  let unavailable: WslTranscriptFsError | undefined
   for (const distro of rankDistrosForGuestPath(homeDirs, path)) {
     const uncPath = toWindowsWslPath(path, distro)
-    if (await pathExists(uncPath)) {
-      return uncPath
+    try {
+      if (await pathExists(uncPath)) {
+        return uncPath
+      }
+    } catch (error) {
+      // Why: one stalled distro must not hide another distro's hit.
+      unavailable = wslTranscriptFsRefusal(error)
     }
   }
+  // No hit and at least one distro never probed: "couldn't look", not "absent".
+  if (unavailable) {
+    throw unavailable
+  }
   return null
 }
 
diff --git a/src/main/native-chat/native-chat-file-provenance.test.ts b/src/main/native-chat/native-chat-file-provenance.test.ts
new file mode 100644
index 00000000000..f92bd829026
--- /dev/null
+++ b/src/main/native-chat/native-chat-file-provenance.test.ts
@@ -0,0 +1,129 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { NativeChatMessage } from '../../shared/native-chat-types'
+import type { RuntimeMobileSessionClientTab } from '../../shared/runtime-types'
+import { nativeChatTranscriptIncludesPath } from './native-chat-file-provenance'
+
+function terminalTab(): RuntimeMobileSessionClientTab {
+  return {
+    type: 'terminal',
+    id: 'tab-1',
+    title: 'Codex',
+    parentTabId: 'parent-1',
+    leafId: 'leaf-1',
+    launchAgent: 'codex',
+    agentStatus: {
+      state: 'done',
+      prompt: '',
+      updatedAt: 1,
+      stateStartedAt: 1,
+      paneKey: 'parent-1:leaf-1',
+      stateHistory: [],
+      agentType: 'codex',
+      providerSession: {
+        key: 'session_id',
+        id: 'session-1',
+        transcriptPath: '/host/transcripts/session-1.jsonl'
+      }
+    },
+    isActive: true,
+    status: 'ready',
+    terminal: 'term-1'
+  }
+}
+
+function message(role: NativeChatMessage['role'], text: string): NativeChatMessage {
+  return {
+    id: `${role}-1`,
+    role,
+    blocks: [{ type: 'text', text }],
+    timestamp: 1,
+    source: 'transcript'
+  }
+}
+
+describe('nativeChatTranscriptIncludesPath', () => {
+  it('accepts a path in recent assistant output from the host-bound session', async () => {
+    const readTranscript = vi.fn(async () => ({
+      messages: [message('assistant', 'Open ~/orca-plans/result.html to review it.')]
+    }))
+
+    await expect(
+      nativeChatTranscriptIncludesPath({
+        tabs: [terminalTab()],
+        context: { tabId: 'tab-1', sessionId: 'session-1' },
+        pathText: '~/orca-plans/result.html',
+        absolutePath: '/Users/ada/orca-plans/result.html',
+        readTranscript
+      })
+    ).resolves.toBe(true)
+    expect(readTranscript).toHaveBeenCalledWith({
+      agent: 'codex',
+      sessionId: 'session-1',
+      transcriptPath: '/host/transcripts/session-1.jsonl',
+      limit: 2000
+    })
+  })
+
+  it('rejects a client session identity that does not match the host tab', async () => {
+    const readTranscript = vi.fn()
+
+    await expect(
+      nativeChatTranscriptIncludesPath({
+        tabs: [terminalTab()],
+        context: { tabId: 'tab-1', sessionId: 'forged-session' },
+        pathText: '/etc/passwd',
+        absolutePath: '/etc/passwd',
+        readTranscript
+      })
+    ).resolves.toBe(false)
+    expect(readTranscript).not.toHaveBeenCalled()
+  })
+
+  it('accepts a path followed by a sentence-final period', async () => {
+    const readTranscript = vi.fn(async () => ({
+      messages: [message('assistant', 'Open /tmp/orca-pr14166-external.txt.')]
+    }))
+
+    await expect(
+      nativeChatTranscriptIncludesPath({
+        tabs: [terminalTab()],
+        context: { tabId: 'tab-1', sessionId: 'session-1' },
+        pathText: '/tmp/orca-pr14166-external.txt',
+        absolutePath: '/tmp/orca-pr14166-external.txt',
+        readTranscript
+      })
+    ).resolves.toBe(true)
+  })
+
+  it('does not accept a longer filename sharing the requested path prefix', async () => {
+    const readTranscript = vi.fn(async () => ({
+      messages: [message('assistant', 'Open /tmp/orca-pr14166-external.txt.backup')]
+    }))
+
+    await expect(
+      nativeChatTranscriptIncludesPath({
+        tabs: [terminalTab()],
+        context: { tabId: 'tab-1', sessionId: 'session-1' },
+        pathText: '/tmp/orca-pr14166-external.txt',
+        absolutePath: '/tmp/orca-pr14166-external.txt',
+        readTranscript
+      })
+    ).resolves.toBe(false)
+  })
+
+  it('does not treat user-authored transcript text as agent provenance', async () => {
+    const readTranscript = vi.fn(async () => ({
+      messages: [message('user', 'Please open /etc/passwd')]
+    }))
+
+    await expect(
+      nativeChatTranscriptIncludesPath({
+        tabs: [terminalTab()],
+        context: { tabId: 'tab-1', sessionId: 'session-1' },
+        pathText: '/etc/passwd',
+        absolutePath: '/etc/passwd',
+        readTranscript
+      })
+    ).resolves.toBe(false)
+  })
+})
diff --git a/src/main/native-chat/native-chat-file-provenance.ts b/src/main/native-chat/native-chat-file-provenance.ts
new file mode 100644
index 00000000000..07b0b47082e
--- /dev/null
+++ b/src/main/native-chat/native-chat-file-provenance.ts
@@ -0,0 +1,74 @@
+import type { AgentType, NativeChatMessage } from '../../shared/native-chat-types'
+import { resolveNativeChatTranscriptAgent } from '../../shared/native-chat-agent-support'
+import type {
+  RuntimeMobileSessionClientTab,
+  RuntimeMobileSessionTerminalClientTab,
+  RuntimeNativeChatFileContext
+} from '../../shared/runtime-types'
+import { recentTerminalOutputIncludesPath } from '../runtime/terminal-output-path-candidates'
+import { readNativeChatTranscriptTail } from './transcript-tail-reader'
+
+// Match the largest transcript window mobile can render so any visible citation remains provable.
+const NATIVE_CHAT_FILE_PROVENANCE_WINDOW = 2000
+
+type TranscriptRead = (args: {
+  agent: AgentType
+  sessionId: string
+  transcriptPath?: string
+  limit: number
+}) => Promise<{ messages: NativeChatMessage[] } | { error: string }>
+
+function transcriptTextIncludesPath(text: string, pathText: string, absolutePath: string): boolean {
+  if (recentTerminalOutputIncludesPath(text, pathText, absolutePath)) {
+    return true
+  }
+  // Mobile excludes a sentence-final period from the tappable path span.
+  return recentTerminalOutputIncludesPath(text, `${pathText}.`, `${absolutePath}.`)
+}
+
+export async function nativeChatTranscriptIncludesPath(args: {
+  tabs: readonly RuntimeMobileSessionClientTab[]
+  context: RuntimeNativeChatFileContext
+  pathText: string
+  absolutePath: string
+  readTranscript?: TranscriptRead
+}): Promise<boolean> {
+  const tab = args.tabs.find(
+    (candidate): candidate is RuntimeMobileSessionTerminalClientTab =>
+      candidate.type === 'terminal' && candidate.id === args.context.tabId
+  )
+  const providerSession = tab?.agentStatus?.providerSession
+  const agent = tab?.agentStatus?.agentType ?? tab?.launchAgent
+  if (
+    !tab ||
+    !providerSession ||
+    providerSession.id !== args.context.sessionId ||
+    !agent ||
+    !resolveNativeChatTranscriptAgent(agent)
+  ) {
+    return false
+  }
+
+  try {
+    const result = await (args.readTranscript ?? readNativeChatTranscriptTail)({
+      agent,
+      sessionId: providerSession.id,
+      ...(providerSession.transcriptPath ? { transcriptPath: providerSession.transcriptPath } : {}),
+      limit: NATIVE_CHAT_FILE_PROVENANCE_WINDOW
+    })
+    if (!('messages' in result)) {
+      return false
+    }
+    return result.messages.some(
+      (message) =>
+        message.role === 'assistant' &&
+        message.blocks.some(
+          (block) =>
+            block.type === 'text' &&
+            transcriptTextIncludesPath(block.text, args.pathText, args.absolutePath)
+        )
+    )
+  } catch {
+    return false
+  }
+}
diff --git a/src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts b/src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts
index 07ccc107d65..af14882b371 100644
--- a/src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts
+++ b/src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts
@@ -1,10 +1,12 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as WslTranscriptFsGateModule from './wsl-transcript-fs-gate'
 
 const WSL_SESSIONS_DIR = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.codex\\sessions'
+const DEBIAN_SESSIONS_DIR = '\\\\wsl.localhost\\Debian\\home\\ada\\.codex\\sessions'
 const LOCAL_SESSIONS_DIR = 'C:\\Users\\ada\\.codex\\sessions'
 
 const mocks = vi.hoisted(() => ({
-  gate: vi.fn(async () => []),
+  gate: vi.fn(async (_options: { path: string }) => []),
   walk: vi.fn(
     async (
       dir: string,
@@ -18,7 +20,8 @@ const mocks = vi.hoisted(() => ({
   )
 }))
 
-vi.mock('./wsl-transcript-fs-gate', () => ({
+vi.mock('./wsl-transcript-fs-gate', async (importOriginal) => ({
+  ...(await importOriginal<typeof WslTranscriptFsGateModule>()),
   runWslTranscriptFsTask: mocks.gate
 }))
 vi.mock('../ai-vault/session-scanner-discovery', () => ({
@@ -26,6 +29,7 @@ vi.mock('../ai-vault/session-scanner-discovery', () => ({
 }))
 
 import { resolveSessionFilePath } from './session-file-resolver'
+import { WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 beforeEach(() => {
   mocks.gate.mockClear()
@@ -53,4 +57,77 @@ describe('Codex WSL scan gate', () => {
     expect(mocks.gate).not.toHaveBeenCalled()
     expect(mocks.walk).toHaveBeenCalledTimes(1)
   })
+
+  it("still surfaces a later root's hit when an earlier root is gate-refused", async () => {
+    const hit = `${DEBIAN_SESSIONS_DIR}\\2026\\rollout-1-session-id.jsonl`
+    mocks.gate.mockImplementation(async (options) => {
+      if (options.path.includes('Ubuntu')) {
+        throw new WslTranscriptFsError('timeout', 'slow share')
+      }
+      return []
+    })
+    mocks.walk.mockImplementation(async (dir, _agent, _issues, options) => {
+      await options.readDirectory?.(dir)
+      return dir === DEBIAN_SESSIONS_DIR ? [hit] : []
+    })
+
+    await expect(
+      resolveSessionFilePath('codex', 'session-id', {
+        codexSessionsDirs: [WSL_SESSIONS_DIR, DEBIAN_SESSIONS_DIR]
+      })
+    ).resolves.toBe(hit)
+  })
+
+  it('reports unavailability, not a miss, when every scanned root is gate-refused', async () => {
+    const refusal = new WslTranscriptFsError('unavailable', 'stuck permits')
+    mocks.gate.mockRejectedValue(refusal)
+
+    await expect(
+      resolveSessionFilePath('codex', 'session-id', {
+        codexSessionsDirs: [WSL_SESSIONS_DIR]
+      })
+    ).rejects.toBe(refusal)
+  })
+
+  it('falls through a gate-refused hook path to an id-based hit', async () => {
+    const hit = `${DEBIAN_SESSIONS_DIR}\\2026\\rollout-1-session-id.jsonl`
+    mocks.gate.mockImplementation(async (options: { operation?: string; path: string }) => {
+      if (options.operation === 'access') {
+        throw new WslTranscriptFsError('timeout', 'slow share')
+      }
+      return []
+    })
+    mocks.walk.mockImplementation(async (dir, _agent, _issues, options) => {
+      await options.readDirectory?.(dir)
+      return dir === DEBIAN_SESSIONS_DIR ? [hit] : []
+    })
+
+    await expect(
+      resolveSessionFilePath('codex', 'session-id', {
+        transcriptPath: `${WSL_SESSIONS_DIR}\\2026\\rollout-1-session-id.jsonl`,
+        codexSessionsDirs: [DEBIAN_SESSIONS_DIR]
+      })
+    ).resolves.toBe(hit)
+  })
+
+  it('surfaces the hook-path refusal when the id search also misses', async () => {
+    const refusal = new WslTranscriptFsError('unavailable', 'stuck permits')
+    mocks.gate.mockImplementation(async (options: { operation?: string; path: string }) => {
+      if (options.operation === 'access') {
+        throw refusal
+      }
+      return []
+    })
+    mocks.walk.mockImplementation(async (dir, _agent, _issues, options) => {
+      await options.readDirectory?.(dir)
+      return []
+    })
+
+    await expect(
+      resolveSessionFilePath('codex', 'session-id', {
+        transcriptPath: `${WSL_SESSIONS_DIR}\\2026\\rollout-1-session-id.jsonl`,
+        codexSessionsDirs: [LOCAL_SESSIONS_DIR]
+      })
+    ).rejects.toBe(refusal)
+  })
 })
diff --git a/src/main/native-chat/session-file-resolver.ts b/src/main/native-chat/session-file-resolver.ts
index f597529d933..f0376e01f02 100644
--- a/src/main/native-chat/session-file-resolver.ts
+++ b/src/main/native-chat/session-file-resolver.ts
@@ -1,7 +1,10 @@
 import { homedir } from 'node:os'
 import { basename, extname, join } from 'node:path'
 import type { AgentType } from '../../shared/native-chat-types'
-import { resolveNativeChatTranscriptAgent } from '../../shared/native-chat-agent-support'
+import {
+  resolveNativeChatTranscriptAgent,
+  type NativeChatTranscriptAgent
+} from '../../shared/native-chat-agent-support'
 import { isWslUncPath } from '../../shared/wsl-paths'
 import { walkSessionFiles } from '../ai-vault/session-scanner-discovery'
 import { OMP_SESSION_ARTIFACT_DIR_PATTERN } from '../ai-vault/session-scanner-omp-subagent-transcripts'
@@ -13,6 +16,7 @@ import {
 } from '../../shared/grok-session-paths'
 import { toHostReadableTranscriptPath, wslCodexSessionsDirs } from './host-readable-transcript-path'
 import { findWslCodexSessionPath } from './wsl-codex-session-path-scan'
+import { wslTranscriptFsRefusal, type WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 // Why: these mirror the path constants in ai-vault/session-scanner.ts. Reads
 // run in the main process against the runtime's own home directory; over SSH
@@ -95,14 +99,34 @@ export async function resolveSessionFilePath(
   // beats reconstructing a path from the session id. Route it through the host
   // readability check so a WSL guest path becomes an openable UNC on Windows;
   // stale/missing paths fall through to the id-based search.
+  let unavailable: WslTranscriptFsError | undefined
   const hookPath = options.transcriptPath?.trim()
   if (hookPath && extname(hookPath) === '.jsonl') {
-    const hostReadable = await toHostReadableTranscriptPath(hookPath, { signal })
-    if (hostReadable) {
-      return hostReadable
+    try {
+      const hostReadable = await toHostReadableTranscriptPath(hookPath, { signal })
+      if (hostReadable) {
+        return hostReadable
+      }
+    } catch (error) {
+      // Why: the id-based search may still hit; surface the refusal only when
+      // it does not, so a stalled distro reads as unavailable, never "missing".
+      unavailable = wslTranscriptFsRefusal(error)
     }
   }
 
+  const resolved = await resolveSessionFileById(transcriptAgent, sessionId, options, signal)
+  if (!resolved && unavailable) {
+    throw unavailable
+  }
+  return resolved
+}
+
+async function resolveSessionFileById(
+  transcriptAgent: NativeChatTranscriptAgent,
+  sessionId: string,
+  options: ResolveSessionFileOptions,
+  signal?: AbortSignal
+): Promise<string | null> {
   const trimmedId = sessionId.trim()
   if (!trimmedId) {
     return null
@@ -132,6 +156,10 @@ export async function resolveSessionFilePath(
   if (transcriptAgent === 'omp') {
     return resolveOmpSessionFile(trimmedId, options.ompSessionsDir ?? ompSessionsDir(), signal)
   }
+  // Why: a new transcript agent must pick its own resolver. Falling through to
+  // OMP's scan would search the wrong root with a foreign session id, so fail
+  // the build here instead of resolving silently wrong at runtime.
+  transcriptAgent satisfies never
   return null
 }
 
@@ -178,6 +206,7 @@ async function findCodexRolloutInDirs(
   sessionsDirs: string[],
   signal?: AbortSignal
 ): Promise<string | null> {
+  let unavailable: WslTranscriptFsError | undefined
   for (const sessionsDir of sessionsDirs) {
     // Why: no existence pre-check — walkSessionFiles already yields [] for a
     // missing/unreadable root, and a sync probe would block the main thread on a
@@ -190,18 +219,27 @@ async function findCodexRolloutInDirs(
       }
     }
     const isWslRoot = isWslUncPath(sessionsDir)
-    const files = isWslRoot
-      ? await findWslCodexSessionPath(sessionsDir, sessionId, signal)
-      : (
-          await walkSessionFiles(sessionsDir, 'codex', [], {
-            ...scanOptions,
-            signal
-          })
-        )[0]
-    if (files) {
-      return files
+    try {
+      const files = isWslRoot
+        ? await findWslCodexSessionPath(sessionsDir, sessionId, signal)
+        : (
+            await walkSessionFiles(sessionsDir, 'codex', [], {
+              ...scanOptions,
+              signal
+            })
+          )[0]
+      if (files) {
+        return files
+      }
+    } catch (error) {
+      // Why: one stalled distro must not hide another root's hit.
+      unavailable = wslTranscriptFsRefusal(error)
     }
   }
+  // No hit and at least one root never scanned: "couldn't look", not "missing".
+  if (unavailable) {
+    throw unavailable
+  }
   return null
 }
 
diff --git a/src/main/native-chat/transcript-file-version.ts b/src/main/native-chat/transcript-file-version.ts
index 69634c0a957..2de3c76821f 100644
--- a/src/main/native-chat/transcript-file-version.ts
+++ b/src/main/native-chat/transcript-file-version.ts
@@ -1,4 +1,6 @@
-import { stat } from 'node:fs/promises'
+import { readTranscriptSlice, wslGatedStat } from './wsl-transcript-fs-access'
+
+const BOUNDARY_FINGERPRINT_BYTES = 64
 
 export type TranscriptFileVersion = {
   identity: string
@@ -7,8 +9,11 @@ export type TranscriptFileVersion = {
   ctimeMs: number
 }
 
-export async function readTranscriptFileVersion(filePath: string): Promise<TranscriptFileVersion> {
-  const value = await stat(filePath)
+export async function readTranscriptFileVersion(
+  filePath: string,
+  signal?: AbortSignal
+): Promise<TranscriptFileVersion> {
+  const value = await wslGatedStat(filePath, 'exact', signal)
   return {
     identity: `${value.dev}:${value.ino}`,
     size: value.size,
@@ -17,6 +22,19 @@ export async function readTranscriptFileVersion(filePath: string): Promise<Trans
   }
 }
 
+export async function boundaryFingerprint(
+  filePath: string,
+  offset: number,
+  signal?: AbortSignal
+): Promise<string> {
+  if (offset <= 0) {
+    return ''
+  }
+  const start = Math.max(0, offset - BOUNDARY_FINGERPRINT_BYTES)
+  const slice = await readTranscriptSlice(filePath, start, offset - start, 'exact', signal)
+  return slice.toString('base64')
+}
+
 export function transcriptFileVersionChanged(
   current: TranscriptFileVersion,
   previous: TranscriptFileVersion
diff --git a/src/main/native-chat/transcript-incremental-reader.ts b/src/main/native-chat/transcript-incremental-reader.ts
index 8ad8cc335d1..1dd60f58292 100644
--- a/src/main/native-chat/transcript-incremental-reader.ts
+++ b/src/main/native-chat/transcript-incremental-reader.ts
@@ -1,10 +1,10 @@
-import { open, stat } from 'node:fs/promises'
 import type { NativeChatMessage, NativeChatTurnLifecycle } from '../../shared/native-chat-types'
 import { transcriptFallbackId } from './transcript-fallback-id'
 import {
   MAX_NATIVE_CHAT_TRANSCRIPT_RECORD_BYTES,
   type NativeChatLineDecoder
 } from './transcript-tail-reader'
+import { openTranscriptReadStream, wslGatedStat } from './wsl-transcript-fs-access'
 
 const APPEND_BATCH_MESSAGE_LIMIT = 40
 
@@ -30,16 +30,21 @@ export async function readIncrementalTranscriptMessages(
   decode: NativeChatLineDecoder,
   onBatch?: (messages: NativeChatMessage[]) => void,
   decodeLifecycle?: (line: string, fallbackId: string) => NativeChatTurnLifecycle | null,
-  onLifecycle?: (lifecycle: NativeChatTurnLifecycle) => void
+  onLifecycle?: (lifecycle: NativeChatTurnLifecycle) => void,
+  signal?: AbortSignal
 ): Promise<NativeChatMessage[]> {
-  const end = (await stat(filePath)).size
+  const end = (await wslGatedStat(filePath, 'exact', signal)).size
   if (end <= state.offset) {
     return []
   }
   const messages: NativeChatMessage[] = []
-  const handle = await open(filePath, 'r')
+  const stream = openTranscriptReadStream(
+    filePath,
+    { start: state.offset, end: end - 1 },
+    'exact',
+    signal
+  )
   try {
-    const stream = handle.createReadStream({ start: state.offset, end: end - 1, autoClose: false })
     let absoluteOffset = state.offset
     for await (const rawChunk of stream) {
       const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk)
@@ -62,7 +67,9 @@ export async function readIncrementalTranscriptMessages(
     }
     return messages
   } finally {
-    await handle.close()
+    // Early exits (throw/oversized-record bail) must not leak the fd or, on
+    // UNC, the gated handle the generator's finally closes.
+    stream.destroy()
   }
 
   function retainPart(part: Buffer): void {
diff --git a/src/main/native-chat/transcript-read-cache-refusal-recovery.test.ts b/src/main/native-chat/transcript-read-cache-refusal-recovery.test.ts
new file mode 100644
index 00000000000..4e865b306fc
--- /dev/null
+++ b/src/main/native-chat/transcript-read-cache-refusal-recovery.test.ts
@@ -0,0 +1,115 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+
+const UNC_PATH = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.claude\\projects\\p\\session.jsonl'
+const mocks = vi.hoisted(() => ({
+  resolve: vi.fn<() => Promise<string | null>>(),
+  stat: vi.fn(),
+  open: vi.fn()
+}))
+
+vi.mock('./session-file-resolver', () => ({
+  resolveSessionFilePath: mocks.resolve
+}))
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  stat: mocks.stat,
+  open: mocks.open
+}))
+
+import {
+  clearNativeChatTranscriptCache,
+  readNativeChatTranscriptCached
+} from './transcript-read-cache'
+import {
+  WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS,
+  WSL_TRANSCRIPT_FS_SLOW_MESSAGE
+} from './wsl-transcript-fs-gate'
+
+const BODY = Buffer.from(
+  `${JSON.stringify({
+    type: 'user',
+    uuid: 'u-0',
+    timestamp: '2026-06-01T10:00:00.000Z',
+    message: { role: 'user', content: 'hello' }
+  })}\n`
+)
+
+let releaseStall: (() => void) | undefined
+
+function stalls<T>(value: T): Promise<T> {
+  return new Promise<T>((resolve) => {
+    releaseStall = () => resolve(value)
+  })
+}
+
+function transcriptHandle(body = BODY) {
+  return {
+    read: vi.fn(async (buffer: Buffer, offset: number, length: number, position: number) => {
+      const slice = body.subarray(position, Math.min(position + length, body.length))
+      slice.copy(buffer, offset)
+      return { bytesRead: slice.length, buffer }
+    }),
+    close: vi.fn(async () => {})
+  }
+}
+
+beforeEach(() => {
+  clearNativeChatTranscriptCache()
+  mocks.resolve.mockReset()
+  mocks.stat.mockReset()
+  mocks.open.mockReset()
+  releaseStall = undefined
+  mocks.resolve.mockResolvedValue(UNC_PATH)
+  // The file itself never changes across the refusal and the recovery.
+  mocks.stat.mockResolvedValue({ mtimeMs: 42, size: BODY.length })
+  vi.useFakeTimers()
+})
+
+afterEach(async () => {
+  releaseStall?.()
+  releaseStall = undefined
+  await vi.advanceTimersByTimeAsync(0)
+  vi.useRealTimers()
+})
+
+describe('cached native chat transcript read after WSL gate refusals', () => {
+  it('retries a refused stat instead of caching it as a missing file', async () => {
+    mocks.stat.mockReturnValueOnce(stalls({ mtimeMs: 42, size: BODY.length }))
+    const refused = readNativeChatTranscriptCached('claude', 'session-id')
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+
+    expect(await refused).toEqual({ error: WSL_TRANSCRIPT_FS_SLOW_MESSAGE })
+    releaseStall?.()
+    releaseStall = undefined
+    await vi.advanceTimersByTimeAsync(0)
+    mocks.open.mockResolvedValue(transcriptHandle())
+
+    await expect(readNativeChatTranscriptCached('claude', 'session-id')).resolves.toMatchObject({
+      messages: [expect.objectContaining({ role: 'user' })]
+    })
+    expect(mocks.stat).toHaveBeenCalledTimes(2)
+  })
+
+  it('retries the body on the next call even though the mtime is unchanged', async () => {
+    mocks.open.mockResolvedValue({
+      read: vi.fn((buffer: Buffer) => stalls({ bytesRead: 0, buffer })),
+      close: vi.fn(async () => {})
+    })
+    const refused = readNativeChatTranscriptCached('claude', 'session-id')
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+    expect(await refused).toEqual({ error: WSL_TRANSCRIPT_FS_SLOW_MESSAGE })
+
+    releaseStall?.()
+    releaseStall = undefined
+    await vi.advanceTimersByTimeAsync(0)
+    mocks.open.mockResolvedValue(transcriptHandle())
+
+    const recovered = await readNativeChatTranscriptCached('claude', 'session-id')
+
+    expect(mocks.open).toHaveBeenCalledTimes(2)
+    expect(recovered).toMatchObject({
+      messages: [expect.objectContaining({ role: 'user' })]
+    })
+  })
+})
diff --git a/src/main/native-chat/transcript-read-cache-wsl-stall.test.ts b/src/main/native-chat/transcript-read-cache-wsl-stall.test.ts
new file mode 100644
index 00000000000..1ce0a22e455
--- /dev/null
+++ b/src/main/native-chat/transcript-read-cache-wsl-stall.test.ts
@@ -0,0 +1,91 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+
+const UNC_PATH = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.claude\\projects\\p\\session.jsonl'
+
+const mocks = vi.hoisted(() => ({
+  resolve: vi.fn<() => Promise<string | null>>(),
+  stat: vi.fn(),
+  read: vi.fn()
+}))
+
+vi.mock('./session-file-resolver', () => ({
+  resolveSessionFilePath: mocks.resolve
+}))
+vi.mock('./transcript-reader', () => ({
+  readNativeChatTranscript: mocks.read
+}))
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  stat: mocks.stat
+}))
+
+import {
+  clearNativeChatTranscriptCache,
+  readNativeChatTranscriptCached
+} from './transcript-read-cache'
+import { WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS } from './wsl-transcript-fs-gate'
+
+const SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+
+beforeEach(() => {
+  mocks.resolve.mockReset()
+  mocks.stat.mockReset()
+  mocks.read.mockReset()
+  mocks.resolve.mockResolvedValue(UNC_PATH)
+  clearNativeChatTranscriptCache()
+})
+
+describe('cached native chat transcript read with a stalled post-resolution stat', () => {
+  it('reports a retryable error without notFound and leaves nothing cached', async () => {
+    vi.useFakeTimers()
+    try {
+      mocks.stat.mockReturnValueOnce(new Promise(() => {}))
+      const stalled = readNativeChatTranscriptCached('claude', 'session-id')
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+
+      const result = await stalled
+      expect(result).toEqual({ error: SLOW_MESSAGE })
+      expect(result).not.toHaveProperty('notFound')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('re-attempts the stat on the next call instead of serving a poisoned entry', async () => {
+    // The stalled task above still holds its permit, so this fast-fails on the
+    // stuck route rather than waiting out a second deadline — but it must still
+    // reach `stat` again once a different distro answers.
+    const healthyPath = '\\\\wsl.localhost\\Debian\\home\\ada\\.claude\\projects\\p\\session.jsonl'
+    mocks.resolve.mockResolvedValue(healthyPath)
+    mocks.stat.mockResolvedValue({ mtimeMs: 5, size: 0 })
+    mocks.read.mockResolvedValue({ messages: [] })
+
+    await readNativeChatTranscriptCached('claude', 'session-id')
+
+    expect(mocks.stat).toHaveBeenCalledWith(healthyPath)
+  })
+
+  it('serves the cached parse rather than a retry banner once the distro stalls', async () => {
+    const path = '\\\\wsl.localhost\\Fedora\\home\\ada\\.claude\\projects\\p\\session.jsonl'
+    mocks.resolve.mockResolvedValue(path)
+    mocks.stat.mockResolvedValue({ mtimeMs: 9, size: 4 })
+    mocks.read.mockResolvedValue({ messages: [{ role: 'user', text: 'hi' }] })
+    const warm = await readNativeChatTranscriptCached('claude', 'session-id')
+
+    vi.useFakeTimers()
+    try {
+      mocks.stat.mockReturnValueOnce(new Promise(() => {}))
+      const stalled = readNativeChatTranscriptCached('claude', 'session-id')
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+
+      // The stat is what the stall refuses; the parse it would have validated is
+      // complete and unchanged, so the chat stays rendered.
+      await expect(stalled).resolves.toBe(warm)
+      expect(mocks.read).toHaveBeenCalledOnce()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
diff --git a/src/main/native-chat/transcript-read-cache.ts b/src/main/native-chat/transcript-read-cache.ts
index 8943c223dd2..ee0c8ddcafd 100644
--- a/src/main/native-chat/transcript-read-cache.ts
+++ b/src/main/native-chat/transcript-read-cache.ts
@@ -1,7 +1,13 @@
-import { stat } from 'node:fs/promises'
 import type { AgentType } from '../../shared/native-chat-types'
 import { resolveSessionFilePath } from './session-file-resolver'
 import { readNativeChatTranscript, type ReadTranscriptResult } from './transcript-reader'
+import { wslGatedStat } from './wsl-transcript-fs-access'
+import {
+  WSL_TRANSCRIPT_FS_CAPACITY_MESSAGE,
+  WSL_TRANSCRIPT_FS_SLOW_MESSAGE,
+  WslTranscriptFsError,
+  wslTranscriptFsRefusal
+} from './wsl-transcript-fs-gate'
 
 // Why: both the desktop IPC handler and the runtime RPC handler read the same
 // host-filesystem transcript, so a single process-global cache keyed by the
@@ -71,9 +77,14 @@ function cacheKey(agent: AgentType, filePath: string): string {
 
 async function fileStat(filePath: string): Promise<{ mtimeMs: number; bytes: number }> {
   try {
-    const stats = await stat(filePath)
+    const stats = await wslGatedStat(filePath, 'exact')
     return { mtimeMs: stats.mtimeMs, bytes: stats.size }
-  } catch {
+  } catch (err) {
+    // Why: swallowing a gate refusal into an unknown mtime falls through to a
+    // full read that burns a second deadline. Let the caller report it instead.
+    if (err instanceof WslTranscriptFsError) {
+      throw err
+    }
     return { mtimeMs: Number.NaN, bytes: 0 }
   }
 }
@@ -89,7 +100,14 @@ export async function readNativeChatTranscriptCached(
   /** Hook-reported authoritative transcript path, preferred over the id glob. */
   transcriptPath?: string
 ): Promise<ReadTranscriptResult> {
-  const filePath = await resolveSessionFilePath(agent, sessionId, { transcriptPath })
+  let filePath: string | null
+  try {
+    filePath = await resolveSessionFilePath(agent, sessionId, { transcriptPath })
+  } catch (err) {
+    // Why: gate refusal is transient unavailability — report it without caching
+    // or `notFound` so the next call re-resolves.
+    return { error: wslTranscriptFsRefusal(err).message }
+  }
   if (!filePath) {
     // Not cached (see below): a not-yet-flushed transcript should be re-checked
     // on the next call, not pinned as a settled miss (#8401).
@@ -97,8 +115,22 @@ export async function readNativeChatTranscriptCached(
   }
 
   const key = cacheKey(agent, filePath)
-  const { mtimeMs, bytes } = await fileStat(filePath)
   const cached = cache.get(key)
+  let mtimeMs: number
+  let bytes: number
+  try {
+    ;({ mtimeMs, bytes } = await fileStat(filePath))
+  } catch (err) {
+    // Why: the refusal says the distro stalled, not that this parse went stale —
+    // a complete cached transcript beats a retry banner. With nothing cached the
+    // error stands, and no `notFound`, so the next call re-stats a woken distro.
+    if (cached) {
+      // Bump recency so a session read through a stall survives eviction.
+      setCached(key, cached)
+      return cached.result
+    }
+    return { error: wslTranscriptFsRefusal(err).message }
+  }
   if (cached && Number.isFinite(mtimeMs) && cached.mtimeMs === mtimeMs) {
     // Bump recency so a frequently-read session survives eviction.
     setCached(key, cached)
@@ -106,12 +138,25 @@ export async function readNativeChatTranscriptCached(
   }
 
   const result = await readNativeChatTranscript(agent, sessionId, { filePath })
-  if (Number.isFinite(mtimeMs)) {
+  // Why: a body-read refusal is transient unavailability, but the file's mtime
+  // is unchanged by it — caching it would serve the retryable error to every
+  // later call until the transcript itself changes, even after the distro woke.
+  if (Number.isFinite(mtimeMs) && !isGateRefusal(result)) {
     setCached(key, { result, mtimeMs, bytes })
   }
   return result
 }
 
+// The reader flattens a refusal into its message, so that is the only handle
+// this layer has on one.
+function isGateRefusal(result: ReadTranscriptResult): boolean {
+  return (
+    'error' in result &&
+    (result.error === WSL_TRANSCRIPT_FS_SLOW_MESSAGE ||
+      result.error === WSL_TRANSCRIPT_FS_CAPACITY_MESSAGE)
+  )
+}
+
 /** Test-only: drop the transcript parse cache between runs. */
 export function clearNativeChatTranscriptCache(): void {
   cache.clear()
diff --git a/src/main/native-chat/transcript-reader-wsl-stall.test.ts b/src/main/native-chat/transcript-reader-wsl-stall.test.ts
new file mode 100644
index 00000000000..47d50ab74bc
--- /dev/null
+++ b/src/main/native-chat/transcript-reader-wsl-stall.test.ts
@@ -0,0 +1,85 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+
+const UNC_PATH = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.claude\\projects\\p\\session.jsonl'
+
+const mocks = vi.hoisted(() => ({ open: vi.fn() }))
+
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  open: mocks.open
+}))
+
+import { readNativeChatTranscript } from './transcript-reader'
+import { WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS } from './wsl-transcript-fs-gate'
+
+const SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+
+const LINE = JSON.stringify({
+  type: 'user',
+  uuid: 'u1',
+  timestamp: '2026-01-01T00:00:00.000Z',
+  message: { role: 'user', content: 'hi' }
+})
+
+function handleServing(body: Buffer, delayMs = 0) {
+  return {
+    read: vi.fn(
+      (buffer: Buffer, offset: number, length: number, position: number) =>
+        new Promise((resolve) => {
+          const slice = body.subarray(position, Math.min(position + length, body.length))
+          slice.copy(buffer, offset)
+          const settle = () => resolve({ bytesRead: slice.length, buffer })
+          if (delayMs > 0) {
+            setTimeout(settle, delayMs)
+          } else {
+            settle()
+          }
+        })
+    ),
+    close: vi.fn(async () => {})
+  }
+}
+
+beforeEach(() => {
+  mocks.open.mockReset()
+})
+
+describe('native chat transcript read with a stalled post-resolution body read', () => {
+  it('surfaces a retryable error without notFound when the first chunk never settles', async () => {
+    vi.useFakeTimers()
+    try {
+      mocks.open.mockResolvedValue({
+        read: vi.fn(() => new Promise(() => {})),
+        close: vi.fn(async () => {})
+      })
+      const reading = readNativeChatTranscript('claude', 'session-id', { filePath: UNC_PATH })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+
+      const result = await reading
+      expect(result).toEqual({ error: SLOW_MESSAGE })
+      expect(result).not.toHaveProperty('notFound')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('succeeds when every chunk is slow but under the deadline, past the whole-file budget', async () => {
+    vi.useFakeTimers()
+    const healthyPath = '\\\\wsl.localhost\\Debian\\home\\ada\\.claude\\projects\\p\\session.jsonl'
+    try {
+      const chunkDelayMs = WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS / 2
+      mocks.open.mockResolvedValue(handleServing(Buffer.from(`${LINE}\n`), chunkDelayMs))
+      const reading = readNativeChatTranscript('claude', 'session-id', { filePath: healthyPath })
+
+      // Two chunk admissions (body + EOF probe) span more than one exact deadline.
+      await vi.advanceTimersByTimeAsync(chunkDelayMs * 4)
+
+      const result = await reading
+      expect(result).toMatchObject({ messages: [expect.objectContaining({ id: 'u1' })] })
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
diff --git a/src/main/native-chat/transcript-reader.ts b/src/main/native-chat/transcript-reader.ts
index 8cb57fdb91d..a4d3acb7465 100644
--- a/src/main/native-chat/transcript-reader.ts
+++ b/src/main/native-chat/transcript-reader.ts
@@ -1,4 +1,3 @@
-import { createReadStream } from 'node:fs'
 import type {
   AgentType,
   NativeChatMessage,
@@ -7,6 +6,8 @@ import type {
 import { resolveNativeChatTranscriptAgent } from '../../shared/native-chat-agent-support'
 import { errorMessage } from '../ai-vault/session-scanner-values'
 import { resolveSessionFilePath, type ResolveSessionFileOptions } from './session-file-resolver'
+import { openTranscriptReadStream } from './wsl-transcript-fs-access'
+import { wslTranscriptFsRefusal } from './wsl-transcript-fs-gate'
 import {
   decodeClaudeTranscriptLine,
   decodeCodexTranscriptLine,
@@ -41,7 +42,14 @@ export async function readNativeChatTranscript(
   sessionId: string,
   options: ReadTranscriptOptions = {}
 ): Promise<ReadTranscriptResult> {
-  const filePath = options.filePath ?? (await resolveSessionFilePath(agent, sessionId, options))
+  let filePath: string | null
+  try {
+    filePath = options.filePath ?? (await resolveSessionFilePath(agent, sessionId, options))
+  } catch (err) {
+    // Why: gate refusal is transient unavailability with retry guidance —
+    // `notFound` would settle callers into a false "missing" state.
+    return { error: wslTranscriptFsRefusal(err).message }
+  }
   if (!filePath) {
     return { error: `No transcript found for ${agent} session ${sessionId}`, notFound: true }
   }
@@ -74,7 +82,7 @@ async function readTranscript(
   filePath: string,
   decode: (line: string, fallbackId: string) => NativeChatMessage | null
 ): Promise<NativeChatMessage[]> {
-  const stream = createReadStream(filePath, { encoding: 'utf-8' })
+  const stream = openTranscriptReadStream(filePath, { encoding: 'utf-8' }, 'exact')
   const { messages } = await decodeTranscriptStream(stream, filePath, 0, decode, true)
   return messages
 }
diff --git a/src/main/native-chat/transcript-stream-lines.test.ts b/src/main/native-chat/transcript-stream-lines.test.ts
index 2bfa6f6f9d2..bc80d88bc0a 100644
--- a/src/main/native-chat/transcript-stream-lines.test.ts
+++ b/src/main/native-chat/transcript-stream-lines.test.ts
@@ -32,6 +32,23 @@ describe('decodeTranscriptStream', () => {
     expect(incremental.messages[0]?.id).toBe(full.messages[1]?.id)
   })
 
+  it('keeps a codepoint split across two Buffer chunks intact', async () => {
+    const line = `{"text":"😀é中"}\n`
+    const bytes = Buffer.from(line, 'utf8')
+    // Split inside the emoji's 4-byte sequence, as a 1 MiB gated chunk boundary does.
+    const split = Buffer.from('{"text":"', 'utf8').length + 2
+    const result = await decodeTranscriptStream(
+      Readable.from([bytes.subarray(0, split), bytes.subarray(split)]),
+      '/chat.jsonl',
+      0,
+      decode,
+      false
+    )
+
+    expect(result.messages[0]?.blocks[0]).toEqual({ type: 'text', text: line.slice(0, -1) })
+    expect(result.consumedBytes).toBe(bytes.length)
+  })
+
   it('does not consume a partial trailing JSONL record', async () => {
     const complete = '{"first":true}\n'
     const partial = '{"second"'
diff --git a/src/main/native-chat/transcript-stream-lines.ts b/src/main/native-chat/transcript-stream-lines.ts
index a764941ad30..2d9e30915bc 100644
--- a/src/main/native-chat/transcript-stream-lines.ts
+++ b/src/main/native-chat/transcript-stream-lines.ts
@@ -1,4 +1,5 @@
 import type { Readable } from 'node:stream'
+import { StringDecoder } from 'node:string_decoder'
 import type { NativeChatMessage } from '../../shared/native-chat-types'
 import { transcriptFallbackId } from './transcript-fallback-id'
 
@@ -12,11 +13,14 @@ export async function decodeTranscriptStream(
   includeTrailingLine: boolean
 ): Promise<{ messages: NativeChatMessage[]; consumedBytes: number }> {
   const messages: NativeChatMessage[] = []
+  // Why: a Buffer chunk can end mid-codepoint, and decoding it standalone would
+  // both corrupt the line and shift `consumedBytes` (which seeds fallback ids).
+  const decoder = new StringDecoder('utf8')
   let pending = ''
   let consumedBytes = 0
 
   for await (const chunk of stream) {
-    pending += typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8')
+    pending += typeof chunk === 'string' ? chunk : decoder.write(Buffer.from(chunk))
     let newlineIndex = pending.indexOf('\n')
     while (newlineIndex !== -1) {
       const segment = pending.slice(0, newlineIndex + 1)
@@ -26,6 +30,7 @@ export async function decodeTranscriptStream(
       newlineIndex = pending.indexOf('\n')
     }
   }
+  pending += decoder.end()
 
   if (includeTrailingLine && pending.length > 0) {
     decodeLine(pending, consumedBytes)
diff --git a/src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts b/src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts
new file mode 100644
index 00000000000..da040de2794
--- /dev/null
+++ b/src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts
@@ -0,0 +1,112 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+
+const mocks = vi.hoisted(() => ({
+  resolve: vi.fn<() => Promise<string | null>>(),
+  stat: vi.fn(),
+  open: vi.fn()
+}))
+
+vi.mock('./session-file-resolver', () => ({
+  resolveSessionFilePath: mocks.resolve
+}))
+
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  stat: mocks.stat,
+  open: mocks.open
+}))
+
+import { readNativeChatTranscriptTail } from './transcript-tail-reader'
+import { WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS, WslTranscriptFsError } from './wsl-transcript-fs-gate'
+
+const SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+
+describe('native chat transcript tail under WSL gate refusals', () => {
+  beforeEach(() => {
+    mocks.resolve.mockReset()
+  })
+
+  it('reports a gate refusal as a retryable error, not a missing transcript', async () => {
+    mocks.resolve.mockRejectedValueOnce(new WslTranscriptFsError('timeout', 'slow share'))
+
+    await expect(
+      readNativeChatTranscriptTail({ agent: 'codex', sessionId: 'session-id', limit: 10 })
+    ).resolves.toEqual({ error: 'slow share' })
+  })
+
+  it('rethrows non-gate resolver failures', async () => {
+    mocks.resolve.mockRejectedValueOnce(new Error('resolver crashed'))
+
+    await expect(
+      readNativeChatTranscriptTail({ agent: 'codex', sessionId: 'session-id', limit: 10 })
+    ).rejects.toThrow('resolver crashed')
+  })
+})
+
+describe('native chat transcript tail with stalled post-resolution UNC I/O', () => {
+  const UNC_PATH = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.codex\\sessions\\a.jsonl'
+  // A stalled task holds its gate permit until the underlying call settles, so
+  // each case releases its stall before the next one runs.
+  let releaseStall: (() => void) | undefined
+
+  function stalls<T>(): Promise<T> {
+    return new Promise<T>((resolve) => {
+      releaseStall = () => resolve(undefined as T)
+    })
+  }
+
+  async function tailAfterStall(): Promise<unknown> {
+    const pending = readNativeChatTranscriptTail({
+      agent: 'codex',
+      sessionId: 'session-id',
+      filePath: UNC_PATH,
+      limit: 10
+    })
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+    return pending
+  }
+
+  beforeEach(() => {
+    mocks.stat.mockReset()
+    mocks.open.mockReset()
+    releaseStall = undefined
+    vi.useFakeTimers()
+  })
+
+  afterEach(async () => {
+    releaseStall?.()
+    await vi.advanceTimersByTimeAsync(0)
+    vi.useRealTimers()
+  })
+
+  it('reports a stalled stat as retryable without notFound', async () => {
+    mocks.stat.mockImplementation(stalls)
+    const result = await tailAfterStall()
+    expect(result).toEqual({ error: SLOW_MESSAGE })
+    expect(result).not.toHaveProperty('notFound')
+  })
+
+  it('reports a stalled open as retryable without notFound', async () => {
+    mocks.stat.mockResolvedValue({ size: 4096 })
+    mocks.open.mockImplementation(stalls)
+    const result = await tailAfterStall()
+    expect(result).toEqual({ error: SLOW_MESSAGE })
+    expect(result).not.toHaveProperty('notFound')
+  })
+
+  it('closes the handle without a second admission when a positional read stalls', async () => {
+    const close = vi.fn(async () => {})
+    mocks.stat.mockResolvedValue({ size: 4096 })
+    mocks.open.mockResolvedValue({ read: vi.fn(stalls), close })
+
+    const result = await tailAfterStall()
+
+    expect(result).toEqual({ error: SLOW_MESSAGE })
+    expect(result).not.toHaveProperty('notFound')
+    // Fire-and-forget close: never gated, never awaited, exactly once.
+    await vi.advanceTimersByTimeAsync(0)
+    expect(close).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/native-chat/transcript-tail-reader.ts b/src/main/native-chat/transcript-tail-reader.ts
index c7b1527858a..e9cbe430090 100644
--- a/src/main/native-chat/transcript-tail-reader.ts
+++ b/src/main/native-chat/transcript-tail-reader.ts
@@ -1,4 +1,4 @@
-import { open, stat } from 'node:fs/promises'
+import type { FileHandle } from 'node:fs/promises'
 import type {
   AgentType,
   NativeChatMessage,
@@ -17,6 +17,13 @@ import {
   nativeChatTurnLifecycleDecoderForAgent,
   type NativeChatTurnLifecycleDecoder
 } from './transcript-turn-lifecycle'
+import {
+  closeTranscriptHandle,
+  wslGatedOpen,
+  wslGatedRead,
+  wslGatedStat
+} from './wsl-transcript-fs-access'
+import { wslTranscriptFsRefusal } from './wsl-transcript-fs-gate'
 
 export const MAX_NATIVE_CHAT_TRANSCRIPT_RECORD_BYTES = 2 * 1024 * 1024
 const TAIL_CHUNK_BYTES = 64 * 1024
@@ -58,12 +65,15 @@ export async function readNativeChatTranscriptTailFile(
   oversizedRecordCount?: number
 }> {
   signal?.throwIfAborted()
-  const end = Math.min((await stat(filePath)).size, endOffset ?? Number.MAX_SAFE_INTEGER)
+  const end = Math.min(
+    (await wslGatedStat(filePath, 'exact', signal)).size,
+    endOffset ?? Number.MAX_SAFE_INTEGER
+  )
   signal?.throwIfAborted()
   if (end === 0) {
     return { messages: [], consumedTo: 0, hasMore: false, beforeOffset: 0 }
   }
-  const handle = await open(filePath, 'r')
+  const handle = await wslGatedOpen(filePath, 'exact', signal)
   const lineParts: Buffer[] = []
   let lineBytes = 0
   let lineOversized = false
@@ -75,13 +85,13 @@ export async function readNativeChatTranscriptTailFile(
     signal?.throwIfAborted()
     const consumedTo = includeTrailingLine
       ? end
-      : await findLastCompleteLineEnd(handle, end, signal)
+      : await findLastCompleteLineEnd(handle, filePath, end, signal)
     if (consumedTo === 0) {
       return { messages: [], consumedTo: 0, hasMore: false, beforeOffset: 0 }
     }
     const newestFirst: { message: NativeChatMessage; offset: number }[] = []
     const finalByte = Buffer.allocUnsafe(1)
-    await handle.read(finalByte, 0, 1, consumedTo - 1)
+    await wslGatedRead(handle, filePath, finalByte, 0, 1, consumedTo - 1, 'exact', signal)
     signal?.throwIfAborted()
     ignoreNextMalformedRecord = finalByte[0] !== 0x0a
     let cursor = consumedTo - (finalByte[0] === 0x0a ? 1 : 0)
@@ -89,7 +99,16 @@ export async function readNativeChatTranscriptTailFile(
       signal?.throwIfAborted()
       const start = Math.max(0, cursor - TAIL_CHUNK_BYTES)
       const buffer = Buffer.allocUnsafe(cursor - start)
-      const { bytesRead } = await handle.read(buffer, 0, buffer.length, start)
+      const { bytesRead } = await wslGatedRead(
+        handle,
+        filePath,
+        buffer,
+        0,
+        buffer.length,
+        start,
+        'exact',
+        signal
+      )
       signal?.throwIfAborted()
       let segmentEnd = bytesRead
       for (let index = bytesRead - 1; index >= 0 && newestFirst.length <= limit; index--) {
@@ -125,7 +144,7 @@ export async function readNativeChatTranscriptTailFile(
       ...(oversizedRecordCount > 0 ? { oversizedRecordCount } : {})
     }
   } finally {
-    await handle.close()
+    await closeTranscriptHandle(handle, filePath)
   }
 
   function retainPart(part: Buffer): void {
@@ -183,13 +202,14 @@ export async function readNativeChatTranscriptTailFile(
 }
 
 async function findLastCompleteLineEnd(
-  handle: Awaited<ReturnType<typeof open>>,
+  handle: FileHandle,
+  filePath: string,
   end: number,
   signal?: AbortSignal
 ): Promise<number> {
   signal?.throwIfAborted()
   const lastByte = Buffer.allocUnsafe(1)
-  await handle.read(lastByte, 0, 1, end - 1)
+  await wslGatedRead(handle, filePath, lastByte, 0, 1, end - 1, 'exact', signal)
   signal?.throwIfAborted()
   if (lastByte[0] === 0x0a) {
     return end
@@ -199,10 +219,19 @@ async function findLastCompleteLineEnd(
     signal?.throwIfAborted()
     const start = Math.max(0, cursor - TAIL_CHUNK_BYTES)
     const buffer = Buffer.allocUnsafe(cursor - start)
-    const { bytesRead } = await handle.read(buffer, 0, buffer.length, start)
+    const { bytesRead } = await wslGatedRead(
+      handle,
+      filePath,
+      buffer,
+      0,
+      buffer.length,
+      start,
+      'exact',
+      signal
+    )
     signal?.throwIfAborted()
     const newline = buffer.subarray(0, bytesRead).lastIndexOf(0x0a)
-    if (newline >= 0) {
+    if (newline !== -1) {
       return start + newline + 1
     }
     cursor = start
@@ -231,12 +260,20 @@ export async function readNativeChatTranscriptTail(
 > {
   const decode = nativeChatLineDecoderForAgent(args.agent)
   const decodeLifecycle = nativeChatTurnLifecycleDecoderForAgent(args.agent)
-  const filePath =
-    args.filePath ?? (await resolveSessionFilePath(args.agent, args.sessionId, args, signal))
-  signal?.throwIfAborted()
   if (!decode) {
     return { error: 'Transcript unavailable' }
   }
+  let filePath: string | null
+  try {
+    filePath =
+      args.filePath ?? (await resolveSessionFilePath(args.agent, args.sessionId, args, signal))
+  } catch (error) {
+    signal?.throwIfAborted()
+    // Why: gate refusal is transient unavailability with retry guidance —
+    // `notFound` would settle callers into a false "missing" state.
+    return { error: wslTranscriptFsRefusal(error).message }
+  }
+  signal?.throwIfAborted()
   // Why: a new agent session can report its id before the first JSONL flush;
   // callers keep that miss in loading/retry rather than showing a false error.
   if (!filePath) {
diff --git a/src/main/native-chat/transcript-watch-engine.ts b/src/main/native-chat/transcript-watch-engine.ts
index ff1df71ee0f..3c51319eae4 100644
--- a/src/main/native-chat/transcript-watch-engine.ts
+++ b/src/main/native-chat/transcript-watch-engine.ts
@@ -1,6 +1,6 @@
-import { open, stat } from 'node:fs/promises'
 import type { NativeChatMessage, NativeChatTurnLifecycle } from '../../shared/native-chat-types'
 import {
+  boundaryFingerprint,
   readTranscriptFileVersion,
   transcriptFileVersionChanged,
   type TranscriptFileVersion
@@ -18,6 +18,8 @@ import type {
   SubscribeNativeChatTranscriptArgs
 } from './transcript-watch-contract'
 import { createTranscriptWatchScheduler } from './transcript-watch-scheduler'
+import { wslGatedStat } from './wsl-transcript-fs-access'
+import { WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 const ROTATION_RETRY_MS = 25
 const MAX_ROTATION_RETRY_MS = 2_000
@@ -27,21 +29,6 @@ export function getActiveNativeChatWatcherCount(): number {
   return activeWatcherCount
 }
 
-async function boundaryFingerprint(filePath: string, offset: number): Promise<string> {
-  if (offset <= 0) {
-    return ''
-  }
-  const start = Math.max(0, offset - 64)
-  const handle = await open(filePath, 'r')
-  try {
-    const buffer = Buffer.allocUnsafe(offset - start)
-    const { bytesRead } = await handle.read(buffer, 0, buffer.length, start)
-    return buffer.subarray(0, bytesRead).toString('base64')
-  } finally {
-    await handle.close()
-  }
-}
-
 /**
  * Install the live-tail engine on an already-resolved file path. Returns null
  * when the file doesn't exist yet, so the caller falls back to resolve-polling.
@@ -51,11 +38,20 @@ async function boundaryFingerprint(filePath: string, offset: number): Promise<st
 export async function installTranscriptWatcher(
   filePath: string,
   decode: (line: string, fallbackId: string) => NativeChatMessage | null,
-  args: SubscribeNativeChatTranscriptArgs
+  args: SubscribeNativeChatTranscriptArgs,
+  /** Cancels the install probe so an unsubscribe during it detaches the gate
+   *  waiter immediately instead of at the 30s deadline. */
+  signal?: AbortSignal
 ): Promise<NativeChatTranscriptSubscription | null> {
   try {
-    await stat(filePath)
-  } catch {
+    await wslGatedStat(filePath, 'exact', signal)
+  } catch (error) {
+    // Why: "not flushed yet" degrades to resolve-polling, but a stalled distro
+    // must reach the caller so it can surface a retryable message instead of
+    // stranding the client at `loading`.
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
     return null
   }
   const { onAppend, onInitialSnapshot, onReplace, initialLimit } = args
@@ -75,6 +71,11 @@ export async function installTranscriptWatcher(
   // a persistently-failing retry loop can't spam the subscriber with error frames.
   let initialErrorEmitted = false
   let closed = false
+  // Why: every gated call on the drain path must detach the moment we
+  // unsubscribe, instead of holding a waiter until its 30s deadline, and an
+  // aborted signal also makes the gate refuse admission for anything the
+  // in-flight drain would start after teardown.
+  const gateAbort = new AbortController()
   let reading = false
   let pendingReadRequested = false
   let rotationRetryCount = 0
@@ -106,7 +107,8 @@ export async function installTranscriptWatcher(
       decodeLifecycle ?? undefined,
       (nextLifecycle) => {
         lifecycle = nextLifecycle
-      }
+      },
+      gateAbort.signal
     )
     if (!closed && (remaining.length > 0 || lifecycle)) {
       onAppend(remaining, lifecycle)
@@ -114,8 +116,8 @@ export async function installTranscriptWatcher(
   }
 
   async function finishSuccessfulDrain(startVersion: TranscriptFileVersion): Promise<void> {
-    watchedBoundary = await boundaryFingerprint(filePath, state.offset)
-    const completedVersion = await readTranscriptFileVersion(filePath)
+    watchedBoundary = await boundaryFingerprint(filePath, state.offset, gateAbort.signal)
+    const completedVersion = await readTranscriptFileVersion(filePath, gateAbort.signal)
     if (transcriptFileVersionChanged(completedVersion, startVersion)) {
       // Why: a write racing this drain needs another pass even when the reader
       // happened to reach its new EOF; timestamp-only rewrites may need replace.
@@ -135,8 +137,8 @@ export async function installTranscriptWatcher(
   }
 
   async function drainOnce(): Promise<void> {
-    const current = await readTranscriptFileVersion(filePath)
-    const currentBoundary = await boundaryFingerprint(filePath, state.offset)
+    const current = await readTranscriptFileVersion(filePath, gateAbort.signal)
+    const currentBoundary = await boundaryFingerprint(filePath, state.offset, gateAbort.signal)
     if (closed) {
       return
     }
@@ -168,7 +170,8 @@ export async function installTranscriptWatcher(
             decode,
             false,
             undefined,
-            decodeLifecycle
+            decodeLifecycle,
+            gateAbort.signal
           )
         : null
     if (closed) {
@@ -196,7 +199,8 @@ export async function installTranscriptWatcher(
             decode,
             false,
             undefined,
-            decodeLifecycle
+            decodeLifecycle,
+            gateAbort.signal
           )
         : null
     if (closed) {
@@ -225,7 +229,8 @@ export async function installTranscriptWatcher(
           decodeLifecycle ?? undefined,
           (nextLifecycle) => {
             lifecycle = nextLifecycle
-          }
+          },
+          gateAbort.signal
         )
         if (closed) {
           return
@@ -253,7 +258,7 @@ export async function installTranscriptWatcher(
         pendingReadRequested = false
         try {
           await drainOnce()
-        } catch {
+        } catch (error) {
           // Why: unlink/recreate can detach fs.watch from the pathname. Keep one
           // capped-backoff retry alive until a successor appears or we unsubscribe.
           // A still-pending initial drain also surfaces one error snapshot so a
@@ -261,7 +266,12 @@ export async function installTranscriptWatcher(
           // throwing; initialDrain stays true so a recovered read can still win.
           if (!closed && initialDrain && onInitialSnapshot && !initialErrorEmitted) {
             initialErrorEmitted = true
-            onInitialSnapshot([], false, 0, 'Transcript unavailable')
+            onInitialSnapshot(
+              [],
+              false,
+              0,
+              error instanceof WslTranscriptFsError ? error.message : 'Transcript unavailable'
+            )
           }
           scheduleRotationRetry()
           break
@@ -277,7 +287,7 @@ export async function installTranscriptWatcher(
       return
     }
     try {
-      const current = await readTranscriptFileVersion(filePath)
+      const current = await readTranscriptFileVersion(filePath, gateAbort.signal)
       if (closed) {
         return
       }
@@ -317,6 +327,7 @@ export async function installTranscriptWatcher(
         return
       }
       closed = true
+      gateAbort.abort(new Error('Native Chat transcript watcher unsubscribed'))
       scheduler.dispose()
       nativeWatcher.dispose()
       activeWatcherCount--
diff --git a/src/main/native-chat/transcript-watch-resolve-poll.test.ts b/src/main/native-chat/transcript-watch-resolve-poll.test.ts
index 70a264b93f2..e5ec941e5e9 100644
--- a/src/main/native-chat/transcript-watch-resolve-poll.test.ts
+++ b/src/main/native-chat/transcript-watch-resolve-poll.test.ts
@@ -20,6 +20,7 @@ vi.mock('./host-readable-transcript-path', async (importOriginal) => ({
 }))
 
 import { subscribeNativeChatTranscript } from './transcript-watch'
+import { WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 const realPlatform = process.platform
 
@@ -125,6 +126,41 @@ describe('native chat transcript resolve polling', () => {
     subscription.unsubscribe()
   })
 
+  it('degrades a gate-refused initial resolve to the poll fallback instead of failing', async () => {
+    const engine = { unsubscribe: vi.fn(), watching: true }
+    mocks.resolve
+      .mockRejectedValueOnce(new WslTranscriptFsError('unavailable', 'stuck permits'))
+      .mockResolvedValue('/home/ada/found.jsonl')
+    mocks.install.mockImplementation((filePath: string) => (filePath ? engine : null))
+
+    const subscription = await subscribeNativeChatTranscript({
+      agent: 'claude',
+      sessionId: 'session-id',
+      resolvePollIntervalMs: 10,
+      onAppend: () => {}
+    })
+    expect(subscription.watching).toBe(true)
+
+    await vi.advanceTimersByTimeAsync(20)
+    expect(
+      mocks.install.mock.calls.some(([filePath]) => filePath === '/home/ada/found.jsonl')
+    ).toBe(true)
+    subscription.unsubscribe()
+    expect(engine.unsubscribe).toHaveBeenCalled()
+  })
+
+  it('still fails subscribe on non-gate resolver errors', async () => {
+    mocks.resolve.mockRejectedValueOnce(new Error('resolver crashed'))
+
+    await expect(
+      subscribeNativeChatTranscript({
+        agent: 'claude',
+        sessionId: 'session-id',
+        onAppend: () => {}
+      })
+    ).rejects.toThrow('resolver crashed')
+  })
+
   it('cancels queued WSL resolution when the subscription closes', async () => {
     setPlatform('win32')
     let receivedSignal: AbortSignal | undefined
diff --git a/src/main/native-chat/transcript-watch-wsl-exact-path.test.ts b/src/main/native-chat/transcript-watch-wsl-exact-path.test.ts
index 5a483c11c48..814addff83c 100644
--- a/src/main/native-chat/transcript-watch-wsl-exact-path.test.ts
+++ b/src/main/native-chat/transcript-watch-wsl-exact-path.test.ts
@@ -68,7 +68,12 @@ describe('exact hook path install on a Windows host with WSL (#10326)', () => {
     })
 
     await vi.advanceTimersByTimeAsync(50)
-    expect(mocks.install).toHaveBeenCalledWith(ROLLOUT_UNC, expect.anything(), expect.anything())
+    expect(mocks.install).toHaveBeenCalledWith(
+      ROLLOUT_UNC,
+      expect.anything(),
+      expect.anything(),
+      expect.any(AbortSignal)
+    )
     expect(mocks.install.mock.calls.every(([path]) => path !== ROLLOUT_LINUX)).toBe(true)
     subscription.unsubscribe()
   })
@@ -84,7 +89,12 @@ describe('exact hook path install on a Windows host with WSL (#10326)', () => {
     })
 
     await vi.advanceTimersByTimeAsync(50)
-    expect(mocks.install).toHaveBeenCalledWith(ROLLOUT_LINUX, expect.anything(), expect.anything())
+    expect(mocks.install).toHaveBeenCalledWith(
+      ROLLOUT_LINUX,
+      expect.anything(),
+      expect.anything(),
+      expect.any(AbortSignal)
+    )
     subscription.unsubscribe()
   })
 })
diff --git a/src/main/native-chat/transcript-watch-wsl-stall.test.ts b/src/main/native-chat/transcript-watch-wsl-stall.test.ts
new file mode 100644
index 00000000000..3fd066325bb
--- /dev/null
+++ b/src/main/native-chat/transcript-watch-wsl-stall.test.ts
@@ -0,0 +1,175 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+import type { NativeChatMessage } from '../../shared/native-chat-types'
+
+const UNC_PATH = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.claude\\projects\\p\\session.jsonl'
+
+const mocks = vi.hoisted(() => ({
+  resolve: vi.fn<() => Promise<string | null>>(),
+  stat: vi.fn(),
+  open: vi.fn()
+}))
+
+vi.mock('./session-file-resolver', () => ({ resolveSessionFilePath: mocks.resolve }))
+vi.mock('./transcript-native-watcher', () => ({
+  createTranscriptNativeWatcher: () => ({
+    bind: () => true,
+    needsRebind: () => false,
+    invalidate: () => {},
+    dispose: () => {}
+  })
+}))
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  stat: mocks.stat,
+  open: mocks.open
+}))
+
+import { subscribeNativeChatTranscript } from './transcript-watch'
+import { WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS } from './wsl-transcript-fs-gate'
+
+const SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+
+type Snapshot = [NativeChatMessage[], boolean, number, string | undefined]
+
+let releaseStall: (() => void) | undefined
+let unhandled: unknown[] = []
+
+function stalls<T>(): Promise<T> {
+  return new Promise<T>((resolve) => {
+    releaseStall = () => resolve(undefined as T)
+  })
+}
+
+function subscribeCollecting(snapshots: Snapshot[]) {
+  return subscribeNativeChatTranscript({
+    agent: 'claude',
+    sessionId: 'session-id',
+    onAppend: () => {},
+    onInitialSnapshot: (messages, hasMore, beforeOffset, error) => {
+      snapshots.push([messages, hasMore, beforeOffset, error])
+    },
+    initialLimit: 10,
+    resolvePollIntervalMs: 50,
+    reconciliationIntervalMs: 1_000
+  })
+}
+
+function trackUnhandled(reason: unknown): void {
+  unhandled.push(reason)
+}
+
+beforeEach(() => {
+  mocks.resolve.mockReset()
+  mocks.stat.mockReset()
+  mocks.open.mockReset()
+  releaseStall = undefined
+  unhandled = []
+  process.on('unhandledRejection', trackUnhandled)
+  vi.useFakeTimers()
+})
+
+afterEach(async () => {
+  releaseStall?.()
+  await vi.advanceTimersByTimeAsync(0)
+  vi.useRealTimers()
+  process.off('unhandledRejection', trackUnhandled)
+})
+
+const EMPTY_STATS = { size: 0, mtimeMs: 1, ctimeMs: 1, ino: 1, dev: 1, mtime: new Date(0) }
+
+describe('native chat transcript subscription with a stalled install stat', () => {
+  it('keeps watching and emits exactly one retryable snapshot, then the real one', async () => {
+    mocks.resolve.mockResolvedValue(UNC_PATH)
+    mocks.stat.mockImplementationOnce(stalls).mockResolvedValue(EMPTY_STATS)
+    const snapshots: Snapshot[] = []
+
+    // Not awaited yet: the setup install is itself blocked on the stalled stat.
+    const subscribing = subscribeCollecting(snapshots)
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+    const subscription = await subscribing
+    expect(subscription.watching).toBe(true)
+
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+    expect(snapshots).toEqual([[[], false, 0, SLOW_MESSAGE]])
+
+    // Later poll ticks fast-fail on the still-stuck route without re-emitting.
+    await vi.advanceTimersByTimeAsync(500)
+    expect(snapshots).toHaveLength(1)
+
+    // The distro wakes: the same subscription still delivers a real snapshot.
+    releaseStall?.()
+    await vi.advanceTimersByTimeAsync(500)
+
+    expect(snapshots.length).toBeGreaterThan(1)
+    expect(snapshots.at(-1)?.[3]).toBeUndefined()
+    subscription.unsubscribe()
+    expect(unhandled).toEqual([])
+  })
+
+  it('keeps the poll loop alive on a non-gate resolve failure without emitting a frame', async () => {
+    // First resolve misses (transcript not flushed) so setup falls through to
+    // the poll loop; every later tick throws a non-gate error.
+    mocks.resolve
+      .mockResolvedValueOnce(null)
+      .mockRejectedValue(Object.assign(new Error('EACCES'), { code: 'EACCES' }))
+    const snapshots: Snapshot[] = []
+
+    const subscription = await subscribeCollecting(snapshots)
+    const attemptsAfterSetup = mocks.resolve.mock.calls.length
+    await vi.advanceTimersByTimeAsync(500)
+
+    expect(snapshots).toEqual([])
+    // Still retrying: the rethrow-free branch must not kill `void runAttempt()`.
+    expect(mocks.resolve.mock.calls.length).toBeGreaterThan(attemptsAfterSetup)
+    expect(unhandled).toEqual([])
+    subscription.unsubscribe()
+  })
+
+  it('detaches drain waiters on unsubscribe and starts no further gated work', async () => {
+    mocks.resolve.mockResolvedValue(UNC_PATH)
+    mocks.stat.mockResolvedValue({ ...EMPTY_STATS, size: 64 })
+    let releaseOpen: ((handle: unknown) => void) | undefined
+    mocks.open.mockReturnValue(
+      new Promise((resolve) => {
+        releaseOpen = resolve
+      })
+    )
+    const handle = {
+      read: vi.fn(async () => ({ bytesRead: 0, buffer: Buffer.alloc(0) })),
+      close: vi.fn(async () => {})
+    }
+
+    const subscription = await subscribeCollecting([])
+    await vi.advanceTimersByTimeAsync(100)
+    expect(mocks.open).toHaveBeenCalledTimes(1)
+    const statCallsAtTeardown = mocks.stat.mock.calls.length
+
+    subscription.unsubscribe()
+    // No timer advance: the waiter must detach on unsubscribe, not 30s later.
+    releaseOpen?.(handle)
+    await vi.advanceTimersByTimeAsync(0)
+
+    // The drain that was in flight must not admit anything more.
+    expect(handle.read).not.toHaveBeenCalled()
+    expect(mocks.stat.mock.calls.length).toBe(statCallsAtTeardown)
+    // Nobody is left to own the late handle, so the gate closes it.
+    expect(handle.close).toHaveBeenCalledTimes(1)
+    expect(unhandled).toEqual([])
+  })
+
+  it('tears down cleanly while an admission is still stalled', async () => {
+    mocks.resolve.mockResolvedValue(UNC_PATH)
+    mocks.stat.mockImplementation(stalls)
+    const snapshots: Snapshot[] = []
+
+    const subscribing = subscribeCollecting(snapshots)
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+    const subscription = await subscribing
+
+    expect(() => subscription.unsubscribe()).not.toThrow()
+    await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+    expect(unhandled).toEqual([])
+  })
+})
diff --git a/src/main/native-chat/transcript-watch.ts b/src/main/native-chat/transcript-watch.ts
index fff5bc60599..b2ef5b05ec3 100644
--- a/src/main/native-chat/transcript-watch.ts
+++ b/src/main/native-chat/transcript-watch.ts
@@ -11,6 +11,7 @@ import type {
   SubscribeNativeChatTranscriptArgs
 } from './transcript-watch-contract'
 import { nativeChatLineDecoderForAgent } from './transcript-tail-reader'
+import { WslTranscriptFsError, wslTranscriptFsRefusal } from './wsl-transcript-fs-gate'
 
 export { readNativeChatTranscriptTail } from './transcript-tail-reader'
 export { getActiveNativeChatWatcherCount } from './transcript-watch-engine'
@@ -32,7 +33,7 @@ async function attemptInstall(
   if (!filePath) {
     return null
   }
-  const installed = await installTranscriptWatcher(filePath, decode, args)
+  const installed = await installTranscriptWatcher(filePath, decode, args, signal)
   if (signal?.aborted) {
     installed?.unsubscribe()
     signal.throwIfAborted()
@@ -77,6 +78,9 @@ function subscribeViaResolvePoll(
   // the exact-path install doesn't wait on the slower id-glob (#10326).
   let hostReadableExactPath: string | null = null
   let lastWslTranslateAt = 0
+  // Latches only once a frame was actually emitted, so a subscriber without the
+  // callback can't suppress it for a later one.
+  let gateErrorEmitted = false
   const resolveController = new AbortController()
 
   function scheduleAttempt(): void {
@@ -140,9 +144,18 @@ function subscribeViaResolvePoll(
         lastFallbackResolveAt = Date.now()
         result = await attemptInstall(args, decode, resolveController.signal)
       }
-    } catch {
+    } catch (error) {
       // Why: a transient resolve failure (EACCES/EIO during the glob) must not
-      // kill the poll loop with an unhandled rejection — retry like a miss.
+      // kill the poll loop with an unhandled rejection — retry like a miss. A
+      // stalled WSL distro would otherwise poll silently forever, leaving the
+      // client at 'loading'; emit its retryable message once and keep polling,
+      // so a later tick's real snapshot still replaces it. Narrowed with a bare
+      // instanceof, never wslTranscriptFsRefusal — that helper rethrows, and
+      // runAttempt is invoked as `void runAttempt()`.
+      if (error instanceof WslTranscriptFsError && !gateErrorEmitted && args.onInitialSnapshot) {
+        gateErrorEmitted = true
+        args.onInitialSnapshot([], false, 0, error.message)
+      }
       result = null
     }
     if (closed) {
@@ -207,7 +220,16 @@ export async function subscribeNativeChatTranscript(
     return { unsubscribe: () => {}, watching: false }
   }
 
-  const installed = await attemptInstall(args, decode, setupSignal)
+  let installed: NativeChatTranscriptSubscription | null
+  try {
+    installed = await attemptInstall(args, decode, setupSignal)
+  } catch (error) {
+    setupSignal?.throwIfAborted()
+    // Why: a gate-refused resolve (stalled WSL distro) must degrade to the
+    // resolve-poll fallback below, not fail the subscribe outright.
+    void wslTranscriptFsRefusal(error) // rethrows anything that is not a gate refusal
+    installed = null
+  }
   if (installed) {
     return installed
   }
diff --git a/src/main/native-chat/wsl-transcript-fs-access.test.ts b/src/main/native-chat/wsl-transcript-fs-access.test.ts
new file mode 100644
index 00000000000..6f978453239
--- /dev/null
+++ b/src/main/native-chat/wsl-transcript-fs-access.test.ts
@@ -0,0 +1,400 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsModule from 'node:fs'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+import type * as GateModule from './wsl-transcript-fs-gate'
+
+const UNC_PATH = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.codex\\sessions\\a.jsonl'
+const OTHER_DISTRO_UNC_PATH = '\\\\wsl.localhost\\Debian\\home\\ada\\.codex\\sessions\\a.jsonl'
+const LEGACY_UNC_PATH = '\\\\wsl$\\Ubuntu\\home\\ada\\.codex\\sessions\\a.jsonl'
+const WINDOWS_PATH = 'C:\\Users\\ada\\.codex\\sessions\\a.jsonl'
+const POSIX_PATH = '/home/ada/.codex/sessions/a.jsonl'
+
+const mocks = vi.hoisted(() => ({
+  stat: vi.fn(),
+  lstat: vi.fn(),
+  readdir: vi.fn(),
+  readFile: vi.fn(),
+  open: vi.fn(),
+  createReadStream: vi.fn(),
+  runTask: vi.fn()
+}))
+
+vi.mock('node:fs', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsModule>()),
+  createReadStream: mocks.createReadStream
+}))
+
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  stat: mocks.stat,
+  lstat: mocks.lstat,
+  readdir: mocks.readdir,
+  readFile: mocks.readFile,
+  open: mocks.open
+}))
+
+vi.mock('./wsl-transcript-fs-gate', async (importOriginal) => {
+  const original = await importOriginal<typeof GateModule>()
+  mocks.runTask.mockImplementation(original.runWslTranscriptFsTask)
+  return { ...original, runWslTranscriptFsTask: mocks.runTask }
+})
+
+import {
+  closeTranscriptHandle,
+  openTranscriptReadStream,
+  readTranscriptSlice,
+  wslGatedLstat,
+  wslGatedOpen,
+  wslGatedRead,
+  wslGatedReaddir,
+  wslGatedReadFile,
+  wslGatedStat,
+  WSL_TRANSCRIPT_READ_CHUNK_BYTES
+} from './wsl-transcript-fs-access'
+import {
+  resetWslTranscriptFsGateForTests,
+  WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS,
+  WslTranscriptFsError
+} from './wsl-transcript-fs-gate'
+
+function fakeHandle() {
+  return { read: vi.fn(), close: vi.fn(async () => {}) }
+}
+
+beforeEach(() => {
+  // The gate mock delegates to the real implementation, so its module state
+  // survives between cases — a case that leaves a task stalled would otherwise
+  // mark that route stuck and fast-fail every later case on it.
+  resetWslTranscriptFsGateForTests()
+  // runTask keeps the real gate implementation installed by the mock factory;
+  // only its call log is cleared.
+  mocks.runTask.mockClear()
+  for (const [name, mock] of Object.entries(mocks)) {
+    if (name !== 'runTask') {
+      mock.mockReset()
+    }
+  }
+})
+
+describe('transcript filesystem accessor off WSL UNC', () => {
+  it.each([
+    ['a posix path', POSIX_PATH],
+    ['a Windows drive path', WINDOWS_PATH]
+  ])('never enters the gate for %s', async (_label, path) => {
+    mocks.stat.mockResolvedValue({ size: 1 })
+    mocks.lstat.mockResolvedValue({ size: 1 })
+    mocks.readdir.mockResolvedValue([])
+    mocks.readFile.mockResolvedValue('body')
+    const handle = fakeHandle()
+    handle.read.mockResolvedValue({ bytesRead: 0, buffer: Buffer.alloc(0) })
+    mocks.open.mockResolvedValue(handle)
+    mocks.createReadStream.mockReturnValue('raw-stream')
+
+    await wslGatedStat(path, 'exact')
+    await wslGatedLstat(path, 'scan')
+    await wslGatedReaddir(path, 'scan')
+    await wslGatedReadFile(path, 'utf-8', 'scan')
+    const opened = await wslGatedOpen(path, 'exact')
+    await wslGatedRead(opened, path, Buffer.alloc(1), 0, 1, 0, 'exact')
+    const stream = openTranscriptReadStream(path, { encoding: 'utf-8' }, 'scan')
+
+    expect(mocks.runTask).not.toHaveBeenCalled()
+    expect(mocks.stat).toHaveBeenCalledWith(path)
+    expect(mocks.readdir).toHaveBeenCalledWith(path, { withFileTypes: true })
+    expect(mocks.readFile).toHaveBeenCalledWith(path, 'utf-8')
+    expect(mocks.open).toHaveBeenCalledWith(path, 'r')
+    // Off UNC the raw stream is handed back verbatim, encoding included.
+    expect(stream).toBe('raw-stream')
+    expect(mocks.createReadStream).toHaveBeenCalledWith(path, {
+      encoding: 'utf-8',
+      signal: undefined
+    })
+  })
+
+  it('forwards the caller signal so the local stream honours cancellation', () => {
+    mocks.createReadStream.mockReturnValue('raw-stream')
+    const controller = new AbortController()
+
+    openTranscriptReadStream(POSIX_PATH, { start: 4 }, 'exact', controller.signal)
+
+    expect(mocks.createReadStream).toHaveBeenCalledWith(POSIX_PATH, {
+      start: 4,
+      signal: controller.signal
+    })
+  })
+})
+
+describe('transcript filesystem accessor on WSL UNC', () => {
+  it.each([
+    ['wsl.localhost', UNC_PATH],
+    ['wsl$', LEGACY_UNC_PATH]
+  ])('routes %s paths through the gate', async (_label, path) => {
+    mocks.stat.mockResolvedValue({ size: 7 })
+    mocks.lstat.mockResolvedValue({ size: 7 })
+    mocks.readdir.mockResolvedValue([])
+    mocks.readFile.mockResolvedValue('body')
+
+    await wslGatedStat(path, 'exact')
+    await wslGatedLstat(path, 'scan')
+    await wslGatedReaddir(path, 'scan')
+    await wslGatedReadFile(path, 'utf-8', 'scan')
+
+    expect(mocks.runTask.mock.calls.map(([options]) => options.operation)).toEqual([
+      'stat',
+      'lstat',
+      'readdir',
+      'readfile'
+    ])
+  })
+
+  it('opts positional reads and opens out of coalescing', async () => {
+    const handle = fakeHandle()
+    handle.read.mockResolvedValue({ bytesRead: 1, buffer: Buffer.alloc(1) })
+    mocks.open.mockResolvedValue(handle)
+
+    const opened = await wslGatedOpen(UNC_PATH, 'exact')
+    await wslGatedRead(opened, UNC_PATH, Buffer.alloc(1), 0, 1, 0, 'exact')
+
+    for (const call of mocks.runTask.mock.calls) {
+      expect(call[0]).toMatchObject({ dedupe: false })
+    }
+  })
+
+  it('reads a slice and closes the handle even when the read rejects', async () => {
+    const handle = fakeHandle()
+    handle.read.mockRejectedValue(new Error('EIO'))
+    mocks.open.mockResolvedValue(handle)
+
+    await expect(readTranscriptSlice(UNC_PATH, 4, 8, 'scan')).rejects.toThrow('EIO')
+    expect(handle.close).toHaveBeenCalledTimes(1)
+  })
+
+  it('yields Buffer chunks and closes the handle when the consumer destroys the stream', async () => {
+    const handle = fakeHandle()
+    handle.read.mockImplementation(
+      async (buffer: Buffer, offset: number, length: number, position: number) => {
+        const body = Buffer.from('{"a":1}\n{"b":2}\n')
+        const slice = body.subarray(position, Math.min(position + length, body.length))
+        slice.copy(buffer, offset)
+        return { bytesRead: slice.length, buffer }
+      }
+    )
+    mocks.open.mockResolvedValue(handle)
+
+    const stream = openTranscriptReadStream(UNC_PATH, {}, 'exact')
+    const chunks: unknown[] = []
+    for await (const chunk of stream) {
+      chunks.push(chunk)
+      break
+    }
+    stream.destroy()
+    await new Promise((resolve) => setImmediate(resolve))
+
+    expect(chunks).toHaveLength(1)
+    expect(Buffer.isBuffer(chunks[0])).toBe(true)
+    expect((chunks[0] as Buffer).toString('utf-8')).toBe('{"a":1}\n{"b":2}\n')
+    expect(handle.close).toHaveBeenCalledTimes(1)
+  })
+
+  it('swallows close failures so teardown never rejects', async () => {
+    const handle = fakeHandle()
+    handle.close.mockRejectedValue(new Error('stalled close'))
+    await expect(closeTranscriptHandle(handle as never, UNC_PATH)).resolves.toBeUndefined()
+    await new Promise((resolve) => setImmediate(resolve))
+  })
+
+  it('drains handle closes one at a time so teardown cannot flood the thread pool', async () => {
+    let releaseFirst: (() => void) | undefined
+    const first = fakeHandle()
+    first.close.mockReturnValue(
+      new Promise<void>((resolve) => {
+        releaseFirst = resolve
+      })
+    )
+    const second = fakeHandle()
+
+    await closeTranscriptHandle(first as never, UNC_PATH)
+    await closeTranscriptHandle(second as never, UNC_PATH)
+    await new Promise((resolve) => setImmediate(resolve))
+
+    // A blocked uv_fs_close holds a libuv thread the gate cannot see, so the
+    // second one must wait rather than occupy a thread of its own.
+    expect(first.close).toHaveBeenCalledTimes(1)
+    expect(second.close).not.toHaveBeenCalled()
+
+    releaseFirst?.()
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(second.close).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps a blocked close on one distro from stranding teardown on another', async () => {
+    let releaseStuck: (() => void) | undefined
+    const stuck = fakeHandle()
+    stuck.close.mockReturnValue(
+      new Promise<void>((resolve) => {
+        releaseStuck = resolve
+      })
+    )
+    const healthy = fakeHandle()
+
+    try {
+      await closeTranscriptHandle(stuck as never, UNC_PATH)
+      await closeTranscriptHandle(healthy as never, OTHER_DISTRO_UNC_PATH)
+      await new Promise((resolve) => setImmediate(resolve))
+
+      // A close that never settles on a stalled mount would hold a shared lane
+      // for the process lifetime, leaking every later descriptor with it.
+      expect(stuck.close).toHaveBeenCalledTimes(1)
+      expect(healthy.close).toHaveBeenCalledTimes(1)
+    } finally {
+      releaseStuck?.()
+      await new Promise((resolve) => setImmediate(resolve))
+    }
+  })
+
+  it.each([
+    ['stat', wslGatedStat, mocks.stat],
+    ['lstat', wslGatedLstat, mocks.lstat]
+  ])(
+    'detaches a cancelled %s waiter without waiting out the deadline',
+    async (_op, gated, mock) => {
+      let release: (() => void) | undefined
+      mock.mockReturnValue(
+        new Promise((resolve) => {
+          release = () => resolve({ size: 0 })
+        })
+      )
+      try {
+        const controller = new AbortController()
+        const reason = new Error('unsubscribed')
+        const pending = gated(UNC_PATH, 'exact', controller.signal)
+        const settled = pending.then(
+          () => 'resolved',
+          (error: unknown) => error
+        )
+        // Let the gate admit and start the syscall, so this covers the waiter on a
+        // RUNNING unabortable call rather than a still-queued one.
+        await new Promise((resolve) => setImmediate(resolve))
+        expect(mock).toHaveBeenCalledTimes(1)
+
+        controller.abort(reason)
+
+        // No timer advance: the waiter must be gone the moment the caller cancels,
+        // not 30s later when its deadline fires.
+        await expect(settled).resolves.toBe(reason)
+      } finally {
+        release?.()
+        await new Promise((resolve) => setImmediate(resolve))
+      }
+    }
+  )
+
+  it('closes an abandoned open whose syscall lands after the caller gave up', async () => {
+    vi.useFakeTimers()
+    let release: ((handle: unknown) => void) | undefined
+    mocks.open.mockReturnValue(
+      new Promise((resolve) => {
+        release = resolve
+      })
+    )
+    try {
+      const handle = fakeHandle()
+      const refused = wslGatedOpen(UNC_PATH, 'exact').catch((error: unknown) => error)
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+      await expect(refused).resolves.toBeInstanceOf(WslTranscriptFsError)
+
+      release?.(handle)
+      await vi.advanceTimersByTimeAsync(0)
+
+      // Nobody received the handle, so the gate owns closing it.
+      expect(handle.close).toHaveBeenCalledTimes(1)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
+
+describe('transcript handle close off WSL UNC', () => {
+  it('awaits teardown and surfaces the failure, as the raw close did', async () => {
+    const handle = fakeHandle()
+    let closed = false
+    handle.close.mockImplementation(async () => {
+      await new Promise((resolve) => setImmediate(resolve))
+      closed = true
+    })
+
+    await closeTranscriptHandle(handle as never, POSIX_PATH)
+    expect(closed).toBe(true)
+
+    handle.close.mockRejectedValue(new Error('EIO on close'))
+    await expect(closeTranscriptHandle(handle as never, WINDOWS_PATH)).rejects.toThrow(
+      'EIO on close'
+    )
+  })
+})
+
+describe('per-chunk admission', () => {
+  it('carries a codepoint straddling the 1 MiB chunk boundary across chunks', async () => {
+    const emoji = Buffer.from('😀', 'utf8')
+    // Two of the emoji's four bytes land in chunk 1, two in chunk 2 — derived
+    // from the production constant so the fixture cannot drift off the boundary.
+    const body = Buffer.concat([
+      Buffer.alloc(WSL_TRANSCRIPT_READ_CHUNK_BYTES - 2, 0x61),
+      emoji,
+      Buffer.from('tail\n', 'utf8')
+    ])
+    const handle = fakeHandle()
+    handle.read.mockImplementation(
+      async (buffer: Buffer, offset: number, length: number, position: number) => {
+        const slice = body.subarray(position, Math.min(position + length, body.length))
+        slice.copy(buffer, offset)
+        return { bytesRead: slice.length, buffer }
+      }
+    )
+    mocks.open.mockResolvedValue(handle)
+
+    const stream = openTranscriptReadStream(UNC_PATH, { encoding: 'utf-8' }, 'exact')
+    let decoded = ''
+    for await (const chunk of stream) {
+      expect(typeof chunk).toBe('string')
+      decoded += chunk as string
+    }
+
+    expect(decoded).not.toContain('�')
+    expect(decoded).toBe(body.toString('utf8'))
+    expect(handle.read.mock.calls.length).toBeGreaterThan(1)
+  })
+
+  it('surfaces a gate refusal mid-stream as an error event', async () => {
+    vi.useFakeTimers()
+    try {
+      let served = 0
+      const handle = fakeHandle()
+      handle.read.mockImplementation((buffer: Buffer) => {
+        if (served++ === 0) {
+          buffer.write('x')
+          return Promise.resolve({ bytesRead: 1, buffer })
+        }
+        return new Promise(() => {})
+      })
+      mocks.open.mockResolvedValue(handle)
+
+      const stream = openTranscriptReadStream(UNC_PATH, {}, 'exact')
+      const drained = (async () => {
+        for await (const chunk of stream) {
+          void chunk
+        }
+      })()
+      const settled = drained.then(
+        () => null,
+        (error: unknown) => error
+      )
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS + 1)
+
+      await expect(settled).resolves.toBeInstanceOf(WslTranscriptFsError)
+      expect(handle.close).toHaveBeenCalledTimes(1)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
diff --git a/src/main/native-chat/wsl-transcript-fs-access.ts b/src/main/native-chat/wsl-transcript-fs-access.ts
new file mode 100644
index 00000000000..b50c1b1f5f6
--- /dev/null
+++ b/src/main/native-chat/wsl-transcript-fs-access.ts
@@ -0,0 +1,276 @@
+import { createReadStream, type Dirent, type Stats } from 'node:fs'
+import { lstat, open, readdir, readFile, stat, type FileHandle } from 'node:fs/promises'
+import { Readable } from 'node:stream'
+import { StringDecoder } from 'node:string_decoder'
+import { isWslUncPath } from '../../shared/wsl-paths'
+import { runWslTranscriptFsTask, type WslTranscriptFsTaskPriority } from './wsl-transcript-fs-gate'
+import { wslTranscriptFsRouteKey } from './wsl-transcript-fs-route'
+
+/** Never nest a gated call inside another — that deadlocks the scan slot. */
+
+// Why: one deadline per chunk instead of one for the whole file, so a large
+// healthy-but-slow transcript is not false-failed by a whole-file timeout.
+export const WSL_TRANSCRIPT_READ_CHUNK_BYTES = 1024 * 1024
+type Operation = Parameters<typeof runWslTranscriptFsTask>[0]['operation']
+
+function runPathOperation<T>(
+  operation: Operation,
+  path: string,
+  priority: WslTranscriptFsTaskPriority,
+  signal: AbortSignal | undefined,
+  task: () => Promise<T>,
+  options?: { dedupe?: boolean; onAbandonedResult?: (value: T) => void }
+): Promise<T> {
+  return isWslUncPath(path)
+    ? runWslTranscriptFsTask({ operation, path, priority, signal, ...options }, task)
+    : task()
+}
+
+export function wslGatedStat(
+  path: string,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Promise<Stats> {
+  return runPathOperation('stat', path, priority, signal, () => stat(path))
+}
+
+export function wslGatedLstat(
+  path: string,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Promise<Stats> {
+  return runPathOperation('lstat', path, priority, signal, () => lstat(path))
+}
+
+export function wslGatedReaddir(
+  path: string,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Promise<Dirent[]> {
+  return runPathOperation('readdir', path, priority, signal, () =>
+    readdir(path, { withFileTypes: true })
+  )
+}
+
+export function wslGatedReadFile(
+  path: string,
+  encoding: BufferEncoding,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Promise<string> {
+  return runPathOperation('readfile', path, priority, signal, () => readFile(path, encoding))
+}
+
+// dedupe:false — two joiners would share one FileHandle and both close it.
+export function wslGatedOpen(
+  path: string,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Promise<FileHandle> {
+  return runPathOperation('open', path, priority, signal, () => open(path, 'r'), {
+    dedupe: false,
+    // An unabortable open can still succeed after its caller timed out or
+    // cancelled; without this the descriptor leaks for the process lifetime.
+    onAbandonedResult: (handle) => void closeTranscriptHandle(handle, path)
+  })
+}
+
+/**
+ * `path` is only the gate's route key and UNC guard — the handle carries no
+ * path and is never re-opened. dedupe:false because `read` fills the CALLER's
+ * buffer: a joiner would receive the first caller's buffer while its own
+ * (often `Buffer.allocUnsafe`) stays uninitialized.
+ */
+export function wslGatedRead(
+  handle: FileHandle,
+  path: string,
+  buffer: Buffer,
+  offset: number,
+  length: number,
+  position: number,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Promise<{ bytesRead: number; buffer: Buffer }> {
+  return runPathOperation(
+    'read',
+    path,
+    priority,
+    signal,
+    () => handle.read(buffer, offset, length, position),
+    { dedupe: false }
+  )
+}
+
+// A blocked `uv_fs_close` holds a libuv threadpool thread just like a blocked
+// read does, but it is invisible to the gate — so UNC teardown drains one handle
+// at a time. Unbounded fire-and-forget closes are what would exhaust the pool the
+// gate's two permits are sized against, re-creating the process-wide stall the
+// gate exists to prevent; serializing them costs at most one extra busy thread.
+// The queue cannot grow without bound: opens on a stuck route already fast-fail.
+// Keyed by route like the gate's own admission, because a close that blocks on a
+// stalled distro never settles — a shared queue would strand every later close,
+// including handles on healthy distros, for the process lifetime.
+const MAX_CONCURRENT_UNC_CLOSES_PER_ROUTE = 1
+type RouteCloseQueue = { queued: FileHandle[]; active: number }
+const closeQueuesByRoute = new Map<string, RouteCloseQueue>()
+
+function drainQueuedCloses(route: string): void {
+  const lane = closeQueuesByRoute.get(route)
+  if (!lane) {
+    return
+  }
+  while (lane.active < MAX_CONCURRENT_UNC_CLOSES_PER_ROUTE) {
+    const handle = lane.queued.shift()
+    if (!handle) {
+      if (lane.active === 0) {
+        closeQueuesByRoute.delete(route)
+      }
+      return
+    }
+    lane.active += 1
+    void handle
+      .close()
+      .catch(() => {})
+      .finally(() => {
+        lane.active -= 1
+        drainQueuedCloses(route)
+      })
+  }
+}
+
+/**
+ * Never gated. Off UNC this is the prior contract verbatim — the caller awaits
+ * fd teardown and a close failure surfaces. On UNC it is fire-and-forget:
+ * closing a handle on a stalled mount can itself block, and a gated close would
+ * burn a permit and a waiter deadline purely for teardown. One leaked fd until
+ * the OS unblocks beats a second blocked waiter.
+ */
+export function closeTranscriptHandle(handle: FileHandle, path: string): Promise<void> {
+  if (!isWslUncPath(path)) {
+    return handle.close()
+  }
+  const route = wslTranscriptFsRouteKey(path)
+  const lane = closeQueuesByRoute.get(route) ?? { queued: [], active: 0 }
+  closeQueuesByRoute.set(route, lane)
+  lane.queued.push(handle)
+  drainQueuedCloses(route)
+  return Promise.resolve()
+}
+
+/**
+ * Open, read one slice, close — for callers that want bytes at an offset and
+ * never touch the handle. Each of the two syscalls is admitted separately, so a
+ * stalled mount fails at whichever one it blocks on.
+ */
+export async function readTranscriptSlice(
+  path: string,
+  position: number,
+  length: number,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Promise<Buffer> {
+  const handle = await wslGatedOpen(path, priority, signal)
+  try {
+    const buffer = Buffer.allocUnsafe(length)
+    const { bytesRead } = await wslGatedRead(
+      handle,
+      path,
+      buffer,
+      0,
+      length,
+      position,
+      priority,
+      signal
+    )
+    return buffer.subarray(0, bytesRead)
+  } finally {
+    await closeTranscriptHandle(handle, path)
+  }
+}
+
+export type TranscriptReadStreamOptions = {
+  start?: number
+  /** Inclusive, matching `createReadStream`. */
+  end?: number
+  /** Set it to get decoded string chunks on both branches; leave it unset and
+   *  the UNC branch yields `Buffer`s the consumer must decode incrementally
+   *  itself, since a chunk boundary can split a multibyte codepoint. */
+  encoding?: BufferEncoding
+}
+
+async function* gatedChunks(
+  path: string,
+  options: TranscriptReadStreamOptions,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): AsyncGenerator<Buffer | string> {
+  const handle = await wslGatedOpen(path, priority, signal)
+  // Why: chunk boundaries fall mid-codepoint, so decoding each slice
+  // independently would emit U+FFFD on both sides of any straddling character.
+  const decoder = options.encoding ? new StringDecoder(options.encoding) : null
+  try {
+    let position = options.start ?? 0
+    for (;;) {
+      const length =
+        options.end === undefined
+          ? WSL_TRANSCRIPT_READ_CHUNK_BYTES
+          : Math.min(WSL_TRANSCRIPT_READ_CHUNK_BYTES, options.end - position + 1)
+      if (length <= 0) {
+        break
+      }
+      const buffer = Buffer.allocUnsafe(length)
+      const { bytesRead } = await wslGatedRead(
+        handle,
+        path,
+        buffer,
+        0,
+        length,
+        position,
+        priority,
+        signal
+      )
+      if (bytesRead <= 0) {
+        break
+      }
+      position += bytesRead
+      const chunk = buffer.subarray(0, bytesRead)
+      if (!decoder) {
+        yield chunk
+        continue
+      }
+      const decoded = decoder.write(chunk)
+      if (decoded) {
+        yield decoded
+      }
+    }
+    // Trailing bytes of an incomplete sequence at EOF, replacement-char'd once.
+    const trailing = decoder?.end()
+    if (trailing) {
+      yield trailing
+    }
+  } finally {
+    // Runs on `.destroy()` too (Readable.from calls the generator's return()),
+    // so an aborted head-read cannot leak the gated handle.
+    await closeTranscriptHandle(handle, path)
+  }
+}
+
+/**
+ * A read stream whose UNC branch admits and deadlines each 1 MiB chunk
+ * separately. A gate refusal mid-stream surfaces as an `'error'` event carrying
+ * the `WslTranscriptFsError`, which every existing consumer funnels into its
+ * `catch`.
+ */
+export function openTranscriptReadStream(
+  path: string,
+  options: TranscriptReadStreamOptions,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Readable {
+  if (!isWslUncPath(path)) {
+    // Node destroys the stream with an AbortError on abort, matching how the
+    // gated branch surfaces cancellation to the same consumers.
+    return createReadStream(path, { ...options, signal })
+  }
+  return Readable.from(gatedChunks(path, options, priority, signal))
+}
diff --git a/src/main/native-chat/wsl-transcript-fs-gate.test.ts b/src/main/native-chat/wsl-transcript-fs-gate.test.ts
index b434d13cc4e..9c979002d01 100644
--- a/src/main/native-chat/wsl-transcript-fs-gate.test.ts
+++ b/src/main/native-chat/wsl-transcript-fs-gate.test.ts
@@ -1,5 +1,17 @@
-import { describe, expect, it, vi } from 'vitest'
-import { runWslTranscriptFsTask } from './wsl-transcript-fs-gate'
+import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from 'vitest'
+import {
+  runWslTranscriptFsTask,
+  WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS,
+  WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS,
+  WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK,
+  WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS,
+  WslTranscriptFsError
+} from './wsl-transcript-fs-gate'
+
+const SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+const CAPACITY_MESSAGE =
+  'WSL transcript discovery is temporarily unavailable because too many filesystem requests are already waiting. Try again shortly or restart Orca if the issue continues.'
 
 function deferred<T>(): {
   promise: Promise<T>
@@ -28,6 +40,16 @@ function run(
 }
 
 describe('WSL transcript filesystem task scheduling', () => {
+  let warnSpy: MockInstance
+
+  beforeEach(() => {
+    warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    warnSpy.mockRestore()
+  })
+
   it('does not block an exact probe behind a running scan on the same route', async () => {
     const stalled = deferred<string>()
     const scanTask = vi.fn(() => stalled.promise)
@@ -97,8 +119,9 @@ describe('WSL transcript filesystem task scheduling', () => {
     const abandonedTask = vi.fn(async () => 'unused')
     const abandoned = run('\\\\wsl.localhost\\Fedora\\a', 'scan', abandonedTask, controller.signal)
 
-    controller.abort(new Error('closed subscription'))
-    await expect(abandoned).rejects.toThrow('closed subscription')
+    const reason = new Error('closed subscription')
+    controller.abort(reason)
+    await expect(abandoned).rejects.toBe(reason)
     ubuntu.resolve('ubuntu')
     debian.resolve('debian')
     await Promise.all([first, second])
@@ -116,6 +139,29 @@ describe('WSL transcript filesystem task scheduling', () => {
     expect(duplicateTask).not.toHaveBeenCalled()
   })
 
+  it('never joins an exact probe onto the same file queued as scan work', async () => {
+    const transcript = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\live.jsonl'
+    const statTask = (priority: 'exact' | 'scan', task: () => Promise<string>): Promise<string> =>
+      runWslTranscriptFsTask({ operation: 'stat', path: transcript, priority }, task)
+    // Hold the single scan slot on another distro so the same-file scan stat
+    // cannot run — a joiner would inherit exactly that queued position.
+    const blocked = deferred<string>()
+    const holderTask = vi.fn(() => blocked.promise)
+    const holder = run('\\\\wsl.localhost\\Debian\\tree', 'scan', holderTask)
+    await vi.waitFor(() => expect(holderTask).toHaveBeenCalledOnce())
+
+    const scanTask = vi.fn(async () => 'scan')
+    const scanned = statTask('scan', scanTask)
+    const exactTask = vi.fn(async () => 'exact')
+
+    await expect(statTask('exact', exactTask)).resolves.toBe('exact')
+    expect(exactTask).toHaveBeenCalledOnce()
+    expect(scanTask).not.toHaveBeenCalled()
+
+    blocked.resolve('holder')
+    await expect(Promise.all([holder, scanned])).resolves.toEqual(['holder', 'scan'])
+  })
+
   it('keeps shared work needed by a remaining waiter', async () => {
     const pending = deferred<string>()
     const task = vi.fn(() => pending.promise)
@@ -125,8 +171,9 @@ describe('WSL transcript filesystem task scheduling', () => {
     const second = run('\\\\wsl.localhost\\Ubuntu\\shared', 'exact', task, secondController.signal)
     await vi.waitFor(() => expect(task).toHaveBeenCalledOnce())
 
-    firstController.abort(new Error('first closed'))
-    await expect(first).rejects.toThrow('first closed')
+    const reason = new Error('first closed')
+    firstController.abort(reason)
+    await expect(first).rejects.toBe(reason)
     pending.resolve('second')
     await expect(second).resolves.toBe('second')
     expect(task).toHaveBeenCalledOnce()
@@ -175,4 +222,507 @@ describe('WSL transcript filesystem task scheduling', () => {
 
     await expect(Promise.all(tasks)).resolves.toEqual(['0', '1', '2', '3'])
   })
+
+  it.each([
+    ['exact', WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS],
+    ['scan', WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS]
+  ] as const)('rejects a stalled %s waiter at its deadline', async (priority, deadlineMs) => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const task = vi.fn(() => stalled.promise)
+      const pending = run(`\\\\wsl.localhost\\Deadline-${priority}\\a`, priority, task)
+      const rejected = expect(pending).rejects.toMatchObject({
+        name: 'WslTranscriptFsError',
+        code: 'timeout',
+        message: SLOW_MESSAGE
+      })
+      let settled = false
+      void pending.then(
+        () => (settled = true),
+        () => (settled = true)
+      )
+
+      await vi.advanceTimersByTimeAsync(0)
+      expect(task).toHaveBeenCalledOnce()
+      await vi.advanceTimersByTimeAsync(deadlineMs - 1)
+      expect(settled).toBe(false)
+      await vi.advanceTimersByTimeAsync(1)
+      await rejected
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it.each([
+    ['exact', WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS],
+    ['scan', WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS]
+  ] as const)('completes healthy %s work below its deadline', async (priority, deadlineMs) => {
+    vi.useFakeTimers()
+    const work = deferred<string>()
+    try {
+      const pending = run(`\\\\wsl.localhost\\Healthy-${priority}\\a`, priority, () => work.promise)
+
+      await vi.advanceTimersByTimeAsync(deadlineMs - 1)
+      work.resolve('healthy')
+      await expect(pending).resolves.toBe('healthy')
+      expect(vi.getTimerCount()).toBe(0)
+      await vi.advanceTimersByTimeAsync(deadlineMs)
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      work.resolve('healthy')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not let one timed-out waiter settle a later shared waiter', async () => {
+    vi.useFakeTimers()
+    const work = deferred<string>()
+    const task = vi.fn(() => work.promise)
+    try {
+      const path = '\\\\wsl.localhost\\Ubuntu\\staggered'
+      const first = run(path, 'exact', task)
+      const firstRejected = expect(first).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(10_000)
+      const second = run(path, 'exact', task)
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS - 10_000)
+      await firstRejected
+      work.resolve('shared')
+      await expect(second).resolves.toBe('shared')
+      expect(task).toHaveBeenCalledOnce()
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      work.resolve('shared')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('rejects newest work when the pending queue is full', async () => {
+    vi.useFakeTimers()
+    const ubuntu = deferred<string>()
+    const debian = deferred<string>()
+    const queuedController = new AbortController()
+    try {
+      const ubuntuTask = vi.fn(() => ubuntu.promise)
+      const debianTask = vi.fn(() => debian.promise)
+      const first = run('\\\\wsl.localhost\\Ubuntu\\occupied', 'exact', ubuntuTask)
+      const second = run('\\\\wsl.localhost\\Debian\\occupied', 'exact', debianTask)
+      await vi.advanceTimersByTimeAsync(0)
+
+      const queued = Array.from({ length: WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS }, (_, index) =>
+        run(
+          `\\\\wsl.localhost\\Queued-${index}\\a`,
+          'exact',
+          async () => String(index),
+          index === 0 ? queuedController.signal : undefined
+        )
+      )
+      const overflowTask = vi.fn(async () => 'overflow')
+      await expect(
+        run('\\\\wsl.localhost\\Overflow\\a', 'exact', overflowTask)
+      ).rejects.toMatchObject({ code: 'capacity', message: CAPACITY_MESSAGE })
+      expect(overflowTask).not.toHaveBeenCalled()
+
+      const reason = new Error('queued caller closed')
+      queuedController.abort(reason)
+      await expect(queued[0]).rejects.toBe(reason)
+      const replacement = run('\\\\wsl.localhost\\Replacement\\a', 'exact', async () => 'new')
+
+      ubuntu.resolve('ubuntu')
+      debian.resolve('debian')
+      await expect(
+        Promise.all([first, second, ...queued.slice(1), replacement])
+      ).resolves.toHaveLength(WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS + 2)
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      ubuntu.resolve('ubuntu')
+      debian.resolve('debian')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('caps callers waiting on shared work', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    const task = vi.fn(() => stalled.promise)
+    const firstController = new AbortController()
+    try {
+      const path = '\\\\wsl.localhost\\Ubuntu\\shared-cap'
+      const waiters = Array.from({ length: WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK }, (_, index) =>
+        run(path, 'exact', task, index === 0 ? firstController.signal : undefined)
+      )
+      await vi.advanceTimersByTimeAsync(0)
+
+      await expect(run(path, 'exact', task)).rejects.toMatchObject({
+        code: 'capacity',
+        message: CAPACITY_MESSAGE
+      })
+      const reason = new Error('first waiter closed')
+      firstController.abort(reason)
+      await expect(waiters[0]).rejects.toBe(reason)
+      const replacement = run(path, 'exact', task)
+      stalled.resolve('shared')
+      await expect(Promise.all([...waiters.slice(1), replacement])).resolves.toEqual(
+        Array(WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK).fill('shared')
+      )
+      expect(task).toHaveBeenCalledOnce()
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      stalled.resolve('shared')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('fails new work fast after both running permits stall', async () => {
+    vi.useFakeTimers()
+    const ubuntu = deferred<string>()
+    const debian = deferred<string>()
+    try {
+      const first = run('\\\\wsl.localhost\\Ubuntu\\stalled', 'exact', () => ubuntu.promise)
+      const second = run('\\\\wsl.localhost\\Debian\\stalled', 'exact', () => debian.promise)
+      const firstRejected = expect(first).rejects.toBeInstanceOf(WslTranscriptFsError)
+      const secondRejected = expect(second).rejects.toBeInstanceOf(WslTranscriptFsError)
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await Promise.all([firstRejected, secondRejected])
+      const laterTask = vi.fn(async () => 'later')
+      await expect(
+        run('\\\\wsl.localhost\\Fedora\\later', 'exact', laterTask)
+      ).rejects.toMatchObject({ code: 'unavailable', message: SLOW_MESSAGE })
+      expect(laterTask).not.toHaveBeenCalled()
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      ubuntu.resolve('ubuntu')
+      debian.resolve('debian')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('fails only work needing a stuck lane fast, keeping the other permit usable', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\lane-stuck', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await stuckRejected
+
+      const sameLaneTask = vi.fn(async () => 'same-lane')
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\lane-stuck-sibling', 'exact', sameLaneTask)
+      ).rejects.toMatchObject({ code: 'unavailable', message: SLOW_MESSAGE })
+      expect(sameLaneTask).not.toHaveBeenCalled()
+      await expect(
+        run('\\\\wsl.localhost\\Debian\\healthy-lane', 'exact', async () => 'debian')
+      ).resolves.toBe('debian')
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('fails scans and same-route probes fast while a scan is stuck', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuckScan = run('\\\\wsl.localhost\\Ubuntu\\stuck-tree', 'scan', () => stalled.promise)
+      const stuckRejected = expect(stuckScan).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS)
+      await stuckRejected
+
+      const otherScanTask = vi.fn(async () => 'other-scan')
+      await expect(
+        run('\\\\wsl.localhost\\Debian\\other-tree', 'scan', otherScanTask)
+      ).rejects.toMatchObject({ code: 'unavailable' })
+      expect(otherScanTask).not.toHaveBeenCalled()
+      // The whole Ubuntu mount is hung — an exact probe there would only burn
+      // the remaining permit on it.
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\live-probe', 'exact', async () => 'exact')
+      ).rejects.toMatchObject({ code: 'unavailable' })
+      await expect(
+        run('\\\\wsl.localhost\\Debian\\live-probe', 'exact', async () => 'exact')
+      ).resolves.toBe('exact')
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps a stuck exact probe from feeding a doomed scan the second permit', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\hung-file', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await stuckRejected
+
+      const doomedScanTask = vi.fn(async () => 'doomed')
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\tree', 'scan', doomedScanTask)
+      ).rejects.toMatchObject({ code: 'unavailable' })
+      expect(doomedScanTask).not.toHaveBeenCalled()
+      await expect(
+        run('\\\\wsl.localhost\\Debian\\tree', 'scan', async () => 'debian-scan')
+      ).resolves.toBe('debian-scan')
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('admits new work again once stuck work finally settles', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\recovering', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await stuckRejected
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\recovering-next', 'exact', async () => 'blocked')
+      ).rejects.toMatchObject({ code: 'unavailable' })
+
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\recovering-next', 'exact', async () => 'recovered')
+      ).resolves.toBe('recovered')
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('refuses to join in-flight work already past its own deadline', async () => {
+    vi.useFakeTimers()
+    const work = deferred<string>()
+    const task = vi.fn(() => work.promise)
+    try {
+      const path = '\\\\wsl.localhost\\Ubuntu\\join-stuck'
+      const first = run(path, 'exact', task)
+      const firstRejected = expect(first).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(10_000)
+      const second = run(path, 'exact', task)
+      const secondRejected = expect(second).rejects.toMatchObject({ code: 'timeout' })
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS - 10_000)
+      await firstRejected
+      const joinTask = vi.fn(async () => 'join')
+      await expect(run(path, 'exact', joinTask)).rejects.toMatchObject({ code: 'unavailable' })
+      expect(joinTask).not.toHaveBeenCalled()
+      await vi.advanceTimersByTimeAsync(10_000)
+      await secondRejected
+    } finally {
+      work.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('fails joins onto queued work fast when stuck I/O keeps it from running', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    const queuedTask = vi.fn(async () => 'queued')
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\trap-hung', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(5_000)
+      // Queued behind the same route before the hang is detected.
+      const queuedPath = '\\\\wsl.localhost\\Ubuntu\\trap-queued'
+      const queued = run(queuedPath, 'exact', queuedTask)
+      const queuedRejected = expect(queued).rejects.toMatchObject({ code: 'timeout' })
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS - 5_000)
+      await stuckRejected
+      // Re-requests must not keep the doomed queued task alive with fresh
+      // deadlines — that would defeat the fail-fast for as long as I/O hangs.
+      await expect(run(queuedPath, 'exact', queuedTask)).rejects.toMatchObject({
+        code: 'unavailable'
+      })
+      await vi.advanceTimersByTimeAsync(5_000)
+      await queuedRejected
+      expect(queuedTask).not.toHaveBeenCalled()
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not feed a stuck route the other permit from the queue', async () => {
+    vi.useFakeTimers()
+    const scanWork = deferred<string>()
+    const debianWork = deferred<string>()
+    const ubuntuTask = vi.fn(async () => 'ubuntu')
+    try {
+      const scanU = run(
+        '\\\\wsl.localhost\\Ubuntu\\queued-route-tree',
+        'scan',
+        () => scanWork.promise
+      )
+      const exactD = run(
+        '\\\\wsl.localhost\\Debian\\queued-route-d',
+        'exact',
+        () => debianWork.promise
+      )
+      const scanRejected = expect(scanU).rejects.toMatchObject({ code: 'timeout' })
+      const exactDRejected = expect(exactD).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(35_000)
+      await exactDRejected
+
+      // Queued before Ubuntu's hang is detected at the 60s scan deadline.
+      const queuedU = run('\\\\wsl.localhost\\Ubuntu\\queued-route-file', 'exact', ubuntuTask)
+      const queuedURejected = expect(queuedU).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(25_000)
+      await scanRejected
+
+      debianWork.resolve('debian')
+      await vi.advanceTimersByTimeAsync(0)
+      expect(ubuntuTask).not.toHaveBeenCalled()
+      await vi.advanceTimersByTimeAsync(5_000)
+      await queuedURejected
+      expect(ubuntuTask).not.toHaveBeenCalled()
+    } finally {
+      scanWork.resolve('late')
+      debianWork.resolve('debian')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('warns once per task that outlives its deadline while running', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\logged', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS * 3)
+      await stuckRejected
+      expect(warnSpy).toHaveBeenCalledOnce()
+      expect(warnSpy.mock.calls[0][0]).toContain('exact')
+      expect(warnSpy.mock.calls[0][0]).toContain('logged')
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not mark a scan permit stuck before the scan deadline', async () => {
+    vi.useFakeTimers()
+    const exactWork = deferred<string>()
+    const scanWork = deferred<string>()
+    try {
+      const exact = run(
+        '\\\\wsl.localhost\\Ubuntu\\stalled-exact',
+        'exact',
+        () => exactWork.promise
+      )
+      const scanTask = vi.fn(() => scanWork.promise)
+      const scanPath = '\\\\wsl.localhost\\Debian\\healthy-scan'
+      const scan = run(scanPath, 'scan', scanTask)
+      const exactRejected = expect(exact).rejects.toMatchObject({ code: 'timeout' })
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await exactRejected
+      const duplicateTask = vi.fn(async () => 'duplicate')
+      const duplicate = run(scanPath, 'scan', duplicateTask)
+
+      scanWork.resolve('scan')
+      await expect(Promise.all([scan, duplicate])).resolves.toEqual(['scan', 'scan'])
+      expect(scanTask).toHaveBeenCalledOnce()
+      expect(duplicateTask).not.toHaveBeenCalled()
+    } finally {
+      exactWork.resolve('late')
+      scanWork.resolve('scan')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+})
+
+describe('WSL transcript filesystem task coalescing opt-out', () => {
+  const READ_PATH = '\\\\wsl.localhost\\Alpine\\home\\ada\\transcript.jsonl'
+
+  function gatedRead(task: (signal: AbortSignal) => Promise<Buffer>): Promise<Buffer> {
+    return runWslTranscriptFsTask(
+      { operation: 'read', path: READ_PATH, priority: 'exact', dedupe: false },
+      task
+    )
+  }
+
+  it('fills each caller its own buffer for identical positional reads', async () => {
+    const first = Buffer.alloc(4, 0xa1)
+    const second = Buffer.alloc(4, 0xb2)
+    const bodies = [Buffer.from('AAAA'), Buffer.from('BBBB')]
+
+    const reads = Promise.all([
+      gatedRead(async () => {
+        bodies.shift()!.copy(first)
+        return first
+      }),
+      gatedRead(async () => {
+        bodies.shift()!.copy(second)
+        return second
+      })
+    ])
+
+    await expect(reads).resolves.toEqual([first, second])
+    expect(first.toString()).toBe('AAAA')
+    expect(second.toString()).toBe('BBBB')
+    // Neither caller kept its sentinel nor received the other's bytes.
+    expect(first.equals(second)).toBe(false)
+  })
+
+  it('gives each open call a distinct handle', async () => {
+    const handles = [
+      { id: 1, closed: false },
+      { id: 2, closed: false }
+    ]
+    let served = 0
+    const opened = await Promise.all(
+      handles.map(() =>
+        runWslTranscriptFsTask(
+          { operation: 'open', path: READ_PATH, priority: 'exact', dedupe: false },
+          async () => handles[served++]
+        )
+      )
+    )
+
+    expect(opened[0]).not.toBe(opened[1])
+    opened[0].closed = true
+    expect(opened[1].closed).toBe(false)
+  })
+
+  it('still coalesces identical work when dedupe is omitted', async () => {
+    const stalled = deferred<string>()
+    const task = vi.fn(() => stalled.promise)
+    const path = '\\\\wsl.localhost\\Alpine\\home\\ada'
+    const first = run(path, 'scan', task)
+    await vi.waitFor(() => expect(task).toHaveBeenCalledOnce())
+    const joiner = run(
+      path,
+      'scan',
+      vi.fn(async () => 'never')
+    )
+
+    stalled.resolve('shared')
+    await expect(Promise.all([first, joiner])).resolves.toEqual(['shared', 'shared'])
+    expect(task).toHaveBeenCalledOnce()
+  })
 })
diff --git a/src/main/native-chat/wsl-transcript-fs-gate.ts b/src/main/native-chat/wsl-transcript-fs-gate.ts
index 03225b1d3de..84848e13f11 100644
--- a/src/main/native-chat/wsl-transcript-fs-gate.ts
+++ b/src/main/native-chat/wsl-transcript-fs-gate.ts
@@ -1,6 +1,35 @@
-import { parseWslUncPath } from '../../shared/wsl-paths'
+import { wslTranscriptFsRouteKey } from './wsl-transcript-fs-route'
 
 const MAX_CONCURRENT_WSL_TRANSCRIPT_FS_TASKS = 2
+export const WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS = 30_000
+export const WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS = 60_000
+// Burst bounds keep polling fan-out from growing retained tasks or callers indefinitely.
+export const WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS = 64
+export const WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK = 64
+export const WSL_TRANSCRIPT_FS_SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+export const WSL_TRANSCRIPT_FS_CAPACITY_MESSAGE =
+  'WSL transcript discovery is temporarily unavailable because too many filesystem requests are already waiting. Try again shortly or restart Orca if the issue continues.'
+
+export type WslTranscriptFsFailureCode = 'timeout' | 'capacity' | 'unavailable'
+
+export class WslTranscriptFsError extends Error {
+  constructor(
+    readonly code: WslTranscriptFsFailureCode,
+    message: string
+  ) {
+    super(message)
+    this.name = 'WslTranscriptFsError'
+  }
+}
+
+/** Narrow a caught error to a gate refusal, rethrowing anything else. */
+export function wslTranscriptFsRefusal(error: unknown): WslTranscriptFsError {
+  if (error instanceof WslTranscriptFsError) {
+    return error
+  }
+  throw error
+}
 
 export type WslTranscriptFsTaskPriority = 'exact' | 'scan'
 
@@ -9,39 +38,39 @@ type TaskWaiter<T> = {
   reject: (error: unknown) => void
   signal?: AbortSignal
   onAbort?: () => void
+  timeout?: ReturnType<typeof setTimeout>
 }
 
 type ScheduledTask<T> = {
   key: string
   laneKey: string
+  route: string
   priority: WslTranscriptFsTaskPriority
   operation: (signal: AbortSignal) => Promise<T>
+  /** Dispose a value no waiter is left to own (see settleTask). */
+  onAbandonedResult?: (value: T) => void
   controller: AbortController
   waiters: Set<TaskWaiter<T>>
   state: 'queued' | 'running' | 'settled'
+  // Set by the deadline timer, sharing the waiters' monotonic clock — wall time
+  // would misjudge stuckness across laptop sleep or NTP steps.
+  stuck: boolean
+  stuckTimer?: ReturnType<typeof setTimeout>
 }
 
 type UnknownScheduledTask = ScheduledTask<unknown>
 
-let activeTaskCount = 0
 let activeScanCount = 0
+let undedupedTaskId = 0
 const activeLaneKeys = new Set<string>()
 const queuedTasks: UnknownScheduledTask[] = []
 const inFlightTasks = new Map<string, UnknownScheduledTask>()
+const activeTasks = new Set<UnknownScheduledTask>()
 
 function abortReason(signal: AbortSignal): unknown {
   return signal.reason ?? new Error('WSL transcript filesystem task aborted')
 }
 
-function routeKey(path: string): string {
-  const normalized = path.replace(/\\/g, '/')
-  const match = normalized.match(/^\/\/(wsl\.localhost|wsl\$)\/([^/]+)/i)
-  if (match) {
-    return `${match[1].toLowerCase()}/${match[2].trim().toLowerCase()}`
-  }
-  return parseWslUncPath(path)?.distro.trim().toLowerCase() ?? path
-}
-
 function removeQueuedTask(task: UnknownScheduledTask): void {
   const index = queuedTasks.indexOf(task)
   if (index !== -1) {
@@ -55,11 +84,11 @@ function clearTask(task: UnknownScheduledTask): void {
   }
 }
 
-function abandonTaskIfUnused(task: UnknownScheduledTask): void {
+function abandonTaskIfUnused(task: UnknownScheduledTask, reason?: unknown): void {
   if (task.waiters.size > 0 || task.state === 'settled') {
     return
   }
-  task.controller.abort()
+  task.controller.abort(reason)
   // Running I/O keeps its permit; new callers need a reusable controller.
   clearTask(task)
   if (task.state === 'queued') {
@@ -69,24 +98,89 @@ function abandonTaskIfUnused(task: UnknownScheduledTask): void {
   }
 }
 
+function removeWaiter<T>(task: ScheduledTask<T>, waiter: TaskWaiter<T>): boolean {
+  if (!task.waiters.delete(waiter)) {
+    return false
+  }
+  if (waiter.signal && waiter.onAbort) {
+    waiter.signal.removeEventListener('abort', waiter.onAbort)
+  }
+  if (waiter.timeout) {
+    clearTimeout(waiter.timeout)
+  }
+  return true
+}
+
+function timeoutMs(priority: WslTranscriptFsTaskPriority): number {
+  return priority === 'exact'
+    ? WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS
+    : WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS
+}
+
+function timeoutError(): WslTranscriptFsError {
+  return new WslTranscriptFsError('timeout', WSL_TRANSCRIPT_FS_SLOW_MESSAGE)
+}
+
+function capacityError(): WslTranscriptFsError {
+  return new WslTranscriptFsError('capacity', WSL_TRANSCRIPT_FS_CAPACITY_MESSAGE)
+}
+
+function unavailableError(): WslTranscriptFsError {
+  return new WslTranscriptFsError('unavailable', WSL_TRANSCRIPT_FS_SLOW_MESSAGE)
+}
+
+/**
+ * The stuck running task that would doom a new task's admission: one on the
+ * same route (the whole distro mount is hung, whatever the priority — spending
+ * the other permit on it escalates one bad distro into a global outage), one
+ * holding the single scan slot, or (with every permit stuck) any permit.
+ */
+function stuckBlocker(
+  route: string,
+  priority: WslTranscriptFsTaskPriority
+): UnknownScheduledTask | undefined {
+  const stuck = [...activeTasks].filter((task) => task.stuck)
+  if (stuck.length === MAX_CONCURRENT_WSL_TRANSCRIPT_FS_TASKS) {
+    return stuck[0]
+  }
+  return stuck.find(
+    (task) => task.route === route || (priority === 'scan' && task.priority === 'scan')
+  )
+}
+
+// Caller-abort pre-checks live in runWslTranscriptFsTask; nothing here yields
+// before the waiter is attached, so no aborted-signal recheck is needed.
+// The task's own priority is every waiter's deadline: the dedupe key carries
+// priority, so a joiner can only ever join a task scheduled at its own.
 function attachWaiter<T>(task: ScheduledTask<T>, signal?: AbortSignal): Promise<T> {
-  if (signal?.aborted) {
-    abandonTaskIfUnused(task as UnknownScheduledTask)
-    return Promise.reject(abortReason(signal))
+  if (task.waiters.size >= WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK) {
+    return Promise.reject(capacityError())
   }
   return new Promise<T>((resolve, reject) => {
     const waiter: TaskWaiter<T> = { resolve, reject, signal }
+    task.waiters.add(waiter)
     if (signal) {
       waiter.onAbort = () => {
-        if (!task.waiters.delete(waiter)) {
+        const reason = abortReason(signal)
+        if (!removeWaiter(task, waiter)) {
           return
         }
-        reject(abortReason(signal))
-        abandonTaskIfUnused(task as UnknownScheduledTask)
+        reject(reason)
+        abandonTaskIfUnused(task as UnknownScheduledTask, reason)
       }
       signal.addEventListener('abort', waiter.onAbort, { once: true })
     }
-    task.waiters.add(waiter)
+    // UNC/9P calls cannot be aborted; two blocked calls can retain both slots until settling or
+    // Orca restarts, while caller and queue retention remains bounded.
+    waiter.timeout = setTimeout(() => {
+      const error = timeoutError()
+      if (!removeWaiter(task, waiter)) {
+        return
+      }
+      reject(error)
+      abandonTaskIfUnused(task as UnknownScheduledTask, error)
+    }, timeoutMs(task.priority))
+    waiter.timeout.unref?.()
   })
 }
 
@@ -95,16 +189,19 @@ function settleTask<T>(task: ScheduledTask<T>, result: { value: T } | { error: u
     return
   }
   task.state = 'settled'
-  activeTaskCount -= 1
   if (task.priority === 'scan') {
     activeScanCount -= 1
   }
   activeLaneKeys.delete(task.laneKey)
+  activeTasks.delete(task as UnknownScheduledTask)
+  clearTimeout(task.stuckTimer)
   clearTask(task as UnknownScheduledTask)
+  // Why: an unabortable syscall can still succeed after its last waiter timed
+  // out or cancelled. A resource-valued result (open's FileHandle) then has no
+  // owner left to close it, so ownership passes to the task's disposer.
+  const abandoned = task.waiters.size === 0
   for (const waiter of task.waiters) {
-    if (waiter.signal && waiter.onAbort) {
-      waiter.signal.removeEventListener('abort', waiter.onAbort)
-    }
+    removeWaiter(task, waiter)
     if ('value' in result) {
       waiter.resolve(result.value)
     } else {
@@ -112,17 +209,34 @@ function settleTask<T>(task: ScheduledTask<T>, result: { value: T } | { error: u
     }
   }
   task.waiters.clear()
+  if (abandoned && 'value' in result) {
+    // Contained: a disposer that throws must not skip the pump below and wedge
+    // every queued task behind this one.
+    try {
+      task.onAbandonedResult?.(result.value)
+    } catch {
+      // Best-effort teardown; nothing left to report it to.
+    }
+  }
   pumpTasks()
 }
 
 function nextTaskIndex(): number {
+  // Tasks queued before their route hung must not be fed the other permit;
+  // their waiters drain by deadline while healthy routes use the slot.
+  const stuckRoutes = new Set(
+    [...activeTasks].filter((task) => task.stuck).map((task) => task.route)
+  )
   for (const priority of ['exact', 'scan'] as const) {
     // Why: keep one libuv slot available for a live transcript probe.
     if (priority === 'scan' && activeScanCount > 0) {
       continue
     }
     const index = queuedTasks.findIndex(
-      (task) => task.priority === priority && !activeLaneKeys.has(task.laneKey)
+      (task) =>
+        task.priority === priority &&
+        !activeLaneKeys.has(task.laneKey) &&
+        !stuckRoutes.has(task.route)
     )
     if (index !== -1) {
       return index
@@ -132,7 +246,7 @@ function nextTaskIndex(): number {
 }
 
 function pumpTasks(): void {
-  while (activeTaskCount < MAX_CONCURRENT_WSL_TRANSCRIPT_FS_TASKS) {
+  while (activeTasks.size < MAX_CONCURRENT_WSL_TRANSCRIPT_FS_TASKS) {
     const index = nextTaskIndex()
     if (index === -1) {
       return
@@ -142,11 +256,21 @@ function pumpTasks(): void {
       continue
     }
     task.state = 'running'
-    activeTaskCount += 1
     if (task.priority === 'scan') {
       activeScanCount += 1
     }
     activeLaneKeys.add(task.laneKey)
+    activeTasks.add(task)
+    // Anchored at run start: queue wait says nothing about the I/O itself, so
+    // the fail-fast may lag admission by at most one deadline period.
+    task.stuckTimer = setTimeout(() => {
+      task.stuck = true
+      console.warn(
+        `[wsl-transcript-fs-gate] ${task.priority} filesystem task still running after ` +
+          `${timeoutMs(task.priority)}ms and holding a permit: ${task.key}`
+      )
+    }, timeoutMs(task.priority))
+    task.stuckTimer.unref?.()
     void Promise.resolve()
       .then(() => {
         task.controller.signal.throwIfAborted()
@@ -159,38 +283,93 @@ function pumpTasks(): void {
   }
 }
 
+/**
+ * Test-only: drop every task and counter so a case that leaves a task stalled
+ * (holding a permit, marking its route stuck) cannot fast-fail the next one.
+ * Tasks are marked settled first, so a late resolution from the unabortable
+ * syscall they are still blocked on cannot decrement counters this just zeroed.
+ */
+export function resetWslTranscriptFsGateForTests(): void {
+  for (const task of [...activeTasks, ...queuedTasks]) {
+    task.state = 'settled'
+    clearTimeout(task.stuckTimer)
+    for (const waiter of task.waiters) {
+      removeWaiter(task, waiter)
+    }
+  }
+  activeTasks.clear()
+  queuedTasks.length = 0
+  inFlightTasks.clear()
+  activeLaneKeys.clear()
+  activeScanCount = 0
+}
+
 /** Bound 9P work without letting scans delay exact transcript probes. */
 export function runWslTranscriptFsTask<T>(
   options: {
-    operation: 'access' | 'readdir'
+    operation: 'access' | 'readdir' | 'stat' | 'lstat' | 'open' | 'read' | 'readfile'
     path: string
     priority: WslTranscriptFsTaskPriority
     signal?: AbortSignal
+    /** Opt out of coalescing when the result is not the whole answer (`open`,
+     *  positional `read`): a joiner would share the handle or the buffer. */
+    dedupe?: boolean
+    /** Release a late result no waiter is left to own (see settleTask). */
+    onAbandonedResult?: (value: T) => void
   },
   task: (signal: AbortSignal) => Promise<T>
 ): Promise<T> {
+  if (options.signal?.aborted) {
+    return Promise.reject(abortReason(options.signal))
+  }
   // Why: route spelling and Linux path case can change provider behavior, so
-  // only byte-identical filesystem requests are safe to share.
-  const key = JSON.stringify([options.operation, options.path])
+  // only byte-identical filesystem requests are safe to share. Priority is part
+  // of the key because it selects the task's lane, scan slot and deadline: an
+  // exact probe that joined a queued scan task would inherit scan scheduling and
+  // starve behind the very traffic the two priorities exist to bypass. A counter
+  // key never collides, so an un-deduped task simply never finds a join target.
+  const key =
+    options.dedupe === false
+      ? `undeduped:${++undedupedTaskId}`
+      : JSON.stringify([options.operation, options.path, options.priority])
   const existing = inFlightTasks.get(key) as ScheduledTask<T> | undefined
   if (existing) {
+    // A stuck target — or a queued target that stuck I/O keeps from ever
+    // running — dooms every joiner to a slow timeout, and each fresh joiner
+    // would keep the queued task alive past its own abandonment. Fail fast.
+    if (
+      existing.stuck ||
+      (existing.state === 'queued' && stuckBlocker(existing.route, existing.priority))
+    ) {
+      return Promise.reject(unavailableError())
+    }
     return attachWaiter(existing, options.signal)
   }
+  const route = wslTranscriptFsRouteKey(options.path)
+  // Fail fast when the permit, route, or scan slot this task needs is held by
+  // stuck I/O — queueing would only burn the caller's full deadline.
+  if (stuckBlocker(route, options.priority)) {
+    return Promise.reject(unavailableError())
+  }
+  if (queuedTasks.length >= WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS) {
+    return Promise.reject(capacityError())
+  }
 
   const scheduled: ScheduledTask<T> = {
     key,
-    laneKey: `${routeKey(options.path)}:${options.priority}`,
+    laneKey: `${route}:${options.priority}`,
+    route,
     priority: options.priority,
     operation: task,
+    onAbandonedResult: options.onAbandonedResult,
     controller: new AbortController(),
     waiters: new Set(),
-    state: 'queued'
+    state: 'queued',
+    stuck: false
   }
   inFlightTasks.set(key, scheduled as UnknownScheduledTask)
   const result = attachWaiter(scheduled, options.signal)
-  if (scheduled.state === 'queued' && scheduled.waiters.size > 0) {
-    queuedTasks.push(scheduled as UnknownScheduledTask)
-    queueMicrotask(pumpTasks)
-  }
+  queuedTasks.push(scheduled as UnknownScheduledTask)
+  queueMicrotask(pumpTasks)
   return result
 }
diff --git a/src/main/native-chat/wsl-transcript-fs-route.ts b/src/main/native-chat/wsl-transcript-fs-route.ts
new file mode 100644
index 00000000000..dc576c066d7
--- /dev/null
+++ b/src/main/native-chat/wsl-transcript-fs-route.ts
@@ -0,0 +1,19 @@
+import { parseWslUncPath } from '../../shared/wsl-paths'
+
+/**
+ * The isolation unit for WSL transcript filesystem work: one stalled distro
+ * must not fast-fail or strand work on any other. Shared by the gate's
+ * admission and by the ungated close queue so both isolate on the same key.
+ *
+ * wsl$ and wsl.localhost spellings of one distro stay distinct routes on
+ * purpose (provider spelling can change behavior), so a stuck spelling never
+ * fast-fails its twin — the twin is bounded by its own waiter deadlines.
+ */
+export function wslTranscriptFsRouteKey(path: string): string {
+  const normalized = path.replace(/\\/g, '/')
+  const match = normalized.match(/^\/\/(wsl\.localhost|wsl\$)\/([^/]+)/i)
+  if (match) {
+    return `${match[1].toLowerCase()}/${match[2].trim().toLowerCase()}`
+  }
+  return parseWslUncPath(path)?.distro.trim().toLowerCase() ?? path
+}
diff --git a/src/main/network/macos-tailscale-dns-diagnostic.ts b/src/main/network/macos-tailscale-dns-diagnostic.ts
index 5ec5501525e..a4dc948c0bd 100644
--- a/src/main/network/macos-tailscale-dns-diagnostic.ts
+++ b/src/main/network/macos-tailscale-dns-diagnostic.ts
@@ -19,7 +19,7 @@ const NETWORK_LOOKUP_FAILURE_RE =
 
 function globalDnsSection(scutilOutput: string): string {
   const scopedStart = scutilOutput.indexOf('\nDNS configuration (for scoped queries)')
-  return scopedStart >= 0 ? scutilOutput.slice(0, scopedStart) : scutilOutput
+  return scopedStart !== -1 ? scutilOutput.slice(0, scopedStart) : scutilOutput
 }
 
 export function parseMacTailscaleDnsDiagnostic(scutilOutput: string): DnsDiagnostic | null {
diff --git a/src/main/observability/bundle.test.ts b/src/main/observability/bundle.test.ts
index 347e1025893..3c6644a7d43 100644
--- a/src/main/observability/bundle.test.ts
+++ b/src/main/observability/bundle.test.ts
@@ -35,7 +35,7 @@ function makeSpan(overrides: Record<string, unknown> = {}): Record<string, unkno
     kind: 'internal',
     startTimeUnixNano: String(now - 1_000_000_000n),
     endTimeUnixNano: String(now),
-    durationMs: 1.0,
+    durationMs: 1,
     attributes: {},
     events: [],
     exit: { _tag: 'Success' },
diff --git a/src/main/observability/redactor.test.ts b/src/main/observability/redactor.test.ts
index 8de2661515a..0b8ee0f9e61 100644
--- a/src/main/observability/redactor.test.ts
+++ b/src/main/observability/redactor.test.ts
@@ -333,7 +333,7 @@ function makeSpan(overrides: Partial<RedactableSpan>): RedactableSpan {
     kind: 'internal',
     startTimeUnixNano: '1000',
     endTimeUnixNano: '2000',
-    durationMs: 1.0,
+    durationMs: 1,
     attributes: {},
     events: [],
     exit: { _tag: 'Success' },
diff --git a/src/main/observability/redactor.ts b/src/main/observability/redactor.ts
index cd5570f8577..da8feb0a8b0 100644
--- a/src/main/observability/redactor.ts
+++ b/src/main/observability/redactor.ts
@@ -123,7 +123,7 @@ export function redactString(input: string): string {
 export function redactValue(
   value: unknown,
   mode: RedactorMode = 'client',
-  seen: WeakSet<object> = new WeakSet()
+  seen = new WeakSet<object>()
 ): unknown {
   if (value === null || value === undefined) {
     return value
diff --git a/src/main/opencode-usage/scanner-wsl-gate.test.ts b/src/main/opencode-usage/scanner-wsl-gate.test.ts
new file mode 100644
index 00000000000..b7c94000635
--- /dev/null
+++ b/src/main/opencode-usage/scanner-wsl-gate.test.ts
@@ -0,0 +1,117 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { join } from 'node:path'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+
+const UNC_DATA_DIR = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.local\\share\\opencode'
+const UNC_DATABASE = `${UNC_DATA_DIR}\\opencode.db`
+
+const mocks = vi.hoisted(() => ({
+  resolveDataDirectory: vi.fn<() => string>(),
+  readdir: vi.fn(),
+  stat: vi.fn()
+}))
+
+vi.mock('../opencode/opencode-data-directory', () => ({
+  resolveOpenCodeDataDirectory: mocks.resolveDataDirectory
+}))
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeFsPromisesModule>()),
+  readdir: mocks.readdir,
+  stat: mocks.stat
+}))
+
+import { listOpenCodeDatabases } from './scanner'
+import {
+  WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS,
+  WslTranscriptFsError
+} from '../native-chat/wsl-transcript-fs-gate'
+
+// A stalled task holds the gate's single scan slot until it settles, so every
+// case releases its stall before the next one runs.
+let releaseStall: (() => void) | undefined
+
+function stalls<T>(): Promise<T> {
+  return new Promise<T>((resolve) => {
+    releaseStall = () => resolve([] as T)
+  })
+}
+
+function dirent(name: string) {
+  return { name, isFile: () => true }
+}
+
+// The point of the gate: an ungated syscall on a stalled 9P mount never returns,
+// so the call must still be pending at the deadline and settle just after it.
+async function settlesOnlyAtTheScanDeadline(pending: Promise<string[]>): Promise<string[]> {
+  let settled = false
+  const tracked = pending.then((value) => {
+    settled = true
+    return value
+  })
+  await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS - 1)
+  expect(settled).toBe(false)
+  await vi.advanceTimersByTimeAsync(2)
+  return await tracked
+}
+
+let originalDatabaseOverride: string | undefined
+
+beforeEach(() => {
+  originalDatabaseOverride = process.env.OPENCODE_DB
+  delete process.env.OPENCODE_DB
+  mocks.resolveDataDirectory.mockReset()
+  mocks.readdir.mockReset()
+  mocks.stat.mockReset()
+  releaseStall = undefined
+  mocks.resolveDataDirectory.mockReturnValue(UNC_DATA_DIR)
+  vi.useFakeTimers()
+})
+
+afterEach(async () => {
+  releaseStall?.()
+  releaseStall = undefined
+  await vi.advanceTimersByTimeAsync(0)
+  vi.useRealTimers()
+  if (originalDatabaseOverride === undefined) {
+    delete process.env.OPENCODE_DB
+  } else {
+    process.env.OPENCODE_DB = originalDatabaseOverride
+  }
+})
+
+// Why this file exists: the AI Vault's primary OpenCode source reaches these
+// syscalls transitively, so the import-guard that pins direct `node:fs` use in
+// the transcript modules never saw them (STA-4049).
+describe('OpenCode database discovery on a stalled WSL data directory', () => {
+  it('gates the data-directory listing instead of hanging the scan', async () => {
+    mocks.readdir.mockImplementation(stalls)
+    // Asserted because an empty list alone also matches a missing data dir; the
+    // AI Vault's OpenCode source turns this callback into the scan issue.
+    const onRefusal = vi.fn()
+
+    expect(await settlesOnlyAtTheScanDeadline(listOpenCodeDatabases(onRefusal))).toEqual([])
+    expect(onRefusal).toHaveBeenCalledWith(UNC_DATA_DIR, expect.any(WslTranscriptFsError))
+  })
+
+  it('gates an absolute UNC OPENCODE_DB probe instead of hanging the scan', async () => {
+    process.env.OPENCODE_DB = UNC_DATABASE
+    mocks.stat.mockImplementation(stalls)
+    const onRefusal = vi.fn()
+
+    expect(await settlesOnlyAtTheScanDeadline(listOpenCodeDatabases(onRefusal))).toEqual([])
+    expect(mocks.readdir).not.toHaveBeenCalled()
+    // Loose on the path: `isAbsolute` is host-flavoured, so a UNC override only
+    // stays verbatim on Windows. The refusal reaching the caller is the contract.
+    expect(onRefusal).toHaveBeenCalledWith(
+      expect.stringContaining('opencode.db'),
+      expect.any(WslTranscriptFsError)
+    )
+  })
+
+  it('still lists databases when the distro answers', async () => {
+    mocks.readdir.mockResolvedValue([dirent('opencode.db'), dirent('notes.txt')])
+
+    await expect(listOpenCodeDatabases()).resolves.toEqual([join(UNC_DATA_DIR, 'opencode.db')])
+    expect(mocks.readdir).toHaveBeenCalledWith(UNC_DATA_DIR, { withFileTypes: true })
+  })
+})
diff --git a/src/main/opencode-usage/scanner.ts b/src/main/opencode-usage/scanner.ts
index b96e14be503..f3a4e6b13e1 100644
--- a/src/main/opencode-usage/scanner.ts
+++ b/src/main/opencode-usage/scanner.ts
@@ -1,7 +1,9 @@
 /* eslint-disable max-lines -- Why: OpenCode usage analytics need to normalize multiple local DB schema generations, attribute worktrees, and build persisted projections in one auditable pipeline. */
-import { readdir, realpath, stat } from 'node:fs/promises'
+import { realpath, stat } from 'node:fs/promises'
 import { basename, isAbsolute, join, posix, win32 } from 'node:path'
 import { yieldToEventLoop } from '../../shared/event-loop-yield'
+import { wslGatedReaddir, wslGatedStat } from '../native-chat/wsl-transcript-fs-access'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import { areWorktreePathsEqual } from '../ipc/worktree-logic'
 import { resolveOpenCodeDataDirectory } from '../opencode/opencode-data-directory'
 import Database from '../sqlite/sync-database'
@@ -75,7 +77,14 @@ function getOpenCodeDatabaseOverride(dataDirectory: string): OpenCodeDatabaseOve
   }
 }
 
-export async function listOpenCodeDatabases(): Promise<string[]> {
+// Why gated: the AI Vault's primary OpenCode source delegates here from inside
+// its discovery fan-out, so a UNC data dir or a UNC OPENCODE_DB on a stalled
+// distro would otherwise hang the whole scan on a raw syscall (STA-4049).
+export async function listOpenCodeDatabases(
+  /** Lets a caller report the refusal; an empty list otherwise reads as
+   *  "OpenCode not used" rather than "we could not look". */
+  onRefusal?: (path: string, error: WslTranscriptFsError) => void
+): Promise<string[]> {
   const dataDirectory = resolveOpenCodeDataDirectory()
   const databaseOverride = getOpenCodeDatabaseOverride(dataDirectory)
   if (databaseOverride.isConfigured) {
@@ -83,23 +92,37 @@ export async function listOpenCodeDatabases(): Promise<string[]> {
       return []
     }
     try {
-      return (await stat(databaseOverride.path)).isFile() ? [databaseOverride.path] : []
-    } catch {
+      return (await wslGatedStat(databaseOverride.path, 'scan')).isFile()
+        ? [databaseOverride.path]
+        : []
+    } catch (error) {
+      reportRefusal(databaseOverride.path, error, onRefusal)
       return []
     }
   }
 
   try {
-    const entries = await readdir(dataDirectory, { withFileTypes: true })
+    const entries = await wslGatedReaddir(dataDirectory, 'scan')
     return entries
       .filter((entry) => entry.isFile() && /^opencode(?:-[A-Za-z0-9_.-]+)?\.db$/.test(entry.name))
       .map((entry) => join(dataDirectory, entry.name))
       .sort()
-  } catch {
+  } catch (error) {
+    reportRefusal(dataDirectory, error, onRefusal)
     return []
   }
 }
 
+function reportRefusal(
+  path: string,
+  error: unknown,
+  onRefusal?: (path: string, error: WslTranscriptFsError) => void
+): void {
+  if (error instanceof WslTranscriptFsError) {
+    onRefusal?.(path, error)
+  }
+}
+
 function compareOpenCodeClaimPriority(left: string, right: string): number {
   // Why: the canonical opencode.db is the live database; it must claim
   // duplicated sessions ahead of stale sibling copies. Remaining ties use
diff --git a/src/main/orca-profiles/profile-index-store.test.ts b/src/main/orca-profiles/profile-index-store.test.ts
index a2d3446a99c..128dc56cea3 100644
--- a/src/main/orca-profiles/profile-index-store.test.ts
+++ b/src/main/orca-profiles/profile-index-store.test.ts
@@ -3,6 +3,7 @@ import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync, mkdirSync
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import {
+  createDefaultLocalOrcaProfile,
   DEFAULT_LOCAL_ORCA_PROFILE_ID,
   DEFAULT_LOCAL_ORCA_PROFILE_NAME,
   ORCA_PROFILE_INDEX_SCHEMA_VERSION,
@@ -154,6 +155,27 @@ describe('profile index store', () => {
     expect(() => setActiveOrcaProfile('missing-profile')).toThrow('unknown_orca_profile')
   })
 
+  const posixIt = process.platform === 'win32' ? it.skip : it
+  posixIt('writes a fresh profile index when umask removes owner-write permission', async () => {
+    const store = await loadProfileIndexStore()
+    const indexPath = store.getOrcaProfileIndexPath()
+    const profile = createDefaultLocalOrcaProfile(1)
+    const index: OrcaProfileIndex = {
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: profile.id,
+      profiles: [profile]
+    }
+    const originalUmask = process.umask(0o200)
+
+    try {
+      expect(() => store.writeProfileIndex(indexPath, index)).not.toThrow()
+    } finally {
+      process.umask(originalUmask)
+    }
+
+    expect(readJson(indexPath)).toEqual(index)
+  })
+
   it('recovers a corrupted profile index from the backup copy', async () => {
     const store = await loadProfileIndexStore()
     store.ensureActiveOrcaProfile()
diff --git a/src/main/persistence-ssh-lease-termination.test.ts b/src/main/persistence-ssh-lease-termination.test.ts
new file mode 100644
index 00000000000..c1c70c5c667
--- /dev/null
+++ b/src/main/persistence-ssh-lease-termination.test.ts
@@ -0,0 +1,152 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { getDefaultPersistedState } from '../shared/constants'
+
+const testState = { dir: '' }
+
+vi.mock('electron', () => ({
+  app: { getPath: () => testState.dir },
+  safeStorage: { isEncryptionAvailable: () => false }
+}))
+vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn() }))
+
+const TARGET = 'ssh-target-1'
+
+type DurableFlushStore = {
+  flushDurableStateOrThrowAsync: (drainToStableGeneration?: boolean) => Promise<void>
+}
+
+function lease(ptyId: string, state: 'attached' | 'detached') {
+  return {
+    targetId: TARGET,
+    ptyId,
+    state,
+    createdAt: 1,
+    updatedAt: 1
+  }
+}
+
+async function createStore() {
+  mkdirSync(testState.dir, { recursive: true })
+  writeFileSync(
+    join(testState.dir, 'orca-data.json'),
+    JSON.stringify({
+      ...getDefaultPersistedState(testState.dir),
+      sshRemotePtyLeases: [
+        lease('pty-1', 'detached'),
+        lease('pty-2', 'attached'),
+        lease('pty-3', 'detached')
+      ]
+    }),
+    'utf-8'
+  )
+  vi.resetModules()
+  const { Store, initDataPath } = await import('./persistence')
+  initDataPath()
+  return new Store()
+}
+
+beforeEach(() => {
+  testState.dir = mkdtempSync(join(tmpdir(), 'orca-ssh-lease-termination-'))
+})
+
+afterEach(() => {
+  rmSync(testState.dir, { force: true, recursive: true })
+})
+
+describe('SSH lease termination persistence', () => {
+  it('updates only selected leases and awaits one asynchronous durability barrier', async () => {
+    const store = await createStore()
+    const asyncFlush = vi
+      .spyOn(store as unknown as DurableFlushStore, 'flushDurableStateOrThrowAsync')
+      .mockResolvedValue()
+    const syncFlush = vi.spyOn(store, 'flush')
+    const syncFlushOrThrow = vi.spyOn(store, 'flushOrThrow')
+
+    await store.markSshRemotePtyLeasesTerminatedAsync(TARGET, ['pty-1', 'pty-3'])
+
+    expect(asyncFlush).toHaveBeenCalledOnce()
+    expect(asyncFlush).toHaveBeenCalledWith(false)
+    expect(syncFlush).not.toHaveBeenCalled()
+    expect(syncFlushOrThrow).not.toHaveBeenCalled()
+    expect(store.getSshRemotePtyLeases(TARGET)).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ ptyId: 'pty-1', state: 'terminated' }),
+        expect.objectContaining({ ptyId: 'pty-2', state: 'attached' }),
+        expect.objectContaining({ ptyId: 'pty-3', state: 'terminated' })
+      ])
+    )
+  })
+
+  it('does not overwrite concurrent lease state when durability fails', async () => {
+    const store = await createStore()
+    const writeError = new Error('disk full')
+    const asyncFlush = vi
+      .spyOn(store as unknown as DurableFlushStore, 'flushDurableStateOrThrowAsync')
+      .mockRejectedValue(writeError)
+    const scheduleSave = vi.spyOn(store as unknown as { scheduleSave: () => void }, 'scheduleSave')
+    scheduleSave.mockClear()
+
+    const retirement = store.markSshRemotePtyLeasesTerminatedAsync(TARGET, ['pty-1'])
+    store.markSshRemotePtyLeasesForShutdown(TARGET, 'detached')
+
+    await expect(retirement).rejects.toBe(writeError)
+    expect(scheduleSave).toHaveBeenCalledTimes(2)
+    expect(store.getSshRemotePtyLeases(TARGET)).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ ptyId: 'pty-1', state: 'terminated' }),
+        expect.objectContaining({ ptyId: 'pty-2', state: 'detached' })
+      ])
+    )
+
+    asyncFlush.mockRestore()
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const persisted = JSON.parse(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')) as {
+      sshRemotePtyLeases: { ptyId: string; state: string }[]
+    }
+    expect(persisted.sshRemotePtyLeases).toContainEqual(
+      expect.objectContaining({ ptyId: 'pty-1', state: 'terminated' })
+    )
+  })
+
+  it('does not write when no requested lease exists', async () => {
+    const store = await createStore()
+    const asyncFlush = vi.spyOn(
+      store as unknown as DurableFlushStore,
+      'flushDurableStateOrThrowAsync'
+    )
+
+    await store.markSshRemotePtyLeasesTerminatedAsync(TARGET, ['missing'])
+
+    expect(asyncFlush).not.toHaveBeenCalled()
+  })
+
+  it('does not chase mutations made after the retirement generation is durable', async () => {
+    const store = await createStore()
+    const internal = store as unknown as { enqueueWrite: () => Promise<void> }
+    const enqueueWrite = internal.enqueueWrite.bind(store)
+    let injectedMutation = false
+    const enqueueSpy = vi.spyOn(internal, 'enqueueWrite').mockImplementation(async () => {
+      await enqueueWrite()
+      if (!injectedMutation) {
+        injectedMutation = true
+        store.updateUI({ sidebarWidth: 777 })
+      }
+    })
+
+    await store.markSshRemotePtyLeasesTerminatedAsync(TARGET, ['pty-1'])
+
+    expect(enqueueSpy).toHaveBeenCalledOnce()
+    const persisted = JSON.parse(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')) as {
+      sshRemotePtyLeases: { ptyId: string; state: string }[]
+    }
+    expect(persisted.sshRemotePtyLeases).toContainEqual(
+      expect.objectContaining({ ptyId: 'pty-1', state: 'terminated' })
+    )
+    enqueueSpy.mockRestore()
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+  })
+})
diff --git a/src/main/persistence.test.ts b/src/main/persistence.test.ts
index 2255e3a3b8e..899aaa001f8 100644
--- a/src/main/persistence.test.ts
+++ b/src/main/persistence.test.ts
@@ -36,6 +36,7 @@ import {
   ONBOARDING_FLOW_VERSION
 } from '../shared/constants'
 import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
+import { folderWorkspaceToWorktree } from '../shared/folder-workspace-worktree'
 import { toRuntimeExecutionHostId, toSshExecutionHostId } from '../shared/execution-host'
 import { SshConnectionStore } from './ssh/ssh-connection-store'
 import { setSourceControlActionDefault } from '../shared/source-control-ai-actions'
@@ -4738,6 +4739,25 @@ describe('Store', () => {
     expect(updated!.externalWorktreeVisibilityLegacy).toBe(true)
   })
 
+  it('persists agent worktree visibility independently from external visibility', async () => {
+    const store = await createStore()
+    store.addRepo(makeRepo({ externalWorktreeVisibility: 'hide' }))
+
+    const updated = store.updateRepo('r1', { agentWorktreeVisibility: 'show' })
+
+    expect(updated).toMatchObject({
+      externalWorktreeVisibility: 'hide',
+      agentWorktreeVisibility: 'show'
+    })
+
+    store.flush()
+    const reloaded = await createStore()
+    expect(reloaded.getRepo('r1')).toMatchObject({
+      externalWorktreeVisibility: 'hide',
+      agentWorktreeVisibility: 'show'
+    })
+  })
+
   it('updateRepo clears source-control AI overrides independently from other clearable fields', async () => {
     const store = await createStore()
     store.addRepo(
@@ -5044,7 +5064,19 @@ describe('Store', () => {
     const updated = store.updateFolderWorkspace(workspace.id, {
       comment: 'Coordinate api and web',
       isPinned: true,
-      lastActivityAt: 123
+      lastActivityAt: 123,
+      diffComments: [
+        {
+          id: 'note-1',
+          worktreeId: folderWorkspaceKey(workspace.id),
+          filePath: 'README.md',
+          source: 'markdown',
+          lineNumber: 1,
+          body: 'Review this paragraph',
+          createdAt: 100,
+          side: 'modified'
+        }
+      ]
     })
 
     expect(workspace.folderPath).toBe('/workspace/platform')
@@ -5056,9 +5088,16 @@ describe('Store', () => {
       linkedTask,
       comment: 'Coordinate api and web',
       isPinned: true,
-      lastActivityAt: 123
+      lastActivityAt: 123,
+      diffComments: [expect.objectContaining({ id: 'note-1', body: 'Review this paragraph' })]
     })
     expect(store.getFolderWorkspaces()).toHaveLength(1)
+    store.flush()
+
+    const restored = await createStore()
+    expect(restored.getFolderWorkspace(workspace.id)?.diffComments).toEqual([
+      expect.objectContaining({ id: 'note-1', body: 'Review this paragraph' })
+    ])
   })
 
   it('round-trips Jira item and source context for repo-less folder workspaces', async () => {
@@ -5380,6 +5419,369 @@ describe('Store', () => {
     expect(session.browserPagesByWorkspace?.['browser-workspace']).toBeUndefined()
   })
 
+  // ── 8b. Folder-workspace review notes across a build rollback ──
+
+  function makeFolderNote(id: string, body: string, workspaceId = 'fw-1') {
+    return {
+      id,
+      worktreeId: folderWorkspaceKey(workspaceId),
+      filePath: 'README.md',
+      source: 'markdown' as const,
+      lineNumber: 1,
+      body,
+      createdAt: 100,
+      side: 'modified' as const
+    }
+  }
+
+  function folderWorkspaceRecord(overrides: Record<string, unknown> = {}) {
+    return {
+      id: 'fw-1',
+      projectGroupId: 'root',
+      name: 'Refund fix',
+      folderPath: '/workspace/platform',
+      linkedTask: null,
+      comment: '',
+      isArchived: false,
+      isUnread: false,
+      isPinned: false,
+      sortOrder: 10,
+      lastActivityAt: 5,
+      createdAt: 2,
+      updatedAt: 3,
+      ...overrides
+    }
+  }
+
+  function writeFolderWorkspaceProfile(options: {
+    workspaces: Record<string, unknown>[]
+    diffCommentsMap?: unknown
+    connectionId?: string | null
+    extraTopLevel?: Record<string, unknown>
+  }): void {
+    writeDataFile({
+      schemaVersion: 1,
+      repos: [],
+      worktreeMeta: {},
+      settings: {},
+      ui: {},
+      githubCache: { pr: {}, issue: {} },
+      projectGroups: [
+        {
+          id: 'root',
+          name: 'Platform',
+          parentPath: '/workspace/platform',
+          parentGroupId: null,
+          connectionId: options.connectionId ?? null,
+          createdFrom: 'folder-scan',
+          tabOrder: 0,
+          isCollapsed: false,
+          color: null,
+          createdAt: 1,
+          updatedAt: 1
+        }
+      ],
+      folderWorkspaces: options.workspaces,
+      ...('diffCommentsMap' in options
+        ? { folderWorkspaceDiffComments: options.diffCommentsMap }
+        : {}),
+      ...options.extraTopLevel
+    })
+  }
+
+  // The previous build's normalizeFolderWorkspaces has no diffComments projection (the line this
+  // checkout carries at src/shared/folder-workspaces.ts:107 does not exist on v1.4.179–v1.4.181),
+  // and its full-state write re-serializes everything else verbatim (the `{ ...defaults, ...parsed }`
+  // load spread and the omit-style getDurableState()).
+  function simulatePreviousBuildLoadAndFlush(onDisk: PersistedState): PersistedState {
+    return {
+      ...onDisk,
+      folderWorkspaces: onDisk.folderWorkspaces.map(
+        ({ diffComments: _droppedByOldNormalizer, ...rest }) => rest
+      )
+    }
+  }
+
+  it('keeps folder-workspace review notes across a previous-build rollback and re-upgrade', async () => {
+    const store = await createStore()
+    const group = store.createProjectGroup({
+      name: 'Platform',
+      parentPath: '/workspace/platform',
+      createdFrom: 'folder-scan'
+    })
+    const workspace = store.createFolderWorkspace({
+      projectGroupId: group.id,
+      name: 'Refund fix'
+    })
+    const note = makeFolderNote('note-1', 'Review this paragraph', workspace.id)
+    store.updateFolderWorkspace(workspace.id, { diffComments: [note] })
+    store.flush()
+
+    const persisted = readDataFile() as PersistedState
+    expect(persisted.folderWorkspaceDiffComments?.[workspace.id]).toEqual([note])
+    expect(persisted.folderWorkspaces[0]).not.toHaveProperty('diffComments')
+    // The strip lives at the serialization boundary only; live records keep their notes.
+    expect(store.getFolderWorkspace(workspace.id)?.diffComments).toEqual([note])
+    expect(folderWorkspaceToWorktree(store.getFolderWorkspace(workspace.id)!).diffComments).toEqual(
+      [note]
+    )
+
+    writeDataFile(simulatePreviousBuildLoadAndFlush(persisted))
+
+    const restored = await createStore()
+    expect(restored.getFolderWorkspace(workspace.id)?.diffComments).toEqual([note])
+    restored.flush()
+    expect((readDataFile() as PersistedState).folderWorkspaceDiffComments?.[workspace.id]).toEqual([
+      note
+    ])
+  })
+
+  it('survives repeated rollback / re-upgrade hops', async () => {
+    const store = await createStore()
+    const group = store.createProjectGroup({
+      name: 'Platform',
+      parentPath: '/workspace/platform',
+      createdFrom: 'folder-scan'
+    })
+    const workspace = store.createFolderWorkspace({ projectGroupId: group.id, name: 'Refund fix' })
+    const note = makeFolderNote('note-1', 'Review this paragraph', workspace.id)
+    store.updateFolderWorkspace(workspace.id, { diffComments: [note] })
+    store.flush()
+
+    for (let hop = 0; hop < 2; hop++) {
+      writeDataFile(simulatePreviousBuildLoadAndFlush(readDataFile() as PersistedState))
+      const reupgraded = await createStore()
+      expect(reupgraded.getFolderWorkspace(workspace.id)?.diffComments).toEqual([note])
+      reupgraded.flush()
+    }
+  })
+
+  it('keeps notes and remote provenance for an SSH folder workspace across a rollback', async () => {
+    const store = await createStore()
+    const group = store.createProjectGroup({
+      name: 'Platform',
+      parentPath: '/workspace/platform',
+      connectionId: 'ssh-1',
+      createdFrom: 'folder-scan'
+    })
+    const workspace = store.createFolderWorkspace({ projectGroupId: group.id, name: 'Remote fix' })
+    expect(workspace.connectionId).toBe('ssh-1')
+    const note = makeFolderNote('note-remote', 'Remote review', workspace.id)
+    store.updateFolderWorkspace(workspace.id, { diffComments: [note] })
+    store.flush()
+
+    writeDataFile(simulatePreviousBuildLoadAndFlush(readDataFile() as PersistedState))
+
+    const restored = await createStore()
+    expect(restored.getFolderWorkspace(workspace.id)?.diffComments).toEqual([note])
+    expect(restored.getFolderWorkspace(workspace.id)?.connectionId).toBe('ssh-1')
+  })
+
+  it('round-trips unknown top-level state keys through load and flush', async () => {
+    writeFolderWorkspaceProfile({
+      workspaces: [folderWorkspaceRecord({ unknownNestedField: 'from-a-newer-build' })],
+      extraTopLevel: { unknownTopLevelKey: { kept: 'verbatim' } }
+    })
+
+    const store = await createStore()
+    store.updateFolderWorkspace('fw-1', { comment: 'touch' })
+    store.flush()
+
+    const persisted = readDataFile() as PersistedState & { unknownTopLevelKey?: unknown }
+    expect(
+      persisted.unknownTopLevelKey,
+      'Unknown top-level keys must survive load + flush. Note preservation relies on this: converting the ' +
+        '`{ ...defaults, ...parsed }` load spread or the omit-style getDurableState() into an ' +
+        'allowlist re-opens folder-workspace note loss for the then-previous build.'
+    ).toEqual({ kept: 'verbatim' })
+    expect(
+      persisted.folderWorkspaces[0],
+      'Documents existing behavior, not a guarantee: normalizeFolderWorkspaces rebuilds each ' +
+        'record field-by-field, so nested unknown fields are dropped. That is why notes moved ' +
+        'to a top-level key.'
+    ).not.toHaveProperty('unknownNestedField')
+  })
+
+  it('migrates legacy inline folder-workspace notes into the top-level map', async () => {
+    const note = makeFolderNote('note-1', 'Legacy inline note')
+    writeFolderWorkspaceProfile({ workspaces: [folderWorkspaceRecord({ diffComments: [note] })] })
+
+    const store = await createStore()
+    expect(store.getFolderWorkspace('fw-1')?.diffComments).toEqual([note])
+    store.flush()
+
+    const persisted = readDataFile() as PersistedState
+    expect(persisted.folderWorkspaceDiffComments?.['fw-1']).toEqual([note])
+    expect(persisted.folderWorkspaces[0]).not.toHaveProperty('diffComments')
+  })
+
+  it('keeps notes across a rollback when the session never edits anything', async () => {
+    const note = makeFolderNote('note-1', 'Legacy inline note')
+    writeFolderWorkspaceProfile({ workspaces: [folderWorkspaceRecord({ diffComments: [note] })] })
+
+    // Launch and quit on the fixed build, with no mutation: loadNeedsSave must make the
+    // relocation durable on its own. This is the reported P0 sequence.
+    const upgraded = await createStore()
+    upgraded.flush()
+
+    writeDataFile(simulatePreviousBuildLoadAndFlush(readDataFile() as PersistedState))
+
+    const restored = await createStore()
+    expect(restored.getFolderWorkspace('fw-1')?.diffComments).toEqual([note])
+  })
+
+  it('keeps notes authored inline on a rolled-back #14112 build over a staler map entry', async () => {
+    const mapped = makeFolderNote('note-mapped', 'Note from the fixed build')
+    const authored = makeFolderNote('note-inline', 'Note authored while rolled back')
+
+    writeFolderWorkspaceProfile({
+      workspaces: [folderWorkspaceRecord()],
+      diffCommentsMap: { 'fw-1': [mapped] }
+    })
+    // #14112 persists notes inline and never learned about the top-level map, so a note authored
+    // there lands inline while the untouched map entry goes stale. Inline is the newer write.
+    const rolledBack = readDataFile() as PersistedState
+    writeDataFile({
+      ...rolledBack,
+      folderWorkspaces: rolledBack.folderWorkspaces.map((workspace) => ({
+        ...workspace,
+        diffComments: [authored]
+      }))
+    })
+
+    const store = await createStore()
+    expect(store.getFolderWorkspace('fw-1')?.diffComments).toEqual([authored])
+    store.flush()
+    expect((readDataFile() as PersistedState).folderWorkspaceDiffComments).toEqual({
+      'fw-1': [authored]
+    })
+  })
+
+  it('never lets an empty or unrelated map entry delete inline notes', async () => {
+    const inline = makeFolderNote('note-inline', 'Inline note')
+    const mapped = makeFolderNote('note-mapped', 'Mapped note')
+
+    writeFolderWorkspaceProfile({
+      workspaces: [folderWorkspaceRecord({ diffComments: [inline] })],
+      diffCommentsMap: { 'fw-1': [] }
+    })
+    expect((await createStore()).getFolderWorkspace('fw-1')?.diffComments).toEqual([inline])
+
+    writeFolderWorkspaceProfile({
+      workspaces: [folderWorkspaceRecord({ diffComments: [inline] })],
+      diffCommentsMap: { other: [mapped] }
+    })
+    const store = await createStore()
+    expect(store.getFolderWorkspace('fw-1')?.diffComments).toEqual([inline])
+    store.flush()
+    expect((readDataFile() as PersistedState).folderWorkspaceDiffComments).toEqual({
+      'fw-1': [inline]
+    })
+  })
+
+  it('drops orphaned note entries and prunes them when workspaces are deleted', async () => {
+    const note = makeFolderNote('note-1', 'Kept note')
+    writeFolderWorkspaceProfile({
+      workspaces: [folderWorkspaceRecord()],
+      diffCommentsMap: { 'fw-1': [note], ghost: [makeFolderNote('note-ghost', 'Orphan', 'ghost')] }
+    })
+
+    const store = await createStore()
+    store.flush()
+    expect((readDataFile() as PersistedState).folderWorkspaceDiffComments).toEqual({
+      'fw-1': [note]
+    })
+
+    const reloaded = await createStore()
+    reloaded.flush()
+    expect((readDataFile() as PersistedState).folderWorkspaceDiffComments).not.toHaveProperty(
+      'ghost'
+    )
+
+    // Delete paths carry no pruning code: the map is derived from live workspaces on every write.
+    expect(reloaded.removeFolderWorkspace('fw-1')).toBe(true)
+    reloaded.flush()
+    expect(readDataFile() as PersistedState).not.toHaveProperty('folderWorkspaceDiffComments')
+
+    writeFolderWorkspaceProfile({
+      workspaces: [folderWorkspaceRecord()],
+      diffCommentsMap: { 'fw-1': [note] }
+    })
+    const groupDelete = await createStore()
+    expect(groupDelete.deleteProjectGroup('root')).toBe(true)
+    groupDelete.flush()
+    expect(readDataFile() as PersistedState).not.toHaveProperty('folderWorkspaceDiffComments')
+  })
+
+  it('writes no folderWorkspaceDiffComments key for note-free profiles', async () => {
+    const store = await createStore()
+    const group = store.createProjectGroup({
+      name: 'Platform',
+      parentPath: '/workspace/platform',
+      createdFrom: 'folder-scan'
+    })
+    const workspace = store.createFolderWorkspace({ projectGroupId: group.id, name: 'No notes' })
+    store.flush()
+    expect('folderWorkspaceDiffComments' in (readDataFile() as object)).toBe(false)
+
+    store.updateFolderWorkspace(workspace.id, { diffComments: [] })
+    store.flush()
+    expect('folderWorkspaceDiffComments' in (readDataFile() as object)).toBe(false)
+  })
+
+  it.each([
+    ['null root', null, undefined],
+    ['string root', 'oops', undefined],
+    ['array root', [], undefined],
+    ['non-array entry value', { 'fw-1': 'oops' }, undefined],
+    ['array of non-DiffComment members', { 'fw-1': [7] }, [7]]
+  ])(
+    'tolerates a corrupt folderWorkspaceDiffComments map (%s)',
+    async (_label, diffCommentsMap, expected) => {
+      writeFolderWorkspaceProfile({ workspaces: [folderWorkspaceRecord()], diffCommentsMap })
+
+      const store = await createStore()
+
+      expect(store.getFolderWorkspace('fw-1')?.diffComments).toEqual(expected)
+    }
+  )
+
+  it('passes note members through verbatim on load and re-write', async () => {
+    // Shape-only guard: the moment member filtering is added here, the fix itself becomes a new
+    // deletion path for user-authored prose.
+    const noteWithExtras = { ...makeFolderNote('note-1', 'Body'), unknownNoteField: 'kept' }
+    writeFolderWorkspaceProfile({
+      workspaces: [folderWorkspaceRecord(), folderWorkspaceRecord({ id: 'fw-2', name: 'Second' })],
+      diffCommentsMap: { 'fw-1': [7], 'fw-2': [noteWithExtras] }
+    })
+
+    const store = await createStore()
+    store.flush()
+
+    const persisted = readDataFile() as PersistedState
+    expect(persisted.folderWorkspaceDiffComments).toEqual({
+      'fw-1': [7],
+      'fw-2': [noteWithExtras]
+    })
+  })
+
+  it('derives the written note map from live workspaces, never a stale loaded copy', async () => {
+    const loadedNote = makeFolderNote('note-loaded', 'Loaded note')
+    const editedNote = makeFolderNote('note-edited', 'Edited note')
+    writeFolderWorkspaceProfile({
+      workspaces: [folderWorkspaceRecord()],
+      diffCommentsMap: { 'fw-1': [loadedNote] }
+    })
+
+    const store = await createStore()
+    store.updateFolderWorkspace('fw-1', { diffComments: [editedNote] })
+    store.flush()
+
+    expect((readDataFile() as PersistedState).folderWorkspaceDiffComments).toEqual({
+      'fw-1': [editedNote]
+    })
+  })
+
   // ── 9. Settings: get/update ────────────────────────────────────────
 
   it('updateSettings merges partial updates', async () => {
@@ -5621,6 +6023,50 @@ describe('Store', () => {
     expect(persisted.settings).not.toHaveProperty('terminalScrollbackBytes')
   })
 
+  it('retires the persisted GitHub attribution setting without dropping unknown settings', async () => {
+    const settledStore = await createStore()
+    settledStore.flush()
+    const settled = readDataFile() as { settings: Record<string, unknown> }
+    settled.settings.enableGitHubAttribution = true
+    settled.settings.futureSetting = { enabled: true }
+    writeDataFile(settled)
+
+    vi.useFakeTimers()
+    try {
+      const store = await createStore()
+
+      expect(store.getSettings()).not.toHaveProperty('enableGitHubAttribution')
+      expect(store.getSettings()).toHaveProperty('futureSetting', { enabled: true })
+      vi.advanceTimersByTime(5_000)
+      await store.waitForPendingWrite()
+    } finally {
+      vi.useRealTimers()
+    }
+    const persisted = readDataFile() as { settings?: Record<string, unknown> }
+    expect(persisted.settings).not.toHaveProperty('enableGitHubAttribution')
+    expect(persisted.settings).toHaveProperty('futureSetting', { enabled: true })
+  })
+
+  it('ignores retired GitHub attribution updates and strips stale in-memory values on save', async () => {
+    const store = await createStore()
+    const listener = vi.fn()
+    store.onSettingsChanged(listener)
+
+    const updated = store.updateSettings({ enableGitHubAttribution: true } as never, {
+      notifyListeners: true
+    })
+
+    expect(updated).not.toHaveProperty('enableGitHubAttribution')
+    expect(listener).not.toHaveBeenCalled()
+    const settings = store.getSettings() as GlobalSettings & Record<string, unknown>
+    settings.enableGitHubAttribution = false
+    settings.futureSetting = 'kept'
+    store.flush()
+    const persisted = readDataFile() as { settings?: Record<string, unknown> }
+    expect(persisted.settings).not.toHaveProperty('enableGitHubAttribution')
+    expect(persisted.settings?.futureSetting).toBe('kept')
+  })
+
   it('normalizes terminal cursor style before persistence and listener broadcasts', async () => {
     const store = await createStore()
     store.updateSettings({ terminalCursorStyle: 'underline' })
@@ -9176,6 +9622,242 @@ describe('Store', () => {
     )
   })
 
+  it('admits a split binding only while the exact source still owns its layout leaf', async () => {
+    for (const hostId of [undefined, 'ssh:ssh-1']) {
+      const store = await createStore()
+      store.setWorkspaceSession(
+        {
+          ...getDefaultWorkspaceSession(),
+          tabsByWorktree: {
+            wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-source' })]
+          },
+          terminalLayoutsByTabId: {
+            tab1: {
+              root: { type: 'leaf', leafId: TEST_LEAF_1 },
+              activeLeafId: TEST_LEAF_1,
+              expandedLeafId: null,
+              ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-source' }
+            }
+          }
+        },
+        hostId
+      )
+      const staleRendererSession = structuredClone(store.getWorkspaceSession(hostId))
+
+      expect(
+        store.persistPtyBinding(
+          {
+            worktreeId: 'wt1',
+            tabId: 'different-target-tab',
+            leafId: TEST_LEAF_2,
+            ptyId: 'pty-split',
+            expectedSourceBinding: {
+              worktreeId: 'wt1',
+              tabId: 'tab1',
+              leafId: TEST_LEAF_1,
+              ptyId: 'pty-source'
+            }
+          },
+          hostId
+        )
+      ).toBe(false)
+      expect(
+        store
+          .getWorkspaceSession(hostId)
+          .tabsByWorktree.wt1.some((tab) => tab.id === 'different-target-tab')
+      ).toBe(false)
+
+      expect(
+        store.persistPtyBinding(
+          {
+            worktreeId: 'wt-canonical',
+            tabId: 'tab1',
+            leafId: TEST_LEAF_2,
+            ptyId: 'pty-split',
+            expectedSourceBinding: {
+              worktreeId: 'wt1',
+              tabId: 'tab1',
+              leafId: TEST_LEAF_1,
+              ptyId: 'pty-source'
+            }
+          },
+          hostId
+        )
+      ).toBe(true)
+      const admitted = store.getWorkspaceSession(hostId)
+      expect(admitted.terminalTopologyRevisionByRepoId?.wt1).toBe(1)
+      expect(admitted.terminalLayoutsByTabId.tab1.ptyIdsByLeafId).toMatchObject({
+        [TEST_LEAF_1]: 'pty-source',
+        [TEST_LEAF_2]: 'pty-split'
+      })
+
+      store.setWorkspaceSession(staleRendererSession, hostId)
+      expect(
+        store.getWorkspaceSession(hostId).terminalLayoutsByTabId.tab1.ptyIdsByLeafId
+      ).toMatchObject({
+        [TEST_LEAF_1]: 'pty-source',
+        [TEST_LEAF_2]: 'pty-split'
+      })
+
+      expect(
+        store.persistPtyBinding(
+          {
+            worktreeId: 'wt1',
+            tabId: 'rejected-tab',
+            leafId: TEST_LEAF_2,
+            ptyId: 'pty-rejected',
+            expectedSourceBinding: {
+              worktreeId: 'wt1',
+              tabId: 'missing-source-tab',
+              leafId: TEST_LEAF_1,
+              ptyId: 'pty-source'
+            }
+          },
+          hostId
+        )
+      ).toBe(false)
+      expect(
+        store
+          .getWorkspaceSession(hostId)
+          .tabsByWorktree.wt1.some((tab) => tab.id === 'rejected-tab')
+      ).toBe(false)
+      expect(
+        store.getWorkspaceSession(hostId).terminalLayoutsByTabId['rejected-tab']
+      ).toBeUndefined()
+    }
+  })
+
+  it('rejects a split source incarnation mismatch', async () => {
+    const store = await createStore()
+    store.setWorkspaceSession({
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-source' })]
+      },
+      terminalLayoutsByTabId: {
+        tab1: {
+          root: { type: 'leaf', leafId: TEST_LEAF_1 },
+          activeLeafId: TEST_LEAF_1,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-source' }
+        }
+      },
+      terminalPtyIncarnationsByPaneKey: { [`tab1:${TEST_LEAF_1}`]: 'persisted-incarnation' }
+    })
+
+    expect(
+      store.persistPtyBinding({
+        worktreeId: 'wt1',
+        tabId: 'tab1',
+        leafId: TEST_LEAF_2,
+        ptyId: 'pty-split',
+        expectedSourceBinding: {
+          tabId: 'tab1',
+          leafId: TEST_LEAF_1,
+          ptyId: 'pty-source',
+          incarnationId: 'different-incarnation'
+        }
+      })
+    ).toBe(false)
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId.tab1.root).toEqual({
+      type: 'leaf',
+      leafId: TEST_LEAF_1
+    })
+  })
+
+  it('requires an expected split source incarnation in the owning host partition', async () => {
+    for (const hostId of [undefined, 'ssh:ssh-1']) {
+      const store = await createStore()
+      const sourceSession: WorkspaceSessionState = {
+        ...getDefaultWorkspaceSession(),
+        tabsByWorktree: {
+          wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-source' })]
+        },
+        terminalLayoutsByTabId: {
+          tab1: {
+            root: { type: 'leaf', leafId: TEST_LEAF_1 },
+            activeLeafId: TEST_LEAF_1,
+            expandedLeafId: null,
+            ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-source' }
+          }
+        }
+      }
+      if (hostId) {
+        store.setWorkspaceSession(
+          {
+            ...sourceSession,
+            terminalPtyIncarnationsByPaneKey: {
+              [`tab1:${TEST_LEAF_1}`]: 'live-incarnation'
+            }
+          },
+          undefined
+        )
+      }
+      store.setWorkspaceSession(sourceSession, hostId)
+
+      expect(
+        store.persistPtyBinding(
+          {
+            worktreeId: 'wt1',
+            tabId: 'tab1',
+            leafId: TEST_LEAF_2,
+            ptyId: 'pty-split',
+            expectedSourceBinding: {
+              worktreeId: 'wt1',
+              tabId: 'tab1',
+              leafId: TEST_LEAF_1,
+              ptyId: 'pty-source',
+              incarnationId: 'live-incarnation'
+            }
+          },
+          hostId
+        )
+      ).toBe(false)
+      expect(store.getWorkspaceSession(hostId).terminalLayoutsByTabId.tab1.root).toEqual({
+        type: 'leaf',
+        leafId: TEST_LEAF_1
+      })
+    }
+  })
+
+  // Why: a session restored without an incarnation map still owns a valid source binding, so the
+  // split path must be able to fence on the pane alone instead of an id persistence never recorded.
+  it('admits a split whose source pane has no persisted incarnation', async () => {
+    const store = await createStore()
+    store.setWorkspaceSession(
+      {
+        ...getDefaultWorkspaceSession(),
+        tabsByWorktree: {
+          wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-source' })]
+        },
+        terminalLayoutsByTabId: {
+          tab1: {
+            root: { type: 'leaf', leafId: TEST_LEAF_1 },
+            activeLeafId: TEST_LEAF_1,
+            expandedLeafId: null,
+            ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-source' }
+          }
+        }
+      },
+      undefined
+    )
+
+    expect(
+      store.persistPtyBinding({
+        worktreeId: 'wt1',
+        tabId: 'tab1',
+        leafId: TEST_LEAF_2,
+        ptyId: 'pty-split',
+        expectedSourceBinding: {
+          worktreeId: 'wt1',
+          tabId: 'tab1',
+          leafId: TEST_LEAF_1,
+          ptyId: 'pty-source'
+        }
+      })
+    ).toBe(true)
+  })
+
   it('rejects competing PTY and incarnation changes during reconciliation', async () => {
     const store = await createStore()
     const paneKey = `tab1:${TEST_LEAF_1}`
@@ -9310,6 +9992,9 @@ describe('Store', () => {
       expect(store.getWorkspaceSession(hostId).terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
         'inc-live'
       )
+      // Unchanged by STA-3077 step P. The fold moves an SSH pane's incarnation only when it moves
+      // the binding it fences, and this fixture's tab exists solely in the SSH partition — so
+      // there is no second home to disagree with, nothing folds, and both halves stay together.
       const reloaded = await createStore()
       expect(reloaded.getWorkspaceSession(hostId).terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
         'inc-live'
diff --git a/src/main/persistence.ts b/src/main/persistence.ts
index c15cab49aad..14d50d4d297 100644
--- a/src/main/persistence.ts
+++ b/src/main/persistence.ts
@@ -37,6 +37,7 @@ import {
   nextAutomationOccurrenceAfter
 } from '../shared/automation-schedules'
 import { getAutomationLegacyRepoId } from '../shared/automation-run-identity'
+import { isRelayAttestedPtyIncarnationId } from '../shared/pty-incarnation'
 import { normalizeAutomationPrecheck } from '../shared/automation-precheck'
 import { normalizeProxyUrl } from '../shared/network-proxy'
 import { normalizeKagiSessionLink } from '../shared/browser-url'
@@ -96,6 +97,7 @@ import type { MigrationUnsupportedPtyEntry } from '../shared/agent-status-types'
 import { MOBILE_PAIRING_USERDATA_FILES } from './runtime/mobile-pairing-files'
 import { normalizePersistedMobileClientTabSelections } from './runtime/client-session-tab-selection-persistence'
 import { sanitizeWorkspaceSessionTerminalRetirements } from './runtime/mobile-session-terminal-persistence-retirement'
+import { findTerminalTabIdForLeaf } from './runtime/workspace-session-terminal-membership-authority'
 import {
   removeRepoFromHostWorkspaceSessions,
   removeRepoFromWorkspaceSession
@@ -256,6 +258,10 @@ import { normalizeUiLanguage } from '../shared/ui-language'
 import { normalizeBrowserPageZoomLevel } from '../shared/browser-page-zoom'
 import { persistedUIValuesEqual } from '../shared/persisted-ui-equality'
 import { ActiveViewPreference } from './active-view-preference'
+import {
+  collectFolderWorkspaceDiffComments,
+  normalizeFolderWorkspaceDiffComments
+} from './folder-workspace-diff-comments'
 import {
   normalizeFolderWorkspaceName,
   normalizeFolderWorkspaces
@@ -651,6 +657,11 @@ type LegacyTerminalScrollbackSettings = {
   terminalScrollbackBytes?: unknown
 }
 
+type RetiredGlobalSettings = {
+  terminalScrollbackBytes?: unknown
+  enableGitHubAttribution?: unknown
+}
+
 const LEGACY_TERMINAL_TUI_SCROLL_SENSITIVITY_DEFAULT = 3
 
 function readLegacyTerminalScrollbackSettings(settings: unknown): LegacyTerminalScrollbackSettings {
@@ -659,12 +670,16 @@ function readLegacyTerminalScrollbackSettings(settings: unknown): LegacyTerminal
     : {}
 }
 
-function stripLegacyTerminalScrollbackBytes(
+function stripRetiredGlobalSettings(
   settings: Partial<GlobalSettings> | undefined
 ): Partial<GlobalSettings> {
-  const { terminalScrollbackBytes: _legacyScrollbackBytes, ...rest } = (settings ??
-    {}) as Partial<GlobalSettings> & { terminalScrollbackBytes?: unknown }
+  const {
+    terminalScrollbackBytes: _legacyScrollbackBytes,
+    enableGitHubAttribution: _legacyGitHubAttribution,
+    ...rest
+  } = (settings ?? {}) as Partial<GlobalSettings> & RetiredGlobalSettings
   void _legacyScrollbackBytes
+  void _legacyGitHubAttribution
   return rest
 }
 
@@ -673,11 +688,8 @@ function migrateTerminalScrollbackRows(settings: unknown): {
   needsSave: boolean
 } {
   const legacySettings = readLegacyTerminalScrollbackSettings(settings)
-  const hasRows = Object.prototype.hasOwnProperty.call(legacySettings, 'terminalScrollbackRows')
-  const hasLegacyBytes = Object.prototype.hasOwnProperty.call(
-    legacySettings,
-    'terminalScrollbackBytes'
-  )
+  const hasRows = Object.hasOwn(legacySettings, 'terminalScrollbackRows')
+  const hasLegacyBytes = Object.hasOwn(legacySettings, 'terminalScrollbackBytes')
   const rows = hasRows
     ? normalizeDesktopTerminalScrollbackRows(legacySettings.terminalScrollbackRows)
     : legacyTerminalScrollbackBytesToRows(legacySettings.terminalScrollbackBytes)
@@ -1622,7 +1634,13 @@ function normalizeSshRemotePtyLease(value: unknown): SshRemotePtyLease | null {
     createdAt: typeof raw.createdAt === 'number' ? raw.createdAt : now,
     updatedAt: typeof raw.updatedAt === 'number' ? raw.updatedAt : now,
     ...(typeof raw.lastAttachedAt === 'number' ? { lastAttachedAt: raw.lastAttachedAt } : {}),
-    ...(typeof raw.lastDetachedAt === 'number' ? { lastDetachedAt: raw.lastDetachedAt } : {})
+    ...(typeof raw.lastDetachedAt === 'number' ? { lastDetachedAt: raw.lastDetachedAt } : {}),
+    // Rebuilt field by field, so a lease is only as durable as this list — adding the field to the
+    // type without adding it here drops it on every load. Synthesized values are refused rather
+    // than carried: one written by an older build would later read as a different shell.
+    ...(isRelayAttestedPtyIncarnationId(raw.incarnationId)
+      ? { incarnationId: raw.incarnationId }
+      : {})
   }
 }
 
@@ -1685,7 +1703,7 @@ type LayoutLeafNormalization = {
 
 function collectLayoutLeafCounts(
   node: TerminalPaneLayoutNode,
-  counts: Map<string, number> = new Map()
+  counts = new Map<string, number>()
 ): Map<string, number> {
   if (node.type === 'leaf') {
     counts.set(node.leafId, (counts.get(node.leafId) ?? 0) + 1)
@@ -1723,6 +1741,20 @@ function layoutContainsLeafId(node: TerminalPaneLayoutNode | null, leafId: strin
   return layoutContainsLeafId(node.first, leafId) || layoutContainsLeafId(node.second, leafId)
 }
 
+/** Total order so two leases for one pane resolve the same way on every host. */
+function isNewerSshRemotePtyLease(
+  candidate: SshRemotePtyLease,
+  incumbent: SshRemotePtyLease
+): boolean {
+  if (candidate.updatedAt !== incumbent.updatedAt) {
+    return candidate.updatedAt > incumbent.updatedAt
+  }
+  if (candidate.createdAt !== incumbent.createdAt) {
+    return candidate.createdAt > incumbent.createdAt
+  }
+  return candidate.ptyId > incumbent.ptyId
+}
+
 function cloneLayoutNode(node: TerminalPaneLayoutNode): TerminalPaneLayoutNode {
   if (node.type === 'leaf') {
     return { type: 'leaf', leafId: node.leafId }
@@ -2783,6 +2815,14 @@ export type StoreOptions = {
   dataFile?: string
 }
 
+export type PtyBindingSourceExpectation = {
+  worktreeId?: string
+  tabId: string
+  leafId: string
+  ptyId: string
+  incarnationId?: string
+}
+
 export class Store {
   private state: PersistedState
   private readonly dataFile: string
@@ -2810,6 +2850,7 @@ export class Store {
   private pendingGithubCacheWrite: Promise<void> | null = null
   private readonly staleGithubCacheTempCleanup: Promise<void>
   private gitUsernameCache = new Map<string, string>()
+  private readonly sshRemotePtyLeaseMutationVersions = new WeakMap<SshRemotePtyLease, number>()
   private readonly protectedSecrets = new ProtectedSecretPersistence()
   private loadNeedsSave = false
   private settingsChangeListeners = new Set<
@@ -2844,6 +2885,7 @@ export class Store {
     // profile avoids serializing the multi-MB recovery store on navigation.
     this.activeViewPreference = new ActiveViewPreference(this.dataFile, this.state.ui?.activeView)
     const adaptedProjectGroups = this.adaptFlatFolderScanProjectGroups()
+    this.hydrateFolderWorkspaceDiffComments()
     for (const entry of normalized.migrationUnsupportedEntries) {
       setMigrationUnsupportedPty(entry)
     }
@@ -2864,6 +2906,33 @@ export class Store {
     }
   }
 
+  // Why: notes live top-level on disk so an older build's field-by-field
+  // normalizeFolderWorkspaces can't drop them; re-attach them to the in-memory records here.
+  private hydrateFolderWorkspaceDiffComments(): void {
+    const stored = this.state.folderWorkspaceDiffComments
+    let relocatedInline = false
+    for (const workspace of this.state.folderWorkspaces ?? []) {
+      if (Array.isArray(workspace.diffComments) && workspace.diffComments.length > 0) {
+        // Inline wins: an intervening rollback to a #14112 build writes notes inline and leaves the
+        // older map untouched, so inline is the last notes-aware write. Also makes the relocation
+        // durable even if the user never edits anything this session.
+        relocatedInline = true
+        continue
+      }
+      const comments = stored?.[workspace.id]
+      // Not `??`: a degenerate `{ id: [] }` entry must not delete an intact inline value.
+      if (Array.isArray(comments) && comments.length > 0) {
+        workspace.diffComments = comments
+      }
+    }
+    if (relocatedInline) {
+      this.loadNeedsSave = true
+    }
+    // Write-only projection: buildStateToSave() is the only producer, so leaving the loaded map in
+    // state would make it a stale second source of truth that getDurableState() spreads back out.
+    delete this.state.folderWorkspaceDiffComments
+  }
+
   private adaptFlatFolderScanProjectGroups(): boolean {
     // Why: older folder imports kept a real parent path but flat repos; upgrade that shape into v1 sparse folder scopes.
     const groups = this.state.projectGroups ?? []
@@ -3144,6 +3213,13 @@ export class Store {
         if (migratedTerminalScrollback.needsSave) {
           this.loadNeedsSave = true
         }
+        if (
+          parsed.settings &&
+          typeof parsed.settings === 'object' &&
+          Object.hasOwn(parsed.settings, 'enableGitHubAttribution')
+        ) {
+          this.loadNeedsSave = true
+        }
         const migratedTerminalTuiScrollSensitivity = migrateTerminalTuiScrollSensitivityDefault(
           parsed.settings
         )
@@ -3406,6 +3482,9 @@ export class Store {
             parsed.folderWorkspaces,
             normalizedProjectGroups
           ),
+          folderWorkspaceDiffComments: normalizeFolderWorkspaceDiffComments(
+            parsed.folderWorkspaceDiffComments
+          ),
           worktreeLineageById: parsed.worktreeLineageById ?? {},
           mobileClientTabSelectionsByDeviceId: normalizePersistedMobileClientTabSelections(
             parsed.mobileClientTabSelectionsByDeviceId
@@ -3416,7 +3495,7 @@ export class Store {
           settings: {
             ...defaults.settings,
             // Why (#7977): keep persisted experimentalNewWorktreeCardStyle:true — v1.4.130's onboarding auto-wrote it as a plain boolean, so it's indistinguishable from a real opt-in; only the default changed.
-            ...stripLegacyTerminalScrollbackBytes(parsed.settings),
+            ...stripRetiredGlobalSettings(parsed.settings),
             prBotAuthorOverrides: normalizePRBotAuthorOverrides(
               parsed.settings?.prBotAuthorOverrides
             ),
@@ -4000,6 +4079,13 @@ export class Store {
     // Why: clone before encrypting secrets so in-memory this.state stays plaintext.
     const stateToSave = {
       ...this.getDurableState(),
+      // Why both keys unconditionally: the explicit keys always win over the spread, and
+      // JSON.stringify drops the `undefined` value so a note-free profile gains no key on disk.
+      // The strip builds a new array here only; this.state records keep their notes in memory.
+      folderWorkspaces: (this.state.folderWorkspaces ?? []).map(
+        ({ diffComments: _relocated, ...rest }) => rest
+      ),
+      folderWorkspaceDiffComments: collectFolderWorkspaceDiffComments(this.state.folderWorkspaces),
       sshPtyConsumerRecoveries: (this.state.sshPtyConsumerRecoveries ?? []).map((record) => ({
         ...record,
         ownerLease: encryptToSentinel(
@@ -4008,7 +4094,7 @@ export class Store {
         )
       })),
       settings: {
-        ...this.state.settings,
+        ...stripRetiredGlobalSettings(this.state.settings),
         opencodeSessionCookie: encryptToSentinel(
           PROTECTED_SECRET_SLOT.opencodeSessionCookie,
           this.state.settings.opencodeSessionCookie
@@ -4546,6 +4632,7 @@ export class Store {
         | 'pendingFirstAgentMessageRename'
         | 'firstAgentMessageRenameError'
         | 'lastActivityAt'
+        | 'diffComments'
       >
     >
   ): FolderWorkspace | null {
@@ -4619,6 +4706,9 @@ export class Store {
     if (updates.lastActivityAt !== undefined && Number.isFinite(updates.lastActivityAt)) {
       workspace.lastActivityAt = updates.lastActivityAt
     }
+    if (updates.diffComments !== undefined) {
+      workspace.diffComments = updates.diffComments
+    }
     workspace.updatedAt = Date.now()
     this.scheduleSave()
     return workspace
@@ -4910,6 +5000,7 @@ export class Store {
         | 'externalWorktreeVisibilityPromptDismissedAt'
         | 'externalWorktreeInboxBaselinePaths'
         | 'importedExternalWorktreePaths'
+        | 'agentWorktreeVisibility'
         | 'projectGroupId'
         | 'projectGroupOrder'
         | 'projectHostSetupMethod'
@@ -5809,7 +5900,7 @@ export class Store {
     updates: Partial<GlobalSettings>,
     options: { notifyListeners?: boolean; originWebContentsId?: number } = {}
   ): GlobalSettings {
-    const sanitizedUpdates = stripLegacyTerminalScrollbackBytes(updates)
+    const sanitizedUpdates = stripRetiredGlobalSettings(updates)
     if ('opencodeSessionCookie' in updates && !updates.opencodeSessionCookie) {
       this.protectedSecrets.removeRetainedBlob(PROTECTED_SECRET_SLOT.opencodeSessionCookie)
     }
@@ -6773,15 +6864,41 @@ export class Store {
       incarnationId?: string
       startupCwd?: string
       expectedBinding?: { ptyId: string; incarnationId?: string }
+      /** Reattach passes false: an absent durable pane never authorizes creating UI.
+       *  Defaults true so the spawn path keeps its force-quit-race branches. */
+      mayCreate?: boolean
+      expectedSourceBinding?: PtyBindingSourceExpectation
     },
     hostId?: string | null
   ): boolean {
+    const mayCreate = args.mayCreate ?? true
     const resolvedHostId = this.resolveHostId(hostId)
     const session = this.getWorkspaceSession(resolvedHostId)
     const paneKey = `${args.tabId}:${args.leafId}`
+    const bindingWorktreeId = args.expectedSourceBinding?.worktreeId ?? args.worktreeId
+    if (args.expectedSourceBinding) {
+      const expected = args.expectedSourceBinding
+      if (expected.tabId !== args.tabId) {
+        return false
+      }
+      const sourceTab = session.tabsByWorktree?.[bindingWorktreeId]?.find(
+        (candidate) => candidate.id === expected.tabId && candidate.worktreeId === bindingWorktreeId
+      )
+      const sourceLayout = session.terminalLayoutsByTabId?.[expected.tabId]
+      const sourcePaneKey = `${expected.tabId}:${expected.leafId}`
+      if (
+        !sourceTab ||
+        sourceLayout?.ptyIdsByLeafId?.[expected.leafId] !== expected.ptyId ||
+        !layoutContainsLeafId(sourceLayout.root, expected.leafId) ||
+        (expected.incarnationId !== undefined &&
+          session.terminalPtyIncarnationsByPaneKey?.[sourcePaneKey] !== expected.incarnationId)
+      ) {
+        return false
+      }
+    }
     if (args.expectedBinding) {
-      const tab = session.tabsByWorktree?.[args.worktreeId]?.find(
-        (candidate) => candidate.id === args.tabId && candidate.worktreeId === args.worktreeId
+      const tab = session.tabsByWorktree?.[bindingWorktreeId]?.find(
+        (candidate) => candidate.id === args.tabId && candidate.worktreeId === bindingWorktreeId
       )
       const boundPtyId = session.terminalLayoutsByTabId?.[args.tabId]?.ptyIdsByLeafId?.[args.leafId]
       if (
@@ -6804,9 +6921,13 @@ export class Store {
       args.incarnationId !== args.expectedBinding.incarnationId
     let terminalMembershipChanged = false
     const advanceTopologyFence = (): void => {
-      const repoId = getRepoIdFromWorktreeId(args.worktreeId)
+      const repoId = getRepoIdFromWorktreeId(bindingWorktreeId)
       const currentRevision = session.terminalTopologyRevisionByRepoId?.[repoId] ?? 0
-      if (!reconciledIncarnation && (!terminalMembershipChanged || currentRevision <= 0)) {
+      const establishesSplitAuthority = args.expectedSourceBinding !== undefined
+      if (
+        !reconciledIncarnation &&
+        (!terminalMembershipChanged || (currentRevision <= 0 && !establishesSplitAuthority))
+      ) {
         return
       }
       // Why: host-admitted membership or incarnation changes must outrank a stale renderer replay.
@@ -6837,7 +6958,7 @@ export class Store {
         delete session.terminalSurfaceTombstonesByPaneKey[paneKey]
       }
     }
-    const tabs = session.tabsByWorktree?.[args.worktreeId]
+    const tabs = session.tabsByWorktree?.[bindingWorktreeId]
     const tab = tabs?.find((t) => t.id === args.tabId)
     if (tab) {
       tab.ptyId = args.ptyId
@@ -6848,20 +6969,25 @@ export class Store {
         ...(tabs ?? []),
         createMinimalPersistedTerminalTab({
           ...args,
+          worktreeId: bindingWorktreeId,
           existingTabCount: tabs?.length ?? 0
         })
       ]
       session.tabsByWorktree = {
         ...session.tabsByWorktree,
-        [args.worktreeId]: nextTabs
+        [bindingWorktreeId]: nextTabs
       }
-      session.activeWorktreeId ??= args.worktreeId
+      session.activeWorktreeId ??= bindingWorktreeId
       session.activeTabId ??= args.tabId
       session.activeTabIdByWorktree = {
         ...session.activeTabIdByWorktree,
-        [args.worktreeId]: session.activeTabIdByWorktree?.[args.worktreeId] ?? args.tabId
+        [bindingWorktreeId]: session.activeTabIdByWorktree?.[bindingWorktreeId] ?? args.tabId
       }
     }
+    if (!mayCreate && terminalMembershipChanged) {
+      restoreSession()
+      return false
+    }
     if (!isTerminalLeafId(args.leafId)) {
       // Why: keep legacy renderer-local pane ids out of durable leaf-keyed layout state after the UUID migration.
       advanceTopologyFence()
@@ -6912,6 +7038,10 @@ export class Store {
         }
       }
     }
+    if (!mayCreate && terminalMembershipChanged) {
+      restoreSession()
+      return false
+    }
     advanceTopologyFence()
     try {
       this.flushOrThrow()
@@ -7207,6 +7337,12 @@ export class Store {
     return leases.filter((lease) => targetId === undefined || lease.targetId === targetId)
   }
 
+  private advanceSshRemotePtyLeaseMutationVersion(lease: SshRemotePtyLease): number {
+    const version = (this.sshRemotePtyLeaseMutationVersions.get(lease) ?? 0) + 1
+    this.sshRemotePtyLeaseMutationVersions.set(lease, version)
+    return version
+  }
+
   upsertSshRemotePtyLease(
     lease: Omit<SshRemotePtyLease, 'createdAt' | 'updatedAt'> &
       Partial<Pick<SshRemotePtyLease, 'createdAt' | 'updatedAt'>>
@@ -7226,21 +7362,313 @@ export class Store {
       (entry) =>
         entry.targetId === normalizedLease.targetId && entry.ptyId === normalizedLease.ptyId
     )
-    const existing = existingIndex >= 0 ? this.state.sshRemotePtyLeases[existingIndex] : undefined
+    const existing = existingIndex !== -1 ? this.state.sshRemotePtyLeases[existingIndex] : undefined
     const next: SshRemotePtyLease = {
       ...existing,
       ...normalizedLease,
       createdAt: existing?.createdAt ?? normalizedLease.createdAt ?? now,
       updatedAt: normalizedLease.updatedAt ?? now
     }
-    if (existingIndex >= 0) {
+    if (existingIndex !== -1) {
       this.state.sshRemotePtyLeases[existingIndex] = next
     } else {
       this.state.sshRemotePtyLeases.push(next)
     }
+    this.supersedeSiblingLeasesForPane(next, now)
     this.flush()
   }
 
+  /**
+   * One pane owns at most one live remote PTY. Without this, lease identity is
+   * `(targetId, ptyId)` alone, so a pane that re-leases under a new relay id
+   * leaves its predecessor live forever — reattach then fans out over both and
+   * grafts a pane the user never opened (STA-3077: 2 -> 19 -> 20 across three
+   * reconnects).
+   *
+   * Superseded leases are marked `expired`, not terminated: the remote shell is
+   * deliberately left running, because losing a lease is not proof the shell died.
+   */
+  private supersedeSiblingLeasesForPane(winner: SshRemotePtyLease, now: number): void {
+    if (!winner.worktreeId || !winner.tabId || !winner.leafId) {
+      return
+    }
+    if (winner.state === 'terminated' || winner.state === 'expired') {
+      return
+    }
+    // Why consult the binding here: at upsert time the caller's lease may not be
+    // the one the pane is bound to yet. Expiring the bound predecessor would
+    // detach a live pane, so leave both live and let reattach arbitrate with the
+    // binding in hand.
+    const boundPtyId = this.durablyBoundPtyIdForPane(winner.targetId, winner.tabId, winner.leafId)
+    if (boundPtyId && boundPtyId !== winner.ptyId) {
+      return
+    }
+    const superseded: SshRemotePtyLease[] = []
+    for (const lease of this.state.sshRemotePtyLeases ?? []) {
+      if (
+        lease.ptyId !== winner.ptyId &&
+        lease.targetId === winner.targetId &&
+        lease.worktreeId === winner.worktreeId &&
+        // Leaf only: a lease freezes its tabId, and a pane broken out to a new tab would otherwise
+        // never compete with its own predecessor — which is the reported cardinality growth.
+        lease.leafId === winner.leafId
+      ) {
+        if (lease.state === 'expired') {
+          // A concurrent same-pane owner confirms this lease must outlive rollback as retired.
+          this.advanceSshRemotePtyLeaseMutationVersion(lease)
+          continue
+        }
+        if (lease.state === 'terminated') {
+          continue
+        }
+        lease.state = 'expired'
+        lease.updatedAt = now
+        this.advanceSshRemotePtyLeaseMutationVersion(lease)
+        superseded.push(lease)
+      }
+    }
+    // Why: matching on lease ptyId first means this scrubs only the predecessor's
+    // stale binding — the winner's own binding cannot match and is left intact.
+    this.clearSshRemotePtyBindingsForLeases(winner.targetId, superseded, 'local')
+  }
+
+  /** The PTY a pane is durably bound to. The desktop plane's home is `local` — the renderer is its
+   *  only publisher of pane membership. Hedging into `ssh:<target>` let the headless plane's copy
+   *  outvote the live binding and silently no-op supersession (STA-3077).
+   *
+   *  Keyed on the leaf, falling back across tabs: a lease freezes its tabId at write time, and
+   *  `detachTerminalPaneToTab` moves a live pane, so the named tab can be the one the pane left.
+   *  Missing the binding there makes it lose to recency and retires the pane's own shell. */
+  private durablyBoundPtyIdForPane(
+    targetId: string,
+    tabId: string,
+    leafId: string
+  ): string | undefined {
+    // Deliberately does NOT require the tab to still exist, unlike findTerminalTabIdForLeaf, which
+    // must — binding a live shell to a deleted tab registers a ghost pane. Here the consequence
+    // runs the other way: a binding under a departed tab only ever keeps a lease alive, and not
+    // retiring is the safe direction when nothing has proved the shell dead.
+    const findLeafBinding = (session: WorkspaceSessionState | undefined): string | undefined => {
+      const layouts = session?.terminalLayoutsByTabId
+      return (
+        layouts?.[tabId]?.ptyIdsByLeafId?.[leafId] ??
+        Object.values(layouts ?? {}).find((layout) => layout?.ptyIdsByLeafId?.[leafId])
+          ?.ptyIdsByLeafId?.[leafId]
+      )
+    }
+    // Local FIRST, and only then the headless plane. Local-first is what STA-3077 needed: the old
+    // code preferred `ssh:<target>`, so a copy no live writer maintained outvoted the real binding
+    // and supersession no-opped. The fallback is not that hedge — it only speaks for a pane local
+    // says nothing about, so a headless-owned pane still gets a vote before its lease is retired.
+    const boundPtyId =
+      findLeafBinding(this.state.workspaceSession) ??
+      findLeafBinding(this.state.workspaceSessionsByHostId?.[toSshExecutionHostId(targetId)])
+    return boundPtyId ? this.getRelayPtyIdForSshLeaseComparison(targetId, boundPtyId) : undefined
+  }
+
+  /**
+   * The durable pane binding outranks recency. Picking the newest lease alone
+   * would retire the one the pane is actually bound to whenever a newer unbound
+   * lease exists, which detaches a live pane instead of healing it.
+   */
+  private outranksForPane(
+    candidate: SshRemotePtyLease,
+    incumbent: SshRemotePtyLease,
+    targetId: string
+  ): boolean {
+    const boundPtyId = this.durablyBoundPtyIdForPane(
+      targetId,
+      candidate.tabId ?? '',
+      candidate.leafId ?? ''
+    )
+    if (boundPtyId) {
+      if (incumbent.ptyId === boundPtyId) {
+        return false
+      }
+      if (candidate.ptyId === boundPtyId) {
+        return true
+      }
+    }
+    return isNewerSshRemotePtyLease(candidate, incumbent)
+  }
+
+  /**
+   * Heals lease state that predates pane-keyed supersession. Existing installs
+   * carry the duplicates STA-3077 accumulated — one report reached 20 live
+   * leases for a handful of panes — and supersession alone only prevents new
+   * ones. Reattach calls this first so a stale predecessor cannot be revived.
+   *
+   * Returns the number of leases retired, for logging.
+   */
+  async supersedeDuplicatePaneLeases(targetId: string): Promise<number> {
+    const live = (this.state.sshRemotePtyLeases ?? []).filter(
+      (lease) =>
+        lease.targetId === targetId && lease.state !== 'terminated' && lease.state !== 'expired'
+    )
+    const winnerByPane = new Map<string, SshRemotePtyLease>()
+    for (const lease of live) {
+      if (!lease.worktreeId || !lease.tabId || !lease.leafId) {
+        continue
+      }
+      // Keyed on the leaf, not the frozen tabId: the same pane moved between tabs must land in one
+      // bucket, or its duplicates never arbitrate against each other.
+      const paneKey = [lease.worktreeId, lease.leafId].join('\0')
+      const incumbent = winnerByPane.get(paneKey)
+      if (!incumbent || this.outranksForPane(lease, incumbent, targetId)) {
+        winnerByPane.set(paneKey, lease)
+      }
+    }
+    if (winnerByPane.size === 0) {
+      return 0
+    }
+    const winners = new Set(winnerByPane.values())
+    const now = Date.now()
+    const superseded: SshRemotePtyLease[] = []
+    const restore: (() => void)[] = []
+    for (const lease of live) {
+      if (!lease.worktreeId || !lease.tabId || !lease.leafId || winners.has(lease)) {
+        continue
+      }
+      const { state, updatedAt } = lease
+      lease.state = 'expired'
+      lease.updatedAt = now
+      const rollbackVersion = this.advanceSshRemotePtyLeaseMutationVersion(lease)
+      restore.push(() => {
+        if (
+          this.state.sshRemotePtyLeases?.includes(lease) &&
+          this.sshRemotePtyLeaseMutationVersions.get(lease) === rollbackVersion &&
+          lease.state === 'expired' &&
+          lease.updatedAt === now
+        ) {
+          lease.state = state
+          lease.updatedAt = updatedAt
+          this.advanceSshRemotePtyLeaseMutationVersion(lease)
+        }
+      })
+      superseded.push(lease)
+    }
+    if (superseded.length === 0) {
+      return 0
+    }
+    const bindingsBefore = this.snapshotSshLeaseBindings(targetId, superseded)
+    this.clearSshRemotePtyBindingsForLeases(targetId, superseded, 'local')
+    this.scheduleSave()
+    try {
+      // Why the ASYNC twin: the sync flush fsyncs a multi-MB file from the Electron main thread,
+      // and this runs on every reconnect. On a stalled network profile mount that syscall is
+      // uninterruptible and nothing can bound it — see flushAsync. Why "OrThrow" and not plain
+      // flush(): flush() swallows write errors, which would leave these leases retired in memory
+      // but attached on disk for the rest of the session.
+      await this.flushDurableStateOrThrowAsync(false)
+    } catch (err) {
+      for (const undo of restore) {
+        undo()
+      }
+      this.restoreSshLeaseBindings(targetId, superseded, bindingsBefore)
+      this.scheduleSave()
+      console.error('[persistence] Failed to retire duplicate pane leases:', err)
+      return 0
+    }
+    return superseded.length
+  }
+
+  private snapshotSshLeaseBindings(
+    targetId: string,
+    leases: SshRemotePtyLease[]
+  ): {
+    tabs: { leafId: string; ptyId: string }[]
+    leaves: { leafId: string; ptyId: string }[]
+  } {
+    const tabSnapshots: { leafId: string; ptyId: string }[] = []
+    const leaves: { leafId: string; ptyId: string }[] = []
+    const session = this.state.workspaceSession
+    for (const [worktreeId, tabs] of Object.entries(session?.tabsByWorktree ?? {})) {
+      for (const tab of tabs) {
+        if (tab.ptyId) {
+          const lease = leases.find((candidate) =>
+            this.sshRemotePtyLeaseMayReferenceBinding(candidate, {
+              ptyId: tab.ptyId!,
+              worktreeId,
+              targetId,
+              tabId: tab.id
+            })
+          )
+          if (lease?.leafId) {
+            tabSnapshots.push({ leafId: lease.leafId, ptyId: tab.ptyId })
+          }
+        }
+      }
+    }
+    for (const [tabId, layout] of Object.entries(session?.terminalLayoutsByTabId ?? {})) {
+      const worktreeId = Object.entries(session?.tabsByWorktree ?? {}).find(([, tabs]) =>
+        tabs.some((tab) => tab.id === tabId)
+      )?.[0]
+      for (const [leafId, ptyId] of Object.entries(layout.ptyIdsByLeafId ?? {})) {
+        if (
+          leases.some(
+            (lease) =>
+              lease.leafId === leafId &&
+              this.sshRemotePtyLeaseMayReferenceBinding(lease, {
+                ptyId,
+                targetId,
+                ...(worktreeId ? { worktreeId } : {}),
+                tabId,
+                leafId
+              })
+          )
+        ) {
+          leaves.push({ leafId, ptyId })
+        }
+      }
+    }
+    return { tabs: tabSnapshots, leaves }
+  }
+
+  private restoreSshLeaseBindings(
+    targetId: string,
+    leases: SshRemotePtyLease[],
+    snapshots: {
+      tabs: { leafId: string; ptyId: string }[]
+      leaves: { leafId: string; ptyId: string }[]
+    }
+  ): void {
+    const currentLeases = new Set(this.state.sshRemotePtyLeases ?? [])
+    const session = this.state.workspaceSession
+    const hasLiveLease = (snapshot: { leafId: string; ptyId: string }): boolean =>
+      leases.some(
+        (lease) =>
+          currentLeases.has(lease) &&
+          lease.state !== 'terminated' &&
+          lease.state !== 'expired' &&
+          lease.targetId === targetId &&
+          lease.leafId === snapshot.leafId &&
+          lease.ptyId === this.getRelayPtyIdForSshLeaseComparison(targetId, snapshot.ptyId)
+      )
+    for (const snapshot of snapshots.tabs) {
+      const tabId = findTerminalTabIdForLeaf(session, snapshot.leafId)
+      const tab = Object.values(session?.tabsByWorktree ?? {})
+        .flat()
+        .find((candidate) => candidate.id === tabId)
+      if (hasLiveLease(snapshot) && tab?.ptyId === null) {
+        tab.ptyId = snapshot.ptyId
+      }
+    }
+    for (const snapshot of snapshots.leaves) {
+      const tabId = findTerminalTabIdForLeaf(session, snapshot.leafId)
+      const layout = tabId ? session?.terminalLayoutsByTabId?.[tabId] : undefined
+      if (
+        hasLiveLease(snapshot) &&
+        layout &&
+        layout.ptyIdsByLeafId?.[snapshot.leafId] === undefined
+      ) {
+        layout.ptyIdsByLeafId = {
+          ...layout.ptyIdsByLeafId,
+          [snapshot.leafId]: snapshot.ptyId
+        }
+      }
+    }
+  }
+
   markSshRemotePtyLeases(targetId: string, state: SshRemotePtyLease['state']): void {
     if (this.updateSshRemotePtyLeaseStates(targetId, state)) {
       this.flush()
@@ -7259,6 +7687,7 @@ export class Store {
     state: SshRemotePtyLease['state']
   ): Promise<void> {
     if (this.updateSshRemotePtyLeaseStates(targetId, state)) {
+      this.scheduleSave()
       await this.flushDurableStateOrThrowAsync()
     }
   }
@@ -7271,10 +7700,30 @@ export class Store {
       ptyIds.map((ptyId) => this.getRelayPtyIdForSshLeaseStorage(targetId, ptyId))
     )
     if (this.updateSshRemotePtyLeaseStates(targetId, 'attached', relayPtyIds)) {
+      this.scheduleSave()
       await this.flushDurableStateOrThrowAsync()
     }
   }
 
+  async markSshRemotePtyLeasesTerminatedAsync(
+    targetId: string,
+    ptyIds: readonly string[]
+  ): Promise<void> {
+    const relayPtyIds = new Set(
+      ptyIds.map((ptyId) => this.getRelayPtyIdForSshLeaseStorage(targetId, ptyId))
+    )
+    if (this.updateSshRemotePtyLeaseStates(targetId, 'terminated', relayPtyIds)) {
+      this.scheduleSave()
+      try {
+        await this.flushDurableStateOrThrowAsync(false)
+      } catch (error) {
+        // Keep the proven exit retryable after a transient persistence failure.
+        this.scheduleSave()
+        throw error
+      }
+    }
+  }
+
   private updateSshRemotePtyLeaseStates(
     targetId: string,
     state: SshRemotePtyLease['state'],
@@ -7293,8 +7742,13 @@ export class Store {
         continue
       }
       if (state === 'detached' && lease.state !== 'attached') {
+        if (lease.state === 'expired') {
+          // A later detach fences rollback from restoring attached ownership.
+          this.advanceSshRemotePtyLeaseMutationVersion(lease)
+        }
         continue
       }
+      this.advanceSshRemotePtyLeaseMutationVersion(lease)
       if (lease.state !== state) {
         lease.state = state
         lease.updatedAt = now
@@ -7323,6 +7777,7 @@ export class Store {
     if (!lease) {
       return
     }
+    this.advanceSshRemotePtyLeaseMutationVersion(lease)
     const shouldClearBindings = state === 'terminated' || state === 'expired'
     if (lease.state === state) {
       if (shouldClearBindings && this.clearSshRemotePtyBindingsForLeases(targetId, [lease])) {
@@ -7376,19 +7831,27 @@ export class Store {
     this.clearSshRemotePtyBindingsForLeases(targetId, leases ?? [])
   }
 
+  /** `arbitratedFrom` names the plane a supersession DECISION was made from. A decision reached by
+   *  reading one plane may only mutate that plane: the other plane's binding never got a vote, and
+   *  deleting it strands a shell its owner can still be using. An explicit expiry or termination is
+   *  plane-agnostic — the pty is gone for everyone — so those callers pass nothing. */
   private clearSshRemotePtyBindingsForLeases(
     targetId: string,
-    leases: SshRemotePtyLease[]
+    leases: SshRemotePtyLease[],
+    arbitratedFrom?: 'local'
   ): boolean {
     if (!leases?.length) {
       return false
     }
     let changed = false
     const sessions = new Set(
-      [
-        this.state.workspaceSession,
-        this.state.workspaceSessionsByHostId?.[toSshExecutionHostId(targetId)]
-      ].filter((session): session is WorkspaceSessionState => Boolean(session))
+      (arbitratedFrom === 'local'
+        ? [this.state.workspaceSession]
+        : [
+            this.state.workspaceSession,
+            this.state.workspaceSessionsByHostId?.[toSshExecutionHostId(targetId)]
+          ]
+      ).filter((session): session is WorkspaceSessionState => Boolean(session))
     )
     for (const session of sessions) {
       for (const [worktreeId, tabs] of Object.entries(session.tabsByWorktree ?? {})) {
@@ -7497,10 +7960,11 @@ export class Store {
 
   // Async twin of flushOrThrow: durable state only. Active-view and GitHub sidecars are
   // quit/startup work and must not be snapshotted on the live SSH establish/reconnect path.
-  private async flushDurableStateOrThrowAsync(): Promise<void> {
+  private async flushDurableStateOrThrowAsync(drainToStableGeneration = true): Promise<void> {
     if (this.writesFrozen || this.quitFlushStarted) {
       throw new Error('Cannot flush while persistence is finalized')
     }
+    const requiredDurableGeneration = this.writeGeneration
     for (;;) {
       if (this.writeTimer) {
         clearTimeout(this.writeTimer)
@@ -7509,6 +7973,12 @@ export class Store {
       this.firstPendingSaveAt = null
       const generation = this.writeGeneration
       await this.enqueueWrite()
+      if (
+        !drainToStableGeneration &&
+        this.lastDurableWriteGeneration >= requiredDurableGeneration
+      ) {
+        break
+      }
       if (generation === this.writeGeneration) {
         break
       }
diff --git a/src/main/pi/legacy-omp-overlay-migration.ts b/src/main/pi/legacy-omp-overlay-migration.ts
index 88baf78ea9f..74d6039fcb5 100644
--- a/src/main/pi/legacy-omp-overlay-migration.ts
+++ b/src/main/pi/legacy-omp-overlay-migration.ts
@@ -146,7 +146,7 @@ function copyMissingLegacyOmpOverlayEntries(
   overlayDir: string,
   sourceAgentDir: string,
   pathSegments: string[] = [],
-  copiedFilePaths: Set<string> = new Set()
+  copiedFilePaths = new Set<string>()
 ): boolean {
   let completed = true
   let entries: Dirent[]
diff --git a/src/main/pi/titlebar-extension-service.test.ts b/src/main/pi/titlebar-extension-service.test.ts
index 485ea71cafa..e197a4a0c3a 100644
--- a/src/main/pi/titlebar-extension-service.test.ts
+++ b/src/main/pi/titlebar-extension-service.test.ts
@@ -94,10 +94,6 @@ describe('PiTitlebarExtensionService', () => {
     rmSync(join(userDataDir, 'pi-agent-overlays'), { recursive: true, force: true })
     rmSync(join(userDataDir, 'omp-agent-overlays'), { recursive: true, force: true })
     rmSync(join(userDataDir, 'omp-managed-status-extension'), { recursive: true, force: true })
-    rmSync(join(userDataDir, 'prime-agent-managed-status-extension'), {
-      recursive: true,
-      force: true
-    })
   })
 
   function expectPiHomeIntact(): void {
@@ -185,21 +181,6 @@ describe('PiTitlebarExtensionService', () => {
     expectPiHomeIntact()
   })
 
-  it('writes a Prime status-only extension outside the guest-owned config dir', () => {
-    const svc = new PiTitlebarExtensionService()
-    const env = svc.buildStatusOnlyPtyEnv('prime-agent')
-    const statusPath = join(
-      userDataDir,
-      'prime-agent-managed-status-extension',
-      'orca-agent-status.ts'
-    )
-
-    expect(env).toEqual({ ORCA_PRIME_AGENT_STATUS_EXTENSION: statusPath })
-    expect(readFileSync(statusPath, 'utf8')).toContain('/hook/prime-agent')
-    expect(readFileSync(statusPath, 'utf8')).not.toContain("return '/hook/omp'")
-    expectPiHomeIntact()
-  })
-
   it('uses the same source dir for multiple PTYs with the same Pi dir', () => {
     const svc = new PiTitlebarExtensionService()
     const firstEnv = svc.buildPtyEnv('pty-shared-1', piHome, 'pi')
diff --git a/src/main/pi/titlebar-extension-service.ts b/src/main/pi/titlebar-extension-service.ts
index 59c0f44797f..5e728fa0274 100644
--- a/src/main/pi/titlebar-extension-service.ts
+++ b/src/main/pi/titlebar-extension-service.ts
@@ -27,10 +27,7 @@ export const isSafeDescendCandidate = sharedIsSafeDescendCandidate
 
 const PI_AGENT_SUBDIR = 'agent'
 const ORCA_MANAGED_EXTENSION_MARKER = '@orca-managed-pi-extension'
-const MANAGED_STATUS_EXTENSION_DIR: Record<'omp' | 'prime-agent', string> = {
-  omp: 'omp-managed-status-extension',
-  'prime-agent': 'prime-agent-managed-status-extension'
-}
+const OMP_MANAGED_STATUS_EXTENSION_DIR = 'omp-managed-status-extension'
 
 type ManagedExtensionWriteResult = 'written' | 'skipped-user-owned' | 'failed'
 
@@ -124,11 +121,8 @@ export class PiTitlebarExtensionService {
     }
   }
 
-  private writeFallbackStatusExtension(
-    source: string,
-    kind: keyof typeof MANAGED_STATUS_EXTENSION_DIR
-  ): string | undefined {
-    const fallbackDir = join(app.getPath('userData'), MANAGED_STATUS_EXTENSION_DIR[kind])
+  private writeOmpFallbackStatusExtension(source: string): string | undefined {
+    const fallbackDir = join(app.getPath('userData'), OMP_MANAGED_STATUS_EXTENSION_DIR)
     try {
       mkdirSync(fallbackDir, { recursive: true })
     } catch {
@@ -171,7 +165,7 @@ export class PiTitlebarExtensionService {
         statusResult === 'written'
           ? statusExtensionPath
           : kind === 'omp'
-            ? this.writeFallbackStatusExtension(statusSource, 'omp')
+            ? this.writeOmpFallbackStatusExtension(statusSource)
             : undefined
     }
   }
@@ -201,7 +195,7 @@ export class PiTitlebarExtensionService {
     if (!existsSync(sourceAgentDir) && !materializeDefaultHome) {
       if (kind === 'omp') {
         const statusSource = withOrcaManagedExtensionMarker(getPiAgentStatusExtensionSource(kind))
-        const statusExtensionPath = this.writeFallbackStatusExtension(statusSource, 'omp')
+        const statusExtensionPath = this.writeOmpFallbackStatusExtension(statusSource)
         return statusExtensionPath ? { ORCA_OMP_STATUS_EXTENSION: statusExtensionPath } : {}
       }
       return {}
@@ -226,12 +220,6 @@ export class PiTitlebarExtensionService {
     return env
   }
 
-  buildStatusOnlyPtyEnv(kind: 'prime-agent'): Record<string, string> {
-    const source = withOrcaManagedExtensionMarker(getPiAgentStatusExtensionSource(kind))
-    const statusExtensionPath = this.writeFallbackStatusExtension(source, kind)
-    return statusExtensionPath ? { ORCA_PRIME_AGENT_STATUS_EXTENSION: statusExtensionPath } : {}
-  }
-
   clearPty(ptyId: string): void {
     // Why: PTY teardown doesn't know which kind was launched (the daemon
     // exit path discards the launch command). Sweep both old PTY-scoped
diff --git a/src/main/plugins/plugin-dev-watcher.ts b/src/main/plugins/plugin-dev-watcher.ts
index c6aefa12699..6e7f6f908f0 100644
--- a/src/main/plugins/plugin-dev-watcher.ts
+++ b/src/main/plugins/plugin-dev-watcher.ts
@@ -98,7 +98,7 @@ export class PluginDevWatcher {
 
   private removeSubscription(subscription: WatcherProcessSubscription): void {
     const index = this.subscriptions.indexOf(subscription)
-    if (index >= 0) {
+    if (index !== -1) {
       this.subscriptions.splice(index, 1)
     }
   }
diff --git a/src/main/plugins/plugin-host-runtime.ts b/src/main/plugins/plugin-host-runtime.ts
index 2a2f5f9fcab..b7f3eb9b8a1 100644
--- a/src/main/plugins/plugin-host-runtime.ts
+++ b/src/main/plugins/plugin-host-runtime.ts
@@ -20,7 +20,7 @@ export type PluginHostCallError = Error & { code?: string }
 export type PluginWorkerOrcaApi = {
   /** Register the handler for a command declared in the manifest. */
   commands: {
-    register(commandId: string, handler: (args: unknown) => unknown | Promise<unknown>): void
+    register(commandId: string, handler: (args: unknown) => unknown): void
   }
   /** Handle an event the manifest subscribed to (`contributes.events`). */
   events: {
@@ -55,7 +55,7 @@ export function createPluginWorkerRuntime(
   const send = options.send
   const importModule = options.importModule ?? ((specifier: string) => import(specifier))
   const exit = options.exit ?? ((code: number) => process.exit(code))
-  const commandHandlers = new Map<string, (args: unknown) => unknown | Promise<unknown>>()
+  const commandHandlers = new Map<string, (args: unknown) => unknown>()
   const eventHandlers = new Map<string, ((payload: unknown) => void | Promise<void>)[]>()
   const pendingHostCalls = new Map<
     number,
@@ -64,7 +64,7 @@ export function createPluginWorkerRuntime(
   let nextHostCallId = 0
   let initialized = false
   let shuttingDown = false
-  let deactivate: (() => unknown | Promise<unknown>) | null = null
+  let deactivate: (() => unknown) | null = null
 
   async function handleInit(input: {
     pluginRoot: string
@@ -88,7 +88,7 @@ export function createPluginWorkerRuntime(
     if (module.deactivate !== undefined && typeof module.deactivate !== 'function') {
       throw new Error(`plugin entry ${input.mainEntry} has a non-function deactivate export`)
     }
-    deactivate = (module.deactivate as (() => unknown | Promise<unknown>) | undefined) ?? null
+    deactivate = (module.deactivate as (() => unknown) | undefined) ?? null
     const orca: PluginWorkerOrcaApi = {
       commands: {
         register(commandId, handler) {
diff --git a/src/main/plugins/plugin-worker-output-buffer.ts b/src/main/plugins/plugin-worker-output-buffer.ts
index dfbe0478c28..836330c8799 100644
--- a/src/main/plugins/plugin-worker-output-buffer.ts
+++ b/src/main/plugins/plugin-worker-output-buffer.ts
@@ -34,7 +34,7 @@ export function pipePluginWorkerOutput(
     while (remaining.length > 0) {
       if (discarding) {
         const newline = remaining.indexOf('\n')
-        if (newline < 0) {
+        if (newline === -1) {
           return
         }
         discarding = false
@@ -42,20 +42,20 @@ export function pipePluginWorkerOutput(
         continue
       }
       const newline = remaining.indexOf('\n')
-      const segment = newline < 0 ? remaining : remaining.slice(0, newline)
+      const segment = newline === -1 ? remaining : remaining.slice(0, newline)
       const available = PLUGIN_WORKER_OUTPUT_LINE_LIMIT - buffered.length
       if (segment.length > available) {
         emit(buffered + segment.slice(0, available), true)
         buffered = ''
-        discarding = newline < 0
+        discarding = newline === -1
       } else {
         buffered += segment
-        if (newline >= 0) {
+        if (newline !== -1) {
           emit(buffered)
           buffered = ''
         }
       }
-      if (newline < 0) {
+      if (newline === -1) {
         return
       }
       remaining = remaining.slice(newline + 1)
diff --git a/src/main/plugins/plugin-worker-slot-pool.ts b/src/main/plugins/plugin-worker-slot-pool.ts
index 5b86acf38d7..7cb6c79d6f1 100644
--- a/src/main/plugins/plugin-worker-slot-pool.ts
+++ b/src/main/plugins/plugin-worker-slot-pool.ts
@@ -49,7 +49,7 @@ export class PluginWorkerSlotPool {
           }
           cancelled = true
           const index = this.waiters.indexOf(waiter)
-          if (index >= 0) {
+          if (index !== -1) {
             this.waiters.splice(index, 1)
           }
           signal.removeEventListener('abort', waiter.onAbort)
diff --git a/src/main/providers/__tests__/shell-ready-framework/shell-script-test.ts b/src/main/providers/__tests__/shell-ready-framework/shell-script-test.ts
index c9217f17994..a1dd3727c54 100644
--- a/src/main/providers/__tests__/shell-ready-framework/shell-script-test.ts
+++ b/src/main/providers/__tests__/shell-ready-framework/shell-script-test.ts
@@ -62,6 +62,8 @@ export async function shellScriptTest(
 
     const env: Record<string, string> = {
       ...config.env,
+      // Why: these examples inspect startup-file discovery, not the PTY-owner protocol stream.
+      ORCA_SHELL_STARTUP_IDENTITY: '0',
       // Why: the framework creates user startup files under testHome after
       // computing the wrapper config; route wrapper discovery to that fixture.
       HOME: testHome,
diff --git a/src/main/providers/local-pty-provider.test.ts b/src/main/providers/local-pty-provider.test.ts
index 03e7127ce4c..eedcb87abfc 100644
--- a/src/main/providers/local-pty-provider.test.ts
+++ b/src/main/providers/local-pty-provider.test.ts
@@ -2,6 +2,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { delimiter } from 'node:path'
 import type * as MacosTccLoginShell from './macos-tcc-login-shell'
+import { stripLegacyTerminalShimEnv } from '../pty/legacy-terminal-shim-dir'
 
 const {
   existsSyncMock,
@@ -15,7 +16,8 @@ const {
   readWindowsConptyProcessIdsMock,
   killWithDescendantSweepMock,
   isWslAvailableAsyncMock,
-  wslUncDirectoryExistsMock
+  wslUncDirectoryExistsMock,
+  createShellPromptReadinessProbeMock
 } = vi.hoisted(() => ({
   existsSyncMock: vi.fn(),
   statSyncMock: vi.fn(),
@@ -28,7 +30,8 @@ const {
   readWindowsConptyProcessIdsMock: vi.fn(),
   killWithDescendantSweepMock: vi.fn(),
   isWslAvailableAsyncMock: vi.fn(),
-  wslUncDirectoryExistsMock: vi.fn()
+  wslUncDirectoryExistsMock: vi.fn(),
+  createShellPromptReadinessProbeMock: vi.fn()
 }))
 
 vi.mock('fs', () => ({
@@ -107,6 +110,10 @@ vi.mock('../wsl', () => ({
   wslUncDirectoryExists: (...args: unknown[]) => wslUncDirectoryExistsMock(...args)
 }))
 
+vi.mock('../shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: createShellPromptReadinessProbeMock
+}))
+
 import {
   _resetLocalPtyProviderStateForTest,
   LOCAL_PTY_FORCE_KILL_RETRY_MS,
@@ -174,6 +181,7 @@ describe('LocalPtyProvider', () => {
     isWslAvailableAsyncMock.mockResolvedValue(true)
     wslUncDirectoryExistsMock.mockReset()
     wslUncDirectoryExistsMock.mockReturnValue(true)
+    createShellPromptReadinessProbeMock.mockReset()
 
     exitCb = undefined
     mockProc = {
@@ -534,6 +542,24 @@ describe('LocalPtyProvider', () => {
       expect(spawnCall[2].env.CUSTOM_VAR).toBe('custom-value')
     })
 
+    it('verifies shell identity against the exact spawn PATH', async () => {
+      provider.configure({
+        buildSpawnEnv: (_id, env) => ({ ...env, PATH: '/post-hook/bin' })
+      })
+
+      await provider.spawn({
+        cols: 80,
+        rows: 24,
+        command: 'printf ready',
+        env: { PATH: '/pre-hook/bin' }
+      })
+
+      expect(spawnMock.mock.calls.at(-1)?.[2].env.PATH).toBe('/post-hook/bin')
+      expect(createShellPromptReadinessProbeMock).toHaveBeenCalledWith(
+        expect.objectContaining({ shellPathEnv: '/post-hook/bin' })
+      )
+    })
+
     it('does not inherit NODE_ENV from the Orca process env', async () => {
       // Why: NODE_ENV in Orca's process is Orca's build mode (electron-vite sets
       // `development` in dev runs); leaking it breaks `next build` and Vitest.
@@ -551,7 +577,9 @@ describe('LocalPtyProvider', () => {
 
       const spawnCall = spawnMock.mock.calls.at(-1)!
       expect(spawnCall[2].env.NODE_ENV).toBeUndefined()
-      expect(spawnCall[2].env.PATH).toBe(process.env.PATH)
+      const expectedEnv = { PATH: process.env.PATH ?? '' }
+      stripLegacyTerminalShimEnv(expectedEnv, process.platform)
+      expect(spawnCall[2].env.PATH).toBe(expectedEnv.PATH)
     })
 
     it('keeps an explicitly requested NODE_ENV for spawned terminals', async () => {
@@ -633,6 +661,23 @@ describe('LocalPtyProvider', () => {
       }
     })
 
+    it.each([
+      ['after the ready marker', ['\x1b]777;orca-shell-ready\x07', '\x1b[?2004hfish> ']],
+      ['after the ESC introducer', ['\x1b]777;orca-shell-ready\x07\x1b', '[?2004hfish> ']]
+    ])('preserves Fish bracketed-paste output split %s', async (_boundary, chunks) => {
+      process.env.SHELL = '/usr/bin/fish'
+      const received: string[] = []
+      provider.configure({ onData: (_id, data) => received.push(data) })
+
+      await provider.spawn({ cols: 80, rows: 24, command: 'printf ready' })
+      const dataCallback = mockProc.onData.mock.calls[0]?.[0] as (data: string) => void
+      for (const chunk of chunks) {
+        dataCallback(chunk)
+      }
+
+      expect(received.join('')).toBe('\x1b[?2004hfish> ')
+    })
+
     it('releases held marker-prefix bytes when local shell readiness times out', async () => {
       vi.useFakeTimers()
       const onData = vi.fn()
@@ -685,8 +730,8 @@ describe('LocalPtyProvider', () => {
       provider.configure({
         buildSpawnEnv: (_id, env) => {
           env.TERM_PROGRAM = 'Orca'
-          env.ORCA_ATTRIBUTION_SHIM_DIR = '/tmp/orca-attribution'
-          env.PATH = `/tmp/orca-attribution:${env.PATH ?? ''}`
+          env.ORCA_STALE_TEST_ENV = '/tmp/orca-stale'
+          env.PATH = `/tmp/orca-stale:${env.PATH ?? ''}`
           return env
         }
       })
@@ -699,7 +744,7 @@ describe('LocalPtyProvider', () => {
           PATH: '/tmp/orca-agent-teams-bin:/usr/bin',
           ORCA_AGENT_TEAMS_TEAM_ID: 'team-test'
         },
-        envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
+        envToDelete: ['TERM_PROGRAM', 'ORCA_STALE_TEST_ENV']
       })
 
       const spawnCall = spawnMock.mock.calls.at(-1)!
@@ -707,7 +752,20 @@ describe('LocalPtyProvider', () => {
       expect(spawnCall[2].env.TERM).toBe('screen-256color')
       expect(spawnCall[2].env.PATH.split(':')[0]).toBe('/tmp/orca-agent-teams-bin')
       expect(spawnCall[2].env.TERM_PROGRAM).toBeUndefined()
-      expect(spawnCall[2].env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
+      expect(spawnCall[2].env.ORCA_STALE_TEST_ENV).toBeUndefined()
+    })
+
+    it('does not re-promote a legacy attribution path for Agent Teams', async () => {
+      await provider.spawn({
+        cols: 80,
+        rows: 24,
+        env: {
+          PATH: '/tmp/orca-terminal-attribution/posix:/usr/bin',
+          ORCA_AGENT_TEAMS_TEAM_ID: 'team-test'
+        }
+      })
+
+      expect(spawnMock.mock.calls.at(-1)?.[2].env.PATH).toBe('/usr/bin')
     })
 
     it('drops stale inherited Git config indices behind a smaller explicit count', async () => {
@@ -817,9 +875,9 @@ describe('LocalPtyProvider', () => {
       Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
       provider.configure({
         buildSpawnEnv: (_id, env) => {
-          // Why: attribution collapses Windows PATH onto `Path` and prepends its own shim dir.
+          // Why: host env collapses Windows PATH onto `Path` and prepends its own shim dir.
           delete env.PATH
-          env.Path = `/tmp/orca-attribution:${env.Path ?? ''}`
+          env.Path = `/tmp/orca-stale:${env.Path ?? ''}`
           return env
         }
       })
diff --git a/src/main/providers/local-pty-provider.ts b/src/main/providers/local-pty-provider.ts
index aafd04b9e1b..b4af3c907fb 100644
--- a/src/main/providers/local-pty-provider.ts
+++ b/src/main/providers/local-pty-provider.ts
@@ -13,6 +13,7 @@ import { existsSync } from 'node:fs'
 import * as pty from 'node-pty'
 import { getDefaultWslDistro, parseWslPath, isWslAvailableAsync } from '../wsl'
 import { splitWorktreeIdForFilesystem } from '../../shared/worktree-id'
+import { isBracketedPasteSafeShell } from '../../shared/startup-command-submission'
 import {
   injectHistoryEnv,
   updateHistFileForFallback,
@@ -26,11 +27,8 @@ import {
 } from './local-pty-utils'
 import { prepareMacosTccLoginShell } from './macos-tcc-login-shell'
 import {
-  getAttributionShellLaunchConfig,
+  getMarkerlessShellLaunchConfig,
   getShellReadyLaunchConfig,
-  createShellReadyScanState,
-  drainShellReadyHeldBytes,
-  scanForShellReady,
   writeStartupCommandWhenShellReady,
   STARTUP_COMMAND_READY_MAX_WAIT_MS
 } from './local-pty-shell-ready'
@@ -38,6 +36,7 @@ import type { ShellReadySignal } from './local-pty-shell-ready'
 import { removeInheritedNoColor } from '../pty/terminal-color-env'
 import { removeAppImageRuntimeEnv } from '../pty/appimage-terminal-env'
 import { stripInheritedBuildModeEnv } from '../pty/build-mode-env'
+import { stripLegacyTerminalShimEnv } from '../pty/legacy-terminal-shim-dir'
 import { SessionNotFoundError } from '../daemon/daemon-errors'
 import { resolvePathEnvKey } from '../pty/windows-environment-path'
 import { isHostCodexHomeForWsl, isWslCodexHomeForHost } from '../pty/codex-home-wsl-env'
@@ -74,6 +73,15 @@ import {
   createPtySlaveEchoProbe,
   readPtySlavePath
 } from '../../shared/pty-slave-line-discipline-echo'
+import {
+  createShellStartupOutputScanState,
+  drainShellStartupOutputScanState,
+  scanShellStartupOutput
+} from '../shell-startup-output-scanner'
+import {
+  createShellPromptReadinessProbe,
+  type ShellPromptReadinessProbe
+} from '../shell-prompt-readiness-probe'
 import {
   expandWindowsEnvironmentVariables,
   expandWindowsPathEnvironmentVariables
@@ -781,7 +789,6 @@ export class LocalPtyProvider implements IPtyProvider {
     if (!wslInfo && process.platform !== 'win32') {
       // Why: OpenCode/Codex PATH restoration and OMP's status wrapper need shell-ready code after user startup files run.
       const needsNoMarkerWrapper =
-        finalEnv.ORCA_ATTRIBUTION_SHIM_DIR ||
         finalEnv.ORCA_OPENCODE_CONFIG_DIR ||
         finalEnv.ORCA_MIMOCODE_HOME ||
         finalEnv.ORCA_OMP_STATUS_EXTENSION ||
@@ -798,16 +805,16 @@ export class LocalPtyProvider implements IPtyProvider {
         getFallbackShellReadyConfig = (shell) =>
           shouldWaitForShellReady
             ? getShellReadyLaunchConfig(shell)
-            : getAttributionShellLaunchConfig(shell)
+            : getMarkerlessShellLaunchConfig(shell)
         shellLaunch = shouldWaitForShellReady
           ? getShellReadyLaunchConfig(shellPath)
-          : getAttributionShellLaunchConfig(shellPath)
+          : getMarkerlessShellLaunchConfig(shellPath)
       } else if (args.command) {
         getFallbackShellReadyConfig = (shell) => getShellReadyLaunchConfig(shell)
         shellLaunch = getShellReadyLaunchConfig(shellPath)
       } else if (needsNoMarkerWrapper) {
-        getFallbackShellReadyConfig = (shell) => getAttributionShellLaunchConfig(shell)
-        shellLaunch = getAttributionShellLaunchConfig(shellPath)
+        getFallbackShellReadyConfig = (shell) => getMarkerlessShellLaunchConfig(shell)
+        shellLaunch = getMarkerlessShellLaunchConfig(shellPath)
       } else {
         getFallbackShellReadyConfig = undefined
       }
@@ -823,6 +830,8 @@ export class LocalPtyProvider implements IPtyProvider {
       finalEnv,
       requestedEnv ? requestedEnv[resolvePathEnvKey(requestedEnv, process.platform)] : undefined
     )
+    // Why: raw requested PATH promotion runs after the host-env scrub.
+    stripLegacyTerminalShimEnv(finalEnv, process.platform)
 
     // Why: worktree-scoped HISTFILE — without it worktrees share one global history (terminal-history-scope-design §7–§10).
     const worktreeId = args.worktreeId
@@ -950,8 +959,10 @@ export class LocalPtyProvider implements IPtyProvider {
     // Shell-ready startup command support
     let resolveShellReady: ((signal: ShellReadySignal) => void) | null = null
     let shellReadyTimeout: ReturnType<typeof setTimeout> | null = null
-    const shellReadyScanState = shellReadyLaunch?.supportsReadyMarker
-      ? createShellReadyScanState()
+    let shellStartupPid: number | null = null
+    let shellPromptReadinessProbe: ShellPromptReadinessProbe | null = null
+    let shellStartupOutputScanState = shellReadyLaunch?.supportsReadyMarker
+      ? createShellStartupOutputScanState()
       : null
     const shellReadyPromise = args.command
       ? new Promise<ShellReadySignal>((resolve) => {
@@ -966,20 +977,39 @@ export class LocalPtyProvider implements IPtyProvider {
         clearTimeout(shellReadyTimeout)
         shellReadyTimeout = null
       }
+      shellPromptReadinessProbe?.dispose()
+      shellPromptReadinessProbe = null
       const resolve = resolveShellReady
       resolveShellReady = null
       resolve(signal)
     }
     const releaseHeldShellReadyBytes = (): void => {
-      if (!shellReadyScanState) {
+      if (!shellStartupOutputScanState) {
         return
       }
-      const heldBytes = drainShellReadyHeldBytes(shellReadyScanState)
+      const heldBytes = drainShellStartupOutputScanState(shellStartupOutputScanState)
+      shellStartupOutputScanState = null
       if (heldBytes.length === 0) {
         return
       }
       startupIngress.accept(heldBytes)
     }
+    if (shellStartupOutputScanState) {
+      shellPromptReadinessProbe = createShellPromptReadinessProbe({
+        slavePath: readPtySlavePath(proc),
+        shellPath,
+        shellCwd: effectiveCwd,
+        shellPathEnv: finalEnv.PATH,
+        getShellPid: () => shellStartupPid,
+        onPromptReady: () => {
+          console.warn(
+            `[pty] ${id}: shell-ready wrapper was replaced before its marker; releasing at the identified shell prompt. OSC 133 integration may be unavailable.`
+          )
+          releaseHeldShellReadyBytes()
+          finishShellReady({ postMarkerBytesObserved: true })
+        }
+      })
+    }
     if (args.command) {
       if (shellReadyLaunch?.supportsReadyMarker) {
         shellReadyTimeout = setTimeout(() => {
@@ -1001,20 +1031,28 @@ export class LocalPtyProvider implements IPtyProvider {
         startupCommandCleanup?.()
         startupCommandCleanup = null
         resolveShellReady = null
+        shellPromptReadinessProbe?.dispose()
+        shellPromptReadinessProbe = null
       })
     }
 
     const disposables: { dispose: () => void }[] = []
     const onDataDisposable = proc.onData((rawData) => {
       let data = rawData
-      if (shellReadyScanState && resolveShellReady) {
-        const scanned = scanForShellReady(shellReadyScanState, rawData)
+      if (shellStartupOutputScanState && resolveShellReady) {
+        const scanned = scanShellStartupOutput(shellStartupOutputScanState, data)
         data = scanned.output
-        if (scanned.matched) {
+        if (scanned.shellPid) {
+          shellStartupPid = scanned.shellPid
+        }
+        if (scanned.ready) {
           finishShellReady({ postMarkerBytesObserved: scanned.postMarkerBytesObserved })
         }
       }
       startupIngress.accept(data)
+      if (resolveShellReady && data.length > 0) {
+        shellPromptReadinessProbe?.notifyOutput(data)
+      }
     })
     if (onDataDisposable) {
       disposables.push(onDataDisposable)
@@ -1032,6 +1070,8 @@ export class LocalPtyProvider implements IPtyProvider {
         shellReadyTimeout = null
       }
       startupCommandCleanup?.()
+      shellPromptReadinessProbe?.dispose()
+      shellPromptReadinessProbe = null
       clearPtyState(id)
       startupIngress.drainAndClose()
       startupIngressByPty.delete(id)
@@ -1048,10 +1088,14 @@ export class LocalPtyProvider implements IPtyProvider {
     ptyDisposables.set(id, disposables)
 
     if (args.command && !startupCommandDeliveredInShellArgs) {
-      // Why: only POSIX bash/zsh have bracketed-paste armed so multiline startup prompts paste literally; others use raw submit.
+      // Why: shells with bracketed paste armed take a multiline startup prompt literally; others use raw submit.
       const spawnedShellName = getSpawnedShellName(shellPath).toLowerCase()
       const bracketedPasteSafe =
-        process.platform !== 'win32' && (spawnedShellName === 'bash' || spawnedShellName === 'zsh')
+        process.platform !== 'win32' &&
+        isBracketedPasteSafeShell({
+          shellName: spawnedShellName,
+          waitsForShellReady: shellReadyLaunch?.supportsReadyMarker === true
+        })
       writeStartupCommandWhenShellReady(
         shellReadyPromise,
         proc,
diff --git a/src/main/providers/local-pty-shell-ready.test.ts b/src/main/providers/local-pty-shell-ready.test.ts
index d9034a5cc24..64d8859e6cc 100644
--- a/src/main/providers/local-pty-shell-ready.test.ts
+++ b/src/main/providers/local-pty-shell-ready.test.ts
@@ -380,10 +380,10 @@ describePosix('local PTY shell-ready launch config', () => {
     expect(init).toContain('functions -e __orca_shell_ready_marker')
   })
 
-  it('keeps attribution-only fish spawns unwrapped', async () => {
-    const { getAttributionShellLaunchConfig } = await importFreshLocalPtyShellReady()
+  it('keeps markerless fish spawns unwrapped', async () => {
+    const { getMarkerlessShellLaunchConfig } = await importFreshLocalPtyShellReady()
 
-    const config = getAttributionShellLaunchConfig('/opt/homebrew/bin/fish')
+    const config = getMarkerlessShellLaunchConfig('/opt/homebrew/bin/fish')
 
     expect(config).toEqual({ args: null, env: {}, supportsReadyMarker: false })
   })
@@ -485,6 +485,7 @@ describePosix('local PTY shell-ready launch config', () => {
     const zshrc = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zshrc'), 'utf8')
     const zlogin = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zlogin'), 'utf8')
     expect(zshenv).toContain('_orca_user_zdotdir="${_orca_spawn_orig_zdotdir:-$HOME}"')
+    expect(zshenv).toContain('printf "\\033]777;orca-shell-start:%s\\007" "$$"')
     expect(zshenv).toContain('*/shell-ready/zsh) _orca_user_zdotdir="$HOME" ;;')
     expect(zshenv).toContain('""|*/shell-ready/zsh) export ORCA_ORIG_ZDOTDIR="$HOME" ;;')
     expectZdotdirSourceContext(zprofile, '.zprofile')
@@ -526,8 +527,6 @@ describePosix('local PTY shell-ready launch config', () => {
       '[[ -n "${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="${ORCA_CODEX_HOME}"'
     const agentTeamsPathRestoreLine = '[[ -n "${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0'
     const ompWrapperLine = 'command omp --extension "${ORCA_OMP_STATUS_EXTENSION}" "$@"'
-    const primeWrapperLine =
-      'command prime-agent --extension "${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"'
     expect(zshrc).toContain(restoreLine)
     expect(zlogin).toContain(restoreLine)
     expect(bashRc).toContain(restoreLine)
@@ -549,9 +548,12 @@ describePosix('local PTY shell-ready launch config', () => {
     expect(zshrc).toContain(ompWrapperLine)
     expect(zlogin).toContain(ompWrapperLine)
     expect(bashRc).toContain(ompWrapperLine)
-    expect(zshrc).toContain(primeWrapperLine)
-    expect(zlogin).toContain(primeWrapperLine)
-    expect(bashRc).toContain(primeWrapperLine)
+    for (const wrapperFile of [zshrc, zlogin, bashRc]) {
+      expect(wrapperFile).not.toContain('prime-agent()')
+      expect(wrapperFile).not.toContain('__orca_prime_agent')
+      expect(wrapperFile).not.toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION')
+      expect(wrapperFile).not.toContain('command prime-agent --extension')
+    }
   })
 
   // Why: issue #2422 — without OSC 133 C/D markers, bash sessions kept the worktree spinner "working" ~30min after the agent exited.
@@ -814,8 +816,6 @@ path=(/custom/bin $path)
       }
       delete cleanEnv.ZDOTDIR
       delete cleanEnv.ORCA_ORIG_ZDOTDIR
-      // Why: this test isolates zsh top-level path scoping, not attribution shim ordering.
-      delete cleanEnv.ORCA_ATTRIBUTION_SHIM_DIR
       cleanEnv.ZDOTDIR = config.env.ZDOTDIR // Point to Orca wrapper dir
 
       const result = spawnSync(
@@ -854,7 +854,6 @@ path=(/custom/bin $path)
         }
         delete cleanEnv.ZDOTDIR
         delete cleanEnv.ORCA_ORIG_ZDOTDIR
-        delete cleanEnv.ORCA_ATTRIBUTION_SHIM_DIR
         delete cleanEnv.USER_ZSHRC_LOADED
         cleanEnv.ZDOTDIR = join(movedUserData, 'shell-ready', 'zsh')
 
@@ -902,7 +901,6 @@ path=(/custom/bin $path)
         }
         delete cleanEnv.ZDOTDIR
         delete cleanEnv.ORCA_ORIG_ZDOTDIR
-        delete cleanEnv.ORCA_ATTRIBUTION_SHIM_DIR
         delete cleanEnv.USER_ZSHRC_LOADED
         cleanEnv.ZDOTDIR = join(nonAsciiUserData, 'shell-ready', 'zsh')
 
diff --git a/src/main/providers/local-pty-shell-ready.ts b/src/main/providers/local-pty-shell-ready.ts
index 63885e23579..9a3230590ec 100644
--- a/src/main/providers/local-pty-shell-ready.ts
+++ b/src/main/providers/local-pty-shell-ready.ts
@@ -15,13 +15,13 @@ import {
   isPowerShellExecutableName
 } from '../powershell-osc133-bootstrap'
 import { getPosixOmpShellWrapper } from '../pty/omp-shell-wrapper'
-import { getPosixPrimeAgentShellWrapper } from '../pty/prime-agent-shell-wrapper'
 import { buildStartupCommandSubmission } from '../../shared/startup-command-submission'
 import {
   getFishShellReadyInitCommand,
   getZshEnvTemplate,
   getZshFinalZdotdirRestoreBlock,
   getZshShellReadyMarkerRegistrationBlock,
+  SHELL_STARTUP_IDENTITY_MARKER_BLOCK,
   getZshStartupFileSourceBlock
 } from '../shell-templates'
 export {
@@ -93,6 +93,7 @@ function resolveOriginalZshenvSourceDir(): string {
 
 export function getBashShellReadyRcfileContent(): string {
   return `# Orca bash shell-ready wrapper
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 [[ -f /etc/profile ]] && source /etc/profile
 if [[ -f "$HOME/.bash_profile" ]]; then
   source "$HOME/.bash_profile"
@@ -109,14 +110,6 @@ fi
 # Why: preserve bash's normal login-shell contract. Many users already source
 # ~/.bashrc from ~/.bash_profile; forcing ~/.bashrc again here would duplicate
 # PATH edits, hooks, and prompt init in Orca startup-command shells.
-__orca_restore_attribution_path() {
-  [[ -n "\${ORCA_ATTRIBUTION_SHIM_DIR:-}" ]] || return 0
-  case "$PATH" in
-    "\${ORCA_ATTRIBUTION_SHIM_DIR}"|"\${ORCA_ATTRIBUTION_SHIM_DIR}:"*) return 0 ;;
-  esac
-  export PATH="\${ORCA_ATTRIBUTION_SHIM_DIR}:$PATH"
-}
-__orca_restore_attribution_path
 __orca_restore_agent_teams_path() {
   [[ -n "\${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0
   case "$PATH" in
@@ -130,7 +123,6 @@ __orca_restore_agent_teams_path
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 ${getPosixOmpShellWrapper()}
-${getPosixPrimeAgentShellWrapper()}
 # Why: Codex must keep using Orca's runtime CODEX_HOME after profile scripts.
 [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 # Why: emit OSC 133 C/D so terminal-command-lifecycle can drop stale agent
@@ -226,14 +218,6 @@ ${getZshStartupFileSourceBlock({
   interactiveOnly: true,
   skipWhenHomeIsCurrentZdotdir: true
 })}
-__orca_restore_attribution_path() {
-  [[ -n "\${ORCA_ATTRIBUTION_SHIM_DIR:-}" ]] || return 0
-  case "$PATH" in
-    "\${ORCA_ATTRIBUTION_SHIM_DIR}"|"\${ORCA_ATTRIBUTION_SHIM_DIR}:"*) return 0 ;;
-  esac
-  export PATH="\${ORCA_ATTRIBUTION_SHIM_DIR}:$PATH"
-}
-[[ ! -o login ]] && __orca_restore_attribution_path
 __orca_restore_agent_teams_path() {
   [[ -n "\${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0
   case "$PATH" in
@@ -247,7 +231,6 @@ if [[ ! -o login ]]; then
   [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
   ${getPosixOmpShellWrapper()}
-  ${getPosixPrimeAgentShellWrapper()}
   # Why: Codex must keep using Orca's runtime CODEX_HOME after rc files.
   [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 fi
@@ -288,14 +271,6 @@ ${getZshStartupFileSourceBlock({ fileName: '.zprofile' })}
   const zshRc = getZshShellReadyRcfileContent()
   const zshLogin = `# Orca zsh shell-ready wrapper
 ${getZshStartupFileSourceBlock({ fileName: '.zlogin', interactiveOnly: true })}
-__orca_restore_attribution_path() {
-  [[ -n "\${ORCA_ATTRIBUTION_SHIM_DIR:-}" ]] || return 0
-  case "$PATH" in
-    "\${ORCA_ATTRIBUTION_SHIM_DIR}"|"\${ORCA_ATTRIBUTION_SHIM_DIR}:"*) return 0 ;;
-  esac
-  export PATH="\${ORCA_ATTRIBUTION_SHIM_DIR}:$PATH"
-}
-__orca_restore_attribution_path
 __orca_restore_agent_teams_path() {
   [[ -n "\${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0
   case "$PATH" in
@@ -308,7 +283,6 @@ __orca_restore_agent_teams_path
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 ${getPosixOmpShellWrapper()}
-${getPosixPrimeAgentShellWrapper()}
 [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 ${getZshShellReadyMarkerRegistrationBlock(SHELL_READY_MARKER_ESCAPED)}
 ${getZshFinalZdotdirRestoreBlock()}
@@ -372,7 +346,8 @@ function getWrappedShellLaunchConfig(
         ORCA_ORIG_ZDOTDIR: resolveOriginalZdotdir(),
         ORCA_ZSHENV_SOURCE_DIR: resolveOriginalZshenvSourceDir(),
         ZDOTDIR: `${getShellReadyWrapperRoot()}/zsh`,
-        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0'
+        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0',
+        ORCA_SHELL_STARTUP_IDENTITY: options.emitReadyMarker ? '1' : '0'
       },
       supportsReadyMarker: options.emitReadyMarker
     }
@@ -383,7 +358,8 @@ function getWrappedShellLaunchConfig(
     return {
       args: ['--rcfile', `${getShellReadyWrapperRoot()}/bash/rcfile`],
       env: {
-        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0'
+        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0',
+        ORCA_SHELL_STARTUP_IDENTITY: options.emitReadyMarker ? '1' : '0'
       },
       supportsReadyMarker: options.emitReadyMarker
     }
@@ -402,7 +378,7 @@ function getWrappedShellLaunchConfig(
     }
   }
 
-  // Why: mirrors daemon/shell-ready.ts; attribution-only fish stays unwrapped.
+  // Why: mirrors daemon/shell-ready.ts; markerless fish stays unwrapped.
   if (shellName === 'fish' && options.emitReadyMarker) {
     return {
       args: ['-l', '-C', getFishShellReadyInitCommand(SHELL_READY_MARKER_ESCAPED)],
@@ -422,7 +398,7 @@ export function getShellReadyLaunchConfig(shellPath: string): ShellReadyLaunchCo
   return getWrappedShellLaunchConfig(shellPath, { emitReadyMarker: true })
 }
 
-export function getAttributionShellLaunchConfig(shellPath: string): ShellReadyLaunchConfig {
+export function getMarkerlessShellLaunchConfig(shellPath: string): ShellReadyLaunchConfig {
   return getWrappedShellLaunchConfig(shellPath, { emitReadyMarker: false })
 }
 
@@ -433,7 +409,7 @@ export function writeStartupCommandWhenShellReady(
   proc: pty.IPty,
   startupCommand: string,
   onExit: (cleanup: () => void) => void,
-  // Why: only Orca-wrapped bash/zsh have bracketed-paste active; other shells use the raw path to avoid echoing the ESC[200~ markers.
+  // Why: only shells with bracketed-paste active (see isBracketedPasteSafeShell) accept the wrapper; others use the raw path so ESC[200~ isn't echoed.
   options: { bracketedPasteSafe?: boolean } = {}
 ): void {
   let sent = false
diff --git a/src/main/providers/provider-dispatch.test.ts b/src/main/providers/provider-dispatch.test.ts
index 57d7e3f815c..2ba058ffd9c 100644
--- a/src/main/providers/provider-dispatch.test.ts
+++ b/src/main/providers/provider-dispatch.test.ts
@@ -62,6 +62,7 @@ import {
   unregisterSshPtyProvider
 } from '../ipc/pty'
 import type { IPtyProvider } from './types'
+import { LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS } from '../pty/legacy-terminal-shim-dir'
 
 describe('PTY provider dispatch', () => {
   const handlers = new Map<string, (...args: unknown[]) => unknown>()
@@ -147,6 +148,7 @@ describe('PTY provider dispatch', () => {
     const sshSpawnArgs = vi.mocked(mockSshProvider.spawn).mock.calls.at(-1)![0]
     expect([...(sshSpawnArgs.envToDelete ?? [])].sort()).toEqual(
       [
+        ...LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS,
         'CLAUDE_CODE_CHILD_SESSION',
         'CLAUDE_CODE_SESSION_ID',
         'CLAUDE_CODE_BRIDGE_SESSION_ID'
diff --git a/src/main/providers/pty-provider-contract.ts b/src/main/providers/pty-provider-contract.ts
index e1017cab2c4..5e4a34db5a4 100644
--- a/src/main/providers/pty-provider-contract.ts
+++ b/src/main/providers/pty-provider-contract.ts
@@ -32,6 +32,10 @@ export type PtyProviderBufferSnapshot = {
   oscLinks?: TerminalOscLinkRange[]
   alternateScreen?: boolean
   pendingEscapeTailAnsi?: string
+  /** Effective kitty keyboard flags PROVEN at this snapshot's own `seq`
+   *  boundary. Absent means the source could not prove them; readers must not
+   *  rewrite that silence into a known `0`. */
+  kittyKeyboardFlags?: number
 }
 
 export type PtySpawnOptions = {
@@ -119,7 +123,8 @@ export type IPtyProvider = {
   /** Whether fresh structured creates can replay one spawn across a lost relay response. */
   supportsAgentSessionCreateOperations?: (options?: PtyProbeOptions) => boolean | Promise<boolean>
   attach(id: string): Promise<Pick<PtySpawnResult, 'providerSequence'> | void>
-  hasPty?: (id: string) => boolean
+  /** Three-valued: null means the provider cannot see this id right now — absence is unproven, never dead. */
+  hasPty?: (id: string) => boolean | null
   /** Exact provider readback: false only when the provider answered that the PTY is absent. */
   probePtyLiveness?: (id: string) => Promise<boolean | null>
   write(id: string, data: string): void
diff --git a/src/main/providers/pty-spawn-result.ts b/src/main/providers/pty-spawn-result.ts
index 66fec74a482..ebed657ee21 100644
--- a/src/main/providers/pty-spawn-result.ts
+++ b/src/main/providers/pty-spawn-result.ts
@@ -49,6 +49,9 @@ export type PtySpawnResult = {
    *  (terminal-query-authority.md §kitty). Never replayed into a renderer
    *  xterm — POST_REPLAY_REATTACH_RESET's kitty reset stays authoritative. */
   snapshotKittyKeyboardFlags?: number
+  /** Renderer-domain sequence main reconciled for the attach boundary those
+   *  flags describe. Set by main, not the provider. */
+  snapshotSeq?: number
   /** True when the spawn reattached to an existing daemon session. */
   isReattach?: boolean
   /** Last OSC title tracked by the daemon session the snapshot came from.
diff --git a/src/main/providers/ssh-pty-errors.ts b/src/main/providers/ssh-pty-errors.ts
index a8c551f228b..c389422f55d 100644
--- a/src/main/providers/ssh-pty-errors.ts
+++ b/src/main/providers/ssh-pty-errors.ts
@@ -1,12 +1,30 @@
-export const SSH_SESSION_EXPIRED_ERROR = 'SSH_SESSION_EXPIRED'
-export const SSH_PTY_IDENTITY_MISMATCH_ERROR = 'SSH_PTY_IDENTITY_MISMATCH'
+export {
+  SSH_SESSION_EXPIRED_ERROR,
+  SSH_PTY_IDENTITY_MISMATCH_ERROR,
+  SSH_PTY_EXITED_ERROR,
+  SSH_SOURCE_RESTORE_REQUIRED_ERROR
+} from '../../shared/ssh-pty-failure-tokens'
+import {
+  SSH_SOURCE_RESTORE_REQUIRED_ERROR,
+  isSshPtyExitedMessage,
+  isSshPtyIdentityMismatchMessage
+} from '../../shared/ssh-pty-failure-tokens'
+
+export function isSshSourceRestoreRequiredError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error)
+  return message.includes(SSH_SOURCE_RESTORE_REQUIRED_ERROR)
+}
 
 export function isSshPtyNotFoundError(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error)
   return /PTY ".+" not found/i.test(message)
 }
 
+/** The relay watched this shell exit — first-hand proof, unlike a bare not-found. */
+export function isSshPtyExitedError(error: unknown): boolean {
+  return isSshPtyExitedMessage(error instanceof Error ? error.message : String(error))
+}
+
 export function isSshPtyIdentityMismatchError(error: unknown): boolean {
-  const message = error instanceof Error ? error.message : String(error)
-  return message.includes(SSH_PTY_IDENTITY_MISMATCH_ERROR) || /identity mismatch/i.test(message)
+  return isSshPtyIdentityMismatchMessage(error instanceof Error ? error.message : String(error))
 }
diff --git a/src/main/providers/ssh-pty-identity-mismatch-is-not-death.test.ts b/src/main/providers/ssh-pty-identity-mismatch-is-not-death.test.ts
new file mode 100644
index 00000000000..86d8cc36e58
--- /dev/null
+++ b/src/main/providers/ssh-pty-identity-mismatch-is-not-death.test.ts
@@ -0,0 +1,215 @@
+/**
+ * An identity mismatch means the relay FOUND the PTY and its recorded pane
+ * differs — the shell is running. Publishing that as expiry makes the renderer
+ * clear the binding and cold-restore with agent resume, which is a second agent
+ * on one transcript while the first keeps running.
+ *
+ * Reachable today from a shipped gesture: detaching a pane into a new tab
+ * changes tabId, the relay still holds the tabId frozen at spawn, and the
+ * reattach mismatches.
+ *
+ * Pins the PRODUCER and the CONSUMERS together. The two guards this program
+ * shipped before both passed while sitting off the route production takes, so
+ * asserting the classifier alone is not enough — the destructive token has to
+ * be absent from what the reattach actually throws.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { reattachSshPtySession } from './ssh-pty-session-reattach'
+import {
+  SSH_SESSION_EXPIRED_ERROR,
+  SSH_PTY_IDENTITY_MISMATCH_ERROR,
+  formatPtyExitedError
+} from '../../shared/ssh-pty-failure-tokens'
+
+/** The renderer converts a failure into `sessionExpired: true` on these tokens
+ *  and then respawns on the flag alone, never consulting the classifier.
+ *  Mirrors pty-transport.ts. */
+const SSH_PTY_CONNECTION_MISMATCH_MARKER = 'belongs to SSH connection'
+function transportWouldReportSessionExpired(message: string): boolean {
+  return (
+    message.includes(SSH_SESSION_EXPIRED_ERROR) ||
+    message.includes(SSH_PTY_CONNECTION_MISMATCH_MARKER)
+  )
+}
+
+const CONNECTION_ID = 'ssh-target-1'
+const RELAY_PTY_ID = 'pty-7'
+
+function muxThatFailsAttachWith(message: string): { mux: unknown } {
+  return {
+    mux: {
+      request: vi.fn().mockRejectedValue(new Error(message)),
+      notify: vi.fn()
+    }
+  }
+}
+
+async function reattachError(
+  attachFailure: string,
+  expectedIncarnationId?: string
+): Promise<Error> {
+  const { mux } = muxThatFailsAttachWith(attachFailure)
+  try {
+    await reattachSshPtySession({
+      mux: mux as never,
+      connectionId: CONNECTION_ID,
+      sessionId: RELAY_PTY_ID,
+      options: {
+        cols: 80,
+        rows: 24,
+        paneKey: 'tab-new:leaf-1',
+        tabId: 'tab-new',
+        ...(expectedIncarnationId ? { expectedIncarnationId } : {})
+      } as never
+    })
+  } catch (error) {
+    return error as Error
+  }
+  throw new Error('reattach unexpectedly succeeded')
+}
+
+describe('an identity mismatch is not a death', () => {
+  it('does not publish the destructive expiry token', async () => {
+    const error = await reattachError(`PTY "${RELAY_PTY_ID}" not found (identity mismatch)`)
+
+    expect(error.message).not.toContain(SSH_SESSION_EXPIRED_ERROR)
+  })
+
+  // The renderer keys off this token; its own clauses live beside the
+  // classifier, in reattach-failure-classification.test.ts.
+  it('marks the failure with the shared mismatch token', async () => {
+    const error = await reattachError(`PTY "${RELAY_PTY_ID}" not found (identity mismatch)`)
+
+    expect(error.message).toContain(SSH_PTY_IDENTITY_MISMATCH_ERROR)
+  })
+
+  // The flag path bypasses the classifier entirely, so it needs its own clause.
+  it('does not trip the renderer transport into sessionExpired', async () => {
+    const error = await reattachError(`PTY "${RELAY_PTY_ID}" not found (identity mismatch)`)
+
+    expect(transportWouldReportSessionExpired(error.message)).toBe(false)
+  })
+})
+
+describe('only an exit the relay watched is a death', () => {
+  // Clause-selectivity: a fix that silences real expiry would strand panes on a
+  // shell that truly went away, so the contrast has to hold.
+  it('publishes expiry when the relay reports the exit it observed', async () => {
+    const error = await reattachError(
+      formatPtyExitedError(RELAY_PTY_ID, 0, 'inc-host-7'),
+      'inc-host-7'
+    )
+
+    expect(error.message).toContain(SSH_SESSION_EXPIRED_ERROR)
+    expect(error.message).not.toContain(SSH_PTY_IDENTITY_MISMATCH_ERROR)
+    expect(transportWouldReportSessionExpired(error.message)).toBe(true)
+  })
+
+  // INVERTED. This used to require a bare absence to publish expiry. That is the defect: the relay
+  // we asked cannot hand the id back, which proves an exit ONLY if it is the relay that minted it.
+  // A replaced relay answers exactly this for shells still running under its predecessor, so
+  // expiry there cleared ownership and resumed the agent a second time onto a live shell. The
+  // death that is real is still detected — by the clause above, from an exit the relay watched.
+  // Enforcement cannot live only on the host: the host is the party whose answer is in question,
+  // and versions differ. A proof we cannot tie to the shell we asked about is not proof.
+  it('does not publish expiry for an exit that names a different shell', async () => {
+    const error = await reattachError(
+      formatPtyExitedError(RELAY_PTY_ID, 0, 'inc-some-other-shell'),
+      'inc-host-7'
+    )
+
+    expect(error.message).not.toContain(SSH_SESSION_EXPIRED_ERROR)
+    expect(transportWouldReportSessionExpired(error.message)).toBe(false)
+  })
+
+  it('does not publish expiry for an exit that names a different PTY id', async () => {
+    const error = await reattachError(
+      formatPtyExitedError('pty-some-other-shell', 0, 'inc-host-7'),
+      'inc-host-7'
+    )
+
+    expect(error.message).not.toContain(SSH_SESSION_EXPIRED_ERROR)
+    expect(transportWouldReportSessionExpired(error.message)).toBe(false)
+  })
+
+  it('does not publish expiry for an exit when the pane knows no incarnation', async () => {
+    const error = await reattachError(formatPtyExitedError(RELAY_PTY_ID, 0, 'inc-host-7'))
+
+    expect(error.message).not.toContain(SSH_SESSION_EXPIRED_ERROR)
+  })
+
+  it('does not publish expiry when the relay merely has no such PTY', async () => {
+    const error = await reattachError(`PTY "${RELAY_PTY_ID}" not found`)
+
+    expect(error.message).not.toContain(SSH_SESSION_EXPIRED_ERROR)
+    expect(transportWouldReportSessionExpired(error.message)).toBe(false)
+  })
+
+  it('leaves an unrelated failure untouched rather than guessing', async () => {
+    const error = await reattachError('ECONNRESET while writing to the relay')
+
+    expect(error.message).not.toContain(SSH_SESSION_EXPIRED_ERROR)
+    expect(error.message).not.toContain(SSH_PTY_IDENTITY_MISMATCH_ERROR)
+  })
+})
+
+// New relays prioritize incarnation, so the pane fields do not reject a moved pane. Old relays
+// ignore the additive incarnation field and still need their weaker pane fence.
+describe('reattach preserves the old-relay pane fence', () => {
+  async function attachParams(
+    extraOptions: Record<string, unknown> = {}
+  ): Promise<Record<string, unknown>> {
+    const request = vi.fn().mockRejectedValue(new Error('boom'))
+    try {
+      await reattachSshPtySession({
+        mux: { request, notify: vi.fn() } as never,
+        connectionId: CONNECTION_ID,
+        sessionId: RELAY_PTY_ID,
+        options: {
+          cols: 80,
+          rows: 24,
+          paneKey: 'tab-new:leaf-1',
+          tabId: 'tab-new',
+          env: { ORCA_PANE_KEY: 'tab-old:leaf-1', ORCA_TAB_ID: 'tab-old' },
+          ...extraOptions
+        } as never
+      })
+    } catch {
+      // the attach failure is not what this clause is about
+    }
+    const call = request.mock.calls.at(0)
+    return (call?.[1] ?? call?.[0] ?? {}) as Record<string, unknown>
+  }
+
+  it('sends the current pane key for relays that do not understand incarnation', async () => {
+    expect(await attachParams()).toMatchObject({ expectedPaneKey: 'tab-new:leaf-1' })
+  })
+
+  it('sends the current tab id for relays that do not understand incarnation', async () => {
+    expect(await attachParams()).toMatchObject({ expectedTabId: 'tab-new' })
+  })
+
+  // The producer pin for the relay's incarnation guard. The guard is only worth having if the
+  // expectation actually leaves the client, and nothing else here would notice if it stopped:
+  // the relay stays permissive on an absent field, so a silent regression reads as "all green".
+  it('sends the expected incarnation when the host attested one', async () => {
+    expect(await attachParams({ expectedIncarnationId: 'inc-host-7' })).toMatchObject({
+      expectedIncarnationId: 'inc-host-7',
+      expectedPaneKey: 'tab-new:leaf-1',
+      expectedTabId: 'tab-new'
+    })
+  })
+
+  // A stand-in minted locally when the host reported none. It is first-write-wins and is dropped
+  // when provider state resets, so the same live shell can present a different one after a
+  // reconnect — sending it would make the relay refuse the pane its own shell.
+  it('sends no expected incarnation when the value was synthesized locally', async () => {
+    expect(await attachParams({ expectedIncarnationId: 'legacy:23:0:pty-7' })).not.toHaveProperty(
+      'expectedIncarnationId'
+    )
+  })
+
+  it('sends no expected incarnation when there is none to send', async () => {
+    expect(await attachParams()).not.toHaveProperty('expectedIncarnationId')
+  })
+})
diff --git a/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts b/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
index e088b21f025..b150c7fa0c7 100644
--- a/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
+++ b/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
@@ -316,7 +316,8 @@ describe('SSH fresh agent-session create operations', () => {
     )
 
     expect(onData).not.toHaveBeenCalled()
-    expect(exactProvider.hasPty('ssh:conn-1@@pty-1')).toBe(false)
+    // Not `false`: the provider has never listed this host, so absence is unknown, not proven.
+    expect(exactProvider.hasPty('ssh:conn-1@@pty-1')).not.toBe(true)
     const shutdownRequest = await waitForRequest(transport, 'pty.shutdown')
     transport.deliver(responseFrame(shutdownRequest.id as number, null, 4))
     const cancelRequest = await waitForRequest(transport, 'pty.cancelDelivery')
diff --git a/src/main/providers/ssh-pty-provider-exit-race.test.ts b/src/main/providers/ssh-pty-provider-exit-race.test.ts
index 22a19985d21..38c665d93c4 100644
--- a/src/main/providers/ssh-pty-provider-exit-race.test.ts
+++ b/src/main/providers/ssh-pty-provider-exit-race.test.ts
@@ -170,3 +170,30 @@ it('returns a provisional source activation lease to reconnect authority', async
     deliveryToken: 'token-reconnect'
   })
 })
+
+it('fences a mismatched attach response before installing its source activation', async () => {
+  const response = {
+    incarnationId: 'incarnation-other',
+    sourceActivation: sourceActivation('incarnation-other')
+  }
+  const mux = {
+    request: vi.fn(async (method: string, _params, options) => {
+      if (method !== 'pty.attach') {
+        return undefined
+      }
+      options?.beforeResolve?.(response)
+      return response
+    }),
+    notify: vi.fn(),
+    onNotification: vi.fn(),
+    dispose: vi.fn(),
+    isDisposed: vi.fn().mockReturnValue(false)
+  }
+  const provider = new SshPtyProvider('conn-1', mux as never)
+
+  await expect(
+    provider.attachForReconnect('ssh:conn-1@@pty-1', undefined, 'incarnation-expected')
+  ).rejects.toThrow('SSH_PTY_IDENTITY_MISMATCH')
+
+  expect(mux.request).toHaveBeenCalledTimes(1)
+})
diff --git a/src/main/providers/ssh-pty-provider-output-state.ts b/src/main/providers/ssh-pty-provider-output-state.ts
index 4d98097b9c6..a80ffc4ec4f 100644
--- a/src/main/providers/ssh-pty-provider-output-state.ts
+++ b/src/main/providers/ssh-pty-provider-output-state.ts
@@ -11,6 +11,7 @@ import {
   type SshPtyReceivingActivationLease
 } from './ssh-pty-notification-routing'
 import type { PtySourceReceivingActivation } from '../../shared/pty-source-receiving-activation'
+import { SYNTHESIZED_PTY_INCARNATION_PREFIX } from '../../shared/pty-incarnation'
 
 export class SshPtyProviderOutputState {
   private readonly dataListeners = new Set<SshPtyDataCallback>()
@@ -132,7 +133,7 @@ export class SshPtyProviderOutputState {
     this.rememberPtyIncarnation(relayPtyId, incarnationId)
     let resolved = this.incarnationByRelayPtyId.get(relayPtyId)
     if (!resolved) {
-      resolved = `legacy:${this.providerGeneration}:${this.legacyIncarnationSerial++}:${relayPtyId}`
+      resolved = `${SYNTHESIZED_PTY_INCARNATION_PREFIX}${this.providerGeneration}:${this.legacyIncarnationSerial++}:${relayPtyId}`
       this.incarnationByRelayPtyId.set(relayPtyId, resolved)
     }
     return resolved
diff --git a/src/main/providers/ssh-pty-provider-process-events.test.ts b/src/main/providers/ssh-pty-provider-process-events.test.ts
index e152ef47fae..449c3e4c356 100644
--- a/src/main/providers/ssh-pty-provider-process-events.test.ts
+++ b/src/main/providers/ssh-pty-provider-process-events.test.ts
@@ -29,6 +29,17 @@ describe('SshPtyProvider process listings and events', () => {
     provider = new SshPtyProvider('conn-1', mux as never)
   })
 
+  // Why: a reconnect builds a fresh provider with an empty set, so a miss before the
+  // first completed listing is ignorance about the host, not a dead PTY.
+  it('answers unknown liveness until a completed listing makes absence provable', async () => {
+    expect(provider.hasPty(scopedPty1)).toBe(null)
+
+    mux.request.mockResolvedValueOnce([])
+    await provider.listProcesses()
+
+    expect(provider.hasPty(scopedPty1)).toBe(false)
+  })
+
   it('scopes process listings and bounds the relay RPC by the teardown deadline', async () => {
     const processes = [{ id: 'pty-1', cwd: '/home', title: 'zsh', worktreeId: 'repo::/home' }]
     mux.request.mockResolvedValue(processes)
diff --git a/src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts b/src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts
index 74989dc34e5..af7eeb98139 100644
--- a/src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts
+++ b/src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts
@@ -1,8 +1,28 @@
 import { describe, expect, it, vi } from 'vitest'
-import { SSH_SESSION_EXPIRED_ERROR } from './ssh-pty-errors'
+import {
+  SSH_PTY_IDENTITY_MISMATCH_ERROR,
+  SSH_SESSION_EXPIRED_ERROR,
+  SSH_SOURCE_RESTORE_REQUIRED_ERROR
+} from './ssh-pty-errors'
 import { SshPtyProvider } from './ssh-pty-provider'
 
 describe('SSH PTY provider session reattach incarnation', () => {
+  it.each([
+    ['an old-relay response without an incarnation', {}],
+    ['a response for a different incarnation', { incarnationId: 'incarnation-other' }]
+  ])('rejects %s', async (_label, response) => {
+    const mux = {
+      request: vi.fn().mockResolvedValue(response),
+      notify: vi.fn(),
+      onNotification: vi.fn().mockReturnValue(vi.fn())
+    }
+    const provider = new SshPtyProvider('conn-1', mux as never)
+
+    await expect(
+      provider.attachForReconnect('ssh:conn-1@@pty-old', undefined, 'incarnation-expected')
+    ).rejects.toThrow(SSH_PTY_IDENTITY_MISMATCH_ERROR)
+  })
+
   it('remembers the authoritative incarnation before a legacy exit arrives', async () => {
     let notify: ((method: string, params: Record<string, unknown>) => void) | undefined
     const mux = {
@@ -44,8 +64,10 @@ describe('SSH PTY provider session reattach incarnation', () => {
     }
     const provider = new SshPtyProvider('conn-1', mux as never)
 
-    await expect(provider.spawn({ cols: 80, rows: 24, sessionId: 'pty-old' })).rejects.toThrow(
-      `${SSH_SESSION_EXPIRED_ERROR}: pty-old`
-    )
+    // Fails closed, but NOT as expiry: the shell is still running, and callers
+    // respawn on expiry — which duplicate-resumed the live agent session.
+    const spawn = provider.spawn({ cols: 80, rows: 24, sessionId: 'pty-old' })
+    await expect(spawn).rejects.toThrow(`${SSH_SOURCE_RESTORE_REQUIRED_ERROR}: pty-old`)
+    await expect(spawn).rejects.not.toThrow(SSH_SESSION_EXPIRED_ERROR)
   })
 })
diff --git a/src/main/providers/ssh-pty-provider.test.ts b/src/main/providers/ssh-pty-provider.test.ts
index d299e65b716..e0b1d6b8213 100644
--- a/src/main/providers/ssh-pty-provider.test.ts
+++ b/src/main/providers/ssh-pty-provider.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi, beforeEach } from 'vitest'
+import { formatPtyExitedError } from '../../shared/ssh-pty-failure-tokens'
 import { SshPtyProvider } from './ssh-pty-provider'
 import { POWERLEVEL10K_WIZARD_DISABLE_ENV } from '../pty/powerlevel10k-wizard-env'
 import { PTY_STARTUP_INGRESS_VERSION } from '../../shared/pty-startup-ingress'
@@ -427,7 +428,7 @@ describe('SshPtyProvider', () => {
 
     it('preserves explicit TERM and forwards final env deletions to the relay', async () => {
       mux.request.mockResolvedValue({ id: 'pty-env-precedence' })
-      const envToDelete = ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
+      const envToDelete = ['TERM_PROGRAM', 'ORCA_STALE_TEST_ENV']
 
       await provider.spawn({
         cols: 120,
@@ -435,7 +436,7 @@ describe('SshPtyProvider', () => {
         env: {
           TERM: 'screen-256color',
           TERM_PROGRAM: 'stale-terminal',
-          ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/stale-attribution'
+          ORCA_STALE_TEST_ENV: '/tmp/stale-env'
         },
         envToDelete
       })
@@ -452,7 +453,7 @@ describe('SshPtyProvider', () => {
       })
       const spawnCall = mux.request.mock.calls.find((call) => call[0] === 'pty.spawn')
       expect(spawnCall?.[1]?.env).not.toHaveProperty('TERM_PROGRAM')
-      expect(spawnCall?.[1]?.env).not.toHaveProperty('ORCA_ATTRIBUTION_SHIM_DIR')
+      expect(spawnCall?.[1]?.env).not.toHaveProperty('ORCA_STALE_TEST_ENV')
     })
 
     it('forwards provider command delivery to the relay', async () => {
@@ -584,7 +585,8 @@ describe('SshPtyProvider', () => {
           id: 'pty-old',
           cols: 80,
           rows: 24,
-          suppressReplayNotification: true
+          suppressReplayNotification: true,
+          exitProofSupported: true
         },
         sourceActivationRequestOptions
       )
@@ -630,7 +632,8 @@ describe('SshPtyProvider', () => {
         id: 'pty-old',
         cols: 80,
         rows: 24,
-        suppressReplayNotification: true
+        suppressReplayNotification: true,
+        exitProofSupported: true
       })
       expect(result).toEqual({
         id: 'ssh:conn-1@@pty-old',
@@ -639,7 +642,8 @@ describe('SshPtyProvider', () => {
       })
     })
 
-    it('reattaches with explicit pane identity when hook env was stripped', async () => {
+    // New relays prioritize incarnation; old relays ignore that field and retain this weaker fence.
+    it('preserves pane identity for relays that predate incarnation fencing', async () => {
       mux.request.mockResolvedValue({ replay: 'buffered-output' })
 
       await provider.spawn({
@@ -655,18 +659,30 @@ describe('SshPtyProvider', () => {
         cols: 80,
         rows: 24,
         suppressReplayNotification: true,
+        exitProofSupported: true,
         expectedPaneKey: 'tab-a:leaf-a',
         expectedTabId: 'tab-a'
       })
     })
 
-    it('does not fresh-spawn over an expired reattach session', async () => {
-      mux.request.mockRejectedValueOnce(new Error('PTY "pty-old" not found'))
-
-      await expect(provider.spawn({ cols: 80, rows: 24, sessionId: 'pty-old' })).rejects.toThrow(
-        'SSH_SESSION_EXPIRED: pty-old'
+    it('does not fresh-spawn over a reattach whose shell the relay saw exit', async () => {
+      // INVERTED to drive the exit the relay OBSERVED. A bare not-found no longer becomes expiry —
+      // it proves nothing when the answering relay may be a replacement — so the observed exit is
+      // now what carries this through to expiry. The property under test is unchanged: a failed
+      // reattach throws instead of quietly spawning a second shell over the pane.
+      mux.request.mockRejectedValueOnce(
+        new Error(formatPtyExitedError('pty-old', 0, 'inc-host-old'))
       )
 
+      await expect(
+        provider.spawn({
+          cols: 80,
+          rows: 24,
+          sessionId: 'pty-old',
+          expectedIncarnationId: 'inc-host-old'
+        })
+      ).rejects.toThrow('SSH_SESSION_EXPIRED: pty-old')
+
       expect(mux.request).toHaveBeenNthCalledWith(
         1,
         'pty.attach',
@@ -674,13 +690,27 @@ describe('SshPtyProvider', () => {
           id: 'pty-old',
           cols: 80,
           rows: 24,
-          suppressReplayNotification: true
+          suppressReplayNotification: true,
+          exitProofSupported: true,
+          expectedIncarnationId: 'inc-host-old'
         },
         sourceActivationRequestOptions
       )
       expect(mux.request).toHaveBeenCalledTimes(1)
     })
 
+    // The sibling case, and the one the change is for: an id the relay simply does not know may be
+    // a shell still running under a relay this one replaced. It must still refuse to fresh-spawn,
+    // and must NOT be dressed up as expiry, which is what authorized the replacement.
+    it('does not fresh-spawn, nor claim expiry, when the relay merely has no such PTY', async () => {
+      mux.request.mockRejectedValueOnce(new Error('PTY "pty-old" not found'))
+
+      await expect(provider.spawn({ cols: 80, rows: 24, sessionId: 'pty-old' })).rejects.toThrow(
+        'PTY "pty-old" not found'
+      )
+      expect(mux.request).toHaveBeenCalledTimes(1)
+    })
+
     it('preserves transient reattach failures for retry handling', async () => {
       mux.request.mockRejectedValueOnce(new Error('SSH connection lost, reconnecting...'))
 
@@ -714,7 +744,8 @@ describe('SshPtyProvider', () => {
       'pty.attach',
       {
         id: 'pty-1',
-        suppressReplayNotification: true
+        suppressReplayNotification: true,
+        exitProofSupported: true
       },
       expect.objectContaining({
         timeoutMs: 10_000,
@@ -739,28 +770,6 @@ describe('SshPtyProvider', () => {
     )
   })
 
-  it('attachForReconnect forwards expected identity when provided', async () => {
-    await provider.attachForReconnect(scopedPty1, {
-      paneKey: 'tab-a:leaf-a',
-      tabId: 'tab-a'
-    })
-
-    expectRequest(
-      mux.request,
-      'pty.attach',
-      {
-        id: 'pty-1',
-        suppressReplayNotification: true,
-        expectedPaneKey: 'tab-a:leaf-a',
-        expectedTabId: 'tab-a'
-      },
-      expect.objectContaining({
-        timeoutMs: 10_000,
-        beforeResolve: expect.any(Function)
-      })
-    )
-  })
-
   it('write sends pty.data notification', () => {
     provider.write(scopedPty1, 'hello')
     expect(mux.notify).toHaveBeenCalledWith('pty.data', { id: 'pty-1', data: 'hello' })
diff --git a/src/main/providers/ssh-pty-provider.ts b/src/main/providers/ssh-pty-provider.ts
index 2bc52fe491d..2eaf202f0b2 100644
--- a/src/main/providers/ssh-pty-provider.ts
+++ b/src/main/providers/ssh-pty-provider.ts
@@ -13,6 +13,7 @@ import { SshPtyProviderOutputState } from './ssh-pty-provider-output-state'
 import { spawnFreshSshPty } from './ssh-agent-session-create-operation'
 import { mapSshPtyProcessList } from './ssh-agent-session-process-list'
 import {
+  buildSshPtyReconnectAttachParams,
   requestSshPtyAttach,
   reattachSshPtySessionWithExitFence,
   type PtySourceRecoveryRequest,
@@ -22,7 +23,7 @@ import { buildSshPtySpawnRequest } from './ssh-pty-spawn-request'
 import { SshPtySpawnExitRaceTracker } from './ssh-pty-spawn-exit-race'
 import { SshAgentSessionCapabilities } from './ssh-agent-session-capabilities'
 import type { PtyProcessInspection } from './pty-process-inspection'
-import { SSH_SESSION_EXPIRED_ERROR } from './ssh-pty-errors'
+import { SSH_SOURCE_RESTORE_REQUIRED_ERROR } from './ssh-pty-errors'
 
 // Why: sequential relay teardown calls share one absolute budget; convert to the mux-relative timeout only at dispatch.
 function relayTimeoutOptions(deadlineMs: number | undefined): { timeoutMs: number } | undefined {
@@ -34,6 +35,7 @@ export class SshPtyProvider implements IPtyProvider {
   private mux: SshChannelMultiplexer
   private connectionId: string
   private livePtyIds = new Set<string>()
+  private listedOnce = false
   readonly getAppliedSize: NonNullable<IPtyProvider['getAppliedSize']>
   private readonly agentSessionCapabilities: SshAgentSessionCapabilities
   private spawnExitRaces = new SshPtySpawnExitRaceTracker()
@@ -63,6 +65,7 @@ export class SshPtyProvider implements IPtyProvider {
   dispose(): void {
     this.outputState.dispose()
     this.livePtyIds.clear()
+    this.listedOnce = false
   }
 
   getConnectionId = (): string => this.connectionId
@@ -101,8 +104,11 @@ export class SshPtyProvider implements IPtyProvider {
             this.outputState.rememberPtyIncarnation(relayPtyId, incarnationId)
         })
         if (result.sourceRecovery?.status === 'restoreRequired') {
+          // Why not SSH_SESSION_EXPIRED: the shell is still running, only its
+          // output source needs re-establishing. Reporting expiry made the pane
+          // respawn and resume the same agent session twice into one transcript.
           throw new Error(
-            `${SSH_SESSION_EXPIRED_ERROR}: ${toRelaySshPtyId(this.connectionId, result.id)}`
+            `${SSH_SOURCE_RESTORE_REQUIRED_ERROR}: ${toRelaySshPtyId(this.connectionId, result.id)}`
           )
         }
         this.livePtyIds.add(result.id)
@@ -177,20 +183,16 @@ export class SshPtyProvider implements IPtyProvider {
 
   async attachForReconnect(
     id: string,
-    expected?: { paneKey?: string; tabId?: string },
-    sourceRecovery?: PtySourceRecoveryRequest
+    sourceRecovery?: PtySourceRecoveryRequest,
+    expectedIncarnationId?: string,
+    legacyExpectedIdentity?: { paneKey?: string; tabId?: string }
   ): Promise<SshPtyAttachResult> {
-    // Why: reconnect owns replay delivery so stale/duplicate attach results can
-    // be filtered before they reach the renderer. The expected identity lets the
-    // relay reject a cross-generation id collision instead of reattaching this
-    // lease to a different pane's freshly spawned PTY.
-    const params = {
+    const params = buildSshPtyReconnectAttachParams({
       id: this.toRelayPtyId(id),
-      suppressReplayNotification: true,
       ...(sourceRecovery ? { sourceRecovery } : {}),
-      ...(expected?.paneKey ? { expectedPaneKey: expected.paneKey } : {}),
-      ...(expected?.tabId ? { expectedTabId: expected.tabId } : {})
-    }
+      ...(expectedIncarnationId ? { expectedIncarnationId } : {}),
+      ...(legacyExpectedIdentity ? { legacyExpectedIdentity } : {})
+    })
     const relayPtyId = this.toRelayPtyId(id)
     return await requestSshPtyAttach({
       mux: this.mux,
@@ -296,11 +298,14 @@ export class SshPtyProvider implements IPtyProvider {
       const relayPtyId = this.toRelayPtyId(process.id)
       this.outputState.rememberPtyIncarnation(relayPtyId, process.incarnationId)
     }
+    this.listedOnce = true
     return processes
   }
 
-  hasPty(id: string): boolean {
-    return this.livePtyIds.has(id)
+  hasPty(id: string): boolean | null {
+    // Why null before a completed listing: a reconnect builds a new provider with an
+    // empty set, so a miss there is ignorance about the host, not a dead PTY.
+    return this.livePtyIds.has(id) ? true : this.listedOnce ? false : null
   }
 
   async getDefaultShell(): Promise<string> {
diff --git a/src/main/providers/ssh-pty-session-reattach.ts b/src/main/providers/ssh-pty-session-reattach.ts
index 34974940caf..ff490464853 100644
--- a/src/main/providers/ssh-pty-session-reattach.ts
+++ b/src/main/providers/ssh-pty-session-reattach.ts
@@ -1,11 +1,16 @@
 import type { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
-import { isPtyIncarnationId, type PtyIncarnationId } from '../../shared/pty-incarnation'
+import {
+  isPtyIncarnationId,
+  isRelayAttestedPtyIncarnationId,
+  type PtyIncarnationId
+} from '../../shared/pty-incarnation'
 import {
   SSH_PTY_IDENTITY_MISMATCH_ERROR,
   SSH_SESSION_EXPIRED_ERROR,
-  isSshPtyIdentityMismatchError,
-  isSshPtyNotFoundError
+  isSshPtyExitedError,
+  isSshPtyIdentityMismatchError
 } from './ssh-pty-errors'
+import { parseMatchingPtyExitedError } from '../../shared/ssh-pty-failure-tokens'
 import { toAppSshPtyId, toRelaySshPtyId } from './ssh-pty-id'
 import type { PtySpawnOptions, PtySpawnResult } from './types'
 import type { SshPtySpawnExitRaceTracker } from './ssh-pty-spawn-exit-race'
@@ -27,6 +32,29 @@ export type SshPtyAttachResult = {
   sourceActivationLease?: SshPtyReceivingActivationLease
 }
 
+export function buildSshPtyReconnectAttachParams(args: {
+  id: string
+  sourceRecovery?: PtySourceRecoveryRequest
+  expectedIncarnationId?: string
+  legacyExpectedIdentity?: { paneKey?: string; tabId?: string }
+}): Record<string, unknown> {
+  return {
+    id: args.id,
+    suppressReplayNotification: true,
+    exitProofSupported: true,
+    ...(isRelayAttestedPtyIncarnationId(args.expectedIncarnationId)
+      ? { expectedIncarnationId: args.expectedIncarnationId }
+      : {}),
+    ...(args.legacyExpectedIdentity?.paneKey
+      ? { expectedPaneKey: args.legacyExpectedIdentity.paneKey }
+      : {}),
+    ...(args.legacyExpectedIdentity?.tabId
+      ? { expectedTabId: args.legacyExpectedIdentity.tabId }
+      : {}),
+    ...(args.sourceRecovery ? { sourceRecovery: args.sourceRecovery } : {})
+  }
+}
+
 type SshPtyReattachResult = PtySpawnResult & {
   sourceRecovery?: PtySourceRecoveryResult
   sourceActivationLease?: SshPtyReceivingActivationLease
@@ -85,6 +113,18 @@ export async function requestSshPtyAttach(args: {
   rememberPtyIncarnation?: (relayPtyId: string, incarnationId: unknown) => void
 }): Promise<SshPtyAttachResult> {
   let activationLease: SshPtyReceivingActivationLease | undefined
+  const parseResult = (value: unknown): SshPtyAttachResult => {
+    const result = parseSshPtyAttachResult(value)
+    const expectedIncarnationId = args.params.expectedIncarnationId
+    // Old relays ignore the request fence, so their response must prove the same shell.
+    if (
+      isRelayAttestedPtyIncarnationId(expectedIncarnationId) &&
+      result.incarnationId !== expectedIncarnationId
+    ) {
+      throw new Error(`${SSH_PTY_IDENTITY_MISMATCH_ERROR}: ${args.relayPtyId}`)
+    }
+    return result
+  }
   const installFromResult = (result: SshPtyAttachResult): void => {
     if (!activationLease && result.sourceActivation && args.installSourceActivation) {
       activationLease = args.installSourceActivation(args.relayPtyId, result.sourceActivation)
@@ -93,9 +133,9 @@ export async function requestSshPtyAttach(args: {
   try {
     const rawResult = await args.mux.request('pty.attach', args.params, {
       ...(args.timeoutMs === undefined ? {} : { timeoutMs: args.timeoutMs }),
-      beforeResolve: (value) => installFromResult(parseSshPtyAttachResult(value))
+      beforeResolve: (value) => installFromResult(parseResult(value))
     })
-    const result = parseSshPtyAttachResult(rawResult)
+    const result = parseResult(rawResult)
     installFromResult(result)
     args.rememberPtyIncarnation?.(args.relayPtyId, result.incarnationId)
     if (args.commitSourceActivation) {
@@ -185,7 +225,6 @@ export async function reattachSshPtySession(args: {
   const relaySessionId = toRelaySshPtyId(args.connectionId, args.sessionId)
   console.warn(`[ssh-pty] spawn() called with sessionId=${args.sessionId}, attempting pty.attach`)
   try {
-    // Why: expected pane identity prevents a reused relay id from attaching the wrong shell.
     const expectedPaneKey = args.options.paneKey ?? args.options.env?.ORCA_PANE_KEY
     const expectedTabId = args.options.tabId ?? args.options.env?.ORCA_TAB_ID
     const attachResult = await requestSshPtyAttach({
@@ -196,6 +235,17 @@ export async function reattachSshPtySession(args: {
         cols: args.options.cols,
         rows: args.options.rows,
         suppressReplayNotification: true,
+        // Declares that this client can act on a proven exit. Without it a host must keep answering
+        // in the older wording, because an older client reads anything else as an unknown failure
+        // and leaves the pane with no shell and no way back.
+        exitProofSupported: true,
+        // The shell's own identity, so it survives a pane moving between tabs — unlike the pane
+        // identity this replaced. Sent only when the host attested it: a locally synthesized
+        // stand-in is not stable across reconnects and would refuse the pane its own shell. An
+        // older relay ignores the field, so the legacy pane fence below remains its fallback.
+        ...(isRelayAttestedPtyIncarnationId(args.options.expectedIncarnationId)
+          ? { expectedIncarnationId: args.options.expectedIncarnationId }
+          : {}),
         ...(expectedPaneKey ? { expectedPaneKey } : {}),
         ...(expectedTabId ? { expectedTabId } : {})
       },
@@ -219,12 +269,34 @@ export async function reattachSshPtySession(args: {
   } catch (error) {
     // Why: an expired relay lease must be surfaced distinctly so the renderer clears its binding.
     console.warn(`[ssh-pty] pty.attach FAILED for ${args.sessionId}:`, error)
-    if (isSshPtyNotFoundError(error)) {
-      const mismatchMarker = isSshPtyIdentityMismatchError(error)
-        ? ` ${SSH_PTY_IDENTITY_MISMATCH_ERROR}`
-        : ''
-      throw new Error(`${SSH_SESSION_EXPIRED_ERROR}: ${relaySessionId}${mismatchMarker}`)
+    // Why: the relay reports a mismatch by saying "not found", but it found the
+    // pty — comparing identity is how it knows. Publishing expiry there makes
+    // the renderer respawn and resume the agent a second time onto a live shell.
+    if (isSshPtyIdentityMismatchError(error)) {
+      throw new Error(`${SSH_PTY_IDENTITY_MISMATCH_ERROR}: ${relaySessionId}`)
     }
+    // The relay WATCHED this shell exit, which is the only answer that proves it is gone, so this
+    // is the one route that may authorize a replacement. The proof still has to be about OUR shell:
+    // the host applies that rule too, but the host is the party whose answer is in question and
+    // versions differ, so a proof we cannot tie to the incarnation we asked about is not proof and
+    // falls through to the disconnected pane instead of replacing a shell that may be running.
+    if (isSshPtyExitedError(error)) {
+      const proof = parseMatchingPtyExitedError(
+        error instanceof Error ? error.message : String(error),
+        relaySessionId,
+        args.options.expectedIncarnationId
+      )
+      if (proof) {
+        throw new Error(`${SSH_SESSION_EXPIRED_ERROR}: ${relaySessionId}`)
+      }
+      throw error
+    }
+    // A bare not-found deliberately does NOT become expiry any more. It means the relay we asked
+    // cannot hand the id back, which is proof of an exit only if that relay is the one that minted
+    // it — and a replaced relay answers exactly this for shells still running under its
+    // predecessor. Treating it as death cleared ownership and resumed the agent a second time onto
+    // a live shell. Unproven now falls through to the caller, which shows the pane as
+    // disconnected and lets the user decide.
     throw error
   }
 }
diff --git a/src/main/providers/windows-foreground-process-rows.ts b/src/main/providers/windows-foreground-process-rows.ts
index 7e4cdd2e48d..d5e8f8185cd 100644
--- a/src/main/providers/windows-foreground-process-rows.ts
+++ b/src/main/providers/windows-foreground-process-rows.ts
@@ -112,7 +112,7 @@ function parseWindowsProcessValueRows(stdout: string): WindowsProcessRow[] {
       continue
     }
     const eq = line.indexOf('=')
-    if (eq < 0) {
+    if (eq === -1) {
       continue
     }
     const key = line.slice(0, eq)
diff --git a/src/main/providers/windows-shell-args.test.ts b/src/main/providers/windows-shell-args.test.ts
index c3bead6c5b2..534bfc90085 100644
--- a/src/main/providers/windows-shell-args.test.ts
+++ b/src/main/providers/windows-shell-args.test.ts
@@ -280,16 +280,17 @@ describe('resolveWindowsShellLaunchArgs', () => {
     expect(existsSync(join(userDataPath, 'shell-ready', 'bash', 'rcfile'))).toBe(true)
     expect(existsSync(join(userDataPath, 'shell-ready', 'zsh', '.zshenv'))).toBe(true)
 
-    // Why: typed agents need the host-managed status extension in WSL.
+    // Why: typed OMP keeps its existing shell integration, while typed Prime
+    // commands must reach the user's binary without Orca rewriting argv.
     const bashRcfile = readFileSync(join(userDataPath, 'shell-ready', 'bash', 'rcfile'), 'utf8')
     const zshLogin = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zlogin'), 'utf8')
     for (const wrapperFile of [bashRcfile, zshLogin]) {
       expect(wrapperFile).toContain('command omp --extension "${ORCA_OMP_STATUS_EXTENSION}" "$@"')
       expect(wrapperFile).toContain('omp() { __orca_omp "$@"; }')
-      expect(wrapperFile).toContain(
-        'command prime-agent --extension "${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"'
-      )
-      expect(wrapperFile).toContain('prime-agent() { __orca_prime_agent "$@"; }')
+      expect(wrapperFile).not.toContain('prime-agent()')
+      expect(wrapperFile).not.toContain('__orca_prime_agent')
+      expect(wrapperFile).not.toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION')
+      expect(wrapperFile).not.toContain('command prime-agent --extension')
     }
   })
 
diff --git a/src/main/pty/legacy-terminal-posix-tombstone.ts b/src/main/pty/legacy-terminal-posix-tombstone.ts
new file mode 100644
index 00000000000..4520b9e4708
--- /dev/null
+++ b/src/main/pty/legacy-terminal-posix-tombstone.ts
@@ -0,0 +1,69 @@
+const SHELL_DOLLAR = '$'
+
+const POSIX_TOMBSTONE = String.raw`#!/usr/bin/env bash
+set -u
+
+command_name="__ORCA_COMMAND__"
+wrapper_dir="$(cd -- "$(dirname -- "${SHELL_DOLLAR}{BASH_SOURCE[0]}")" && pwd)"
+legacy_wrapper_dir="${SHELL_DOLLAR}{ORCA_ATTRIBUTION_SHIM_DIR:-}"
+cleaned_path="${SHELL_DOLLAR}{PATH:-}"
+
+filter_path() {
+  local legacy_target="$legacy_wrapper_dir"
+  while [[ "$legacy_target" != "/" && "$legacy_target" == */ ]]; do
+    legacy_target="${SHELL_DOLLAR}{legacy_target%/}"
+  done
+  local remaining="$cleaned_path"
+  local filtered_path=""
+  local separator=""
+  path_entry_kept=0
+  local entry normalized candidate has_more
+  while true; do
+    if [[ "$remaining" == *:* ]]; then
+      entry="${SHELL_DOLLAR}{remaining%%:*}"
+      remaining="${SHELL_DOLLAR}{remaining#*:}"
+      has_more=1
+    else
+      entry="$remaining"
+      has_more=0
+    fi
+    normalized="$entry"
+    while [[ "$normalized" != "/" && "$normalized" == */ ]]; do
+      normalized="${SHELL_DOLLAR}{normalized%/}"
+    done
+    candidate="${SHELL_DOLLAR}{entry:-.}"
+    if [[ -n "$legacy_target" && "$normalized" == "$legacy_target" ]]; then
+      :
+    elif [[ "$candidate" -ef "$wrapper_dir" ]]; then
+      :
+    else
+      filtered_path+="$separator$entry"
+      separator=":"
+      path_entry_kept=1
+    fi
+    [[ "$has_more" == 1 ]] || break
+  done
+  cleaned_path="$filtered_path"
+}
+
+filter_path
+unset ORCA_ENABLE_GIT_ATTRIBUTION ORCA_GIT_COMMIT_TRAILER ORCA_GH_PR_FOOTER
+unset ORCA_GH_ISSUE_FOOTER ORCA_ATTRIBUTION_SHIM_DIR ORCA_REAL_GIT ORCA_REAL_GH ORCA_ATTRIBUTION_BYPASS
+
+real_command=""
+if [[ "$path_entry_kept" == 1 ]]; then
+  real_command="$(PATH="$cleaned_path" type -P "$command_name" || true)"
+fi
+if [[ -n "$real_command" && "$real_command" -ef "${SHELL_DOLLAR}{BASH_SOURCE[0]}" ]]; then
+  real_command=""
+fi
+if [[ -z "$real_command" ]]; then
+  printf 'Orca compatibility wrapper could not locate %s on PATH.\n' "$command_name" >&2
+  exit 127
+fi
+PATH="$cleaned_path" exec "$real_command" "$@"
+`
+
+export function renderLegacyTerminalPosixTombstone(command: 'git' | 'gh'): string {
+  return POSIX_TOMBSTONE.replaceAll('__ORCA_COMMAND__', command)
+}
diff --git a/src/main/pty/legacy-terminal-shim-dir.test.ts b/src/main/pty/legacy-terminal-shim-dir.test.ts
new file mode 100644
index 00000000000..32e59800266
--- /dev/null
+++ b/src/main/pty/legacy-terminal-shim-dir.test.ts
@@ -0,0 +1,343 @@
+import { spawn } from 'node:child_process'
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  __resetLegacyTerminalShimNeutralizationForTests,
+  neutralizeLegacyTerminalShimDir,
+  stripLegacyTerminalShimEnv
+} from './legacy-terminal-shim-dir'
+
+const itOnPosix = process.platform === 'win32' ? it.skip : it
+// Why: the failure case uses directory permissions, which Windows ignores and root bypasses.
+const itOnPosixNonRoot = process.platform === 'win32' || process.getuid?.() === 0 ? it.skip : it
+
+describe('legacy terminal shim neutralization', () => {
+  const tempRoots: string[] = []
+
+  const makeUserDataDir = (): string => {
+    const userData = mkdtempSync(join(tmpdir(), 'orca-legacy-shim-'))
+    tempRoots.push(userData)
+    return userData
+  }
+
+  beforeEach(() => {
+    __resetLegacyTerminalShimNeutralizationForTests()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    for (const tempRoot of tempRoots.splice(0)) {
+      rmSync(tempRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('atomically replaces the legacy command paths with executable tombstones', () => {
+    const userData = makeUserDataDir()
+    const legacyRoot = join(userData, 'orca-terminal-attribution')
+    const posixDir = join(legacyRoot, 'posix')
+    const win32Dir = join(legacyRoot, 'win32')
+    mkdirSync(posixDir, { recursive: true })
+    mkdirSync(win32Dir, { recursive: true })
+    writeFileSync(join(posixDir, 'git'), 'legacy attribution wrapper')
+    writeFileSync(join(win32Dir, 'gh.cmd'), 'legacy attribution wrapper')
+
+    neutralizeLegacyTerminalShimDir(userData)
+
+    for (const path of [
+      join(posixDir, 'git'),
+      join(posixDir, 'gh'),
+      join(win32Dir, 'git.cmd'),
+      join(win32Dir, 'gh.cmd')
+    ]) {
+      expect(existsSync(path)).toBe(true)
+      expect(readFileSync(path, 'utf8')).not.toContain('Co-authored-by: Orca')
+      if (process.platform !== 'win32') {
+        expect(statSync(path).mode & 0o111).not.toBe(0)
+      }
+    }
+    expect(readFileSync(join(legacyRoot, 'VERSION'), 'utf8')).toBe('7\n')
+  })
+
+  it('rejects stale Windows real-command paths inside the wrapper directory', () => {
+    const userData = makeUserDataDir()
+    const win32Dir = join(userData, 'orca-terminal-attribution', 'win32')
+
+    neutralizeLegacyTerminalShimDir(userData)
+
+    const cmd = readFileSync(join(win32Dir, 'git.cmd'), 'utf8')
+    expect(cmd).toContain(
+      'if defined orca_real for %%G in ("%orca_real%") do if /I "%%~dpG"=="%~dp0" set "orca_real="'
+    )
+    const powershell = readFileSync(join(win32Dir, 'git-wrapper.ps1'), 'utf8')
+    expect(powershell).toContain('[StringComparison]::OrdinalIgnoreCase')
+    expect(powershell).toContain('$realCommand = $null')
+    expect(powershell.indexOf('[StringComparison]::OrdinalIgnoreCase')).toBeLessThan(
+      powershell.indexOf('Test-Path -LiteralPath $realCommand')
+    )
+  })
+
+  it('removes every Windows PATH occurrence of both captured wrapper directories', () => {
+    const userData = makeUserDataDir()
+    const win32Dir = join(userData, 'orca-terminal-attribution', 'win32')
+
+    neutralizeLegacyTerminalShimDir(userData)
+
+    const cmd = readFileSync(join(win32Dir, 'git.cmd'), 'utf8')
+    const cmdCapture = 'set "orca_legacy_wrapper_dir=%ORCA_ATTRIBUTION_SHIM_DIR%"'
+    expect(cmd.indexOf(cmdCapture)).toBeLessThan(cmd.indexOf('set "ORCA_ATTRIBUTION_SHIM_DIR="'))
+    expect(cmd).toContain('for %%P in ("%PATH:;=" "%") do call :orca_append_path "%%~P"')
+    expect(cmd).toContain('if /I "%orca_path_entry_dir%"=="%orca_wrapper_dir%" exit /b')
+    expect(cmd).toContain(
+      'if defined orca_legacy_wrapper_dir for %%G in ("%orca_legacy_wrapper_dir%") do if /I "%orca_path_entry_dir%"=="%%~fG\\" exit /b'
+    )
+
+    const powershell = readFileSync(join(win32Dir, 'git-wrapper.ps1'), 'utf8')
+    expect(powershell.indexOf('$legacyWrapperDir = $env:ORCA_ATTRIBUTION_SHIM_DIR')).toBeLessThan(
+      powershell.indexOf('Remove-Item "Env:$_"')
+    )
+    expect(powershell).toContain('$wrapperDirs = @($wrapperDir, $legacyWrapperDir)')
+    expect(powershell).toContain("$env:PATH = (($env:PATH -split ';') | Where-Object {")
+    expect(powershell).toContain('[StringComparison]::OrdinalIgnoreCase')
+  })
+
+  it('does not throw when the legacy directory is absent', () => {
+    const userData = makeUserDataDir()
+
+    expect(() => neutralizeLegacyTerminalShimDir(userData)).not.toThrow()
+    expect(existsSync(join(userData, 'orca-terminal-attribution', 'posix', 'git'))).toBe(true)
+  })
+
+  itOnPosixNonRoot('retries a startup failure in-process and latches after success', async () => {
+    vi.useFakeTimers()
+    const userData = makeUserDataDir()
+    const posixDir = join(userData, 'orca-terminal-attribution', 'posix')
+    const gitWrapper = join(posixDir, 'git')
+    mkdirSync(posixDir, { recursive: true })
+    writeFileSync(gitWrapper, 'legacy attribution wrapper')
+    chmodSync(posixDir, 0o500)
+    try {
+      neutralizeLegacyTerminalShimDir(userData)
+      expect(readFileSync(gitWrapper, 'utf8')).toBe('legacy attribution wrapper')
+    } finally {
+      chmodSync(posixDir, 0o700)
+    }
+
+    try {
+      await vi.advanceTimersByTimeAsync(1_000)
+      expect(readFileSync(gitWrapper, 'utf8')).not.toContain('legacy attribution wrapper')
+
+      writeFileSync(gitWrapper, 'recreated after success')
+      neutralizeLegacyTerminalShimDir(userData)
+      expect(readFileSync(gitWrapper, 'utf8')).toBe('recreated after success')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  itOnPosix('keeps a real Bash command hash working with trailing PATH separators', async () => {
+    const userData = makeUserDataDir()
+    const shimDir = join(userData, 'orca-terminal-attribution', 'posix')
+    const shimGit = join(shimDir, 'git')
+    const realBin = join(userData, 'real-bin')
+    const realGit = join(realBin, 'git')
+    mkdirSync(shimDir, { recursive: true })
+    mkdirSync(realBin, { recursive: true })
+    writeFileSync(shimGit, '#!/usr/bin/env bash\nexit 99\n', { mode: 0o755 })
+    writeFileSync(
+      realGit,
+      "#!/usr/bin/env bash\nprintf 'arg=<%s>\\n' \"$@\"\ncat\nprintf 'fixture stderr\\n' >&2\nexit 23\n",
+      { mode: 0o755 }
+    )
+    const child = spawn('bash', ['--noprofile', '--norc'], {
+      cwd: shimDir,
+      env: {
+        ...process.env,
+        PATH: `${shimDir}//::${realBin}:${process.env.PATH ?? ''}`,
+        ORCA_ENABLE_GIT_ATTRIBUTION: '1',
+        ORCA_GIT_COMMIT_TRAILER: 'Co-authored-by: Orca <help@stably.ai>',
+        ORCA_ATTRIBUTION_SHIM_DIR: ''
+      },
+      stdio: ['pipe', 'pipe', 'pipe']
+    })
+    let stdout = ''
+    let stderr = ''
+    child.stdout.setEncoding('utf8')
+    child.stderr.setEncoding('utf8')
+    child.stdout.on('data', (chunk: string) => {
+      stdout += chunk
+    })
+    child.stderr.on('data', (chunk: string) => {
+      stderr += chunk
+    })
+    const ready = waitForOutput(child.stdout, '__ORCA_HASH_READY__\n')
+    child.stdin.write(`hash -p ${quoteBash(shimGit)} git\nprintf '__ORCA_HASH_READY__\\n'\n`)
+
+    try {
+      await ready
+    } catch (error) {
+      child.kill('SIGKILL')
+      throw error
+    }
+    neutralizeLegacyTerminalShimDir(userData)
+    const closed = waitForChildClose(child, 2_000)
+    child.stdin.end("printf 'stdin payload\\n' | git commit -m 'subject with spaces'; exit $?\n")
+
+    try {
+      expect(await closed).toBe(23)
+    } finally {
+      child.kill('SIGKILL')
+    }
+    expect(stdout).toContain('arg=<commit>\narg=<-m>\narg=<subject with spaces>\nstdin payload\n')
+    expect(stdout).not.toContain('Co-authored-by: Orca')
+    expect(stderr).toBe('fixture stderr\n')
+  })
+
+  it('drops inherited shim env and its PATH entry without touching real entries', () => {
+    const env: Record<string, string> = {
+      PATH: `/home/u/.orca/orca-terminal-attribution/posix:/usr/local/bin:/usr/bin`,
+      ORCA_ENABLE_GIT_ATTRIBUTION: '1',
+      ORCA_GIT_COMMIT_TRAILER: 'Co-authored-by: Orca <help@stably.ai>',
+      ORCA_GH_PR_FOOTER: 'footer',
+      ORCA_GH_ISSUE_FOOTER: 'footer',
+      ORCA_ATTRIBUTION_SHIM_DIR: '/home/u/.orca/orca-terminal-attribution/posix',
+      ORCA_REAL_GIT: '/usr/bin/git',
+      ORCA_REAL_GH: '/usr/bin/gh',
+      HOME: '/home/u'
+    }
+
+    stripLegacyTerminalShimEnv(env, 'linux')
+
+    expect(env).toEqual({ PATH: '/usr/local/bin:/usr/bin', HOME: '/home/u' })
+  })
+
+  it('uses the captured POSIX shim directory literally when it contains a colon', () => {
+    const shimDir = '/tmp/orca:user/orca-terminal-attribution/posix'
+    const env: Record<string, string> = {
+      PATH: `/usr/local/bin:${shimDir}:/usr/bin`,
+      ORCA_ATTRIBUTION_SHIM_DIR: shimDir
+    }
+
+    stripLegacyTerminalShimEnv(env, 'linux')
+
+    expect(env).toEqual({ PATH: '/usr/local/bin:/usr/bin' })
+  })
+
+  it('treats legacy Windows environment keys case-insensitively', () => {
+    const shimDir = 'C:\\Users\\orca;user\\orca-terminal-attribution\\win32'
+    const env: Record<string, string> = {
+      Path: `${shimDir};C:\\Windows\\System32`,
+      orca_attribution_shim_dir: shimDir,
+      Orca_Enable_Git_Attribution: '1',
+      orca_real_git: 'C:\\Git\\git.exe'
+    }
+
+    stripLegacyTerminalShimEnv(env, 'win32')
+
+    expect(env).toEqual({ Path: 'C:\\Windows\\System32' })
+  })
+
+  it('strips legacy entries from every Windows PATH spelling', () => {
+    const env: Record<string, string> = {
+      PATH: 'C:\\Orca\\orca-terminal-attribution\\win32',
+      Path: 'C:\\Orca\\orca-terminal-attribution\\win32;C:\\Windows\\System32'
+    }
+
+    stripLegacyTerminalShimEnv(env, 'win32')
+
+    expect(env.PATH).toBeUndefined()
+    expect(env.Path).toBe('C:\\Windows\\System32')
+  })
+
+  it('matches a re-cased Windows shim path', () => {
+    const env: Record<string, string> = {
+      Path: 'C:\\Orca\\Orca-Terminal-Attribution\\Win32;C:\\Windows\\System32'
+    }
+
+    stripLegacyTerminalShimEnv(env, 'win32')
+
+    expect(env.Path).toBe('C:\\Windows\\System32')
+  })
+
+  it('preserves explicit empty PATH values', () => {
+    const windowsEnv: Record<string, string> = { PATH: '', Path: 'C:\\Windows' }
+    const posixEnv: Record<string, string> = { PATH: '' }
+
+    stripLegacyTerminalShimEnv(windowsEnv, 'win32')
+    stripLegacyTerminalShimEnv(posixEnv, 'linux')
+
+    expect(windowsEnv).toEqual({ PATH: '', Path: 'C:\\Windows' })
+    expect(posixEnv).toEqual({ PATH: '' })
+  })
+
+  it('keeps neighbouring directories that merely share the name prefix', () => {
+    const env: Record<string, string> = {
+      PATH: '/opt/orca-terminal-attribution:/opt/orca-terminal-attribution/custom-tools:/home/u/orca-terminal-attribution-notes/bin:/usr/bin'
+    }
+
+    stripLegacyTerminalShimEnv(env, 'linux')
+
+    expect(env.PATH).toBe(
+      '/opt/orca-terminal-attribution:/opt/orca-terminal-attribution/custom-tools:/home/u/orca-terminal-attribution-notes/bin:/usr/bin'
+    )
+  })
+
+  it('leaves an unrelated PATH untouched', () => {
+    const env: Record<string, string> = { PATH: '/usr/local/bin:/usr/bin' }
+    stripLegacyTerminalShimEnv(env, 'linux')
+    expect(env.PATH).toBe('/usr/local/bin:/usr/bin')
+  })
+})
+
+function quoteBash(value: string): string {
+  return `'${value.replaceAll("'", `'\\''`)}'`
+}
+
+function waitForOutput(stream: NodeJS.ReadableStream, marker: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    let output = ''
+    const onData = (chunk: string | Buffer): void => {
+      output += chunk.toString()
+      if (output.includes(marker)) {
+        cleanup()
+        resolve()
+      }
+    }
+    const onEnd = (): void => {
+      cleanup()
+      reject(new Error(`Bash exited before emitting ${marker}`))
+    }
+    const cleanup = (): void => {
+      stream.off('data', onData)
+      stream.off('end', onEnd)
+    }
+    stream.on('data', onData)
+    stream.on('end', onEnd)
+  })
+}
+
+function waitForChildClose(
+  child: ReturnType<typeof spawn>,
+  timeoutMs: number
+): Promise<number | null> {
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      child.kill('SIGKILL')
+      reject(new Error(`Bash did not exit within ${timeoutMs}ms`))
+    }, timeoutMs)
+    child.once('close', (exitCode) => {
+      clearTimeout(timeout)
+      resolve(exitCode)
+    })
+  })
+}
diff --git a/src/main/pty/legacy-terminal-shim-dir.ts b/src/main/pty/legacy-terminal-shim-dir.ts
new file mode 100644
index 00000000000..0d64ebaed05
--- /dev/null
+++ b/src/main/pty/legacy-terminal-shim-dir.ts
@@ -0,0 +1,269 @@
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import {
+  LEGACY_TERMINAL_ATTRIBUTION_BYPASS_ENV_KEY,
+  LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY
+} from '../../shared/legacy-terminal-attribution-env'
+import { renderLegacyTerminalPosixTombstone } from './legacy-terminal-posix-tombstone'
+
+const LEGACY_SHIM_ROOT_DIR = 'orca-terminal-attribution'
+const LEGACY_SHIM_VERSION = '7'
+const NEUTRALIZATION_RETRY_DELAYS_MS = [1_000, 5_000, 15_000, 30_000]
+export const LEGACY_TERMINAL_SHIM_ENV_KEYS = [
+  'ORCA_ENABLE_GIT_ATTRIBUTION',
+  'ORCA_GIT_COMMIT_TRAILER',
+  'ORCA_GH_PR_FOOTER',
+  'ORCA_GH_ISSUE_FOOTER',
+  'ORCA_ATTRIBUTION_SHIM_DIR',
+  'ORCA_REAL_GIT',
+  'ORCA_REAL_GH',
+  LEGACY_TERMINAL_ATTRIBUTION_BYPASS_ENV_KEY
+] as const
+export const LEGACY_TERMINAL_SHIM_REMOTE_ENV_KEYS = [
+  LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY
+] as const
+
+const WIN32_PASSTHROUGH_WRAPPER = String.raw`@echo off
+setlocal
+set "orca_real=%ORCA_REAL___ORCA_UPPER_COMMAND__%"
+set "orca_wrapper_dir=%~dp0"
+set "orca_legacy_wrapper_dir=%ORCA_ATTRIBUTION_SHIM_DIR%"
+set "orca_clean_path="
+for %%P in ("%PATH:;=" "%") do call :orca_append_path "%%~P"
+set "PATH=%orca_clean_path%"
+set "ORCA_ENABLE_GIT_ATTRIBUTION="
+set "ORCA_GIT_COMMIT_TRAILER="
+set "ORCA_GH_PR_FOOTER="
+set "ORCA_GH_ISSUE_FOOTER="
+set "ORCA_ATTRIBUTION_SHIM_DIR="
+set "ORCA_ATTRIBUTION_BYPASS="
+set "ORCA_REAL_GIT="
+set "ORCA_REAL_GH="
+if defined orca_real for %%G in ("%orca_real%") do if /I "%%~dpG"=="%~dp0" set "orca_real="
+if defined orca_real if exist "%orca_real%" goto run
+for /f "delims=" %%G in ('where.exe __ORCA_COMMAND__.exe 2^>nul') do if not defined orca_real set "orca_real=%%G"
+if not defined orca_real (
+  echo Orca compatibility wrapper could not locate __ORCA_COMMAND__ on PATH. 1>&2
+  exit /b 127
+)
+:run
+"%orca_real%" %*
+exit /b %ERRORLEVEL%
+
+:orca_append_path
+for %%G in ("%~1") do set "orca_path_entry_dir=%%~fG\"
+if /I "%orca_path_entry_dir%"=="%orca_wrapper_dir%" exit /b
+if defined orca_legacy_wrapper_dir for %%G in ("%orca_legacy_wrapper_dir%") do if /I "%orca_path_entry_dir%"=="%%~fG\" exit /b
+if defined orca_clean_path (set "orca_clean_path=%orca_clean_path%;%~1") else set "orca_clean_path=%~1"
+exit /b
+`
+
+const POWERSHELL_PASSTHROUGH_WRAPPER = String.raw`$ErrorActionPreference = 'Stop'
+$commandName = '__ORCA_COMMAND__'
+$realCommand = [Environment]::GetEnvironmentVariable('ORCA_REAL___ORCA_UPPER_COMMAND__')
+$wrapperDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$legacyWrapperDir = $env:ORCA_ATTRIBUTION_SHIM_DIR
+$wrapperDirs = @($wrapperDir, $legacyWrapperDir) | Where-Object { $_ } | ForEach-Object { $_.TrimEnd('\') }
+$env:PATH = (($env:PATH -split ';') | Where-Object {
+  $pathEntry = $_
+  $pathEntry -and -not ($wrapperDirs | Where-Object {
+    [string]::Equals($_, $pathEntry.TrimEnd('\'), [StringComparison]::OrdinalIgnoreCase)
+  })
+}) -join ';'
+'ORCA_ENABLE_GIT_ATTRIBUTION', 'ORCA_GIT_COMMIT_TRAILER', 'ORCA_GH_PR_FOOTER', 'ORCA_GH_ISSUE_FOOTER', 'ORCA_ATTRIBUTION_SHIM_DIR', 'ORCA_REAL_GIT', 'ORCA_REAL_GH', 'ORCA_ATTRIBUTION_BYPASS' | ForEach-Object { Remove-Item "Env:$_" -ErrorAction SilentlyContinue }
+if ($realCommand) {
+  try {
+    $capturedDir = Split-Path -Parent ([IO.Path]::GetFullPath($realCommand))
+    if ([string]::Equals($capturedDir.TrimEnd('\'), $wrapperDir.TrimEnd('\'), [StringComparison]::OrdinalIgnoreCase)) {
+      $realCommand = $null
+    }
+  } catch {
+    $realCommand = $null
+  }
+}
+if (-not $realCommand -or -not (Test-Path -LiteralPath $realCommand)) {
+  $resolved = Get-Command "$commandName.exe" -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+  $realCommand = if ($resolved) { $resolved.Source } else { $null }
+}
+if (-not $realCommand) {
+  [Console]::Error.WriteLine("Orca compatibility wrapper could not locate $commandName on PATH.")
+  exit 127
+}
+& $realCommand @args
+exit $LASTEXITCODE
+`
+
+let neutralized = false
+let neutralizationRetryTimer: ReturnType<typeof setTimeout> | null = null
+let neutralizationRetryAttempt = 0
+
+export function neutralizeLegacyTerminalShimDir(userDataPath: string): void {
+  if (neutralized) {
+    return
+  }
+  try {
+    const rootDir = join(userDataPath, LEGACY_SHIM_ROOT_DIR)
+    writeNeutralWrappers(rootDir)
+    writeFileAtomically(join(rootDir, 'VERSION'), `${LEGACY_SHIM_VERSION}\n`, 0o644)
+    neutralized = true
+    clearNeutralizationRetry()
+  } catch {
+    // Why: Windows can keep a running .cmd open briefly after startup.
+    scheduleNeutralizationRetry(userDataPath)
+  }
+}
+
+function scheduleNeutralizationRetry(userDataPath: string): void {
+  if (
+    neutralizationRetryTimer ||
+    neutralizationRetryAttempt >= NEUTRALIZATION_RETRY_DELAYS_MS.length
+  ) {
+    return
+  }
+  const delayMs = NEUTRALIZATION_RETRY_DELAYS_MS[neutralizationRetryAttempt]
+  neutralizationRetryAttempt += 1
+  neutralizationRetryTimer = setTimeout(() => {
+    neutralizationRetryTimer = null
+    neutralizeLegacyTerminalShimDir(userDataPath)
+  }, delayMs)
+  neutralizationRetryTimer.unref?.()
+}
+
+function clearNeutralizationRetry(): void {
+  if (neutralizationRetryTimer) {
+    clearTimeout(neutralizationRetryTimer)
+    neutralizationRetryTimer = null
+  }
+  neutralizationRetryAttempt = 0
+}
+
+function writeNeutralWrappers(rootDir: string): void {
+  const posixDir = join(rootDir, 'posix')
+  const win32Dir = join(rootDir, 'win32')
+  mkdirSync(posixDir, { recursive: true })
+  mkdirSync(win32Dir, { recursive: true })
+  for (const command of ['git', 'gh'] as const) {
+    const upperCommand = command.toUpperCase()
+    writeFileAtomically(join(posixDir, command), renderLegacyTerminalPosixTombstone(command), 0o755)
+    writeFileAtomically(
+      join(win32Dir, `${command}.cmd`),
+      renderWindowsWrapper(WIN32_PASSTHROUGH_WRAPPER, command, upperCommand),
+      0o755
+    )
+    writeFileAtomically(
+      join(win32Dir, `${command}-wrapper.ps1`),
+      renderWindowsWrapper(POWERSHELL_PASSTHROUGH_WRAPPER, command, upperCommand),
+      0o755
+    )
+  }
+}
+
+function renderWindowsWrapper(template: string, command: string, upperCommand: string): string {
+  return template
+    .replaceAll('__ORCA_UPPER_COMMAND__', upperCommand)
+    .replaceAll('__ORCA_COMMAND__', command)
+}
+
+function writeFileAtomically(filePath: string, contents: string, mode: number): void {
+  const temporaryPath = `${filePath}.orca-neutralizing-${process.pid}`
+  try {
+    rmSync(temporaryPath, { force: true, recursive: true })
+    writeFileSync(temporaryPath, contents, { encoding: 'utf8', flag: 'wx', mode })
+    chmodSync(temporaryPath, mode)
+    renameSync(temporaryPath, filePath)
+  } finally {
+    rmSync(temporaryPath, { force: true, recursive: true })
+  }
+}
+
+export function isLegacyTerminalShimPathEntry(entry: string): boolean {
+  const normalized = entry.replaceAll('\\', '/').replace(/\/+$/, '').toLowerCase()
+  return (
+    normalized.endsWith(`/${LEGACY_SHIM_ROOT_DIR}/posix`) ||
+    normalized.endsWith(`/${LEGACY_SHIM_ROOT_DIR}/win32`)
+  )
+}
+
+export function stripLegacyTerminalShimEnv(
+  env: Record<string, string>,
+  platform: NodeJS.Platform = process.platform
+): void {
+  const windows = platform === 'win32'
+  const legacyKeySet = new Set(
+    LEGACY_TERMINAL_SHIM_ENV_KEYS.map((key) => (windows ? key.toLowerCase() : key))
+  )
+  const shimDirKey = 'ORCA_ATTRIBUTION_SHIM_DIR'.toLowerCase()
+  const explicitShimDirs = Object.entries(env)
+    .filter(([key]) =>
+      windows ? key.toLowerCase() === shimDirKey : key === 'ORCA_ATTRIBUTION_SHIM_DIR'
+    )
+    .map(([, value]) => value)
+    .filter(Boolean)
+  for (const key of Object.keys(env)) {
+    if (windows ? legacyKeySet.has(key.toLowerCase()) : legacyKeySet.has(key)) {
+      delete env[key]
+    }
+  }
+  const delimiter = windows ? ';' : ':'
+  const pathKeys = windows
+    ? Object.keys(env).filter((key) => key.toLowerCase() === 'path')
+    : ['PATH']
+  for (const pathKey of pathKeys) {
+    const current = env[pathKey]
+    if (!current) {
+      continue
+    }
+    const withoutExplicitDirs = explicitShimDirs.reduce(
+      (pathValue, shimDir) => removeLiteralPathEntry(pathValue, shimDir, delimiter, windows),
+      current
+    )
+    const cleaned = withoutExplicitDirs
+      .split(delimiter)
+      .filter((entry) => entry && !isLegacyTerminalShimPathEntry(entry))
+      .join(delimiter)
+    if (cleaned) {
+      env[pathKey] = cleaned
+    } else {
+      delete env[pathKey]
+    }
+  }
+}
+
+function removeLiteralPathEntry(
+  pathValue: string,
+  entry: string,
+  delimiter: string,
+  caseInsensitive: boolean
+): string {
+  let result = pathValue
+  const needle = caseInsensitive ? entry.toLowerCase() : entry
+  let searchStart = 0
+  for (;;) {
+    const comparable = caseInsensitive ? result.toLowerCase() : result
+    const index = comparable.indexOf(needle, searchStart)
+    if (index === -1) {
+      return result
+    }
+    const end = index + entry.length
+    const startsAtBoundary = index === 0 || result[index - 1] === delimiter
+    const endsAtBoundary = end === result.length || result[end] === delimiter
+    if (!startsAtBoundary || !endsAtBoundary) {
+      searchStart = index + 1
+      continue
+    }
+    if (result[end] === delimiter) {
+      result = result.slice(0, index) + result.slice(end + 1)
+    } else if (index > 0) {
+      result = result.slice(0, index - 1) + result.slice(end)
+    } else {
+      result = ''
+    }
+    searchStart = Math.max(0, index - 1)
+  }
+}
+
+/** Test-only: the module-level once-guard would otherwise leak across cases. */
+export function __resetLegacyTerminalShimNeutralizationForTests(): void {
+  neutralized = false
+  clearNeutralizationRetry()
+}
diff --git a/src/main/pty/posix-pty-foreground-group.ts b/src/main/pty/posix-pty-foreground-group.ts
index 124978c269d..8b3e375dbff 100644
--- a/src/main/pty/posix-pty-foreground-group.ts
+++ b/src/main/pty/posix-pty-foreground-group.ts
@@ -103,7 +103,7 @@ export function getPosixPtyForegroundGroup(
 export function signalPosixPtyForegroundGroup(
   rootPid: number,
   ptsName: string | undefined,
-  signal: NodeJS.Signals | string,
+  signal: NodeJS.Signals | (string & {}),
   fallback: () => void,
   deps: PosixPtyForegroundGroupDeps = {}
 ): void {
diff --git a/src/main/pty/prime-agent-shell-wrapper.test.ts b/src/main/pty/prime-agent-shell-wrapper.test.ts
deleted file mode 100644
index 1ad1fe774cb..00000000000
--- a/src/main/pty/prime-agent-shell-wrapper.test.ts
+++ /dev/null
@@ -1,244 +0,0 @@
-import { spawnSync } from 'node:child_process'
-import { chmodSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { dirname, join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
-import { getPosixPrimeAgentShellWrapper } from './prime-agent-shell-wrapper'
-
-const describePosix = process.platform === 'win32' ? describe.skip : describe
-const hasBash = process.platform !== 'win32' && spawnSync('bash', ['--version']).status === 0
-const itWithBash = hasBash ? it : it.skip
-const tempDirs: string[] = []
-
-function makeFixture(): {
-  root: string
-  extensionPath: string
-  capturePath: string
-  endpointPath: string
-  primeHome: string
-  rcfile: string
-} {
-  const root = mkdtempSync(join(tmpdir(), 'orca-prime-wrapper-'))
-  tempDirs.push(root)
-  const binDir = join(root, 'bin')
-  const primeHome = join(root, 'guest-prime-home')
-  const extensionPath = join(root, 'orca-agent-status.ts')
-  const capturePath = join(root, 'capture')
-  const endpointPath = join(
-    root,
-    '.orca-wsl',
-    'agent-hooks',
-    'instance-testinstance',
-    'endpoint.env'
-  )
-  const rcfile = join(root, 'rcfile')
-  mkdirSync(binDir)
-  mkdirSync(primeHome)
-  mkdirSync(dirname(endpointPath), { recursive: true })
-  writeFileSync(extensionPath, 'export default {}')
-  writeFileSync(endpointPath, 'ORCA_AGENT_HOOK_PORT=4567\nORCA_AGENT_HOOK_TOKEN=current-token\n')
-  writeFileSync(rcfile, getPosixPrimeAgentShellWrapper())
-  writeFileSync(
-    join(binDir, 'prime-agent'),
-    `#!/bin/sh
-{
-  printf 'HOME=%s\n' "$PRIME_AGENT_CODING_AGENT_DIR"
-  printf 'ENDPOINT=%s\n' "$ORCA_AGENT_HOOK_ENDPOINT"
-  i=0
-  for arg in "$@"; do
-    i=$((i + 1))
-    printf 'ARG%s=%s\n' "$i" "$arg"
-  done
-} > "$ORCA_CAPTURE_FILE"
-if [ "\${1:-}" = "config" ]; then
-  printf 'preserved\n' > "$PRIME_AGENT_CODING_AGENT_DIR/config.yml"
-fi
-`,
-    { mode: 0o755 }
-  )
-  chmodSync(join(binDir, 'prime-agent'), 0o755)
-  return { root, extensionPath, capturePath, endpointPath, primeHome, rcfile }
-}
-
-function runPrime(
-  fixture: ReturnType<typeof makeFixture>,
-  command: string,
-  extensionPath = fixture.extensionPath
-): string {
-  const result = spawnSync('bash', ['--noprofile', '--rcfile', fixture.rcfile, '-ic', command], {
-    cwd: fixture.root,
-    env: {
-      ...process.env,
-      HOME: fixture.root,
-      PATH: `${join(fixture.root, 'bin')}:${process.env.PATH ?? ''}`,
-      PRIME_AGENT_CODING_AGENT_DIR: fixture.primeHome,
-      ORCA_PRIME_AGENT_STATUS_EXTENSION: extensionPath,
-      ORCA_WSL_HOOK_INSTANCE: 'testinstance',
-      ORCA_AGENT_HOOK_ENDPOINT: '/mnt/c/current/endpoint.cmd',
-      ORCA_AGENT_HOOK_PORT: '4567',
-      ORCA_AGENT_HOOK_TOKEN: 'current-token',
-      ORCA_CAPTURE_FILE: fixture.capturePath
-    },
-    encoding: 'utf8'
-  })
-  expect(result.status, result.stderr).toBe(0)
-  return readFileSync(fixture.capturePath, 'utf8')
-}
-
-describePosix('Prime Agent shell wrapper', () => {
-  afterEach(() => {
-    for (const dir of tempDirs.splice(0)) {
-      rmSync(dir, { recursive: true, force: true })
-    }
-  })
-
-  itWithBash('injects the managed extension into an interactive launch', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent ask')
-
-    expect(capture).toContain(`HOME=${fixture.primeHome}`)
-    expect(capture).toContain(`ENDPOINT=${fixture.endpointPath}`)
-    expect(capture).toContain('ARG1=--extension')
-    expect(capture).toContain(`ARG2=${fixture.extensionPath}`)
-    expect(capture).toContain('ARG3=ask')
-  })
-
-  itWithBash('preserves config subcommands and the guest Prime home', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent config')
-
-    expect(capture).toContain(`HOME=${fixture.primeHome}`)
-    expect(capture).toContain('ARG1=config')
-    expect(capture).not.toContain('ARG1=--extension')
-    expect(readFileSync(join(fixture.primeHome, 'config.yml'), 'utf8')).toBe('preserved\n')
-  })
-
-  itWithBash.each([
-    'agents',
-    'doctor',
-    'help',
-    'list',
-    'model',
-    'package',
-    'rename',
-    'schedule',
-    'send',
-    'session',
-    'shutdown',
-    'status',
-    'stop',
-    'update'
-  ])('preserves the %s subcommand argv', (subcommand) => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, `prime-agent ${subcommand}`)
-
-    expect(capture).toContain(`ARG1=${subcommand}`)
-    expect(capture).not.toContain('ARG1=--extension')
-  })
-
-  itWithBash.each(['stop', 'rename'])(
-    'preserves --daemon-socket before the %s management command',
-    (subcommand) => {
-      const fixture = makeFixture()
-      const capture = runPrime(
-        fixture,
-        `prime-agent --daemon-socket /tmp/prime.sock ${subcommand} agent-123`
-      )
-
-      expect(capture).toContain('ARG1=--daemon-socket')
-      expect(capture).toContain('ARG2=/tmp/prime.sock')
-      expect(capture).toContain(`ARG3=${subcommand}`)
-      expect(capture).not.toContain(fixture.extensionPath)
-    }
-  )
-
-  itWithBash('injects the extension after the attach agent operand', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent attach agent-123 --follow')
-
-    expect(capture).toContain('ARG1=attach')
-    expect(capture).toContain('ARG2=agent-123')
-    expect(capture).toContain('ARG3=--extension')
-    expect(capture).toContain(`ARG4=${fixture.extensionPath}`)
-    expect(capture).toContain('ARG5=--follow')
-  })
-
-  itWithBash('preserves attach help without inventing an agent operand', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent attach --help')
-
-    expect(capture).toContain('ARG1=attach')
-    expect(capture).toContain('ARG2=--help')
-    expect(capture).not.toContain(fixture.extensionPath)
-  })
-
-  itWithBash('does not override an explicit user extension', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent --extension /tmp/user-extension.ts ask')
-
-    expect(capture).toContain('ARG1=--extension')
-    expect(capture).toContain('ARG2=/tmp/user-extension.ts')
-    expect(capture).not.toContain(fixture.extensionPath)
-  })
-
-  itWithBash('does not add a second extension to attach', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(
-      fixture,
-      'prime-agent attach agent-123 --extension /tmp/user-extension.ts'
-    )
-
-    expect(capture).toContain('ARG1=attach')
-    expect(capture).toContain('ARG2=agent-123')
-    expect(capture).toContain('ARG3=--extension')
-    expect(capture).toContain('ARG4=/tmp/user-extension.ts')
-    expect(capture).not.toContain(fixture.extensionPath)
-  })
-
-  itWithBash('degrades to the original argv when the managed extension is unavailable', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent ask', join(fixture.root, 'missing.ts'))
-
-    expect(capture).toContain('ARG1=ask')
-    expect(capture).not.toContain('ARG1=--extension')
-  })
-
-  itWithBash('keeps the stable guest endpoint path while its relay refreshes stale data', () => {
-    const fixture = makeFixture()
-    writeFileSync(fixture.endpointPath, 'ORCA_AGENT_HOOK_PORT=4567\nORCA_AGENT_HOOK_TOKEN=stale\n')
-
-    const capture = runPrime(fixture, 'prime-agent ask')
-
-    expect(capture).toContain(`ENDPOINT=${fixture.endpointPath}`)
-    expect(capture).toContain('ARG1=--extension')
-  })
-
-  itWithBash('uses the guest endpoint path when the relay binds a fallback port', () => {
-    const fixture = makeFixture()
-    writeFileSync(
-      fixture.endpointPath,
-      'ORCA_AGENT_HOOK_PORT=9876\nORCA_AGENT_HOOK_TOKEN=current-token\n'
-    )
-
-    const capture = runPrime(fixture, 'prime-agent ask')
-
-    expect(capture).toContain(`ENDPOINT=${fixture.endpointPath}`)
-    expect(capture).toContain('ARG1=--extension')
-  })
-
-  itWithBash('does not define wrapper helpers when the bridge env is absent', () => {
-    const fixture = makeFixture()
-    const result = spawnSync(
-      'bash',
-      ['--noprofile', '--rcfile', fixture.rcfile, '-ic', 'type -t __orca_prime_agent'],
-      {
-        cwd: fixture.root,
-        env: { ...process.env, ORCA_PRIME_AGENT_STATUS_EXTENSION: '' },
-        encoding: 'utf8'
-      }
-    )
-
-    expect(result.status).not.toBe(0)
-    expect(result.stdout.trim()).toBe('')
-  })
-})
diff --git a/src/main/pty/prime-agent-shell-wrapper.ts b/src/main/pty/prime-agent-shell-wrapper.ts
deleted file mode 100644
index 97e723c26f1..00000000000
--- a/src/main/pty/prime-agent-shell-wrapper.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { wslHookRelayEndpointFilePath } from '../../shared/wsl-hook-relay-contract'
-
-const PRIME_AGENT_SUBCOMMANDS = [
-  'agents',
-  'config',
-  'doctor',
-  'help',
-  'list',
-  'model',
-  'package',
-  'rename',
-  'schedule',
-  'send',
-  'session',
-  'shutdown',
-  'status',
-  'stop',
-  'update'
-] as const
-
-export function getPosixPrimeAgentShellWrapper(): string {
-  const subcommands = PRIME_AGENT_SUBCOMMANDS.join('|')
-  const guestEndpointPath = wslHookRelayEndpointFilePath('${HOME%/}', '${ORCA_WSL_HOOK_INSTANCE}')
-  return `# Why: WSL cannot install into Prime's guest-owned config root from the
-# Windows host, so pass Orca's status extension only to interactive launches.
-if [[ -n "\${ORCA_PRIME_AGENT_STATUS_EXTENSION:-}" ]]; then
-  __orca_prime_agent_should_skip_extension() {
-    if [[ "\${1:-}" == "--daemon-socket" && ( "\${3:-}" == "stop" || "\${3:-}" == "rename" ) ]]; then
-      return 0
-    fi
-    if [[ "\${1:-}" == --daemon-socket=* && ( "\${2:-}" == "stop" || "\${2:-}" == "rename" ) ]]; then
-      return 0
-    fi
-    case "\${1:-}" in
-      help|--help|-h|--version|-v|--extension|--extension=*) return 0 ;;
-      ${subcommands}) return 0 ;;
-    esac
-    return 1
-  }
-  __orca_prime_agent_has_explicit_extension() {
-    local __orca_arg
-    for __orca_arg in "$@"; do
-      case "$__orca_arg" in
-        --extension|--extension=*) return 0 ;;
-      esac
-    done
-    return 1
-  }
-  __orca_prime_agent() {
-    if [[ "\${1:-}" == "attach" && ( -z "\${2:-}" || "\${2:-}" == -* ) ]]; then
-      command prime-agent "$@"
-      return
-    fi
-    if ! __orca_prime_agent_should_skip_extension "$@" && ! __orca_prime_agent_has_explicit_extension "$@" && [[ -f "\${ORCA_PRIME_AGENT_STATUS_EXTENSION}" ]]; then
-      local __orca_guest_endpoint="${guestEndpointPath}"
-      if [[ -n "\${HOME:-}" && -n "\${ORCA_WSL_HOOK_INSTANCE:-}" ]]; then
-        local ORCA_AGENT_HOOK_ENDPOINT="$__orca_guest_endpoint"
-        export ORCA_AGENT_HOOK_ENDPOINT
-      fi
-      if [[ "\${1:-}" == "attach" && -n "\${2:-}" && "\${2:-}" != -* ]]; then
-        local __orca_attach_agent="$2"
-        shift 2
-        command prime-agent attach "$__orca_attach_agent" --extension "\${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"
-      else
-        command prime-agent --extension "\${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"
-      fi
-    else
-      command prime-agent "$@"
-    fi
-  }
-  prime-agent() { __orca_prime_agent "$@"; }
-fi
-`
-}
diff --git a/src/main/pty/shell-startup-env.test.ts b/src/main/pty/shell-startup-env.test.ts
index 73aabc3b753..eaf8cffeba4 100644
--- a/src/main/pty/shell-startup-env.test.ts
+++ b/src/main/pty/shell-startup-env.test.ts
@@ -1,28 +1,41 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { existsSyncMock, readFileSyncMock } = vi.hoisted(() => ({
+const { existsSyncMock, readFileSyncMock, readdirSyncMock } = vi.hoisted(() => ({
   existsSyncMock: vi.fn(),
-  readFileSyncMock: vi.fn()
+  readFileSyncMock: vi.fn(),
+  readdirSyncMock: vi.fn()
 }))
 
 vi.mock('fs', () => ({
   existsSync: existsSyncMock,
-  readFileSync: readFileSyncMock
+  readFileSync: readFileSyncMock,
+  readdirSync: readdirSyncMock
 }))
 
 import {
   __resetShellStartupEnvCache,
   isShellStartupEnvProbeSupported,
+  readSessionShellStartupEnvVar,
   readShellStartupEnvVar
 } from './shell-startup-env'
 
 describe('readShellStartupEnvVar', () => {
   const originalPlatform = process.platform
   const originalShell = process.env.SHELL
+  // Why pinned: the fish branch defaults configHome to process.env.XDG_CONFIG_HOME, which CI
+  // runners set and dev machines usually do not — leaving it ambient makes these mocked paths
+  // resolve differently per host.
+  const originalXdgConfigHome = process.env.XDG_CONFIG_HOME
 
   beforeEach(() => {
+    delete process.env.XDG_CONFIG_HOME
     existsSyncMock.mockReset()
     readFileSyncMock.mockReset()
+    readdirSyncMock.mockReset()
+    // Why: only the fish branch lists a directory; every other case must see ENOENT.
+    readdirSyncMock.mockImplementation(() => {
+      throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
+    })
     Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' })
     process.env.SHELL = '/bin/zsh'
     __resetShellStartupEnvCache()
@@ -35,6 +48,11 @@ describe('readShellStartupEnvVar', () => {
     } else {
       process.env.SHELL = originalShell
     }
+    if (originalXdgConfigHome === undefined) {
+      delete process.env.XDG_CONFIG_HOME
+    } else {
+      process.env.XDG_CONFIG_HOME = originalXdgConfigHome
+    }
   })
 
   function mockStartupFiles(files: Record<string, string>) {
@@ -326,4 +344,218 @@ describe('readShellStartupEnvVar', () => {
     mockStartupFiles({ '.zshrc': '# export OPENCODE_CONFIG_DIR=/from-comment\n' })
     expect(readShellStartupEnvVar('OPENCODE_CONFIG_DIR', '/home/alice')).toBeUndefined()
   })
+
+  describe('fish', () => {
+    const FISH = '/opt/homebrew/bin/fish'
+
+    function mockFishFiles(files: Record<string, string>, snippets: string[] = []) {
+      readdirSyncMock.mockImplementation((dir: string) => {
+        if (dir === '/home/alice/.config/fish/conf.d' || dir === '/cfg/fish/conf.d') {
+          return snippets
+        }
+        throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
+      })
+      mockStartupFiles(files)
+    }
+
+    it('reads an exported set from config.fish', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /home/alice/.codex\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/home/alice/.codex')
+    })
+
+    it('lets config.fish win over a conf.d snippet, matching fish source order', () => {
+      mockFishFiles(
+        {
+          '/home/alice/.config/fish/conf.d/10-agents.fish': 'set -gx CODEX_HOME /from/confd\n',
+          '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /from/config\n'
+        },
+        ['10-agents.fish']
+      )
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/from/config')
+    })
+
+    it('sources conf.d snippets in filename order', () => {
+      mockFishFiles(
+        {
+          '/home/alice/.config/fish/conf.d/aaa.fish': 'set -gx CODEX_HOME /from/aaa\n',
+          '/home/alice/.config/fish/conf.d/zzz.fish': 'set -gx CODEX_HOME /from/zzz\n'
+        },
+        ['zzz.fish', 'aaa.fish', 'notes.txt']
+      )
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/from/zzz')
+    })
+
+    it('honors XDG_CONFIG_HOME', () => {
+      mockFishFiles({ '/cfg/fish/config.fish': 'set -gx CODEX_HOME /from/xdg\n' })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH, '/cfg')).toBe('/from/xdg')
+    })
+
+    // Why also via the env: the argument defaults to process.env.XDG_CONFIG_HOME, so without
+    // this every other fish case here silently depends on the host not exporting it.
+    it('defaults configHome to XDG_CONFIG_HOME from the environment', () => {
+      process.env.XDG_CONFIG_HOME = '/cfg'
+      __resetShellStartupEnvCache()
+      mockFishFiles({ '/cfg/fish/config.fish': 'set -gx CODEX_HOME /from/env-xdg\n' })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/from/env-xdg')
+    })
+
+    it('ignores sets that are not exported', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish':
+          'set -g CODEX_HOME /global\nset -l CODEX_HOME /local\nset CODEX_HOME /plain\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBeUndefined()
+    })
+
+    it('accepts every fish export spelling', () => {
+      for (const line of [
+        'set -x CODEX_HOME /a',
+        'set -xg CODEX_HOME /a',
+        'set -gx CODEX_HOME /a',
+        'set -Ux CODEX_HOME /a',
+        'set --export --global CODEX_HOME /a'
+      ]) {
+        __resetShellStartupEnvCache()
+        mockFishFiles({ '/home/alice/.config/fish/config.fish': `${line}\n` })
+        expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/a')
+      }
+    })
+
+    it('expands $HOME in double quotes and keeps single quotes literal', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME "$HOME/.codex" # note\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/home/alice/.codex')
+
+      __resetShellStartupEnvCache()
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': "set -gx CODEX_HOME '$HOME/.codex'\n"
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('$HOME/.codex')
+    })
+
+    it('does not read zsh or bash startup files for a fish user', () => {
+      mockFishFiles({
+        '/home/alice/.zshrc': 'export CODEX_HOME=/from/zsh\n',
+        '/home/alice/.bash_profile': 'export CODEX_HOME=/from/bash\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBeUndefined()
+    })
+
+    it('ignores a commented assignment', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': '# set -gx CODEX_HOME /from-comment\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBeUndefined()
+    })
+
+    it('does not match a different variable with the same prefix', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME_BACKUP /backup\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBeUndefined()
+    })
+  })
+
+  // Why these matter: a caller that plumbs HOME/SHELL but forgets XDG_CONFIG_HOME
+  // reads a different fish config than the shell will, so the same user gets one
+  // answer locally and another over relay.
+  describe('readSessionShellStartupEnvVar', () => {
+    const FISH = '/opt/homebrew/bin/fish'
+    const savedConfigHome = process.env.XDG_CONFIG_HOME
+    const savedHome = process.env.HOME
+
+    afterEach(() => {
+      restoreEnv('XDG_CONFIG_HOME', savedConfigHome)
+      restoreEnv('HOME', savedHome)
+    })
+
+    function restoreEnv(key: string, value: string | undefined) {
+      if (value === undefined) {
+        delete process.env[key]
+      } else {
+        process.env[key] = value
+      }
+    }
+
+    it("prefers the session env's XDG_CONFIG_HOME over the main process's", () => {
+      process.env.XDG_CONFIG_HOME = '/main-process-cfg'
+      mockStartupFiles({
+        '/session-cfg/fish/config.fish': 'set -gx CODEX_HOME /from/session\n',
+        '/main-process-cfg/fish/config.fish': 'set -gx CODEX_HOME /from/main-process\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar('CODEX_HOME', {
+          HOME: '/home/alice',
+          SHELL: FISH,
+          XDG_CONFIG_HOME: '/session-cfg'
+        })
+      ).toBe('/from/session')
+    })
+
+    it('falls back to the main process XDG_CONFIG_HOME when the session env lacks one', () => {
+      process.env.XDG_CONFIG_HOME = '/main-process-cfg'
+      mockStartupFiles({
+        '/main-process-cfg/fish/config.fish': 'set -gx CODEX_HOME /from/main-process\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar('CODEX_HOME', { HOME: '/home/alice', SHELL: FISH })
+      ).toBe('/from/main-process')
+    })
+
+    it("falls back to fish's own ~/.config default when neither env has one", () => {
+      delete process.env.XDG_CONFIG_HOME
+      mockStartupFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /from/default\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar('CODEX_HOME', { HOME: '/home/alice', SHELL: FISH })
+      ).toBe('/from/default')
+    })
+
+    it('resolves against the session HOME, not the main process HOME', () => {
+      delete process.env.XDG_CONFIG_HOME
+      process.env.HOME = '/home/root-user'
+      mockStartupFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME "$HOME/.codex"\n',
+        '/home/root-user/.config/fish/config.fish': 'set -gx CODEX_HOME /from/wrong-home\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar('CODEX_HOME', { HOME: '/home/alice', SHELL: FISH })
+      ).toBe('/home/alice/.codex')
+    })
+
+    it('lets an explicit shell override beat the session SHELL', () => {
+      delete process.env.XDG_CONFIG_HOME
+      mockStartupFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /from/fish\n',
+        '/home/alice/.zshrc': 'export CODEX_HOME=/from/zsh\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar(
+          'CODEX_HOME',
+          { HOME: '/home/alice', SHELL: '/bin/zsh' },
+          FISH
+        )
+      ).toBe('/from/fish')
+    })
+
+    it('falls back to the main process HOME and SHELL with no session env at all', () => {
+      delete process.env.XDG_CONFIG_HOME
+      process.env.HOME = '/home/alice'
+      process.env.SHELL = FISH
+      mockStartupFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /from/process-env\n'
+      })
+
+      expect(readSessionShellStartupEnvVar('CODEX_HOME', undefined)).toBe('/from/process-env')
+    })
+  })
 })
diff --git a/src/main/pty/shell-startup-env.ts b/src/main/pty/shell-startup-env.ts
index f423ef38f22..ad6392160a9 100644
--- a/src/main/pty/shell-startup-env.ts
+++ b/src/main/pty/shell-startup-env.ts
@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { posix } from 'node:path'
 
 // Why: only files the user's actual shell would source. Mixing zsh and bash
@@ -11,24 +11,45 @@ const ZSH_AFTER_ENV_FILES = ['.zprofile', '.zshrc', '.zlogin']
 // .bash_profile / .bash_login / .profile but intentionally does NOT force
 // .bashrc. Scanning .bashrc would mirror values the live Orca bash never sees.
 const BASH_LOGIN_FILES = ['.bash_profile', '.bash_login', '.profile']
+// Why: fish sources conf.d/*.fish (sorted by name) before config.fish, for
+// login and non-login shells alike — verified against fish 4.7.
+const FISH_SNIPPET_DIR = 'conf.d'
+const FISH_SNIPPET_SUFFIX = '.fish'
+const FISH_CONFIG_FILE = 'config.fish'
+
+/** Assignment grammar of a startup file: `export NAME=value` vs fish `set -gx NAME value`. */
+type StartupFileSyntax = 'export' | 'fish-set'
+
+type ShellStartupFiles = {
+  paths: readonly string[]
+  syntax: StartupFileSyntax
+}
 
 export function isShellStartupEnvProbeSupported(): boolean {
   return process.platform !== 'win32'
 }
 
-function parseExportedValue(content: string, name: string, home: string): string | undefined {
-  const assignment = new RegExp(`^export\\s+${name}=(.+)$`)
+function parseAssignedValue(
+  content: string,
+  name: string,
+  home: string,
+  syntax: StartupFileSyntax
+): string | undefined {
+  const assignment =
+    syntax === 'fish-set'
+      ? new RegExp(`^set\\s+((?:-{1,2}[A-Za-z][\\w-]*\\s+)+)${name}\\s+(.+)$`)
+      : new RegExp(`^export\\s+${name}=()(.+)$`)
   let lastMatch: string | undefined
 
   for (const rawLine of content.split(/\r?\n/)) {
     const line = rawLine.trim()
     const match = assignment.exec(line)
-    if (!match?.[1]) {
+    if (!match?.[2] || (syntax === 'fish-set' && !fishFlagsExport(match[1] ?? ''))) {
       continue
     }
     // Why: strip trailing unquoted `# comment` first so quoted values like
     // `"$HOME/.opencode" # note` survive intact for unquoteShellValue.
-    const decommented = stripTrailingComment(match[1])
+    const decommented = stripTrailingComment(match[2])
     const { text, quoted } = unquoteShellValue(decommented)
     // Why: $HOME / ${HOME} / ~ expansion mimics what the live shell would
     // do for double-quoted and unquoted values; single-quoted is literal.
@@ -41,6 +62,21 @@ function parseExportedValue(content: string, name: string, home: string): string
   return lastMatch
 }
 
+function parseExportedValue(content: string, name: string, home: string): string | undefined {
+  return parseAssignedValue(content, name, home, 'export')
+}
+
+// Why: only `set -x` / `--export` reaches child processes; `set -g`, `set -l`
+// and function-local sets never appear in the PTY's environment.
+function fishFlagsExport(flags: string): boolean {
+  return flags
+    .trim()
+    .split(/\s+/)
+    .some((flag) =>
+      flag.startsWith('--') ? flag === '--export' : /^-[A-Za-z]*x[A-Za-z]*$/.test(flag)
+    )
+}
+
 function readStartupFile(path: string): string | null {
   if (!existsSync(path)) {
     return null
@@ -52,23 +88,55 @@ function readStartupFile(path: string): string | null {
   }
 }
 
-function shellStartupFilePaths(home: string, shell: string | undefined): readonly string[] {
+function shellStartupFiles(
+  home: string,
+  shell: string | undefined,
+  configHome: string | undefined
+): ShellStartupFiles {
   if (!shell) {
     // Why: Orca's POSIX default shell is /bin/zsh when $SHELL is unset.
-    return zshStartupFilePaths(home)
+    return { paths: zshStartupFilePaths(home), syntax: 'export' }
   }
 
   const name = posix.basename(shell).toLowerCase()
   if (name === 'zsh') {
-    return zshStartupFilePaths(home)
+    return { paths: zshStartupFilePaths(home), syntax: 'export' }
   }
   if (name === 'bash') {
-    return BASH_LOGIN_FILES.map((file) => posix.join(home, file))
+    return {
+      paths: BASH_LOGIN_FILES.map((file) => posix.join(home, file)),
+      syntax: 'export'
+    }
   }
-  // Why: unsupported explicit shells (fish, nushell, custom wrappers) do not
-  // use Orca's zsh/bash shell-ready startup files, so scanning those files
+  if (name === 'fish') {
+    return {
+      paths: fishStartupFilePaths(home, configHome),
+      syntax: 'fish-set'
+    }
+  }
+  // Why: unsupported explicit shells (nushell, custom wrappers) do not use
+  // Orca's zsh/bash/fish shell-ready startup files, so scanning those files
   // would mirror values the live PTY shell never sees.
-  return []
+  return { paths: [], syntax: 'export' }
+}
+
+function fishStartupFilePaths(home: string, configHome: string | undefined): readonly string[] {
+  const fishDir = posix.join(configHome?.trim() || posix.join(home, '.config'), 'fish')
+  return [
+    ...fishSnippetPaths(posix.join(fishDir, FISH_SNIPPET_DIR)),
+    posix.join(fishDir, FISH_CONFIG_FILE)
+  ]
+}
+
+function fishSnippetPaths(snippetDir: string): readonly string[] {
+  try {
+    return readdirSync(snippetDir)
+      .filter((entry) => entry.endsWith(FISH_SNIPPET_SUFFIX))
+      .sort()
+      .map((entry) => posix.join(snippetDir, entry))
+  } catch {
+    return []
+  }
 }
 
 function zshStartupFilePaths(home: string): readonly string[] {
@@ -139,21 +207,24 @@ const cache = new Map<string, string | undefined>()
  * Limits (callers should treat the result as a hint, not authoritative):
  * - Conditionals (`[[ ... ]] && export FOO=...`), sourced files, and
  *   `$VAR` substitution beyond `$HOME` / `${HOME}` / `~` are not evaluated.
- * - Bare assignments (no `export` keyword) are ignored because POSIX shells
- *   do not export them to child processes.
+ * - Bare assignments (no `export` keyword, or fish `set` without `-x`) are
+ *   ignored because they never reach child processes.
  * - Files are scanned in shell evaluation order for the user's $SHELL family
- *   only (zsh OR bash, not both); unsupported explicit shells scan nothing.
- *   LAST matching assignment wins.
+ *   only (zsh OR bash OR fish, never mixed); unsupported explicit shells scan
+ *   nothing. LAST matching assignment wins.
+ * - fish universal variables (`set -Ux` stored in fish_variables) are only
+ *   seen when the assignment is also written in a config file.
  * - Windows is unsupported (PowerShell profile parsing is out of scope).
  *
- * Results are memoized per (name, home, shell) for the process lifetime —
- * shell startup files do not change mid-session in any practical scenario,
- * and PTY spawn is on the hot path.
+ * Results are memoized per (name, home, shell, configHome) for the process
+ * lifetime — shell startup files do not change mid-session in any practical
+ * scenario, and PTY spawn is on the hot path.
  */
 export function readShellStartupEnvVar(
   name: string,
   home = process.env.HOME,
-  shell = process.env.SHELL
+  shell = process.env.SHELL,
+  configHome = process.env.XDG_CONFIG_HOME
 ): string | undefined {
   if (!home || !isShellStartupEnvProbeSupported()) {
     return undefined
@@ -164,20 +235,21 @@ export function readShellStartupEnvVar(
     return undefined
   }
 
-  const cacheKey = `${name}\0${home}\0${shell ?? ''}`
+  const cacheKey = `${name}\0${home}\0${shell ?? ''}\0${configHome ?? ''}`
   if (cache.has(cacheKey)) {
     return cache.get(cacheKey)
   }
 
   let lastMatch: string | undefined
 
-  for (const path of shellStartupFilePaths(home, shell)) {
+  const { paths, syntax } = shellStartupFiles(home, shell, configHome)
+  for (const path of paths) {
     const content = readStartupFile(path)
     if (content === null) {
       continue
     }
 
-    const match = parseExportedValue(content, name, home)
+    const match = parseAssignedValue(content, name, home, syntax)
     if (match !== undefined) {
       lastMatch = match
     }
@@ -187,6 +259,34 @@ export function readShellStartupEnvVar(
   return lastMatch
 }
 
+/** The env keys that decide which startup files a shell would actually source. */
+export type ShellStartupEnvSource = {
+  HOME?: string | undefined
+  SHELL?: string | undefined
+  XDG_CONFIG_HOME?: string | undefined
+}
+
+/**
+ * Same probe, resolved against a session/PTY env with process.env as fallback.
+ *
+ * Why this exists rather than three inline `??` chains per call site: dropping
+ * XDG_CONFIG_HOME silently scans a *different* fish config than the shell will,
+ * so local launches and relay launches disagree about the same user's
+ * `set -gx` — a divergence with no visible symptom until it is wrong.
+ */
+export function readSessionShellStartupEnvVar(
+  name: string,
+  sessionEnv: ShellStartupEnvSource | undefined,
+  shellOverride?: string
+): string | undefined {
+  return readShellStartupEnvVar(
+    name,
+    sessionEnv?.HOME ?? process.env.HOME,
+    shellOverride ?? sessionEnv?.SHELL ?? process.env.SHELL,
+    sessionEnv?.XDG_CONFIG_HOME ?? process.env.XDG_CONFIG_HOME
+  )
+}
+
 /**
  * Test-only helper to reset the per-process cache between cases.
  * Why: production callers never invalidate (rc files don't change at
diff --git a/src/main/pty/wsl-orca-env.test.ts b/src/main/pty/wsl-orca-env.test.ts
index c27655ba7e4..21a3f69d1cd 100644
--- a/src/main/pty/wsl-orca-env.test.ts
+++ b/src/main/pty/wsl-orca-env.test.ts
@@ -48,8 +48,7 @@ describe('addOrcaWslInteropEnv', () => {
       ORCA_USER_DATA_PATH: 'C:\\Users\\jin\\AppData\\Roaming\\Orca',
       ORCA_CLI_COMMAND: 'orca-ide',
       ORCA_OMP_STATUS_EXTENSION: 'C:\\Users\\jin\\.omp\\agent\\extensions\\orca-agent-status.ts',
-      ORCA_PRIME_AGENT_STATUS_EXTENSION:
-        'C:\\Users\\jin\\AppData\\Roaming\\Orca\\prime-agent-managed-status-extension\\orca-agent-status.ts',
+      ORCA_PRIME_AGENT_STATUS_EXTENSION: 'C:\\stale\\orca-agent-status.ts',
       ORCA_PANE_KEY: 'tab-1:leaf-1',
       ORCA_TAB_ID: 'tab-1',
       ORCA_WORKTREE_ID: 'repo::\\\\wsl.localhost\\Ubuntu\\home\\jin\\repo',
@@ -70,7 +69,7 @@ describe('addOrcaWslInteropEnv', () => {
     expect(env.WSLENV).toContain('ORCA_USER_DATA_PATH/p')
     expect(env.WSLENV).toContain('ORCA_CLI_COMMAND/u')
     expect(env.WSLENV).toContain('ORCA_OMP_STATUS_EXTENSION/p')
-    expect(env.WSLENV).toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION/p')
+    expect(env.WSLENV).not.toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION')
     expect(env.WSLENV).toContain('ORCA_PANE_KEY/u')
     expect(env.WSLENV).toContain('ORCA_TAB_ID/u')
     expect(env.WSLENV).toContain('ORCA_WORKTREE_ID/u')
diff --git a/src/main/pty/wsl-orca-env.ts b/src/main/pty/wsl-orca-env.ts
index 5e90eaa6b4a..40f3b957249 100644
--- a/src/main/pty/wsl-orca-env.ts
+++ b/src/main/pty/wsl-orca-env.ts
@@ -96,7 +96,6 @@ export function addOrcaWslInteropEnv(env: Record<string, string>): void {
     'ORCA_WSL_HOOK_INSTANCE/u',
     'ORCA_OMP_SOURCE_AGENT_DIR/p',
     'ORCA_OMP_STATUS_EXTENSION/p',
-    'ORCA_PRIME_AGENT_STATUS_EXTENSION/p',
     ...worktreeSetupWslenvEntries(env)
   ]
   applyWslenvPassthrough(env, passthroughEntries)
diff --git a/src/main/rate-limits/minimax-request-context.ts b/src/main/rate-limits/minimax-request-context.ts
index 34dcd47130b..ecda8329a2e 100644
--- a/src/main/rate-limits/minimax-request-context.ts
+++ b/src/main/rate-limits/minimax-request-context.ts
@@ -45,7 +45,7 @@ function parseCookiePairs(cookie: string): { name: string; value: string }[] {
     .map((part) => {
       const normalizedPart = part.replace(/^Cookie:\s*/i, '')
       const eq = normalizedPart.indexOf('=')
-      if (eq < 0) {
+      if (eq === -1) {
         return null
       }
       return {
diff --git a/src/main/rate-limits/opencode-go-usage-fetcher.ts b/src/main/rate-limits/opencode-go-usage-fetcher.ts
index 934d1e72b42..f2ea68b7588 100644
--- a/src/main/rate-limits/opencode-go-usage-fetcher.ts
+++ b/src/main/rate-limits/opencode-go-usage-fetcher.ts
@@ -47,7 +47,7 @@ function parseAuthCookies(raw: string): { name: string; value: string }[] {
     .map((p) => p.trim())
     .map((pair) => {
       const eq = pair.indexOf('=')
-      if (eq < 0) {
+      if (eq === -1) {
         return null
       }
       const name = pair.slice(0, eq).trim()
diff --git a/src/main/runtime/claude-agent-teams-shim-env.test.ts b/src/main/runtime/claude-agent-teams-shim-env.test.ts
index f79c9d150cf..362291e3c26 100644
--- a/src/main/runtime/claude-agent-teams-shim-env.test.ts
+++ b/src/main/runtime/claude-agent-teams-shim-env.test.ts
@@ -61,7 +61,7 @@ describe('claude agent teams shim env', () => {
       expect(plan).toMatchObject({
         command: "claude --teammate-mode auto 'hello'",
         env: expect.objectContaining({ TMUX_PANE: '%1' }),
-        envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
+        envToDelete: ['TERM_PROGRAM']
       })
       expect(capturedShimBin).toBe(cliPath)
     }
diff --git a/src/main/runtime/claude-agent-teams-shim-env.ts b/src/main/runtime/claude-agent-teams-shim-env.ts
index 6b6eeea94ba..7f6c3a1922e 100644
--- a/src/main/runtime/claude-agent-teams-shim-env.ts
+++ b/src/main/runtime/claude-agent-teams-shim-env.ts
@@ -47,7 +47,7 @@ export async function buildClaudeAgentTeamsLaunchPlan(args: {
   return {
     command: addClaudeTeammateModeAuto(args.command),
     env,
-    envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
+    envToDelete: ['TERM_PROGRAM']
   }
 }
 
diff --git a/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts b/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
index a146fff476b..98159e8725e 100644
--- a/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
+++ b/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
@@ -117,7 +117,7 @@ export class ClaudeAgentTeamsTmuxDispatcher {
       direction: splitTarget.direction,
       command: parsed.positional.join(' ') || undefined,
       env: paneEnv(team, fakePaneId),
-      envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR'],
+      envToDelete: ['TERM_PROGRAM'],
       activate: false
     })
     const pane: TeamPane = {
@@ -168,7 +168,7 @@ export class ClaudeAgentTeamsTmuxDispatcher {
       direction: pane.splitDirection ?? 'horizontal',
       command,
       env: paneEnv(team, pane.fakePaneId),
-      envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR'],
+      envToDelete: ['TERM_PROGRAM'],
       activate: false
     })
     try {
diff --git a/src/main/runtime/device-registry.ts b/src/main/runtime/device-registry.ts
index 88818b3cb1d..b5f0c7a6c8d 100644
--- a/src/main/runtime/device-registry.ts
+++ b/src/main/runtime/device-registry.ts
@@ -162,7 +162,7 @@ export class DeviceRegistry {
 
   setRelayBinding(deviceId: string, binding: RelayDeviceBinding): boolean {
     const index = this.devices.findIndex((candidate) => candidate.deviceId === deviceId)
-    if (index < 0 || binding.relayDeviceId !== deviceId) {
+    if (index === -1 || binding.relayDeviceId !== deviceId) {
       return false
     }
     const nextDevices = this.devices.map((device, candidateIndex) =>
@@ -175,7 +175,7 @@ export class DeviceRegistry {
 
   setMobilePairingConnectionMode(deviceId: string, mode: MobilePairingConnectionMode): boolean {
     const index = this.devices.findIndex((candidate) => candidate.deviceId === deviceId)
-    if (index < 0 || this.devices[index]?.scope !== 'mobile') {
+    if (index === -1 || this.devices[index]?.scope !== 'mobile') {
       return false
     }
     // Why: persist before swapping memory so a failed write does not leave a
@@ -208,7 +208,7 @@ export class DeviceRegistry {
 
   updateLastSeen(deviceId: string): void {
     const index = this.devices.findIndex((d) => d.deviceId === deviceId)
-    if (index < 0) {
+    if (index === -1) {
       return
     }
     // Why: persist before memory swap so a failed write cannot leave a scanned
@@ -230,7 +230,7 @@ export class DeviceRegistry {
    */
   updateLastSeenDeferred(deviceId: string): void {
     const index = this.devices.findIndex((d) => d.deviceId === deviceId)
-    if (index < 0) {
+    if (index === -1) {
       return
     }
     if (this.devices[index]!.lastSeenAt === 0) {
diff --git a/src/main/runtime/fetch-remote-cache.test.ts b/src/main/runtime/fetch-remote-cache.test.ts
index 14c18115636..fc2d761c059 100644
--- a/src/main/runtime/fetch-remote-cache.test.ts
+++ b/src/main/runtime/fetch-remote-cache.test.ts
@@ -66,7 +66,7 @@ function fullRemoteFetchOptions(cwd: string): { cwd: string; timeout: number } {
   return { cwd, timeout: 60_000 }
 }
 
-function mockFetchResults(results: (Promise<unknown> | unknown)[]): void {
+function mockFetchResults(results: unknown[]): void {
   let fetchIndex = 0
   gitExecFileAsyncMock.mockImplementation((argv: string[]) => {
     if (argv[0] === 'rev-parse') {
diff --git a/src/main/runtime/headless-terminal-split-layout.test.ts b/src/main/runtime/headless-terminal-split-layout.test.ts
index 000434ee3d7..0fa0d33b1c0 100644
--- a/src/main/runtime/headless-terminal-split-layout.test.ts
+++ b/src/main/runtime/headless-terminal-split-layout.test.ts
@@ -2,9 +2,27 @@ import { describe, expect, it } from 'vitest'
 import type { TerminalLayoutSnapshot } from '../../shared/types'
 import {
   buildHeadlessTerminalSplitLayout,
-  countTerminalLayoutLeaves
+  countTerminalLayoutLeaves,
+  terminalLayoutContainsLeaf
 } from './headless-terminal-split-layout'
 
+describe('terminalLayoutContainsLeaf', () => {
+  it('requires the leaf in the layout tree', () => {
+    expect(
+      terminalLayoutContainsLeaf(
+        {
+          type: 'split',
+          direction: 'vertical',
+          first: { type: 'leaf', leafId: 'leaf-a' },
+          second: { type: 'leaf', leafId: 'leaf-b' }
+        },
+        'leaf-b'
+      )
+    ).toBe(true)
+    expect(terminalLayoutContainsLeaf({ type: 'leaf', leafId: 'leaf-a' }, 'leaf-b')).toBe(false)
+  })
+})
+
 describe('buildHeadlessTerminalSplitLayout (headless split persistence)', () => {
   it('splits a single-leaf tab into a 2-leaf split tree', () => {
     const existing: TerminalLayoutSnapshot = {
@@ -84,6 +102,64 @@ describe('buildHeadlessTerminalSplitLayout (headless split persistence)', () =>
     })
   })
 
+  it('replaces the provisional admission leaf with the requested split direction', () => {
+    const next = buildHeadlessTerminalSplitLayout(
+      {
+        root: {
+          type: 'split',
+          direction: 'vertical',
+          first: { type: 'leaf', leafId: 'leaf-a' },
+          second: { type: 'leaf', leafId: 'leaf-c' }
+        },
+        activeLeafId: 'leaf-c',
+        expandedLeafId: null,
+        ptyIdsByLeafId: { 'leaf-a': 'pty-a', 'leaf-c': 'provisional-pty' }
+      },
+      { leafId: 'leaf-c', ptyId: 'pty-c', splitFromLeafId: 'leaf-a', direction: 'horizontal' }
+    )
+
+    expect(next.root).toEqual({
+      type: 'split',
+      direction: 'horizontal',
+      first: { type: 'leaf', leafId: 'leaf-a' },
+      second: { type: 'leaf', leafId: 'leaf-c' }
+    })
+    expect(next.ptyIdsByLeafId).toEqual({ 'leaf-a': 'pty-a', 'leaf-c': 'pty-c' })
+  })
+
+  it('preserves a sibling committed by a concurrent split', () => {
+    const next = buildHeadlessTerminalSplitLayout(
+      {
+        root: {
+          type: 'split',
+          direction: 'vertical',
+          first: {
+            type: 'split',
+            direction: 'horizontal',
+            first: { type: 'leaf', leafId: 'leaf-a' },
+            second: { type: 'leaf', leafId: 'leaf-b' }
+          },
+          second: { type: 'leaf', leafId: 'leaf-c' }
+        },
+        activeLeafId: 'leaf-c',
+        expandedLeafId: null,
+        ptyIdsByLeafId: {
+          'leaf-a': 'pty-a',
+          'leaf-b': 'pty-b',
+          'leaf-c': 'provisional-pty'
+        }
+      },
+      { leafId: 'leaf-c', ptyId: 'pty-c', splitFromLeafId: 'leaf-a', direction: 'vertical' }
+    )
+
+    expect(countTerminalLayoutLeaves(next.root)).toBe(3)
+    expect(next.ptyIdsByLeafId).toEqual({
+      'leaf-a': 'pty-a',
+      'leaf-b': 'pty-b',
+      'leaf-c': 'pty-c'
+    })
+  })
+
   it('does not collapse — the persisted layout keeps both leaves (regression guard)', () => {
     // Why: the reported bug was the split collapsing back to one pane. After a
     // split, a rebuild reads this persisted layout, so it MUST stay multi-leaf.
diff --git a/src/main/runtime/headless-terminal-split-layout.ts b/src/main/runtime/headless-terminal-split-layout.ts
index c3947334f77..834625f9ef3 100644
--- a/src/main/runtime/headless-terminal-split-layout.ts
+++ b/src/main/runtime/headless-terminal-split-layout.ts
@@ -1,5 +1,18 @@
 import type { TerminalLayoutSnapshot, TerminalPaneLayoutNode } from '../../shared/types'
 
+export function terminalLayoutContainsLeaf(
+  node: TerminalPaneLayoutNode | null | undefined,
+  leafId: string
+): boolean {
+  if (!node) {
+    return false
+  }
+  return node.type === 'leaf'
+    ? node.leafId === leafId
+    : terminalLayoutContainsLeaf(node.first, leafId) ||
+        terminalLayoutContainsLeaf(node.second, leafId)
+}
+
 /**
  * Insert a newly split-off leaf into a terminal tab's persisted layout tree.
  *
@@ -17,7 +30,23 @@ export function buildHeadlessTerminalSplitLayout(
     direction: 'horizontal' | 'vertical'
   }
 ): TerminalLayoutSnapshot {
-  const existingRoot: TerminalPaneLayoutNode = existing?.root ?? {
+  const removeProvisionalLeaf = (node: TerminalPaneLayoutNode): TerminalPaneLayoutNode | null => {
+    if (node.type === 'leaf') {
+      return node.leafId === args.leafId ? null : node
+    }
+    const first = removeProvisionalLeaf(node.first)
+    const second = removeProvisionalLeaf(node.second)
+    if (!first) {
+      return second
+    }
+    if (!second) {
+      return first
+    }
+    return { ...node, first, second }
+  }
+  // Why: PTY admission durably appends a fallback vertical leaf before this exact-direction commit.
+  const currentRoot = existing?.root ? removeProvisionalLeaf(existing.root) : null
+  const existingRoot: TerminalPaneLayoutNode = currentRoot ?? {
     type: 'leaf',
     leafId: args.splitFromLeafId
   }
@@ -35,13 +64,15 @@ export function buildHeadlessTerminalSplitLayout(
     }
     return { ...node, first: insertSplit(node.first), second: insertSplit(node.second) }
   }
+  const ptyIdsByLeafId = { ...existing?.ptyIdsByLeafId }
+  delete ptyIdsByLeafId[args.leafId]
   return {
     ...existing,
     root: insertSplit(existingRoot),
     activeLeafId: args.leafId,
     expandedLeafId: existing?.expandedLeafId ?? null,
     ptyIdsByLeafId: {
-      ...existing?.ptyIdsByLeafId,
+      ...ptyIdsByLeafId,
       [args.leafId]: args.ptyId
     }
   }
diff --git a/src/main/runtime/linear-save-issue.test.ts b/src/main/runtime/linear-save-issue.test.ts
index add8a54d1ab..eb8ed4093d2 100644
--- a/src/main/runtime/linear-save-issue.test.ts
+++ b/src/main/runtime/linear-save-issue.test.ts
@@ -23,7 +23,7 @@ const issue = {
 
 type SaveIssueInternals = {
   resolveLinearAssignee(input: string, teamId: string, workspaceId: string): Promise<string>
-  resolveLinearAgentState(input: string, states: unknown[]): unknown | null
+  resolveLinearAgentState(input: string, states: unknown[]): unknown
   buildLinearSaveUpdate(
     params: { labels?: string[] },
     current: typeof issue,
diff --git a/src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts b/src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts
new file mode 100644
index 00000000000..23f7adc4df8
--- /dev/null
+++ b/src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts
@@ -0,0 +1,161 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { EmulatorSessionInfo } from '../emulator/emulator-types'
+import type { FolderWorkspace } from '../../shared/types'
+import { OrcaRuntimeService } from './orca-runtime'
+
+const FOLDER_WORKSPACE_ID = 'folder-workspace-1'
+const FOLDER_WORKSPACE_KEY = `folder:${FOLDER_WORKSPACE_ID}`
+const EMULATOR_INFO: EmulatorSessionInfo = {
+  deviceUdid: 'emulator-5554',
+  streamUrl: 'scrcpy://emulator-5554',
+  wsUrl: '',
+  streamCodec: 'h264',
+  backend: 'android'
+}
+
+function makeFolderWorkspace(): FolderWorkspace {
+  return {
+    id: FOLDER_WORKSPACE_ID,
+    projectGroupId: 'project-group-1',
+    name: 'Mobile app',
+    folderPath: '/tmp/mobile-app',
+    linkedTask: null,
+    comment: '',
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 1,
+    createdAt: 1,
+    updatedAt: 1
+  }
+}
+
+describe('RuntimeEmulatorCommands folder workspace routing', () => {
+  it.each([FOLDER_WORKSPACE_KEY, `id:${FOLDER_WORKSPACE_KEY}`])(
+    'registers and publishes an attached device for selector %s',
+    async (selector) => {
+      const bridge = {
+        acquireHelperForDevice: vi.fn(async () => ({
+          info: EMULATOR_INFO,
+          release: vi.fn(async () => {})
+        })),
+        getReusableActiveForWorktree: vi.fn(async () => null),
+        registerActiveEmulator: vi.fn(),
+        stopActiveForSwitch: vi.fn(async () => null)
+      }
+      const send = vi.fn()
+      const runtime = new OrcaRuntimeService({
+        getFolderWorkspaces: () => [makeFolderWorkspace()],
+        getAllWorktreeMeta: () => new Map(),
+        getRepo: () => null,
+        getRepos: () => [],
+        getSettings: () => ({
+          mobileEmulatorEnabled: true,
+          mobileEmulatorDefaultDeviceUdid: null,
+          androidSdkPath: null
+        })
+      } as never)
+      runtime.setEmulatorBridge(bridge as never)
+      Object.assign(runtime, {
+        getAuthoritativeWindow: () => ({ webContents: { send } })
+      })
+
+      await expect(
+        runtime.emulatorAttach({
+          device: 'emulator-5554',
+          worktree: selector,
+          focus: true
+        })
+      ).resolves.toEqual({ attached: true, info: EMULATOR_INFO })
+
+      expect(bridge.acquireHelperForDevice).toHaveBeenCalledOnce()
+      expect(bridge.registerActiveEmulator).toHaveBeenCalledWith(
+        FOLDER_WORKSPACE_KEY,
+        EMULATOR_INFO,
+        { managed: true }
+      )
+      expect(send.mock.calls).toEqual([
+        ['ui:emulatorAutoAttach', { worktreeId: FOLDER_WORKSPACE_KEY, info: EMULATOR_INFO }],
+        ['emulator:pane-focus', { worktreeId: FOLDER_WORKSPACE_KEY }]
+      ])
+    }
+  )
+
+  it.each([FOLDER_WORKSPACE_KEY, `id:${FOLDER_WORKSPACE_KEY}`])(
+    'cleans up an active emulator after selector %s is deleted',
+    async (selector) => {
+      let folderWorkspaces = [makeFolderWorkspace()]
+      const shutdownActiveManagedForWorktree = vi.fn(async () => EMULATOR_INFO.deviceUdid)
+      const runtime = new OrcaRuntimeService({
+        getFolderWorkspaces: () => folderWorkspaces,
+        getAllWorktreeMeta: () => new Map(),
+        getRepo: () => null,
+        getRepos: () => [],
+        getSettings: () => ({ androidSdkPath: null })
+      } as never)
+      runtime.setEmulatorBridge({ shutdownActiveManagedForWorktree } as never)
+
+      folderWorkspaces = []
+
+      await expect(
+        runtime.emulatorShutdown({ worktree: selector, managedOnly: true })
+      ).resolves.toEqual({ ok: true, deviceUdid: EMULATOR_INFO.deviceUdid })
+      expect(shutdownActiveManagedForWorktree).toHaveBeenCalledWith(FOLDER_WORKSPACE_KEY)
+    }
+  )
+
+  it('cleans up an attach that finishes after its folder workspace is deleted', async () => {
+    let folderWorkspaces = [makeFolderWorkspace()]
+    const release = vi.fn(async () => {})
+    let finishHelperStart:
+      | ((lease: { info: EmulatorSessionInfo; release: typeof release }) => void)
+      | undefined
+    const bridge = {
+      acquireHelperForDevice: vi.fn(
+        () =>
+          new Promise<{ info: EmulatorSessionInfo; release: typeof release }>((resolve) => {
+            finishHelperStart = resolve
+          })
+      ),
+      getReusableActiveForWorktree: vi.fn(async () => null),
+      registerActiveEmulator: vi.fn(),
+      shutdownActiveManagedForWorktree: vi.fn(async () => null),
+      stopActiveForSwitch: vi.fn(async () => null)
+    }
+    const runtime = new OrcaRuntimeService({
+      getFolderWorkspaces: () => folderWorkspaces,
+      getAllWorktreeMeta: () => new Map(),
+      getRepo: () => null,
+      getRepos: () => [],
+      getSettings: () => ({
+        mobileEmulatorEnabled: true,
+        mobileEmulatorDefaultDeviceUdid: null,
+        androidSdkPath: null
+      })
+    } as never)
+    runtime.setEmulatorBridge(bridge as never)
+    Object.assign(runtime, {
+      getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } })
+    })
+
+    const attach = runtime.emulatorAttach({
+      device: EMULATOR_INFO.deviceUdid,
+      worktree: FOLDER_WORKSPACE_KEY
+    })
+    await vi.waitFor(() => expect(bridge.acquireHelperForDevice).toHaveBeenCalledOnce())
+    folderWorkspaces = []
+    await expect(
+      runtime.emulatorShutdown({ worktree: FOLDER_WORKSPACE_KEY, managedOnly: true })
+    ).resolves.toEqual({ ok: true, deviceUdid: undefined })
+    finishHelperStart?.({ info: EMULATOR_INFO, release })
+    await expect(attach).rejects.toMatchObject({
+      code: 'emulator_no_active',
+      message: 'The workspace changed while the emulator was starting. Reattach the emulator.'
+    })
+
+    expect(bridge.registerActiveEmulator).not.toHaveBeenCalled()
+    expect(bridge.shutdownActiveManagedForWorktree).toHaveBeenCalledWith(FOLDER_WORKSPACE_KEY)
+    expect(release).toHaveBeenCalledWith({ cleanupIfUnused: true })
+  })
+})
diff --git a/src/main/runtime/orca-runtime-emulator.ts b/src/main/runtime/orca-runtime-emulator.ts
index ac67464a533..7c82980c2a3 100644
--- a/src/main/runtime/orca-runtime-emulator.ts
+++ b/src/main/runtime/orca-runtime-emulator.ts
@@ -22,7 +22,8 @@ type EmulatorHostSettings = Pick<
 // Why: dedicated file for "one surface" separation (emulator), parallel to orca-runtime-browser.ts. Keeps OrcaRuntimeService focused; emulator routing easy to scan. No max-lines disable (split further if grows; per AGENTS + plan Phase 3).
 export type RuntimeEmulatorCommandHost = {
   getEmulatorBridge(): EmulatorBridge | null
-  resolveWorktreeSelector(selector: string): Promise<{ id: string }>
+  resolveEmulatorWorkspaceId(selector: string): Promise<string>
+  resolveEmulatorCleanupWorkspaceId(selector: string): Promise<string>
   getAuthoritativeWindow(): BrowserWindow
   getSettings(): EmulatorHostSettings
 }
@@ -157,13 +158,36 @@ export class RuntimeEmulatorCommands {
       // slow-to-boot Android emulator alive for instant switch-back.
       await bridge.stopActiveForSwitch(worktreeId)
     }
-    const info = await bridge.startHelperForDevice(device)
+    const lease = await bridge.acquireHelperForDevice(device)
+    const { info } = lease
     if (worktreeId) {
+      try {
+        const currentWorktreeId = await this.resolveWorktreeId(params.worktree)
+        if (currentWorktreeId !== worktreeId) {
+          throw new EmulatorError(
+            'emulator_no_active',
+            'The workspace changed while the emulator was starting. Reattach the emulator.'
+          )
+        }
+      } catch (error) {
+        // Why: the workspace can disappear while a slow Android device boots.
+        await lease.release({ cleanupIfUnused: true }).catch(() => {})
+        if (error instanceof Error && error.message === 'selector_not_found') {
+          throw new EmulatorError(
+            'emulator_no_active',
+            'The workspace changed while the emulator was starting. Reattach the emulator.'
+          )
+        }
+        throw error
+      }
       bridge.registerActiveEmulator(worktreeId, info, { managed: true })
+      await lease.release()
       this.notifyRendererEmulatorAutoAttach(worktreeId, info)
       if (params.focus) {
         this.notifyRendererEmulatorPaneFocus(worktreeId)
       }
+    } else {
+      await lease.release()
     }
     // Default: no auto steal (mirror browser tab create/switch). --focus sends emulator:pane-focus only when requested.
     return { attached: true, info }
@@ -176,7 +200,7 @@ export class RuntimeEmulatorCommands {
 
   async emulatorUnregisterActive(params: { worktree?: string }): Promise<{ ok: true }> {
     const bridge = this.requireEmulatorBridge()
-    const worktreeId = await this.resolveWorktreeId(params.worktree)
+    const worktreeId = await this.resolveCleanupWorktreeId(params.worktree)
     if (worktreeId) {
       bridge.unregisterActiveEmulator(worktreeId)
     }
@@ -203,7 +227,11 @@ export class RuntimeEmulatorCommands {
   }
 
   private async resolveWorktreeId(worktree?: string): Promise<string | undefined> {
-    return worktree ? (await this.host.resolveWorktreeSelector(worktree)).id : undefined
+    return worktree ? await this.host.resolveEmulatorWorkspaceId(worktree) : undefined
+  }
+
+  private async resolveCleanupWorktreeId(worktree?: string): Promise<string | undefined> {
+    return worktree ? await this.host.resolveEmulatorCleanupWorkspaceId(worktree) : undefined
   }
 
   async emulatorInstall(
@@ -272,7 +300,7 @@ export class RuntimeEmulatorCommands {
     worktree?: string
   }): Promise<{ ok: true; deviceUdid: string }> {
     const bridge = this.requireEmulatorBridge()
-    const worktreeId = await this.resolveWorktreeId(params.worktree)
+    const worktreeId = await this.resolveCleanupWorktreeId(params.worktree)
     const killedUdid = await bridge.kill(params.device ?? params.emulator, worktreeId)
     return { ok: true, deviceUdid: killedUdid }
   }
@@ -284,7 +312,7 @@ export class RuntimeEmulatorCommands {
     managedOnly?: boolean
   }): Promise<{ ok: true; deviceUdid?: string }> {
     const bridge = this.requireEmulatorBridge()
-    const worktreeId = await this.resolveWorktreeId(params.worktree)
+    const worktreeId = await this.resolveCleanupWorktreeId(params.worktree)
     if (params.managedOnly && worktreeId && !params.device && !params.emulator) {
       const shutdownUdid = await bridge.shutdownActiveManagedForWorktree(worktreeId)
       return { ok: true, deviceUdid: shutdownUdid ?? undefined }
diff --git a/src/main/runtime/orca-runtime-files.test.ts b/src/main/runtime/orca-runtime-files.test.ts
index ce96eddb5e0..de78d21b10b 100644
--- a/src/main/runtime/orca-runtime-files.test.ts
+++ b/src/main/runtime/orca-runtime-files.test.ts
@@ -157,6 +157,7 @@ function createRuntimeFileCommands(options?: {
   resolveTerminalContext?: ReturnType<typeof vi.fn>
   resolveTerminalFileUriHostname?: ReturnType<typeof vi.fn>
   hasRecentTerminalOutputPath?: ReturnType<typeof vi.fn>
+  hasRecentNativeChatOutputPath?: ReturnType<typeof vi.fn>
 }) {
   const store = {
     getRepo: vi.fn((_repoId?: string) => undefined as { connectionId?: string } | undefined)
@@ -192,6 +193,9 @@ function createRuntimeFileCommands(options?: {
       ? { resolveTerminalFileUriHostname: options.resolveTerminalFileUriHostname }
       : {}),
     hasRecentTerminalOutputPath: options?.hasRecentTerminalOutputPath ?? vi.fn(() => true),
+    ...(options?.hasRecentNativeChatOutputPath
+      ? { hasRecentNativeChatOutputPath: options.hasRecentNativeChatOutputPath }
+      : {}),
     resolveRuntimeGitTarget: options?.resolveRuntimeGitTarget ?? vi.fn(),
     openFile: options?.openFile ?? vi.fn(),
     ...(options?.openDiff ? { openDiff: options.openDiff } : {})
@@ -945,11 +949,18 @@ describe('RuntimeFileCommands', () => {
       )
     }
 
-    function createRemoteTerminalArtifactGrantFixture(artifactPath = '/tmp/result.json') {
-      const { commands, store } = createRuntimeFileCommands({ path: '/repo' })
+    function createRemoteTerminalArtifactGrantFixture(
+      artifactPath = '/tmp/result.json',
+      nativeChat = false
+    ) {
+      const { commands, store } = createRuntimeFileCommands({
+        path: '/repo',
+        ...(nativeChat ? { hasRecentNativeChatOutputPath: vi.fn(() => true) } : {})
+      })
       store.getRepo.mockReturnValue({ connectionId: 'ssh-1' })
       let realArtifactPath = artifactPath
-      const stat = vi.fn().mockResolvedValue({ type: 'file', size: 11, mtime: 3 })
+      let artifactStat = { type: 'file', size: 11, mtime: 3 }
+      const stat = vi.fn(async () => artifactStat)
       const readTerminalArtifact = vi
         .fn()
         .mockResolvedValue({ content: '{"ok":true}', isBinary: false })
@@ -967,10 +978,20 @@ describe('RuntimeFileCommands', () => {
         writeTerminalArtifact,
         moveArtifactTarget: (nextPath: string) => {
           realArtifactPath = nextPath
+        },
+        replaceArtifact: () => {
+          artifactStat = { type: 'file', size: 12, mtime: 4 }
         }
       }
     }
 
+    function resolveRemoteNativeChatArtifact(commands: RuntimeFileCommands, artifactPath: string) {
+      return commands.resolveTerminalPath('id:wt-1', artifactPath, null, 'client-a', null, true, {
+        tabId: 'tab-1',
+        sessionId: 'session-1'
+      })
+    }
+
     it('resolves an absolute path inside the worktree to a relative path', async () => {
       const { commands } = createRuntimeFileCommands({ path: '/repo' })
       statAsFile()
@@ -992,6 +1013,28 @@ describe('RuntimeFileCommands', () => {
       })
     })
 
+    it('keeps in-worktree resolution unchanged when chat provenance is present', async () => {
+      const hasRecentNativeChatOutputPath = vi.fn(() => true)
+      const { commands } = createRuntimeFileCommands({
+        path: '/repo',
+        hasRecentNativeChatOutputPath
+      })
+      statAsFile()
+
+      const result = await commands.resolveTerminalPath(
+        'id:wt-1',
+        '/repo/src/index.ts',
+        null,
+        'client-a',
+        null,
+        true,
+        { tabId: 'tab-1', sessionId: 'session-1' }
+      )
+
+      expect(result).toMatchObject({ relativePath: 'src/index.ts', exists: true })
+      expect(hasRecentNativeChatOutputPath).not.toHaveBeenCalled()
+    })
+
     it('resolves an absolute path through a known sibling workspace', async () => {
       const sibling = {
         id: 'wt-2',
@@ -1367,9 +1410,13 @@ describe('RuntimeFileCommands', () => {
       expect(statMock).not.toHaveBeenCalled()
     })
 
-    it('does not mint an absolute terminal artifact grant without a source terminal', async () => {
+    it('keeps old-client behavior without native-chat provenance', async () => {
       const artifactPath = await tempFile('result.json', '{}')
-      const { commands } = createRuntimeFileCommands({ path: '/repo' })
+      const hasRecentNativeChatOutputPath = vi.fn(() => true)
+      const { commands } = createRuntimeFileCommands({
+        path: '/repo',
+        hasRecentNativeChatOutputPath
+      })
 
       const result = await commands.resolveTerminalPath('id:wt-1', artifactPath, null, 'client-a')
 
@@ -1380,6 +1427,139 @@ describe('RuntimeFileCommands', () => {
         isDirectory: false
       })
       expect(result.openTarget).toBeUndefined()
+      expect(hasRecentNativeChatOutputPath).not.toHaveBeenCalled()
+    })
+
+    it('mints an exact-path grant for an out-of-worktree path cited by native chat', async () => {
+      const artifactPath = await tempFile('chat-result.html', '<h1>Result</h1>')
+      const hasRecentNativeChatOutputPath = vi.fn(() => true)
+      const { commands } = createRuntimeFileCommands({
+        path: '/repo',
+        hasRecentNativeChatOutputPath
+      })
+
+      const result = await commands.resolveTerminalPath(
+        'id:wt-1',
+        artifactPath,
+        null,
+        'client-a',
+        null,
+        true,
+        { tabId: 'tab-1', sessionId: 'session-1' }
+      )
+
+      expect(hasRecentNativeChatOutputPath).toHaveBeenCalledWith(
+        'wt-1',
+        { tabId: 'tab-1', sessionId: 'session-1' },
+        artifactPath,
+        artifactPath
+      )
+      expect(result).toMatchObject({
+        worktree: 'wt-1',
+        relativePath: null,
+        absolutePath: await realpath(artifactPath),
+        exists: true,
+        isDirectory: false,
+        openTarget: {
+          kind: 'absolute-file',
+          provider: 'local',
+          absolutePath: await realpath(artifactPath),
+          readOnly: true
+        }
+      })
+      const target = absoluteFileTarget(result)
+      await expect(
+        commands.writeTerminalArtifactFile(
+          'id:wt-1',
+          target.grantId,
+          target.absolutePath,
+          '<h1>Changed</h1>',
+          'client-a'
+        )
+      ).rejects.toThrow('terminal_file_grant_read_only')
+      await expect(readFile(artifactPath, 'utf8')).resolves.toBe('<h1>Result</h1>')
+    })
+
+    it('binds a cited symlink alias to its canonical read-only target', async () => {
+      const artifactPath = await tempFile('chat-target.html', '<h1>Result</h1>')
+      const citedPath = join(artifactPath, '..', 'chat-citation.html')
+      await symlink(artifactPath, citedPath)
+      const hasRecentNativeChatOutputPath = vi.fn(() => true)
+      const { commands } = createRuntimeFileCommands({
+        path: '/repo',
+        hasRecentNativeChatOutputPath
+      })
+
+      const result = await commands.resolveTerminalPath(
+        'id:wt-1',
+        citedPath,
+        null,
+        'client-a',
+        null,
+        true,
+        { tabId: 'tab-1', sessionId: 'session-1' }
+      )
+
+      expect(hasRecentNativeChatOutputPath).toHaveBeenCalledWith(
+        'wt-1',
+        { tabId: 'tab-1', sessionId: 'session-1' },
+        citedPath,
+        citedPath
+      )
+      expect(result).toMatchObject({
+        absolutePath: await realpath(artifactPath),
+        exists: true,
+        openTarget: {
+          kind: 'absolute-file',
+          absolutePath: await realpath(artifactPath),
+          readOnly: true
+        }
+      })
+    })
+
+    it('refuses an out-of-worktree chat path without transcript provenance', async () => {
+      const artifactPath = await tempFile('uncited-result.html', '<h1>Secret</h1>')
+      const hasRecentNativeChatOutputPath = vi.fn(() => false)
+      const { commands } = createRuntimeFileCommands({
+        path: '/repo',
+        hasRecentNativeChatOutputPath
+      })
+
+      const result = await commands.resolveTerminalPath(
+        'id:wt-1',
+        artifactPath,
+        null,
+        'client-a',
+        null,
+        true,
+        { tabId: 'tab-1', sessionId: 'session-1' }
+      )
+
+      expect(result).toMatchObject({ relativePath: null, exists: false })
+      expect(result.openTarget).toBeUndefined()
+      expect(hasRecentNativeChatOutputPath).toHaveBeenCalledTimes(1)
+    })
+
+    it('refuses native-chat tilde paths when the workspace runs in WSL', async () => {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      const hasRecentNativeChatOutputPath = vi.fn(() => true)
+      const { commands } = createRuntimeFileCommands({
+        path: String.raw`\\wsl.localhost\Ubuntu\work\repo`,
+        hasRecentNativeChatOutputPath
+      })
+
+      const result = await commands.resolveTerminalPath(
+        'id:wt-1',
+        '~/.ssh/config',
+        null,
+        'client-a',
+        null,
+        true,
+        { tabId: 'tab-1', sessionId: 'session-1' }
+      )
+
+      expect(result).toMatchObject({ relativePath: null, absolutePath: null, exists: false })
+      expect(hasRecentNativeChatOutputPath).not.toHaveBeenCalled()
     })
 
     it('does not mint an absolute terminal artifact grant for an unobserved path', async () => {
@@ -2213,6 +2393,69 @@ describe('RuntimeFileCommands', () => {
       expect(writeTerminalArtifact).toHaveBeenCalled()
     })
 
+    it('reads a remote non-temp artifact cited by native chat', async () => {
+      const artifactPath = '/home/me/report.json'
+      const { commands, readTerminalArtifact } = createRemoteTerminalArtifactGrantFixture(
+        artifactPath,
+        true
+      )
+      const result = await resolveRemoteNativeChatArtifact(commands, artifactPath)
+      const target = absoluteFileTarget(result)
+
+      await expect(
+        commands.readTerminalArtifactFile(
+          'id:wt-1',
+          target.grantId,
+          target.absolutePath,
+          'client-a'
+        )
+      ).resolves.toMatchObject({ content: '{"ok":true}' })
+      expect(readTerminalArtifact).toHaveBeenCalledWith(
+        artifactPath,
+        expect.objectContaining({ expectedRealPath: artifactPath })
+      )
+    })
+
+    it('rejects a retargeted remote native-chat artifact grant', async () => {
+      const artifactPath = '/home/me/report.json'
+      const { commands, readTerminalArtifact, moveArtifactTarget } =
+        createRemoteTerminalArtifactGrantFixture(artifactPath, true)
+      const result = await resolveRemoteNativeChatArtifact(commands, artifactPath)
+      const target = absoluteFileTarget(result)
+
+      moveArtifactTarget('/home/me/private.json')
+
+      await expect(
+        commands.readTerminalArtifactFile(
+          'id:wt-1',
+          target.grantId,
+          target.absolutePath,
+          'client-a'
+        )
+      ).rejects.toThrow('terminal_file_grant_stale')
+      expect(readTerminalArtifact).not.toHaveBeenCalled()
+    })
+
+    it('rejects a replaced remote native-chat artifact grant', async () => {
+      const artifactPath = '/home/me/report.json'
+      const { commands, readTerminalArtifact, replaceArtifact } =
+        createRemoteTerminalArtifactGrantFixture(artifactPath, true)
+      const result = await resolveRemoteNativeChatArtifact(commands, artifactPath)
+      const target = absoluteFileTarget(result)
+
+      replaceArtifact()
+
+      await expect(
+        commands.readTerminalArtifactFile(
+          'id:wt-1',
+          target.grantId,
+          target.absolutePath,
+          'client-a'
+        )
+      ).rejects.toThrow('terminal_file_grant_stale')
+      expect(readTerminalArtifact).not.toHaveBeenCalled()
+    })
+
     it('rejects remote terminal artifact reads when a grant no longer resolves to the granted path', async () => {
       const { commands, readTerminalArtifact, moveArtifactTarget } =
         createRemoteTerminalArtifactGrantFixture()
@@ -2294,6 +2537,28 @@ describe('RuntimeFileCommands', () => {
       expect(stat).not.toHaveBeenCalled()
     })
 
+    it('still refuses a native-chat ~/ path on a remote worktree', async () => {
+      const hasRecentNativeChatOutputPath = vi.fn(() => true)
+      const { commands, store } = createRuntimeFileCommands({
+        path: '/repo',
+        hasRecentNativeChatOutputPath
+      })
+      store.getRepo.mockReturnValue({ connectionId: 'ssh-1' })
+
+      const result = await commands.resolveTerminalPath(
+        'id:wt-1',
+        '~/notes.md',
+        null,
+        'client-a',
+        null,
+        true,
+        { tabId: 'tab-1', sessionId: 'session-1' }
+      )
+
+      expect(result).toMatchObject({ relativePath: null, exists: false })
+      expect(hasRecentNativeChatOutputPath).not.toHaveBeenCalled()
+    })
+
     it('reports a missing remote file as not existing', async () => {
       const { commands, store } = createRuntimeFileCommands({ path: '/repo' })
       store.getRepo.mockReturnValue({ connectionId: 'ssh-1' })
diff --git a/src/main/runtime/orca-runtime-files.ts b/src/main/runtime/orca-runtime-files.ts
index f85bff8abde..fd8f76796a6 100644
--- a/src/main/runtime/orca-runtime-files.ts
+++ b/src/main/runtime/orca-runtime-files.ts
@@ -45,6 +45,7 @@ import type {
   RuntimeFileReadChunkResult,
   RuntimeFilePreviewResult,
   RuntimeFileReadResult,
+  RuntimeNativeChatFileContext,
   RuntimeTerminalPathResolution
 } from '../../shared/runtime-types'
 import {
@@ -183,6 +184,8 @@ type TerminalFileGrant = {
   clientId?: string
   expiresAt: number
   statIdentity: string | null
+  readOnly: boolean
+  provenance: 'terminal-output' | 'native-chat'
   expiryTimer?: ReturnType<typeof setTimeout>
 }
 
@@ -524,6 +527,12 @@ export type RuntimeFileCommandHost = {
     pathText: string,
     absolutePath: string
   ): boolean | Promise<boolean>
+  hasRecentNativeChatOutputPath?(
+    worktreeId: string,
+    context: RuntimeNativeChatFileContext,
+    pathText: string,
+    absolutePath: string
+  ): boolean | Promise<boolean>
   resolveRuntimeGitTarget(
     selector: string
   ): Promise<{ worktree: ResolvedRuntimeFileWorktree; connectionId?: string }>
@@ -726,7 +735,8 @@ export class RuntimeFileCommands {
     cwd?: string | null,
     clientId?: string,
     terminalHandle?: string | null,
-    crossWorkspace?: boolean
+    crossWorkspace?: boolean,
+    nativeChatContext?: RuntimeNativeChatFileContext | null
   ): Promise<RuntimeTerminalPathResolution> {
     const store = this.host.requireStore()
     const target = await this.host.resolveRuntimeFileTarget(worktreeSelector)
@@ -750,9 +760,9 @@ export class RuntimeFileCommands {
       isDirectory: false
     }
 
-    // Why: remote home is unknown (only local os.homedir), so a tapped ~/… on a remote worktree is not-openable, not guessed.
+    // Why: SSH/WSL homes are unknown here; native-chat grants must not expand their ~/… paths against the local host home.
     const isTilde = pathText.startsWith('~/') || pathText.startsWith('~\\')
-    if (isTilde && connectionId) {
+    if (isTilde && (connectionId || (nativeChatContext && parseWslPath(worktree.path)))) {
       return empty
     }
     const expanded = isTilde ? resolveRuntimePath(homedir(), pathText.slice(2)) : pathText
@@ -802,6 +812,26 @@ export class RuntimeFileCommands {
         }
       }
 
+      if (
+        nativeChatContext &&
+        (await this.host.hasRecentNativeChatOutputPath?.(
+          worktree.id,
+          nativeChatContext,
+          pathText,
+          absolutePath
+        ))
+      ) {
+        const artifactPath = await this.resolveNativeChatArtifactPath(absolutePath, connectionId)
+        return await this.resolveAbsoluteFileGrant({
+          worktreeId: worktree.id,
+          artifactPath,
+          connectionId,
+          clientId,
+          readOnly: true,
+          provenance: 'native-chat'
+        })
+      }
+
       // Why: mobile taps may hit agent artifacts outside the worktree; grant the exact path, not arbitrary absolute paths.
       if (!normalizedTerminalHandle || !terminalCwd) {
         return { ...empty, relativePath, absolutePath }
@@ -831,38 +861,13 @@ export class RuntimeFileCommands {
       ) {
         return { ...empty, relativePath, absolutePath }
       }
-      const stats = connectionId
-        ? await this.statRemoteTerminalPath(artifactPath, connectionId)
-        : await this.statLocalTerminalPath(artifactPath)
-      const isDirectory = stats.isDirectory()
-      if (!isDirectory && isTerminalArtifactHardLinked(stats)) {
-        return { ...empty, relativePath, absolutePath }
-      }
-      const grant = isDirectory
-        ? null
-        : this.createTerminalFileGrant({
-            worktreeId: worktree.id,
-            absolutePath: artifactPath,
-            provider: connectionId ? 'ssh' : 'local',
-            connectionId,
-            clientId,
-            stats
-          })
-      return {
-        worktree: worktree.id,
-        relativePath: null,
-        absolutePath: artifactPath,
-        exists: true,
-        isDirectory,
-        openTarget: grant
-          ? {
-              kind: 'absolute-file',
-              provider: grant.provider,
-              absolutePath: artifactPath,
-              grantId: grant.id
-            }
-          : undefined
-      }
+      return await this.resolveAbsoluteFileGrant({
+        worktreeId: worktree.id,
+        artifactPath,
+        rejectedAbsolutePath: absolutePath,
+        connectionId,
+        clientId
+      })
     } catch (error) {
       // Report genuine not-found as missing; let transport/permission errors surface so remote taps aren't all reported missing.
       if (
@@ -909,6 +914,72 @@ export class RuntimeFileCommands {
     return resolveAllowedLocalTerminalArtifactPath(args.absolutePath, args.worktreePath)
   }
 
+  private async resolveNativeChatArtifactPath(
+    absolutePath: string,
+    connectionId?: string
+  ): Promise<string> {
+    if (!connectionId) {
+      return canonicalPathForArtifactComparison(absolutePath)
+    }
+    const provider = getSshFilesystemProvider(connectionId)
+    if (!provider) {
+      throw new Error(SSH_FILESYSTEM_PROVIDER_UNAVAILABLE_MESSAGE)
+    }
+    return provider.realpath(absolutePath)
+  }
+
+  private async resolveAbsoluteFileGrant(args: {
+    worktreeId: string
+    artifactPath: string
+    rejectedAbsolutePath?: string
+    connectionId?: string
+    clientId?: string
+    readOnly?: boolean
+    provenance?: TerminalFileGrant['provenance']
+  }): Promise<RuntimeTerminalPathResolution> {
+    const stats = args.connectionId
+      ? await this.statRemoteTerminalPath(args.artifactPath, args.connectionId)
+      : await this.statLocalTerminalPath(args.artifactPath)
+    const isDirectory = stats.isDirectory()
+    if (!isDirectory && isTerminalArtifactHardLinked(stats)) {
+      return {
+        worktree: args.worktreeId,
+        relativePath: null,
+        absolutePath: args.rejectedAbsolutePath ?? args.artifactPath,
+        exists: false,
+        isDirectory: false
+      }
+    }
+    const grant = isDirectory
+      ? null
+      : this.createTerminalFileGrant({
+          worktreeId: args.worktreeId,
+          absolutePath: args.artifactPath,
+          provider: args.connectionId ? 'ssh' : 'local',
+          connectionId: args.connectionId,
+          clientId: args.clientId,
+          readOnly: args.readOnly === true,
+          provenance: args.provenance ?? 'terminal-output',
+          stats
+        })
+    return {
+      worktree: args.worktreeId,
+      relativePath: null,
+      absolutePath: args.artifactPath,
+      exists: true,
+      isDirectory,
+      openTarget: grant
+        ? {
+            kind: 'absolute-file',
+            provider: grant.provider,
+            absolutePath: args.artifactPath,
+            grantId: grant.id,
+            ...(grant.readOnly ? { readOnly: true } : {})
+          }
+        : undefined
+    }
+  }
+
   private async resolveAllowedRemoteTerminalArtifactPath(
     absolutePath: string,
     connectionId: string
@@ -953,6 +1024,8 @@ export class RuntimeFileCommands {
     provider: 'local' | 'ssh'
     connectionId?: string
     clientId?: string
+    readOnly?: boolean
+    provenance: TerminalFileGrant['provenance']
     stats: RuntimeFileStatLike
   }): TerminalFileGrant {
     assertTerminalArtifactNotHardLinked(args.stats)
@@ -964,7 +1037,9 @@ export class RuntimeFileCommands {
       ...(args.connectionId ? { connectionId: args.connectionId } : {}),
       ...(args.clientId ? { clientId: args.clientId } : {}),
       expiresAt: Date.now() + TERMINAL_FILE_GRANT_TTL_MS,
-      statIdentity: terminalFileStatIdentity(args.stats)
+      statIdentity: terminalFileStatIdentity(args.stats),
+      readOnly: args.readOnly === true,
+      provenance: args.provenance
     }
     this.terminalFileGrants.set(grant.id, grant)
     this.scheduleTerminalFileGrantExpiry(grant)
@@ -1129,6 +1204,9 @@ export class RuntimeFileCommands {
       absolutePath,
       clientId
     )
+    if (grant.readOnly) {
+      throw new Error('terminal_file_grant_read_only')
+    }
     if (isMobileBinaryPath(grant.absolutePath)) {
       throw new Error('binary_file')
     }
@@ -1280,12 +1358,15 @@ export class RuntimeFileCommands {
     if (!provider) {
       throw new Error(SSH_FILESYSTEM_PROVIDER_UNAVAILABLE_MESSAGE)
     }
-    const allowedPath = await this.resolveAllowedRemoteTerminalArtifactPath(
-      grant.absolutePath,
-      grant.connectionId
-    )
-    // Why: relay I/O follows symlinks, so re-canonicalize a remote temp-artifact grant after the process can mutate it.
-    if (allowedPath !== grant.absolutePath) {
+    const canonicalPath =
+      grant.provenance === 'native-chat'
+        ? await provider.realpath(grant.absolutePath)
+        : await this.resolveAllowedRemoteTerminalArtifactPath(
+            grant.absolutePath,
+            grant.connectionId
+          )
+    // Why: relay I/O follows symlinks, so re-canonicalize after the remote process can mutate the path.
+    if (canonicalPath !== grant.absolutePath) {
       throw new Error('terminal_file_grant_stale')
     }
     return provider
diff --git a/src/main/runtime/orca-runtime-git.test.ts b/src/main/runtime/orca-runtime-git.test.ts
index fcde47d5a16..68c6ff798c9 100644
--- a/src/main/runtime/orca-runtime-git.test.ts
+++ b/src/main/runtime/orca-runtime-git.test.ts
@@ -318,8 +318,7 @@ describe('RuntimeGitCommands', () => {
       getRuntimeSettings: () =>
         ({
           commitMessageAi: { enabled: true, agentId: 'codex' },
-          agentCmdOverrides: {},
-          enableGitHubAttribution: false
+          agentCmdOverrides: {}
         }) as GlobalSettings,
       getCommitMessageAgentEnvironment: () => ({
         prepareForCodexLaunch: () => '/managed/codex-home'
@@ -374,8 +373,7 @@ describe('RuntimeGitCommands', () => {
       getRuntimeSettings: () =>
         ({
           commitMessageAi: { enabled: true, agentId: 'codex' },
-          agentCmdOverrides: {},
-          enableGitHubAttribution: false
+          agentCmdOverrides: {}
         }) as GlobalSettings,
       getCommitMessageAgentEnvironment: () => ({
         prepareForCodexLaunch
diff --git a/src/main/runtime/orca-runtime-git.ts b/src/main/runtime/orca-runtime-git.ts
index 022b53ac948..67812240e43 100644
--- a/src/main/runtime/orca-runtime-git.ts
+++ b/src/main/runtime/orca-runtime-git.ts
@@ -90,10 +90,7 @@ import type { HostedReviewProvider } from '../../shared/hosted-review'
 
 export type ResolvedRuntimeGitWorktree = Worktree & { git: GitWorktreeInfo }
 type RuntimeCommitMessageSettingsOverride = Partial<
-  Pick<
-    GlobalSettings,
-    'commitMessageAi' | 'sourceControlAi' | 'agentCmdOverrides' | 'enableGitHubAttribution'
-  >
+  Pick<GlobalSettings, 'commitMessageAi' | 'sourceControlAi' | 'agentCmdOverrides'>
 > & {
   commitMessageDiscoveryHostKey?: string
   sourceControlAiResolvedParams?: ResolvedSourceControlAiGenerationParams
diff --git a/src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts b/src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts
new file mode 100644
index 00000000000..06a5f1cfcd0
--- /dev/null
+++ b/src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { PtyProcessInfo } from '../providers/pty-process-info'
+import { OrcaRuntimeService } from './orca-runtime'
+
+const SSH_SCOPE = JSON.stringify({ kind: 'ssh', targetId: 'ssh-1' })
+const PROCESS_INCARNATION = 'remote:ssh-1:pty-1:inc-1'
+
+function runtimeWithInventory(
+  listProcesses: (connectionId?: string | null) => Promise<PtyProcessInfo[]>
+): OrcaRuntimeService {
+  const runtime = new OrcaRuntimeService()
+  runtime.setPtyController({
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess: async () => null,
+    listProcesses
+  })
+  return runtime
+}
+
+describe('terminal process incarnation liveness', () => {
+  it('classifies only an exact incarnation as live on its owning provider', async () => {
+    const listProcesses = vi.fn().mockResolvedValue([
+      {
+        id: 'remote:ssh-1:pty-1',
+        incarnationId: 'inc-1',
+        cwd: '',
+        title: 'worker'
+      }
+    ])
+    const runtime = runtimeWithInventory(listProcesses)
+
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, SSH_SCOPE)
+    ).resolves.toBe('live')
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness('remote:ssh-1:pty-1:inc-old', SSH_SCOPE)
+    ).resolves.toBe('dead')
+    expect(listProcesses).toHaveBeenNthCalledWith(1, 'ssh-1')
+    expect(listProcesses).toHaveBeenNthCalledWith(2, 'ssh-1')
+  })
+
+  it('keeps missing or malformed identity and unavailable inventory unknown', async () => {
+    const listProcesses = vi
+      .fn()
+      .mockResolvedValueOnce([{ id: 'remote:ssh-1:pty-1', cwd: '', title: 'worker' }])
+      .mockResolvedValueOnce([
+        { id: 'remote:ssh-1:pty-1', incarnationId: ' inc-1 ', cwd: '', title: 'worker' }
+      ])
+      .mockRejectedValueOnce(new Error('provider unavailable'))
+    const runtime = runtimeWithInventory(listProcesses)
+
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, SSH_SCOPE)
+    ).resolves.toBe('unknown')
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, SSH_SCOPE)
+    ).resolves.toBe('unknown')
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, SSH_SCOPE)
+    ).resolves.toBe('unknown')
+  })
+
+  it('does not inspect an unproven host scope', async () => {
+    const listProcesses = vi.fn().mockResolvedValue([])
+    const runtime = runtimeWithInventory(listProcesses)
+
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, null)
+    ).resolves.toBe('unknown')
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, '{"kind":"ssh"}')
+    ).resolves.toBe('unknown')
+    expect(listProcesses).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    [{ kind: 'local', hostId: 'local' }, null],
+    [{ kind: 'wsl', hostId: 'local', distro: 'Ubuntu' }, null]
+  ] as const)('uses the local provider inventory for %s scope', async (scope, connectionId) => {
+    const listProcesses = vi.fn().mockResolvedValue([])
+    const runtime = runtimeWithInventory(listProcesses)
+
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness('local-pty:inc-1', JSON.stringify(scope))
+    ).resolves.toBe('dead')
+    expect(listProcesses).toHaveBeenCalledWith(connectionId)
+  })
+})
diff --git a/src/main/runtime/orca-runtime-terminal-split-authority.test.ts b/src/main/runtime/orca-runtime-terminal-split-authority.test.ts
new file mode 100644
index 00000000000..3aa6ae47603
--- /dev/null
+++ b/src/main/runtime/orca-runtime-terminal-split-authority.test.ts
@@ -0,0 +1,378 @@
+import { describe, expect, it, vi } from 'vitest'
+import { getDefaultWorkspaceSession } from '../../shared/constants'
+import type { RuntimeMobileSessionTabsSnapshot } from '../../shared/runtime-types'
+import type { TerminalLayoutSnapshot, WorkspaceSessionState } from '../../shared/types'
+import { makePaneKey } from '../../shared/stable-pane-id'
+import { OrcaRuntimeService } from './orca-runtime'
+
+const REPO_ID = 'repo-1'
+const WORKTREE_ID = `${REPO_ID}::/workspace`
+const TAB_ID = 'tab-remote'
+const SOURCE_LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const SOURCE_PTY_ID = 'pty-source'
+const SPLIT_PTY_ID = 'pty-split'
+
+function sourceLayout(): TerminalLayoutSnapshot {
+  return {
+    root: { type: 'leaf', leafId: SOURCE_LEAF_ID },
+    activeLeafId: SOURCE_LEAF_ID,
+    expandedLeafId: null,
+    ptyIdsByLeafId: { [SOURCE_LEAF_ID]: SOURCE_PTY_ID }
+  }
+}
+
+function persistedSession(includeSource = true): WorkspaceSessionState {
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: includeSource
+      ? {
+          [WORKTREE_ID]: [
+            {
+              id: TAB_ID,
+              ptyId: SOURCE_PTY_ID,
+              worktreeId: WORKTREE_ID,
+              title: 'Remote terminal',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        }
+      : {},
+    terminalLayoutsByTabId: includeSource ? { [TAB_ID]: sourceLayout() } : {}
+  }
+}
+
+function remoteSnapshot(): RuntimeMobileSessionTabsSnapshot {
+  const layout = sourceLayout()
+  return {
+    worktree: WORKTREE_ID,
+    publicationEpoch: 'remote-viewer',
+    snapshotVersion: 1,
+    activeGroupId: 'group-1',
+    activeTabId: `${TAB_ID}::${SOURCE_LEAF_ID}`,
+    activeTabType: 'terminal',
+    tabGroups: [{ id: 'group-1', activeTabId: TAB_ID, tabOrder: [TAB_ID] }],
+    tabs: [
+      {
+        type: 'terminal',
+        id: `${TAB_ID}::${SOURCE_LEAF_ID}`,
+        parentTabId: TAB_ID,
+        leafId: SOURCE_LEAF_ID,
+        ptyId: SOURCE_PTY_ID,
+        title: 'Remote terminal',
+        parentLayout: layout,
+        isActive: true
+      }
+    ]
+  }
+}
+
+function createHarness(
+  includeSource = true,
+  options: {
+    connectionId?: string | null
+    deferReveal?: boolean
+    deferSpawn?: boolean
+    includePairedSnapshot?: boolean
+    rendererMounted?: boolean
+    sourceIncarnationId?: string
+    stopAndWaitResult?: boolean
+  } = {}
+) {
+  let session = persistedSession(includeSource)
+  const connectionId = options.connectionId ?? null
+  const ownerHostId = connectionId ? `ssh:${connectionId}` : 'local'
+  const requestedSessionHostIds: (string | undefined)[] = []
+  const repo = {
+    id: REPO_ID,
+    path: '/workspace',
+    displayName: 'repo',
+    badgeColor: 'blue',
+    addedAt: 1,
+    ...(connectionId ? { connectionId } : {})
+  }
+  const store = {
+    getRepos: () => [repo],
+    getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
+    getWorkspaceSession: (hostId?: string) => {
+      requestedSessionHostIds.push(hostId)
+      return hostId === undefined || hostId === ownerHostId ? session : getDefaultWorkspaceSession()
+    },
+    setWorkspaceSession: (next: WorkspaceSessionState) => {
+      session = next
+    },
+    persistPtyBinding: () => true
+  }
+  let resolveSpawn: ((result: { id: string }) => void) | undefined
+  const spawn = options.deferSpawn
+    ? vi.fn(
+        () =>
+          new Promise<{ id: string }>((resolve) => {
+            resolveSpawn = resolve
+          })
+      )
+    : vi.fn(async () => ({ id: SPLIT_PTY_ID }))
+  const kill = vi.fn(() => true)
+  const retireRejectedPty = vi.fn()
+  const stopAndWait = vi.fn(async () => options.stopAndWaitResult ?? true)
+  let resolveReveal: ((result: { tabId: string }) => void) | undefined
+  const revealTerminalSession = options.deferReveal
+    ? vi.fn(
+        () =>
+          new Promise<{ tabId: string }>((resolve) => {
+            resolveReveal = resolve
+          })
+      )
+    : vi.fn().mockRejectedValue(new Error(`Terminal tab ${TAB_ID} not found`))
+  const runtime = new OrcaRuntimeService(store as never)
+  Object.assign(runtime, {
+    resolveTerminalWorkspaceLaunchScope: vi.fn(async () => ({
+      id: WORKTREE_ID,
+      path: '/workspace',
+      connectionId,
+      repo,
+      folderWorkspace: null
+    }))
+  })
+  runtime.setPtyController({
+    spawn,
+    write: () => true,
+    kill,
+    retireRejectedPty,
+    ...(options.stopAndWaitResult !== undefined ? { stopAndWait } : {}),
+    getForegroundProcess: async () => null
+  })
+  runtime.setNotifier({ revealTerminalSession } as never)
+  runtime.syncWindowGraph(1, {
+    tabs:
+      includeSource && options.rendererMounted
+        ? [
+            {
+              tabId: TAB_ID,
+              worktreeId: WORKTREE_ID,
+              title: 'Restored terminal',
+              activeLeafId: SOURCE_LEAF_ID,
+              layout: { type: 'leaf', leafId: SOURCE_LEAF_ID } as const
+            }
+          ]
+        : [],
+    leaves:
+      includeSource && options.rendererMounted
+        ? [
+            {
+              tabId: TAB_ID,
+              worktreeId: WORKTREE_ID,
+              leafId: SOURCE_LEAF_ID,
+              paneRuntimeId: 1,
+              ptyId: SOURCE_PTY_ID
+            }
+          ]
+        : [],
+    mobileSessionTabs: (options.includePairedSnapshot ?? includeSource) ? [remoteSnapshot()] : []
+  })
+  runtime.registerPty(SOURCE_PTY_ID, WORKTREE_ID, connectionId, {
+    tabId: TAB_ID,
+    leafId: SOURCE_LEAF_ID,
+    ...(options.sourceIncarnationId ? { incarnationId: options.sourceIncarnationId } : {})
+  })
+  const internals = runtime as unknown as {
+    issuePtyHandle: (pty: unknown) => string
+    mobileSessionTabsByWorktree: Map<string, RuntimeMobileSessionTabsSnapshot>
+    ptysById: Map<string, unknown>
+  }
+  const handle = internals.issuePtyHandle(internals.ptysById.get(SOURCE_PTY_ID))
+  return {
+    runtime,
+    handle,
+    spawn,
+    kill,
+    retireRejectedPty,
+    stopAndWait,
+    revealTerminalSession,
+    getSession: () => session,
+    getSnapshot: () => internals.mobileSessionTabsByWorktree.get(WORKTREE_ID),
+    requestedSessionHostIds,
+    replaceSourceIncarnation: (incarnationId: string) =>
+      runtime.registerPty(SOURCE_PTY_ID, WORKTREE_ID, connectionId, {
+        tabId: TAB_ID,
+        leafId: SOURCE_LEAF_ID,
+        incarnationId
+      }),
+    replacePersistedSourceIncarnation: (incarnationId: string) => {
+      session = {
+        ...session,
+        terminalPtyIncarnationsByPaneKey: {
+          ...session.terminalPtyIncarnationsByPaneKey,
+          [makePaneKey(TAB_ID, SOURCE_LEAF_ID)]: incarnationId
+        }
+      }
+    },
+    resolveReveal: () => resolveReveal?.({ tabId: TAB_ID }),
+    resolveSpawn: () => resolveSpawn?.({ id: SPLIT_PTY_ID })
+  }
+}
+
+describe('remote runtime terminal split authority', () => {
+  it('splits a persisted tab without consulting an unmounted host renderer', async () => {
+    const harness = createHarness()
+
+    const outcome = await harness.runtime
+      .splitTerminal(harness.handle, { direction: 'vertical' })
+      .then((split) => ({ ok: true as const, split }))
+      .catch((error: unknown) => ({ ok: false as const, error }))
+
+    expect.soft(outcome).toMatchObject({
+      ok: true,
+      split: { tabId: TAB_ID, handle: expect.stringMatching(/^term_/) }
+    })
+    expect.soft(harness.spawn).toHaveBeenCalledTimes(1)
+    expect.soft(harness.kill).not.toHaveBeenCalled()
+    expect.soft(harness.revealTerminalSession).not.toHaveBeenCalled()
+    const persistedLayout = harness.getSession().terminalLayoutsByTabId[TAB_ID]
+    expect(persistedLayout).toMatchObject({
+      root: { type: 'split', direction: 'vertical' },
+      ptyIdsByLeafId: {
+        [SOURCE_LEAF_ID]: SOURCE_PTY_ID
+      }
+    })
+    expect(Object.values(persistedLayout!.ptyIdsByLeafId!)).toContain(SPLIT_PTY_ID)
+    const siblingSurfaces = harness
+      .getSnapshot()!
+      .tabs.filter(
+        (tab): tab is Extract<typeof tab, { type: 'terminal' }> =>
+          tab.type === 'terminal' && tab.parentTabId === TAB_ID
+      )
+    expect(siblingSurfaces).toHaveLength(2)
+    expect(siblingSurfaces.every((tab) => tab.parentLayout?.root?.type === 'split')).toBe(true)
+  })
+
+  it('rejects an unowned split source before spawning a PTY', async () => {
+    const harness = createHarness(false)
+
+    const outcome = await harness.runtime
+      .splitTerminal(harness.handle, { direction: 'vertical' })
+      .then(() => 'resolved')
+      .catch((error: unknown) => (error instanceof Error ? error.message : String(error)))
+
+    expect.soft(outcome).toBe('terminal_split_source_not_found')
+    expect.soft(harness.spawn).not.toHaveBeenCalled()
+    expect.soft(harness.kill).not.toHaveBeenCalled()
+    expect.soft(harness.revealTerminalSession).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    { label: 'local', connectionId: null, expectedHostId: 'local' },
+    { label: 'SSH', connectionId: 'ssh-1', expectedHostId: 'ssh:ssh-1' }
+  ])(
+    'rejects a same-ID $label source replacement when restored persistence lacks an incarnation',
+    async ({ connectionId, expectedHostId }) => {
+      const harness = createHarness(true, {
+        connectionId,
+        deferSpawn: true,
+        includePairedSnapshot: false,
+        rendererMounted: true,
+        sourceIncarnationId: 'source-before'
+      })
+
+      const split = harness.runtime.splitTerminal(harness.handle, { direction: 'vertical' })
+      await vi.waitFor(() => expect(harness.spawn).toHaveBeenCalledOnce())
+
+      expect(
+        harness.getSession().terminalPtyIncarnationsByPaneKey?.[makePaneKey(TAB_ID, SOURCE_LEAF_ID)]
+      ).toBeUndefined()
+      expect(harness.spawn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          expectedSourceBinding: expect.objectContaining({ ptyId: SOURCE_PTY_ID })
+        })
+      )
+      // Why: persistence never recorded this incarnation, so sending it would make the store
+      // reject every split from a restored pane; the live id is fenced in-runtime instead.
+      expect(harness.spawn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          expectedSourceBinding: expect.not.objectContaining({ incarnationId: expect.anything() })
+        })
+      )
+
+      harness.replaceSourceIncarnation('source-after')
+      harness.resolveSpawn()
+
+      await expect(split).rejects.toThrow('terminal_split_source_not_found')
+      expect(harness.kill).toHaveBeenCalledWith(SPLIT_PTY_ID)
+      expect(harness.requestedSessionHostIds).toContain(expectedHostId)
+    }
+  )
+
+  it('rejects a same-ID paired-runtime source replacement recovered without an incarnation map', async () => {
+    const harness = createHarness(true, {
+      deferSpawn: true,
+      includePairedSnapshot: true,
+      rendererMounted: false,
+      sourceIncarnationId: 'remote-before'
+    })
+
+    const split = harness.runtime.splitTerminal(harness.handle, { direction: 'horizontal' })
+    await vi.waitFor(() => expect(harness.spawn).toHaveBeenCalledOnce())
+    expect(harness.spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        expectedSourceBinding: expect.not.objectContaining({ incarnationId: expect.anything() })
+      })
+    )
+
+    harness.replaceSourceIncarnation('remote-after')
+    harness.resolveSpawn()
+
+    await expect(split).rejects.toThrow('terminal_split_source_not_found')
+    expect(harness.kill).toHaveBeenCalledWith(SPLIT_PTY_ID)
+    expect(harness.revealTerminalSession).not.toHaveBeenCalled()
+  })
+
+  it('rejects a persisted-only source incarnation change during spawn', async () => {
+    const harness = createHarness(true, {
+      deferSpawn: true,
+      includePairedSnapshot: false,
+      stopAndWaitResult: true
+    })
+    harness.replacePersistedSourceIncarnation('persisted-before')
+
+    const split = harness.runtime.splitTerminal(harness.handle, { direction: 'horizontal' })
+    await vi.waitFor(() => expect(harness.spawn).toHaveBeenCalledOnce())
+    harness.replacePersistedSourceIncarnation('persisted-after')
+    harness.resolveSpawn()
+
+    await expect(split).rejects.toThrow('terminal_split_source_not_found')
+    expect(harness.stopAndWait).toHaveBeenCalledWith(
+      SPLIT_PTY_ID,
+      expect.objectContaining({ deadlineMs: expect.any(Number) })
+    )
+    expect(harness.kill).not.toHaveBeenCalled()
+    expect(harness.retireRejectedPty).toHaveBeenCalledWith(SPLIT_PTY_ID)
+  })
+
+  it('revalidates a projected paired-runtime source after renderer adoption', async () => {
+    const harness = createHarness(false, {
+      deferReveal: true,
+      includePairedSnapshot: true,
+      sourceIncarnationId: 'projected-before',
+      stopAndWaitResult: false
+    })
+
+    const split = harness.runtime.splitTerminal(harness.handle, { direction: 'horizontal' })
+    await vi.waitFor(() => expect(harness.revealTerminalSession).toHaveBeenCalledOnce())
+    expect(harness.spawn).toHaveBeenCalledWith(
+      expect.not.objectContaining({ expectedSourceBinding: expect.anything() })
+    )
+
+    harness.replaceSourceIncarnation('projected-after')
+    harness.resolveReveal()
+
+    await expect(split).rejects.toThrow('terminal_split_source_not_found')
+    expect(harness.stopAndWait).toHaveBeenCalledWith(
+      SPLIT_PTY_ID,
+      expect.objectContaining({ deadlineMs: expect.any(Number) })
+    )
+    expect(harness.kill).toHaveBeenCalledWith(SPLIT_PTY_ID)
+    expect(harness.retireRejectedPty).toHaveBeenCalledWith(SPLIT_PTY_ID)
+  })
+})
diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts
index e5bacc5eb9e..9d141068caa 100644
--- a/src/main/runtime/orca-runtime.test.ts
+++ b/src/main/runtime/orca-runtime.test.ts
@@ -1525,6 +1525,7 @@ function makeRuntimeStoreWithWorkspaceSession(
             }
           }
         }
+        return true
       }
     )
   }
@@ -2847,7 +2848,9 @@ describe('OrcaRuntimeService', () => {
     )
   })
 
-  it('recovers a disconnected pane through one HUB-owned replacement', async () => {
+  // Inverted for STA-3077 S8: the replacement grant this pinned was unreachable in production
+  // (relay-native lease ptyId vs app-form runtime ptyId) and has been deleted.
+  it('refuses to replace a disconnected SSH pane, even inside the lease grace window', async () => {
     const tabId = 'tab-recover'
     const runtime = createRuntimeWithSshLease('pty-expired', tabId)
     const paneKey = makePaneKey(tabId, HEADLESS_LEAF_ID)
@@ -2869,18 +2872,8 @@ describe('OrcaRuntimeService', () => {
 
     await expect(
       runtime.recoverTerminalPane(paneKey, TEST_WORKTREE_ID, expiredHandle)
-    ).resolves.toMatchObject({
-      handle: 'term-replacement',
-      tabId,
-      leafId: HEADLESS_LEAF_ID,
-      worktreeId: TEST_WORKTREE_ID
-    })
-    expect(createTerminal).toHaveBeenCalledWith(`id:${TEST_WORKTREE_ID}`, {
-      tabId,
-      leafId: HEADLESS_LEAF_ID,
-      focus: false,
-      persistHostSessionBinding: true
-    })
+    ).rejects.toThrow('terminal_not_recoverable')
+    expect(createTerminal).not.toHaveBeenCalled()
   })
 
   it('rejects missing host panes without authoritative expired binding evidence', async () => {
@@ -2946,7 +2939,9 @@ describe('OrcaRuntimeService', () => {
     expect(createTerminal).not.toHaveBeenCalled()
   })
 
-  it('deduplicates concurrent pane recovery across stale viewer handles', async () => {
+  // Inverted for STA-3077 S8: this was the only consumer of the recovery-dedup map, which existed
+  // solely to de-duplicate the (unreachable, now deleted) replacement grant. Scenario kept.
+  it('concurrent recovery requests for one disconnected pane both refuse and create nothing', async () => {
     const tabId = 'tab-concurrent'
     const runtime = createRuntimeWithSshLease('pty-expired', tabId)
     const paneKey = makePaneKey(tabId, HEADLESS_LEAF_ID)
@@ -2956,30 +2951,23 @@ describe('OrcaRuntimeService', () => {
     })
     const expiredHandle = runtime.resolveTerminalPane(paneKey, TEST_WORKTREE_ID).handle
     runtime.onPtyExit('pty-expired', 0)
-    let finishCreate!: (result: RuntimeTerminalCreate) => void
-    const pendingCreate = new Promise<RuntimeTerminalCreate>((resolve) => {
-      finishCreate = resolve
-    })
-    const createTerminal = vi.spyOn(runtime, 'createTerminal').mockReturnValue(pendingCreate)
+    // Never settles: a resurrected grant would hang the assertion rather than quietly pass.
+    const createTerminal = vi
+      .spyOn(runtime, 'createTerminal')
+      .mockReturnValue(new Promise<RuntimeTerminalCreate>(() => {}))
 
     const first = runtime.recoverTerminalPane(paneKey, TEST_WORKTREE_ID, expiredHandle)
     const second = runtime.recoverTerminalPane(paneKey, TEST_WORKTREE_ID, 'term-other-viewer')
-    finishCreate({
-      handle: 'term-replacement',
-      tabId,
-      paneKey,
-      ptyId: 'pty-replacement',
-      worktreeId: TEST_WORKTREE_ID,
-      title: null,
-      surface: 'background'
-    })
 
-    await expect(first).resolves.toEqual(expect.objectContaining({ handle: 'term-replacement' }))
+    await expect(first).rejects.toThrow('terminal_not_recoverable')
+    // The second viewer's handle never mapped to this pane, so it still fails the identity guard.
     await expect(second).rejects.toThrow('terminal_not_found')
-    expect(createTerminal).toHaveBeenCalledOnce()
+    expect(createTerminal).not.toHaveBeenCalled()
   })
 
-  it('clears a failed pane recovery so a later reconnect can retry', async () => {
+  // Inverted for STA-3077 S8: it pinned retry-after-a-failed-grant, and the grant (unreachable at
+  // the pty-id shapes production mints) is deleted, so there is nothing left to retry into.
+  it('a repeated recovery request never accumulates a grant', async () => {
     const tabId = 'tab-retry'
     const runtime = createRuntimeWithSshLease('pty-expired', tabId)
     const paneKey = makePaneKey(tabId, HEADLESS_LEAF_ID)
@@ -2989,6 +2977,7 @@ describe('OrcaRuntimeService', () => {
     })
     const expiredHandle = runtime.resolveTerminalPane(paneKey, TEST_WORKTREE_ID).handle
     runtime.onPtyExit('pty-expired', 0)
+    // A fully working createTerminal stays armed across both calls to prove neither one reaches it.
     const createTerminal = vi
       .spyOn(runtime, 'createTerminal')
       .mockRejectedValueOnce(new Error('relay_reconnecting'))
@@ -3004,13 +2993,16 @@ describe('OrcaRuntimeService', () => {
 
     await expect(
       runtime.recoverTerminalPane(paneKey, TEST_WORKTREE_ID, expiredHandle)
-    ).rejects.toThrow('relay_reconnecting')
+    ).rejects.toThrow('terminal_not_recoverable')
     await expect(
       runtime.recoverTerminalPane(paneKey, TEST_WORKTREE_ID, expiredHandle)
-    ).resolves.toMatchObject({ handle: 'term-retry' })
-    expect(createTerminal).toHaveBeenCalledTimes(2)
+    ).rejects.toThrow('terminal_not_recoverable')
+    expect(createTerminal).toHaveBeenCalledTimes(0)
   })
 
+  // STA-3077 S8: no longer discriminating — since the grant was deleted, an 'expired' lease refuses
+  // identically (see the grace-window case above), so 'terminated' no longer selects the outcome.
+  // Retained only as a regression guard: if a replacement path ever returns, this must stay a refusal.
   it('does not recover a pane whose authoritative SSH lease was terminated', async () => {
     const tabId = 'tab-terminated'
     const runtime = createRuntimeWithSshLease('pty-terminated', tabId, 'terminated')
@@ -3324,6 +3316,37 @@ describe('OrcaRuntimeService', () => {
     expect(split.tabs.filter((tab) => tab.type === 'terminal')).toHaveLength(2)
   })
 
+  it('resolves projected split authority from the parent layout PTY binding', () => {
+    const runtime = createRuntime()
+    const tabId = 'projected-parent-tab'
+    const leafId = 'projected-leaf'
+    const ptyId = 'projected-pty'
+    const internals = runtime as unknown as {
+      mobileSessionTabsByWorktree: Map<string, unknown>
+      resolveTerminalSplitSourceAuthority: (
+        worktreeId: string,
+        tabId: string,
+        leafId: string,
+        ptyId: string
+      ) => { persisted: boolean; rendererMounted: boolean } | null
+    }
+    internals.mobileSessionTabsByWorktree.set(TEST_WORKTREE_ID, {
+      tabs: [
+        {
+          type: 'terminal',
+          parentTabId: tabId,
+          leafId,
+          ptyId: null,
+          parentLayout: { ptyIdsByLeafId: { [leafId]: ptyId } }
+        }
+      ]
+    })
+
+    expect(
+      internals.resolveTerminalSplitSourceAuthority(TEST_WORKTREE_ID, tabId, leafId, ptyId)
+    ).toMatchObject({ persisted: false, rendererMounted: false })
+  })
+
   it('keeps targeted terminal lists from adopting controller PTYs for other worktrees', async () => {
     vi.mocked(listWorktrees).mockResolvedValue([
       ...MOCK_GIT_WORKTREES,
@@ -11400,6 +11423,57 @@ describe('OrcaRuntimeService', () => {
     })
   })
 
+  it('keeps blocked prompt text authoritative over an OpenCode marker', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn: vi.fn().mockResolvedValue({ id: 'pty-1' }),
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => 'opencode'
+    })
+    const leafId = '11111111-1111-4111-8111-111111111111'
+    runtime.attachWindow(1)
+    runtime.syncWindowGraph(1, {
+      tabs: [
+        {
+          tabId: 'tab-1',
+          worktreeId: TEST_WORKTREE_ID,
+          title: 'OC | Native session',
+          activeLeafId: leafId,
+          layout: null
+        }
+      ],
+      leaves: [
+        {
+          tabId: 'tab-1',
+          worktreeId: TEST_WORKTREE_ID,
+          leafId,
+          paneRuntimeId: 1,
+          ptyId: 'pty-1',
+          paneTitle: 'OC | Native session'
+        }
+      ]
+    })
+    runtime.onPtyData(
+      'pty-1',
+      'Permission required\nThis command requires permission\nAllow once\nAllow always\nReject\n',
+      123
+    )
+    const [terminal] = (await runtime.listTerminals()).terminals
+
+    await expect(runtime.getTerminalAgentStatus(terminal.handle)).resolves.toEqual({
+      handle: terminal.handle,
+      isRunningAgent: true,
+      status: 'permission'
+    })
+    await expect(
+      runtime.waitForTerminal(terminal.handle, { condition: 'tui-idle', timeoutMs: 1_000 })
+    ).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'codex-interactive-prompt'
+    })
+  })
+
   it('reports permission from blocked wait text over title-only working state', async () => {
     const runtime = new OrcaRuntimeService(store)
     runtime.setPtyController({
@@ -14757,6 +14831,207 @@ describe('OrcaRuntimeService', () => {
     }
   })
 
+  it('keeps a persisted split when mounted renderer adoption rejects', async () => {
+    const tabId = 'persisted-mounted-tab'
+    const ptyId = 'persisted-mounted-pty'
+    const splitPtyId = 'persisted-mounted-split-pty'
+    const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
+      makeWorkspaceSessionWithHeadlessTerminal({
+        tabsByWorktree: {
+          [TEST_WORKTREE_ID]: [
+            {
+              id: tabId,
+              ptyId,
+              worktreeId: TEST_WORKTREE_ID,
+              title: 'Persisted terminal',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        },
+        terminalLayoutsByTabId: {
+          [tabId]: makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: ptyId })
+        }
+      })
+    )
+    const revealTerminalSession = vi.fn().mockRejectedValue(new Error('renderer rejected'))
+    const kill = vi.fn(() => true)
+    let resolveSpawn!: (result: { id: string }) => void
+    const spawn = vi.fn(
+      (_args: unknown) =>
+        new Promise<{ id: string }>((resolve) => {
+          resolveSpawn = resolve
+        })
+    )
+    const runtime = new OrcaRuntimeService(runtimeStore as never)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill,
+      getForegroundProcess: async () => null
+    })
+    runtime.setNotifier({ revealTerminalSession } as never)
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+    runtime.registerPty(ptyId, TEST_WORKTREE_ID, null, {
+      tabId,
+      leafId: HEADLESS_LEAF_ID,
+      incarnationId: 'live-source-incarnation'
+    })
+    const internals = runtime as unknown as {
+      issuePtyHandle: (pty: unknown) => string
+      ptysById: Map<string, unknown>
+    }
+    const handle = internals.issuePtyHandle(internals.ptysById.get(ptyId))
+    const split = runtime.splitTerminal(handle, { direction: 'horizontal' })
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    const splitSpawn = spawn.mock.calls[0]?.[0] as
+      | { expectedSourceBinding?: { incarnationId?: string } }
+      | undefined
+    // Why: persistence never recorded an incarnation for this pane, so sending the live-only id
+    // would make the store's fence reject every split from a restored session.
+    expect(splitSpawn?.expectedSourceBinding).not.toHaveProperty('incarnationId')
+
+    runtime.syncWindowGraph(1, {
+      tabs: [
+        {
+          tabId,
+          worktreeId: TEST_WORKTREE_ID,
+          title: 'Persisted terminal',
+          activeLeafId: HEADLESS_LEAF_ID,
+          layout: { type: 'leaf', leafId: HEADLESS_LEAF_ID }
+        }
+      ],
+      leaves: [
+        {
+          tabId,
+          worktreeId: TEST_WORKTREE_ID,
+          leafId: HEADLESS_LEAF_ID,
+          paneRuntimeId: 1,
+          ptyId
+        }
+      ]
+    })
+    resolveSpawn({ id: splitPtyId })
+
+    await expect(split).resolves.toMatchObject({
+      tabId,
+      handle: expect.stringMatching(/^term_/)
+    })
+
+    expect(revealTerminalSession).toHaveBeenCalledOnce()
+    expect(kill).not.toHaveBeenCalled()
+    expect(getSession().terminalLayoutsByTabId[tabId]?.root).toMatchObject({
+      type: 'split',
+      direction: 'horizontal'
+    })
+  })
+
+  it('rejects a persisted split closed during spawn without recreating its tab', async () => {
+    const tabId = 'closing-persisted-tab'
+    const ptyId = 'closing-persisted-pty'
+    const { runtimeStore, getSession, setSession } = makeRuntimeStoreWithWorkspaceSession(
+      makeWorkspaceSessionWithHeadlessTerminal({
+        tabsByWorktree: {
+          [TEST_WORKTREE_ID]: [
+            {
+              id: tabId,
+              ptyId,
+              worktreeId: TEST_WORKTREE_ID,
+              title: 'Closing terminal',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        },
+        terminalLayoutsByTabId: {
+          [tabId]: makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: ptyId })
+        }
+      })
+    )
+    let resolveSpawn!: (result: { id: string }) => void
+    const spawn = vi.fn(
+      (_args: unknown) =>
+        new Promise<{ id: string }>((resolve) => {
+          resolveSpawn = resolve
+        })
+    )
+    const kill = vi.fn(() => false)
+    const runtime = new OrcaRuntimeService(runtimeStore as never)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill,
+      getForegroundProcess: async () => null
+    })
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+    runtime.registerPty(ptyId, TEST_WORKTREE_ID, null, {
+      tabId,
+      leafId: HEADLESS_LEAF_ID
+    })
+    const internals = runtime as unknown as {
+      issuePtyHandle: (pty: unknown) => string
+      ptysById: Map<string, unknown>
+    }
+    const handle = internals.issuePtyHandle(internals.ptysById.get(ptyId))
+    const split = runtime.splitTerminal(handle, { direction: 'vertical' })
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+
+    setSession(getDefaultWorkspaceSession())
+    runtimeStore.persistPtyBinding.mockReturnValue(false)
+    resolveSpawn({ id: 'rejected-split-pty' })
+
+    await expect(split).rejects.toThrow('terminal_split_source_not_found')
+    expect(spawn.mock.calls[0]?.[0]).toMatchObject({
+      persistHostSessionBinding: true,
+      expectedSourceBinding: {
+        worktreeId: TEST_WORKTREE_ID,
+        tabId,
+        leafId: HEADLESS_LEAF_ID,
+        ptyId
+      }
+    })
+    expect(kill).toHaveBeenCalledWith('rejected-split-pty')
+    expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toBeUndefined()
+    expect(getSession().terminalLayoutsByTabId[tabId]).toBeUndefined()
+  })
+
+  it('rejects a projected split retired during spawn before publishing the new pane', async () => {
+    let resolveSplitSpawn!: (result: { id: string }) => void
+    const spawn = vi
+      .fn()
+      .mockResolvedValueOnce({ id: 'projected-source-pty' })
+      .mockImplementationOnce(
+        () =>
+          new Promise<{ id: string }>((resolve) => {
+            resolveSplitSpawn = resolve
+          })
+      )
+    const kill = vi.fn(() => true)
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill,
+      getForegroundProcess: async () => null
+    })
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+
+    const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
+    const split = runtime.splitTerminal(handle, { direction: 'vertical' })
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledTimes(2))
+
+    runtime['mobileSessionTabsByWorktree'].delete(TEST_WORKTREE_ID)
+    resolveSplitSpawn({ id: 'retired-projected-split-pty' })
+
+    await expect(split).rejects.toThrow('terminal_split_source_not_found')
+    expect(kill).toHaveBeenCalledWith('retired-projected-split-pty')
+    expect(runtime['mobileSessionTabsByWorktree'].has(TEST_WORKTREE_ID)).toBe(false)
+  })
+
   it('splits folder workspace pty-backed terminal sessions with folder cwd and env', async () => {
     const folderPath = await mkdtemp(join(tmpdir(), 'orca-runtime-folder-split-'))
     const spawn = vi
@@ -14835,6 +15110,80 @@ describe('OrcaRuntimeService', () => {
     })
   })
 
+  it('atomically admits persisted SSH splits in the SSH host partition', async () => {
+    const tabId = 'ssh-split-tab'
+    const sourcePtyId = 'ssh:ssh-1@@source-pty'
+    const splitPtyId = 'ssh:ssh-1@@split-pty'
+    const remoteRepo = { ...store.getRepo(TEST_REPO_ID)!, connectionId: 'ssh-1' }
+    const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
+      makeWorkspaceSessionWithHeadlessTerminal({
+        tabsByWorktree: {
+          [TEST_WORKTREE_ID]: [
+            {
+              id: tabId,
+              ptyId: sourcePtyId,
+              worktreeId: TEST_WORKTREE_ID,
+              title: 'SSH terminal',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        },
+        terminalLayoutsByTabId: {
+          [tabId]: makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: sourcePtyId })
+        }
+      }),
+      'ssh:ssh-1'
+    )
+    const spawn = vi.fn().mockResolvedValue({ id: splitPtyId })
+    const runtime = new OrcaRuntimeService({
+      ...runtimeStore,
+      getRepos: () => [remoteRepo],
+      getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined)
+    } as never)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+    runtime.registerPty(sourcePtyId, TEST_WORKTREE_ID, 'ssh-1', {
+      tabId,
+      leafId: HEADLESS_LEAF_ID
+    })
+    const internals = runtime as unknown as {
+      issuePtyHandle: (pty: unknown) => string
+      ptysById: Map<string, unknown>
+    }
+    const handle = internals.issuePtyHandle(internals.ptysById.get(sourcePtyId))
+
+    await expect(runtime.splitTerminal(handle, { direction: 'vertical' })).resolves.toMatchObject({
+      tabId,
+      handle: expect.stringMatching(/^term_/)
+    })
+
+    expect(spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        connectionId: 'ssh-1',
+        worktreeId: TEST_WORKTREE_ID,
+        persistHostSessionBinding: true,
+        expectedSourceBinding: expect.objectContaining({
+          worktreeId: TEST_WORKTREE_ID,
+          tabId,
+          leafId: HEADLESS_LEAF_ID,
+          ptyId: sourcePtyId
+        })
+      })
+    )
+    expect(getSession().terminalLayoutsByTabId[tabId]?.root).toMatchObject({
+      type: 'split',
+      direction: 'vertical'
+    })
+  })
+
   it('returns an actionable discoverability warning when default adoption fails after spawn', async () => {
     const spawn = vi.fn().mockResolvedValue({ id: 'pty-bg' })
     const revealTerminalSession = vi.fn().mockRejectedValue(new Error('Renderer timed out'))
@@ -15309,6 +15658,28 @@ describe('OrcaRuntimeService', () => {
     })
   })
 
+  it('resolves live-leaf tui-idle from an OpenCode native title', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+    syncSinglePty(runtime, 'remote:pty-1', {
+      tabTitle: 'repo terminal',
+      paneTitle: 'ssh build-host | OC | Native session'
+    })
+    const [terminal] = (await runtime.listTerminals()).terminals
+
+    await expect(
+      runtime.waitForTerminal(terminal.handle, { condition: 'tui-idle', timeoutMs: 1_000 })
+    ).resolves.toMatchObject({
+      handle: terminal.handle,
+      condition: 'tui-idle',
+      status: 'running'
+    })
+  })
+
   it('does not treat a Codex launch title as tui-idle readiness', async () => {
     vi.useFakeTimers()
     try {
@@ -22494,6 +22865,65 @@ describe('OrcaRuntimeService', () => {
     })
   })
 
+  it('does not authorize an OpenCode marker left on a shell pane', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => 'zsh'
+    })
+    syncSinglePty(runtime, 'pty-1', { paneTitle: 'OC | zsh' })
+    const [terminal] = (await runtime.listTerminals()).terminals
+
+    await expect(runtime.isTerminalRunningAgent(terminal.handle)).resolves.toBe(false)
+    await expect(runtime.getTerminalAgentStatus(terminal.handle)).resolves.toEqual({
+      handle: terminal.handle,
+      isRunningAgent: false,
+      status: null
+    })
+  })
+
+  it('authorizes a hookless OpenCode marker with an OpenCode foreground process', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => 'opencode'
+    })
+    syncSinglePty(runtime, 'pty-1', { paneTitle: 'OC | Native session' })
+    const [terminal] = (await runtime.listTerminals()).terminals
+
+    await expect(runtime.isTerminalRunningAgent(terminal.handle)).resolves.toBe(true)
+    await expect(runtime.getTerminalAgentStatus(terminal.handle)).resolves.toEqual({
+      handle: terminal.handle,
+      isRunningAgent: true,
+      status: 'idle'
+    })
+  })
+
+  it('does not authorize an OpenCode marker left on a runtime PTY shell', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn: vi.fn().mockResolvedValue({ id: 'pty-bg' }),
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => 'zsh'
+    })
+    runtime.attachWindow(1)
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+    const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`, {
+      command: 'bash',
+      title: 'OC | zsh'
+    })
+
+    await expect(runtime.isTerminalRunningAgent(handle)).resolves.toBe(false)
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toEqual({
+      handle,
+      isRunningAgent: false,
+      status: null
+    })
+  })
+
   // Why: a leaf with no PTY is the same no-evidence case as an unreadable foreground —
   // nothing was even asked, so the bare title is all that is left. The corroborating
   // foreground here is deliberately unreachable: no ptyId means no read.
diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts
index 0b234b24160..856b5960b32 100644
--- a/src/main/runtime/orca-runtime.ts
+++ b/src/main/runtime/orca-runtime.ts
@@ -6,6 +6,8 @@ import {
   isClaudeManagementTitle,
   isCursorAgentTitle,
   isCursorNativeAgentTitle,
+  isOpenCodeNativeTitle,
+  isQuarterCircleSpinnerOnlyAgentTitle,
   isShellProcess,
   normalizeTerminalTitle
 } from '../../shared/agent-detection'
@@ -39,6 +41,7 @@ import type {
 } from '../../shared/terminal-side-effect-facts'
 import type { TerminalGitHubPRLink } from '../../shared/terminal-github-pr-link-detector'
 import { TerminalKittyKeyboardModeTracker } from '../../shared/terminal-kitty-keyboard-mode-tracker'
+import { parseTerminalKittyKeyboardFlags } from '../../shared/terminal-kitty-keyboard-flags'
 import {
   AGENT_STATUS_STALE_AFTER_MS,
   isFreshNonDoneAgentStatus,
@@ -117,6 +120,11 @@ import { resolveWorktreeCreateBase } from '../worktree-create-base'
 import { resolveWorktreeAddBaseRef } from '../../shared/worktree-base-ref'
 import { OrchestrationDb } from './orchestration/db'
 import { reconcileRequestedWorkerTerminalReleases } from './orchestration/worker-terminal-release-reconciliation'
+import {
+  classifyWorkerTerminalProcessIncarnation,
+  parseWorkerTerminalHostScope,
+  type WorkerTerminalHostScope
+} from './orchestration/worker-terminal-process-liveness'
 import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
 import { OrchestrationError } from './orchestration/orchestration-error'
 import {
@@ -527,7 +535,8 @@ import { RemoteRuntimeTerminalCreateIdempotency } from './remote-runtime-termina
 import { deriveRemoteRuntimeTerminalCreateHandle } from './remote-runtime-terminal-create-identity'
 import {
   buildHeadlessTerminalSplitLayout,
-  countTerminalLayoutLeaves
+  countTerminalLayoutLeaves,
+  terminalLayoutContainsLeaf
 } from './headless-terminal-split-layout'
 import { RECENT_PTY_OUTPUT_LIMIT, RecentPtyOutputBuffer } from './recent-pty-output-buffer'
 import {
@@ -702,6 +711,7 @@ import {
   scanLocalRepoWorktreesForResolution,
   type RuntimeWorktreeScanResult
 } from './repo-worktree-resolution-scan'
+import { readRepoWorktreeAdminFingerprint } from './repo-worktree-admin-fingerprint'
 import {
   getLocalWorktreePathAccess,
   removeLocalWorktreePath,
@@ -922,7 +932,7 @@ import {
   WORKTREE_CREATE_MAX_SUFFIX_ATTEMPTS
 } from '../worktree-create-candidates'
 import { normalizeSparseDirectories } from '../ipc/sparse-checkout-directories'
-import type { Store } from '../persistence'
+import type { PtyBindingSourceExpectation, Store } from '../persistence'
 import type { StatsCollector } from '../stats/collector'
 import { AgentDetector } from '../stats/agent-detector'
 import {
@@ -1003,6 +1013,7 @@ import {
   recentTerminalOutputIncludesPath,
   recentTerminalPathCandidatesIncludePath
 } from './terminal-output-path-candidates'
+import { nativeChatTranscriptIncludesPath } from '../native-chat/native-chat-file-provenance'
 import {
   getSelectedReviewBranch,
   getSelectedReviewLookupHints,
@@ -1309,6 +1320,8 @@ type RuntimePtyWorktreeRecord = {
   paneKey: string | null
   launchConfig: SleepingAgentLaunchConfig | null
   launchToken: string | null
+  // Why: provider PTY IDs can be reused; launch identity belongs only to the process that received the token.
+  launchIncarnationId: PtyIncarnationId | null
   launchAgent: TuiAgent | null
   foregroundAgent: TuiAgent | null
   connected: boolean
@@ -1617,6 +1630,9 @@ type RuntimeTerminalBufferSnapshot = {
   alternateScreen?: boolean
   scrollbackAnsi?: string
   pendingEscapeTailAnsi?: string
+  /** Effective kitty flags proven at this snapshot's own `seq`. Absent means
+   *  the winning source could not prove them. */
+  kittyKeyboardFlags?: number
 }
 
 type HeadlessSeedMetadata = {
@@ -1677,6 +1693,7 @@ type RuntimePtyController = {
     sessionId?: string
     isNewSession?: boolean
     persistHostSessionBinding?: boolean
+    expectedSourceBinding?: PtyBindingSourceExpectation
     terminalColorQueryReplies?: { foreground?: string; background?: string }
     agentSessionEnsure?: {
       claim: AgentSessionExecutionClaim
@@ -1709,6 +1726,7 @@ type RuntimePtyController = {
    *  False on doubt (absent session, SSH-scoped id, non-daemon provider). */
   attach?(ptyId: string): Promise<boolean>
   kill(ptyId: string): boolean
+  retireRejectedPty?(ptyId: string): void
   stopAndWait?(
     ptyId: string,
     opts?: { keepHistory?: boolean; deadlineMs?: number }
@@ -1729,7 +1747,14 @@ type RuntimePtyController = {
   serializeBuffer?(
     ptyId: string,
     opts?: { scrollbackRows?: number; altScreenForcesZeroRows?: boolean }
-  ): Promise<{ data: string; cols: number; rows: number; seq?: number; lastTitle?: string } | null>
+  ): Promise<{
+    data: string
+    cols: number
+    rows: number
+    seq?: number
+    lastTitle?: string
+    kittyKeyboardFlags?: number
+  } | null>
   /** Authoritative provider-owned snapshot for restored PTYs with no mounted renderer. */
   serializeProviderBuffer?(
     ptyId: string,
@@ -1805,6 +1830,9 @@ const BRACKETED_PASTE_END = '\x1b[201~'
 const BRACKETED_PASTE_QUIET_MS = 1500
 const DRAFT_PASTE_READY_TIMEOUT_MS = 8000
 const MOBILE_TERMINAL_SURFACE_TIMEOUT_MS = 10_000
+// Why: the split already failed; the caller waits on this teardown only to learn whether the
+// fallback kill is needed, so keep it short — an unreachable host must not stall the rejection.
+const REJECTED_SPLIT_PTY_STOP_TIMEOUT_MS = 2_000
 const MOBILE_TERMINAL_READY_FALLBACK_MS = 1000
 const SSH_PANE_RECOVERY_GRACE_MS = 30_000
 // Why: long enough that a keystroke burst to a proven-dead leaf probes once,
@@ -1983,10 +2011,7 @@ export type OrchestrationCompatibilityTerminalAuthority = {
   processIncarnation: string | null
   paneKey: string | null
   launchTokenHash: string | null
-  hostScope:
-    | { kind: 'local'; hostId: 'local' }
-    | { kind: 'wsl'; hostId: 'local'; distro: string }
-    | { kind: 'ssh'; targetId: string }
+  hostScope: WorkerTerminalHostScope
 }
 
 export type LegacyWorkerTerminalRecoveryResult = {
@@ -2512,12 +2537,25 @@ type RuntimeWorktreeScanCache = {
   runtimeKey: string
   result: RuntimeWorktreeScanResult
   expiresAt: number
+  /**
+   * Git-admin state read as of the scan's start, kept unresolved so no caller ever waits on the
+   * probe to receive a scan result. Resolves to `null` when the state could not be read.
+   */
+  adminFingerprint: Promise<string | null>
+  /** When the Git scan behind `result` actually ran, so reconciliation can be bounded. */
+  scannedAt: number
 }
 
 type RuntimeWorktreeScanInFlight = {
   generation: number
   runtimeKey: string
-  promise: Promise<RuntimeWorktreeScanResult>
+  promise: Promise<RuntimeWorktreeScanRefresh>
+}
+
+type RuntimeWorktreeScanRefresh = {
+  result: RuntimeWorktreeScanResult
+  adminFingerprint: Promise<string | null>
+  scannedAt: number
 }
 
 type WorktreeLineageCandidate = {
@@ -2733,7 +2771,6 @@ export class OrcaRuntimeService {
     }
   >()
   private terminalSleepGeneration = 0
-  private terminalPaneRecoveryByIdentity = new Map<string, Promise<RuntimeTerminalResolvePane>>()
   // Why: idempotency map for worktree.create — a create interrupted by a mobile
   // connection migration is retried with the same clientMutationId and returns
   // the in-flight (or just-finished) operation instead of a duplicate worktree.
@@ -6173,8 +6210,7 @@ export class OrcaRuntimeService {
   private getRecentExpiredSshLease(
     worktreeId: string,
     tabId: string,
-    leafId: string | undefined,
-    ptyId?: string
+    leafId: string | undefined
   ): ReturnType<NonNullable<RuntimeStore['getSshRemotePtyLeases']>>[number] | null {
     const now = Date.now()
     return (
@@ -6185,7 +6221,6 @@ export class OrcaRuntimeService {
             lease.state === 'expired' &&
             lease.worktreeId === worktreeId &&
             lease.tabId === tabId &&
-            (ptyId === undefined || lease.ptyId === ptyId) &&
             (leafId === undefined || lease.leafId === undefined || lease.leafId === leafId) &&
             lease.updatedAt <= now &&
             now - lease.updatedAt <= SSH_PANE_RECOVERY_GRACE_MS
@@ -7662,10 +7697,10 @@ export class OrcaRuntimeService {
     ptyId: string
     splitFromLeafId: string
     direction: 'horizontal' | 'vertical'
-  }): void {
+  }): boolean {
     const session = this.getWorkspaceSessionForWorktree(args.worktreeId)
     if (!session || !this.store?.setWorkspaceSession) {
-      return
+      return false
     }
     const existing = session.terminalLayoutsByTabId?.[args.tabId]
     const nextLayout = buildHeadlessTerminalSplitLayout(
@@ -7679,6 +7714,7 @@ export class OrcaRuntimeService {
         [args.tabId]: nextLayout
       }
     })
+    return true
   }
 
   private persistHeadlessTerminalActiveLeaf(
@@ -8744,6 +8780,13 @@ export class OrcaRuntimeService {
       this.resolveTerminalFileUriHostname(terminalHandle),
     hasRecentTerminalOutputPath: (terminalHandle, pathText, absolutePath) =>
       this.hasRecentTerminalOutputPath(terminalHandle, pathText, absolutePath),
+    hasRecentNativeChatOutputPath: (worktreeId, context, pathText, absolutePath) =>
+      nativeChatTranscriptIncludesPath({
+        tabs: this.getMobileSessionTabsForWorktree(worktreeId).tabs,
+        context,
+        pathText,
+        absolutePath
+      }),
     resolveRuntimeGitTarget: (selector) => this.resolveRuntimeGitTarget(selector),
     openFile: (worktreeId, filePath, relativePath, runtimeEnvironmentId) => {
       if (!this.notifier?.openFile) {
@@ -9376,6 +9419,7 @@ export class OrcaRuntimeService {
       isTuiAgent(agentLaunchAuthority.launchAgent)
     ) {
       pty.launchToken = agentLaunchAuthority.launchToken
+      pty.launchIncarnationId = binding.incarnationId
       pty.launchAgent = agentLaunchAuthority.launchAgent
     }
     const pendingIncarnation = this.pendingPtyRegistrationIncarnations.get(ptyId)
@@ -11599,6 +11643,7 @@ export class OrcaRuntimeService {
     oscLinks?: TerminalOscLinkRange[]
     alternateScreen?: boolean
     pendingEscapeTailAnsi?: string
+    kittyKeyboardFlags?: number
   } | null> {
     if (this.providerSnapshotPreferredPtys.has(ptyId)) {
       // Why: pre-attach stream bytes only form a suffix of restored state. A
@@ -11648,6 +11693,7 @@ export class OrcaRuntimeService {
     lastTitle?: string
     source?: 'renderer'
     oscLinks?: TerminalOscLinkRange[]
+    kittyKeyboardFlags?: number
   } | null> {
     if (this.ptyController?.hasRendererSerializer?.(ptyId) === false) {
       return null
@@ -11660,6 +11706,7 @@ export class OrcaRuntimeService {
       cwd?: string | null
       lastTitle?: string
       oscLinks?: TerminalOscLinkRange[]
+      kittyKeyboardFlags?: number
     } | null = null
     try {
       // Why: recovery/read fallback wants visible alt-screen content (e.g. an
@@ -12042,6 +12089,7 @@ export class OrcaRuntimeService {
     oscLinks?: TerminalOscLinkRange[]
     alternateScreen?: boolean
     scrollbackAnsi?: string
+    kittyKeyboardFlags?: number
     // Why: dangling mid-escape tail the restorer must write LAST, after any
     // reset, so the next live chunk completes it instead of rendering it
     // literally (Bug E / #7329).
@@ -12070,6 +12118,12 @@ export class OrcaRuntimeService {
           source: 'headless' as const,
           oscLinks: snapshot.oscLinks,
           scrollbackAnsi: snapshot.scrollbackAnsi,
+          // Why beside outputSequence and never re-read later: the flags must
+          // describe the same stream position as the image, or replay would
+          // apply push/pop transitions twice or out of order.
+          ...(parseTerminalKittyKeyboardFlags(snapshot.modes?.kittyKeyboardFlags) !== undefined
+            ? { kittyKeyboardFlags: snapshot.modes.kittyKeyboardFlags }
+            : {}),
           ...(snapshot.pendingEscapeTailAnsi
             ? { pendingEscapeTailAnsi: snapshot.pendingEscapeTailAnsi }
             : {}),
@@ -12375,6 +12429,7 @@ export class OrcaRuntimeService {
     }
     this.restoredOrchestrationAuthorityByPtyId.delete(ptyId)
     pty.launchToken = null
+    pty.launchIncarnationId = null
     const paneKeys = new Set<string>()
     if (pty.paneKey && parsePaneKey(pty.paneKey)) {
       paneKeys.add(pty.paneKey)
@@ -15512,6 +15567,24 @@ export class OrcaRuntimeService {
     }
   }
 
+  async inspectTerminalProcessIncarnationLiveness(
+    processIncarnation: string,
+    serializedHostScope: string | null
+  ): Promise<'live' | 'dead' | 'unknown'> {
+    const hostScope = parseWorkerTerminalHostScope(serializedHostScope)
+    if (!hostScope || !this.ptyController?.listProcesses) {
+      return 'unknown'
+    }
+    const listed = await withTimeoutResult(
+      this.ptyController.listProcesses(hostScope.kind === 'ssh' ? hostScope.targetId : null),
+      PTY_CONTROLLER_LIST_TIMEOUT_MS
+    )
+    if (!listed.ok) {
+      return 'unknown'
+    }
+    return classifyWorkerTerminalProcessIncarnation(processIncarnation, listed.value)
+  }
+
   private getTerminalTopologyRevision(worktreeId: string): number {
     const repoId = getRepoIdFromWorktreeId(worktreeId)
     return (
@@ -16449,46 +16522,17 @@ export class OrcaRuntimeService {
     ) {
       throw new Error('terminal_not_found')
     }
-    const recoveryKey = `${expectedWorktreeId}\0${paneKey}`
-    const pending = this.terminalPaneRecoveryByIdentity.get(recoveryKey)
-    if (pending) {
-      return pending
-    }
     if (pty?.connected) {
       const current = this.resolveTerminalPane(paneKey, expectedWorktreeId)
       if (expectedHandle === undefined || current.handle !== expectedHandle) {
         return current
       }
-      throw new Error('terminal_not_recoverable')
     }
-    if (
-      !this.getRecentExpiredSshLease(expectedWorktreeId, parsed.tabId, parsed.leafId, pty.ptyId)
-    ) {
-      // Why: an explicit close leaves a terminated lease; only relay expiry authorizes shell recreation.
-      throw new Error('terminal_not_recoverable')
-    }
-    // Why: disconnected PTYs can reissue handles during graph cleanup; only a connected replacement satisfies the pane CAS.
-    const recovery = this.createTerminal(`id:${expectedWorktreeId}`, {
-      tabId: parsed.tabId,
-      leafId: parsed.leafId,
-      focus: false,
-      // Why: the HUB renderer may publish its exited layout while recovery is in flight; persist the replacement before that stale graph can orphan it.
-      persistHostSessionBinding: true
-    }).then((terminal) => ({
-      handle: terminal.handle,
-      tabId: parsed.tabId,
-      leafId: parsed.leafId,
-      ptyId: terminal.ptyId ?? null,
-      worktreeId: expectedWorktreeId
-    }))
-    this.terminalPaneRecoveryByIdentity.set(recoveryKey, recovery)
-    const clearRecovery = (): void => {
-      if (this.terminalPaneRecoveryByIdentity.get(recoveryKey) === recovery) {
-        this.terminalPaneRecoveryByIdentity.delete(recoveryKey)
-      }
-    }
-    void recovery.then(clearRecovery, clearRecovery)
-    return recovery
+    // A disconnected pane is never silently replaced. The grant this used to hold could not fire:
+    // it compared a relay-native lease id against an app-form runtime id (STA-3077 S6/S8, oracle in
+    // ssh-pane-recovery-grant-reachability.test.ts). The pane surfaces as disconnected instead, and
+    // spawning a replacement is the user's explicit choice.
+    throw new Error('terminal_not_recoverable')
   }
 
   async showTerminal(handle: string): Promise<RuntimeTerminalShow> {
@@ -16722,7 +16766,8 @@ export class OrcaRuntimeService {
     const liveTitleClearsBlockedText =
       terminal.titleStatusIsLive &&
       terminal.titleStatus !== null &&
-      terminal.titleStatus !== 'permission'
+      terminal.titleStatus !== 'permission' &&
+      !isOpenCodeNativeTitle(terminal.title)
     if (terminal.titleStatus === 'permission' && terminal.titleStatusIsLive) {
       return { handle, isRunningAgent: true, status: 'permission' }
     }
@@ -16749,6 +16794,20 @@ export class OrcaRuntimeService {
       }
     }
     if (terminal.titleStatus) {
+      // Why: an OpenCode marker and a lone quarter-circle spinner (STA-4028) are activity,
+      // not identity, so resolve both through the identity/foreground evidence path.
+      if (
+        isOpenCodeNativeTitle(terminal.title) ||
+        isQuarterCircleSpinnerOnlyAgentTitle(terminal.title)
+      ) {
+        const isRunningAgent = await this.isTerminalRunningAgent(handle)
+        this.assertTerminalAgentStatusPtyBinding(handle, ptyId)
+        return {
+          handle,
+          isRunningAgent,
+          status: isRunningAgent ? terminal.titleStatus : null
+        }
+      }
       return { handle, isRunningAgent: true, status: terminal.titleStatus }
     }
 
@@ -18436,6 +18495,7 @@ export class OrcaRuntimeService {
         | 'pendingFirstAgentMessageRename'
         | 'firstAgentMessageRenameError'
         | 'lastActivityAt'
+        | 'diffComments'
       >
     >
   ): Promise<FolderWorkspace | null> {
@@ -19083,6 +19143,7 @@ export class OrcaRuntimeService {
         | 'externalWorktreeVisibilityPromptDismissedAt'
         | 'externalWorktreeInboxBaselinePaths'
         | 'importedExternalWorktreePaths'
+        | 'agentWorktreeVisibility'
         | 'projectGroupId'
         | 'projectGroupOrder'
       >
@@ -23664,8 +23725,7 @@ export class OrcaRuntimeService {
       this.invalidateWorktreeScanCacheForRepo(worktree.repoId)
     }
     const shouldClearPushTarget =
-      Object.prototype.hasOwnProperty.call(metaUpdates, 'pushTarget') &&
-      metaUpdates.pushTarget === null
+      Object.hasOwn(metaUpdates, 'pushTarget') && metaUpdates.pushTarget === null
     const normalizedMetaUpdates: Partial<WorktreeMeta> = shouldClearPushTarget
       ? { ...metaUpdates, pushTarget: undefined }
       : (metaUpdates as Partial<WorktreeMeta>)
@@ -25721,6 +25781,7 @@ export class OrcaRuntimeService {
               ? copySleepingAgentLaunchConfig(effectiveLaunchConfig)
               : null
             pty.launchToken = launchToken ?? null
+            pty.launchIncarnationId = launchToken ? pty.incarnationId : null
             pty.launchAgent = launchOpts.launchAgent ?? null
           }
           pty.tabId = tabId
@@ -27286,6 +27347,17 @@ export class OrcaRuntimeService {
     }
     const direction = opts.direction ?? 'horizontal'
     const workspace = await this.resolveTerminalWorkspaceLaunchScope(`id:${pty.worktreeId}`)
+    const sourceAuthority = this.resolveTerminalSplitSourceAuthority(
+      workspace.id,
+      parentTabId,
+      parsedPaneKey.leafId,
+      pty.ptyId
+    )
+    if (!sourceAuthority) {
+      throw new Error('terminal_split_source_not_found')
+    }
+    const sourceIncarnationId =
+      sourceAuthority.liveIncarnationId ?? sourceAuthority.persistedIncarnationId
     const leafId = randomUUID()
     const preAllocatedHandle = this.createPreAllocatedTerminalHandle()
     const paneKey = makePaneKey(parentTabId, leafId)
@@ -27302,7 +27374,25 @@ export class OrcaRuntimeService {
       preAllocatedHandle,
       tabId: parentTabId,
       leafId,
-      persistHostSessionBinding: true
+      persistHostSessionBinding: true,
+      ...(sourceAuthority.persisted
+        ? {
+            expectedSourceBinding: {
+              ...(sourceAuthority.persistedWorktreeId
+                ? { worktreeId: sourceAuthority.persistedWorktreeId }
+                : {}),
+              tabId: parentTabId,
+              leafId: parsedPaneKey.leafId,
+              ptyId: pty.ptyId,
+              // Why: the store can only match its own persisted map, so a live-only id it never
+              // recorded would reject every split from a session restored without incarnations.
+              // The live id is fenced by revalidateSourceAuthority below instead.
+              ...(sourceAuthority.persistedIncarnationId
+                ? { incarnationId: sourceAuthority.persistedIncarnationId }
+                : {})
+            }
+          }
+        : {})
     })
     this.registerPreAllocatedHandleForPty(result.id, preAllocatedHandle)
     if (result.wslDistro) {
@@ -27320,7 +27410,7 @@ export class OrcaRuntimeService {
       )
     }
 
-    try {
+    const revealSplit = async (): Promise<void> => {
       await this.notifier?.revealTerminalSession?.(workspace.id, {
         ptyId: result.id,
         title: null,
@@ -27332,33 +27422,163 @@ export class OrcaRuntimeService {
         splitDirection: direction,
         splitTelemetrySource: opts.telemetrySource
       })
+    }
+
+    try {
+      const revalidateSourceAuthority = (): void => {
+        const current = this.resolveTerminalSplitSourceAuthority(
+          workspace.id,
+          parentTabId,
+          parsedPaneKey.leafId,
+          pty.ptyId
+        )
+        if (
+          !current ||
+          (sourceAuthority.persisted && !current.persisted) ||
+          (sourceIncarnationId !== null &&
+            (current.liveIncarnationId ?? current.persistedIncarnationId) !== sourceIncarnationId)
+        ) {
+          throw new Error('terminal_split_source_not_found')
+        }
+      }
+      revalidateSourceAuthority()
+      if (!sourceAuthority.persisted) {
+        await revealSplit()
+        // Why: rejecting here unmounts the pane the reveal just added only because the retire
+        // below always emits its exit and the tab still holds the source sibling — the renderer's
+        // exit handler closes non-final panes. Never close it by tabId: that drops the whole tab.
+        revalidateSourceAuthority()
+      }
+      if (createdPty) {
+        const persisted = this.persistHeadlessTerminalSplit({
+          worktreeId: workspace.id,
+          tabId: parentTabId,
+          leafId,
+          ptyId: createdPty.ptyId,
+          splitFromLeafId: parsedPaneKey.leafId,
+          direction
+        })
+        if (sourceAuthority.persisted && !persisted) {
+          throw new Error('workspace_session_unavailable')
+        }
+        this.publishPtyBackedMobileSessionTerminal(workspace.id, createdPty, {
+          tabId: parentTabId,
+          leafId,
+          title: null,
+          activate: opts.activate !== false,
+          split: { splitFromLeafId: parsedPaneKey.leafId, direction }
+        })
+      }
     } catch (error) {
       this.setPairedRendererSessionOwnership(result.id, false)
-      this.ptyController.kill?.(result.id)
+      let stopped = false
+      try {
+        stopped =
+          (await this.ptyController.stopAndWait?.(result.id, {
+            deadlineMs: Date.now() + REJECTED_SPLIT_PTY_STOP_TIMEOUT_MS
+          })) ?? false
+      } catch {
+        // Best-effort fallback below preserves the original split authority error.
+      }
+      if (!stopped) {
+        this.ptyController.kill(result.id)
+      }
+      this.ptyController.retireRejectedPty?.(result.id)
       throw error
     }
-    if (createdPty) {
-      this.publishPtyBackedMobileSessionTerminal(workspace.id, createdPty, {
-        tabId: parentTabId,
-        leafId,
-        title: null,
-        activate: opts.activate !== false,
-        split: { splitFromLeafId: parsedPaneKey.leafId, direction }
-      })
-      // Why: persist the split so a later snapshot rebuild keeps it instead of collapsing to a single pane.
-      this.persistHeadlessTerminalSplit({
-        worktreeId: workspace.id,
-        tabId: parentTabId,
-        leafId,
-        ptyId: createdPty.ptyId,
-        splitFromLeafId: parsedPaneKey.leafId,
-        direction
-      })
+    const committedSourceAuthority = sourceAuthority.persisted
+      ? this.resolveTerminalSplitSourceAuthority(
+          workspace.id,
+          parentTabId,
+          parsedPaneKey.leafId,
+          pty.ptyId
+        )
+      : null
+    if (sourceAuthority.persisted && committedSourceAuthority?.rendererMounted) {
+      // Why: renderer adoption is a projection after the durable main commit; rejection cannot undo it.
+      void revealSplit().catch(() => undefined)
     }
 
     return { handle: this.issuePtyHandle(createdPty ?? pty), tabId: parentTabId, paneRuntimeId: -1 }
   }
 
+  private resolveTerminalSplitSourceAuthority(
+    worktreeId: string,
+    tabId: string,
+    leafId: string,
+    ptyId: string
+  ): {
+    persisted: boolean
+    rendererMounted: boolean
+    persistedWorktreeId: string | null
+    persistedIncarnationId: string | null
+    liveIncarnationId: string | null
+  } | null {
+    const session = this.getWorkspaceSessionForWorktree(worktreeId)
+    const sessionWorktreeId = session ? resolveTerminalSessionWorktreeId(session, worktreeId) : null
+    const persistedTab = sessionWorktreeId
+      ? session?.tabsByWorktree[sessionWorktreeId]?.find(
+          (tab) => tab.id === tabId && runtimeWorktreeIdsEqual(tab.worktreeId, worktreeId)
+        )
+      : undefined
+    const persistedLayout = session?.terminalLayoutsByTabId?.[tabId]
+    const persistedIncarnationId =
+      session?.terminalPtyIncarnationsByPaneKey?.[makePaneKey(tabId, leafId)] ?? null
+    const liveIncarnationId = this.ptysById.get(ptyId)?.incarnationId ?? null
+    if (
+      persistedIncarnationId &&
+      liveIncarnationId &&
+      persistedIncarnationId !== liveIncarnationId
+    ) {
+      return null
+    }
+    const persisted = Boolean(
+      persistedTab &&
+      persistedLayout?.ptyIdsByLeafId?.[leafId] === ptyId &&
+      terminalLayoutContainsLeaf(persistedLayout.root, leafId)
+    )
+    const rendererTab = this.tabs.get(tabId)
+    const rendererLeaf = this.leaves.get(this.getLeafKey(tabId, leafId))
+    const rendererMounted = Boolean(
+      rendererTab &&
+      rendererLeaf &&
+      runtimeWorktreeIdsEqual(rendererTab.worktreeId, worktreeId) &&
+      runtimeWorktreeIdsEqual(rendererLeaf.worktreeId, worktreeId) &&
+      rendererLeaf.ptyId === ptyId
+    )
+    if (persisted && persistedLayout) {
+      return {
+        persisted: true,
+        rendererMounted,
+        persistedWorktreeId: sessionWorktreeId,
+        persistedIncarnationId,
+        liveIncarnationId
+      }
+    }
+    // Why: renderer adoption can precede graph sync; this path still requires reveal success before commit.
+    const projected = [...this.mobileSessionTabsByWorktree.entries()].some(
+      ([candidateWorktreeId, snapshot]) =>
+        runtimeWorktreeIdsEqual(candidateWorktreeId, worktreeId) &&
+        snapshot.tabs.some(
+          (tab) =>
+            tab.type === 'terminal' &&
+            tab.parentTabId === tabId &&
+            tab.leafId === leafId &&
+            (tab.ptyId === ptyId || tab.parentLayout?.ptyIdsByLeafId?.[leafId] === ptyId)
+        )
+    )
+    if (!rendererMounted && !projected) {
+      return null
+    }
+    return {
+      persisted: false,
+      rendererMounted,
+      persistedWorktreeId: null,
+      persistedIncarnationId: null,
+      liveIncarnationId
+    }
+  }
+
   async handleAgentTeamsTmuxCompat(
     request: AgentTeamsTmuxCompatRequest
   ): Promise<AgentTeamsTmuxCompatResponse> {
@@ -27788,7 +28008,7 @@ export class OrcaRuntimeService {
           committedPtyIds,
           terminalHandlesByPtyId
         })
-        if (failedStopIndex >= 0) {
+        if (failedStopIndex !== -1) {
           const failedStop = stopResults[failedStopIndex]
           throw Object.assign(new Error('terminal_worktree_sleep_failed'), {
             ptyId: orderedLivePtyIds[failedStopIndex],
@@ -27815,7 +28035,7 @@ export class OrcaRuntimeService {
         committedPtyIds,
         terminalHandlesByPtyId
       })
-      if (failedStopIndex >= 0 && remainingLivePtyIds.size > 0) {
+      if (failedStopIndex !== -1 && remainingLivePtyIds.size > 0) {
         const failedStop = stopResults[failedStopIndex]
         console.error('[runtime] worktree terminal sleep physical stop failed', {
           worktreeId: worktree.id,
@@ -28174,16 +28394,9 @@ export class OrcaRuntimeService {
   private async resolveFolderWorkspaceLaunchScope(
     selector: string
   ): Promise<TerminalWorkspaceLaunchScope | null> {
-    const workspaceSelector = selector.startsWith('id:') ? selector.slice(3) : selector
-    const parsed = parseWorkspaceKey(workspaceSelector)
-    if (parsed?.type !== 'folder') {
-      return null
-    }
-    const workspace = this.store
-      ?.getFolderWorkspaces?.()
-      .find((entry) => entry.id === parsed.folderWorkspaceId)
+    const workspace = this.resolveFolderWorkspaceSelector(selector)
     if (!workspace) {
-      throw new Error('selector_not_found')
+      return null
     }
     if (!this.store) {
       throw new Error('runtime_unavailable')
@@ -28203,6 +28416,36 @@ export class OrcaRuntimeService {
     }
   }
 
+  private resolveFolderWorkspaceSelector(selector: string): FolderWorkspace | null {
+    const workspaceSelector = selector.startsWith('id:') ? selector.slice(3) : selector
+    const parsed = parseWorkspaceKey(workspaceSelector)
+    if (parsed?.type !== 'folder') {
+      return null
+    }
+    const workspace = this.store
+      ?.getFolderWorkspaces?.()
+      .find((entry) => entry.id === parsed.folderWorkspaceId)
+    if (!workspace) {
+      throw new Error('selector_not_found')
+    }
+    return workspace
+  }
+
+  private async resolveEmulatorWorkspaceId(selector: string): Promise<string> {
+    const folderWorkspace = this.resolveFolderWorkspaceSelector(selector)
+    return folderWorkspace
+      ? folderWorkspaceKey(folderWorkspace.id)
+      : (await this.resolveWorktreeSelector(selector)).id
+  }
+
+  private async resolveEmulatorCleanupWorkspaceId(selector: string): Promise<string> {
+    const workspaceSelector = selector.startsWith('id:') ? selector.slice(3) : selector
+    const parsed = parseWorkspaceKey(workspaceSelector)
+    return parsed?.type === 'folder'
+      ? folderWorkspaceKey(parsed.folderWorkspaceId)
+      : this.resolveEmulatorWorkspaceId(selector)
+  }
+
   private folderWorkspaceToResolvedWorktree(folderWorkspace: FolderWorkspace): ResolvedWorktree {
     const worktree = folderWorkspaceToWorktree(folderWorkspace)
     return {
@@ -29038,26 +29281,30 @@ export class OrcaRuntimeService {
     }
     const inFlight = this.worktreeScanInFlight.get(repo.id)
     if (inFlight?.generation === generation && inFlight.runtimeKey === runtimeKey) {
-      return inFlight.promise
+      return (await inFlight.promise).result
     }
-    const promise = this.listRepoWorktreesForResolutionUncached(repo, projectRuntime)
+    const reusableCached =
+      cached?.generation === generation && cached.runtimeKey === runtimeKey ? cached : null
+    const promise = this.refreshRepoWorktreeScan(repo, projectRuntime, reusableCached)
     this.worktreeScanInFlight.set(repo.id, { generation, runtimeKey, promise })
     try {
-      const result = await promise
+      const refresh = await promise
       // Why: back off local spawn failures under resource pressure while disconnected SSH can recover on the next poll.
       if (
-        (result.ok || !repo.connectionId) &&
+        (refresh.result.ok || !repo.connectionId) &&
         generation === (this.worktreeScanGenerations.get(repo.id) ?? 0) &&
         this.worktreeScanInFlight.get(repo.id)?.promise === promise
       ) {
         this.worktreeScanCache.set(repo.id, {
           generation,
           runtimeKey,
-          result,
-          expiresAt: Date.now() + resolveWorktreeScanCacheTtlMs(repo)
+          result: refresh.result,
+          expiresAt: Date.now() + resolveWorktreeScanCacheTtlMs(repo),
+          adminFingerprint: refresh.adminFingerprint,
+          scannedAt: refresh.scannedAt
         })
       }
-      return result
+      return refresh.result
     } finally {
       if (this.worktreeScanInFlight.get(repo.id)?.promise === promise) {
         this.worktreeScanInFlight.delete(repo.id)
@@ -29065,6 +29312,50 @@ export class OrcaRuntimeService {
     }
   }
 
+  /**
+   * Refresh one repo's worktree rows, skipping the `git worktree list` subprocess when a cheap
+   * Git-admin fingerprint proves nothing changed since the cached scan.
+   */
+  private async refreshRepoWorktreeScan(
+    repo: Repo,
+    projectRuntime: ProjectExecutionRuntimeResolution | undefined,
+    cached: RuntimeWorktreeScanCache | null
+  ): Promise<RuntimeWorktreeScanRefresh> {
+    const scannedAt = Date.now()
+    // SSH and WSL-routed repos run Git off-host, so a local admin-dir read cannot describe them.
+    const fingerprintCapable =
+      !repo.connectionId &&
+      // Why: a repo whose scan TTL already reaches the reconciliation interval can never reuse a
+      // fingerprint, so reading one would be pure work. Agent-scratch roots are that case today.
+      resolveWorktreeScanCacheTtlMs(repo) < WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS &&
+      !getLocalProjectWorktreeGitOptionsForRuntime(repo, projectRuntime).wslDistro
+    // Why issue it before the scan: a change landing while the scan runs must not be stamped as
+    // already-observed, or the next probe would mask it until the reconciliation deadline.
+    const adminFingerprint = fingerprintCapable
+      ? readRepoWorktreeAdminFingerprint(repo.path)
+      : UNFINGERPRINTED_WORKTREE_SCAN
+    const reusable =
+      fingerprintCapable &&
+      cached?.result.ok === true &&
+      scannedAt - cached.scannedAt < WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS
+        ? cached
+        : null
+    if (reusable) {
+      // Why await only here: this is the one branch whose decision needs the probe. A scan-bound
+      // caller must never wait on it, or every cold read pays filesystem latency it cannot use.
+      const [current, previous] = await Promise.all([adminFingerprint, reusable.adminFingerprint])
+      if (current !== null && current === previous) {
+        return {
+          result: reusable.result,
+          adminFingerprint: reusable.adminFingerprint,
+          scannedAt: reusable.scannedAt
+        }
+      }
+    }
+    const result = await this.listRepoWorktreesForResolutionUncached(repo, projectRuntime)
+    return { result, adminFingerprint, scannedAt }
+  }
+
   private async listRepoWorktreesForResolutionUncached(
     repo: Repo,
     projectRuntime: ProjectExecutionRuntimeResolution | undefined
@@ -29218,6 +29509,7 @@ export class OrcaRuntimeService {
         paneKey: state.paneKey ?? null,
         launchConfig: null,
         launchToken: null,
+        launchIncarnationId: null,
         launchAgent: null,
         foregroundAgent: null,
         connected: state.connected ?? true,
@@ -29804,13 +30096,20 @@ export class OrcaRuntimeService {
     // The sync hasPty rescue closes the spawn/list race: a just-spawned PTY can
     // register after the inventory snapshot, and federation reads one
     // connected:false as exited.
+    let directLiveness: boolean | null | undefined
+    try {
+      directLiveness = leaf.ptyId ? this.ptyController?.hasPty?.(leaf.ptyId) : undefined
+    } catch {
+      directLiveness = null
+    }
     const provenAbsent =
       provenLivePtyIds !== null &&
       leaf.ptyId !== null &&
       !provenLivePtyIds.has(leaf.ptyId) &&
       !leaf.ptyId.startsWith('remote:') &&
       parseAppSshPtyId(leaf.ptyId) === null &&
-      this.ptyController?.hasPty?.(leaf.ptyId) !== true
+      directLiveness !== true &&
+      directLiveness !== null
     return {
       handle: this.issueHandle(leaf),
       ptyId: leaf.ptyId,
@@ -29834,7 +30133,7 @@ export class OrcaRuntimeService {
   private syncMobileSessionTabs(
     snapshots: RuntimeMobileSessionTabsSnapshot[] | undefined,
     unchangedWorktreeIds?: string[],
-    resyncWorktreeIds: Set<string> = new Set()
+    resyncWorktreeIds = new Set<string>()
   ): Set<string> {
     const changedWorktreeIds = new Set<string>()
     if (snapshots === undefined) {
@@ -31359,19 +31658,29 @@ export class OrcaRuntimeService {
         return await this.isPtyRunningAgent(pty.pty, leaf)
       }
       const { leaf } = this.getLiveLeafForHandle(handle)
+      const trackedPty = leaf.ptyId ? this.ptysById.get(leaf.ptyId) : null
       // Why: check the leaf pane title and the tab title, which already carries OSC-enriched agent indicators (e.g. ✳ prefix).
       const paneTitle = getLatestLeafTitle(leaf, null)
       const paneTitleClassification = classifyAgentTitle(paneTitle)
-      if (paneTitleClassification === 'agent') {
+      if (
+        trackedPty
+          ? ptyTitleProvesAgentPresence(trackedPty, paneTitle, paneTitleClassification)
+          : agentTitleProvesAgentPresence(paneTitle, paneTitleClassification)
+      ) {
         return true
       }
       const tabTitle = this.tabs.get(leaf.tabId)?.title?.trim() || null
       const tabTitleClassification = paneTitle === null ? classifyAgentTitle(tabTitle) : 'neutral'
-      if (tabTitleClassification === 'agent') {
+      if (
+        trackedPty
+          ? ptyTitleProvesAgentPresence(trackedPty, tabTitle, tabTitleClassification)
+          : agentTitleProvesAgentPresence(tabTitle, tabTitleClassification)
+      ) {
         return true
       }
+      const openCodeMarkerTitle = paneTitle ?? tabTitle
       const waitText = buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-      if (isKnownReadyPromptPreview(waitText)) {
+      if (!isOpenCodeNativeTitle(openCodeMarkerTitle) && isKnownReadyPromptPreview(waitText)) {
         return true
       }
       const hasCurrentTitleEvidence = paneTitle !== null || tabTitle !== null
@@ -31415,7 +31724,7 @@ export class OrcaRuntimeService {
         )
       : null
     const leafTitleClassification = classifyAgentTitle(leafTitle)
-    if (leafTitleClassification === 'agent') {
+    if (ptyTitleProvesAgentPresence(pty, leafTitle, leafTitleClassification)) {
       return true
     }
     const ptyTitle = getLatestAgentCandidateTitle(
@@ -31423,15 +31732,19 @@ export class OrcaRuntimeService {
       { title: pty.lastOscTitle, updatedAt: pty.lastOscTitleAt }
     )
     const ptyTitleClassification = classifyAgentTitle(ptyTitle)
-    if (leafTitle === null && ptyTitleClassification === 'agent') {
+    if (leafTitle === null && ptyTitleProvesAgentPresence(pty, ptyTitle, ptyTitleClassification)) {
       return true
     }
     const managementTitleClassification = classifyLatestAgentTitle({
       title: pty.managementTitle,
       updatedAt: pty.managementTitleAt
     })
+    const openCodeMarkerTitle = leafTitle ?? ptyTitle
+    if (isOpenCodeNativeTitle(openCodeMarkerTitle) && pty.launchAgent === 'opencode') {
+      return true
+    }
     const waitText = buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
-    if (isKnownReadyPromptPreview(waitText)) {
+    if (!isOpenCodeNativeTitle(openCodeMarkerTitle) && isKnownReadyPromptPreview(waitText)) {
       return true
     }
     // Why: stale status is a fallback only when no current title evidence exists; neutral titles (shells) clear it.
@@ -32494,7 +32807,7 @@ export class OrcaRuntimeService {
   linearSearchForAgents(args: {
     query: string
     limit?: number
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   }): ReturnType<typeof searchLinearIssuesForAgents> {
     return searchLinearIssuesForAgents(args)
   }
@@ -32504,7 +32817,7 @@ export class OrcaRuntimeService {
   }
 
   async linearTeamListForAgents(params: {
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   }): Promise<LinearTeamListResult> {
     try {
       const result = await listLinearTeamsForAgent(params.workspaceId)
@@ -32583,7 +32896,7 @@ export class OrcaRuntimeService {
   async linearProjectListForAgents(params: {
     query?: string
     limit?: number
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   }): Promise<LinearProjectListResult> {
     const limit = clampLinearSearchLimit(params.limit)
     try {
@@ -32622,7 +32935,7 @@ export class OrcaRuntimeService {
     filter?: LinearIssueListFilter
     teamInput?: string
     limit?: number
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   }): Promise<LinearIssueListResult> {
     const filter = params.filter ?? 'assigned'
     const limit = clampLinearIssueListLimit(params.limit)
@@ -34305,7 +34618,7 @@ export class OrcaRuntimeService {
 
   private async resolveLinearTeamInput(
     teamInput: string,
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   ): Promise<{
     id: string
     key: string
@@ -34868,7 +35181,9 @@ export class OrcaRuntimeService {
 
   private readonly emulatorCommands = new RuntimeEmulatorCommands({
     getEmulatorBridge: () => this.emulatorBridge,
-    resolveWorktreeSelector: (selector) => this.resolveWorktreeSelector(selector),
+    resolveEmulatorWorkspaceId: (selector) => this.resolveEmulatorWorkspaceId(selector),
+    resolveEmulatorCleanupWorkspaceId: (selector) =>
+      this.resolveEmulatorCleanupWorkspaceId(selector),
     getAuthoritativeWindow: () => this.getAuthoritativeWindow(),
     getSettings: () => this.requireStore().getSettings()
   })
@@ -35372,6 +35687,12 @@ const WORKTREE_SCAN_CACHE_TTL_MS = 30_000
 // fan-out was measured at ~128 git execs/min on real installs, mostly against
 // these (crash-cluster diagnostics, 2026-07).
 const WORKTREE_SCAN_AGENT_SCRATCH_TTL_MS = 5 * 60_000
+// Why: the Git-admin fingerprint reads HEAD and its ref tip exactly, but sparse-checkout pattern
+// edits are invisible to it and a tip living in packed-refs or reftable only gets an mtime + size
+// stamp, so a real scan still runs on this interval even while the probe reports "unchanged".
+export const WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS = 5 * 60_000
+/** Stand-in for a repo the local admin probe cannot or need not describe; never matches a real read. */
+const UNFINGERPRINTED_WORKTREE_SCAN: Promise<string | null> = Promise.resolve(null)
 const RESOLVED_WORKTREE_REPO_TIMEOUT_MS = 5000
 
 export function resolveWorktreeScanCacheTtlMs(repo: Pick<Repo, 'path' | 'connectionId'>): number {
@@ -36213,12 +36534,12 @@ function applyTerminalLineControls(line: string): {
   hadControl: boolean
 } {
   const carriageIndex = line.lastIndexOf('\r')
-  const latestRedraw = carriageIndex >= 0 ? line.slice(carriageIndex + 1) : line
+  const latestRedraw = carriageIndex !== -1 ? line.slice(carriageIndex + 1) : line
   if (!latestRedraw.includes('\u0008') && !latestRedraw.includes('\u001b')) {
     return {
       text: latestRedraw,
       cursorColumn: latestRedraw.length,
-      hadControl: carriageIndex >= 0
+      hadControl: carriageIndex !== -1
     }
   }
 
@@ -36675,6 +36996,8 @@ function detectExplicitIdleStatusFromTitle(title: string): AgentStatus | null {
   // Why: launch titles like "Codex YOLO" contain an agent name but aren't readiness signals; terminal.wait needs explicit idle evidence.
   if (
     EXPLICIT_IDLE_TITLE_RE.test(title) ||
+    // Why: unblock hookless remote waits; guarded writes corroborate this marker.
+    isOpenCodeNativeTitle(title) ||
     title.startsWith(CLAUDE_IDLE_PREFIX) ||
     title.startsWith('* ') ||
     title.includes(GEMINI_IDLE_PREFIX) ||
@@ -36812,7 +37135,7 @@ function isTerminalWaitWhitespace(value: string, index: number): boolean {
 }
 
 const TERMINAL_WAIT_BLOCKED_SENTINEL_RE =
-  /update available|choose working directory to|codex just got an upgrade|hooks need review|do you trust|trust this|trusted workspace|press enter to (?:confirm|continue|view|insert)|press t to trust/i
+  /update available|choose working directory to|codex just got an upgrade|hooks need review|do you trust|trust this|trusted workspace|press enter to (?:confirm|continue|view|insert)|press t to trust|permission required|requires permission|allow once|allow always/i
 
 function findTerminalWaitBlockedSignal(
   normalized: string
@@ -36882,6 +37205,20 @@ function findTerminalWaitBlockedSignal(
       candidates.push({ reason: 'codex-interactive-prompt', index: interactivePromptIndex })
     }
   }
+  const permissionPromptIndex = Math.max(
+    normalized.lastIndexOf('permission required'),
+    normalized.lastIndexOf('requires permission')
+  )
+  if (permissionPromptIndex !== -1) {
+    const permissionSegment = normalized.slice(permissionPromptIndex, permissionPromptIndex + 1_500)
+    const decisionCount = ['allow once', 'allow always', 'reject', 'deny'].filter((choice) =>
+      permissionSegment.includes(choice)
+    ).length
+    if (decisionCount >= 2) {
+      // Why: preserve the existing remote receipt value for mixed-version clients.
+      candidates.push({ reason: 'codex-interactive-prompt', index: permissionPromptIndex })
+    }
+  }
   return candidates.length > 0
     ? candidates.reduce((latest, candidate) =>
         candidate.index > latest.index ? candidate : latest
@@ -36973,16 +37310,14 @@ function runtimePathsEqual(left: string, right: string): boolean {
  * Windows/WSL/SSH ids still match themselves across hosts.
  */
 function runtimeWorktreeIdsEqual(left: string, right: string): boolean {
-  const parsedLeft = splitWorktreeId(left)
-  const parsedRight = splitWorktreeId(right)
-  return parsedLeft && parsedRight
-    ? parsedLeft.repoId === parsedRight.repoId &&
-        runtimePathsEqual(parsedLeft.worktreePath, parsedRight.worktreePath)
-    : left === right
+  // Why: derived from the key rather than re-parsed, so equality and the sleep /
+  // mutation-queue keying can never drift apart into two different identity rules.
+  return runtimeWorktreeIdentityKey(left) === runtimeWorktreeIdentityKey(right)
 }
 
 function runtimeWorktreeIdentityKey(worktreeId: string): string {
   // Same suffix rule: this keys PTY refresh, sleep, and mutation-queue state per session.
+  // NUL cannot occur in a repoId or a path, so the joined key is unambiguous.
   const parsed = splitWorktreeId(worktreeId)
   return parsed
     ? `${parsed.repoId}\0${normalizeRuntimePathForComparison(parsed.worktreePath)}`
@@ -37363,6 +37698,33 @@ function getLatestLeafTitle(leaf: RuntimeLeafRecord, tabTitle: string | null): s
   )
 }
 
+// Why: an 'agent' title only proves an agent owns the pane when something other than a
+// quarter-circle spinner carries it — those glyphs are generic progress frames (STA-4028).
+function agentTitleProvesAgentPresence(
+  title: string | null,
+  classification: 'agent' | 'management' | 'neutral'
+): boolean {
+  return (
+    classification === 'agent' &&
+    !isOpenCodeNativeTitle(title) &&
+    !isQuarterCircleSpinnerOnlyAgentTitle(title)
+  )
+}
+
+function ptyTitleProvesAgentPresence(
+  pty: RuntimePtyWorktreeRecord,
+  title: string | null,
+  classification: 'agent' | 'management' | 'neutral'
+): boolean {
+  return (
+    agentTitleProvesAgentPresence(title, classification) ||
+    (isQuarterCircleSpinnerOnlyAgentTitle(title) &&
+      pty.launchAgent === 'claude' &&
+      pty.launchToken !== null &&
+      pty.launchIncarnationId === pty.incarnationId)
+  )
+}
+
 function classifyAgentTitle(title: string | null): 'agent' | 'management' | 'neutral' {
   if (!title) {
     return 'neutral'
diff --git a/src/main/runtime/orchestration/db.ts b/src/main/runtime/orchestration/db.ts
index 259664c5544..a1ab618847c 100644
--- a/src/main/runtime/orchestration/db.ts
+++ b/src/main/runtime/orchestration/db.ts
@@ -39,11 +39,12 @@ import type {
 } from './types'
 import { buildOrchestrationTaskDisplayMetadata } from '../../../shared/orchestration-task-display'
 import { ORCHESTRATION_LEGACY_RUN_ID } from '../../../shared/orchestration-rpc-contract'
-import { parsePaneKey } from '../../../shared/stable-pane-id'
+import { isEquivalentPaneKey } from '../../../shared/stable-pane-id'
 import { OrchestrationError } from './orchestration-error'
 import { resolveOrchestrationMigrationStartVersion } from './orchestration-schema-version-skew'
 import {
   deriveWorkerTerminalListState,
+  WORKER_SETTLED_STATES,
   type WorkerTerminalResourceRow,
   type WorkerTerminalArchiveRow,
   type WorkerTerminalArchiveStatus,
@@ -62,14 +63,15 @@ import {
   migrateMutationReceiptCapacity
 } from './mutation-receipt-capacity'
 
-// Why: leaf UUID is the remint-stable pane identity (tab half changes on break-out); exact match covers legacy/unparseable keys.
-function isEquivalentPaneKey(a: string, b: string): boolean {
-  if (a === b) {
-    return true
+function parseWorkerTerminalPriorOwnerIds(value: string): string[] | null {
+  try {
+    const parsed: unknown = JSON.parse(value)
+    return Array.isArray(parsed) && parsed.every((entry) => typeof entry === 'string')
+      ? parsed
+      : null
+  } catch {
+    return null
   }
-  const aLeaf = parsePaneKey(a)?.leafId
-  const bLeaf = parsePaneKey(b)?.leafId
-  return Boolean(aLeaf && bLeaf && aLeaf === bLeaf)
 }
 
 // Why: indexable pre-filter for isEquivalentPaneKey — equal strings and equal leaves both share the
@@ -81,7 +83,7 @@ const DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL =
 
 function paneKeyMatchSuffix(paneKey: string): string {
   const colon = paneKey.indexOf(':')
-  return colon < 0 ? paneKey : paneKey.slice(colon + 1)
+  return colon === -1 ? paneKey : paneKey.slice(colon + 1)
 }
 
 export type {
@@ -285,7 +287,7 @@ type RunListCursor = {
 // Schema versions: v2 'heartbeat'+last_heartbeat_at, v3 delivered_at, v4 task-creator terminal, v5 task_title/display_name, v6 pane identity, v7 lightweight Runs, v8 crash-safe Run deliveries, v9 durable question threads, v10 Dispatch capabilities, v11 durable mutation receipts, v12 composed worker state, v18 post-v6 version-skew repair, v19 adopted legacy Runs and compatibility receipts, v20 legacy question backfill, v21 legacy scheduler-loss provenance, v22 dispatch assignee lookup, v23 worker terminal resource ownership, v24 creator-incarnation authority, v25 active Dispatch handle lookup, v26 indexed mutation receipt capacity.
 const SCHEMA_VERSION = 26
 
-function hardenOrchestrationDatabaseFiles(dbPath: string | ':memory:'): void {
+function hardenOrchestrationDatabaseFiles(dbPath: (string & {}) | ':memory:'): void {
   if (dbPath === ':memory:' || process.platform === 'win32') {
     // Why: Windows protects these files through Orca's current-user-only userData DACL; POSIX mode bits are inert there.
     return
@@ -308,7 +310,7 @@ export class OrchestrationDb {
   // per-terminal fan-out. Only createDispatchContext flips this false→true.
   private hasAnyDispatchContextsCache: boolean | undefined
 
-  constructor(dbPath: string | ':memory:') {
+  constructor(dbPath: (string & {}) | ':memory:') {
     this.db = new Database(dbPath)
     this.db.pragma('journal_mode = WAL')
     this.db.pragma('synchronous = NORMAL')
@@ -3851,7 +3853,7 @@ export class OrchestrationDb {
     return this.db.prepare('SELECT * FROM tasks ORDER BY created_at').all() as TaskRow[]
   }
 
-  // Why: LEFT JOIN keeps non-dispatched tasks (NULL assignee); the MAX(rowid) subquery matches getDispatchContext's most-recent-active-dispatch semantics.
+  // Why: the correlated indexed lookup avoids materializing every retained Dispatch before filtering Tasks.
   listTasksWithDispatch(filter?: {
     status?: TaskStatus
     ready?: boolean
@@ -3879,16 +3881,14 @@ export class OrchestrationDb {
         d.assignee_handle AS assignee_handle,
         d.id              AS dispatch_id
       FROM tasks t
-      LEFT JOIN (
-        SELECT dc.*
-        FROM dispatch_contexts dc
-        INNER JOIN (
-          SELECT task_id, MAX(rowid) AS max_rowid
-          FROM dispatch_contexts
-          WHERE status IN ('pending', 'dispatched')
-          GROUP BY task_id
-        ) latest ON latest.task_id = dc.task_id AND latest.max_rowid = dc.rowid
-      ) d ON d.task_id = t.id
+      LEFT JOIN dispatch_contexts d ON d.rowid = (
+        SELECT candidate.rowid
+        FROM dispatch_contexts candidate
+        WHERE candidate.task_id = t.id
+          AND candidate.status IN ('pending', 'dispatched')
+        ORDER BY candidate.rowid DESC
+        LIMIT 1
+      )
       ${where}
       ORDER BY t.created_at
     `
@@ -5096,13 +5096,44 @@ export class OrchestrationDb {
     dispatchId: string
     direction: FederationRelayDirection
     throughSequence: number
+    settleRemoteReport?: { sequence: number; outcome: WorkerReportOutcome }
   }): void {
-    this.db
-      .prepare(
-        `UPDATE federation_relay_items SET acked_at = COALESCE(acked_at, datetime('now'))
-         WHERE dispatch_id = ? AND direction = ? AND sequence <= ?`
-      )
-      .run(params.dispatchId, params.direction, params.throughSequence)
+    this.db.exec('BEGIN IMMEDIATE')
+    try {
+      if (params.settleRemoteReport) {
+        const report = this.getFederationRelayItem(
+          params.dispatchId,
+          params.direction,
+          params.settleRemoteReport.sequence
+        )
+        if (
+          params.direction !== 'to_home' ||
+          params.settleRemoteReport.sequence > params.throughSequence ||
+          report?.kind !== 'worker_done' ||
+          parseFederatedWorkerReportOutcome(report.payload) !== params.settleRemoteReport.outcome
+        ) {
+          throw new OrchestrationError(
+            'request_mismatch',
+            `Federation acknowledgment for ${params.dispatchId} does not match its queued worker_done.`
+          )
+        }
+        this.settleRemoteAttachmentInRelayTransaction(
+          params.dispatchId,
+          params.settleRemoteReport.outcome,
+          'worker_report_settled'
+        )
+      }
+      this.db
+        .prepare(
+          `UPDATE federation_relay_items SET acked_at = COALESCE(acked_at, datetime('now'))
+           WHERE dispatch_id = ? AND direction = ? AND sequence <= ?`
+        )
+        .run(params.dispatchId, params.direction, params.throughSequence)
+      this.db.exec('COMMIT')
+    } catch (error) {
+      this.db.exec('ROLLBACK')
+      throw error
+    }
   }
 
   setFederatedHomeImportSequence(dispatchId: string, sequence: number): void {
@@ -5140,7 +5171,11 @@ export class OrchestrationDb {
           result: string
         }
       | { kind: 'rejected'; code: string; reason: string }
-  }): { message: MessageRow; duplicate: boolean } {
+  }): {
+    message: MessageRow
+    duplicate: boolean
+    lifecycle?: WorkerReportSettlement | { action: 'rejected'; code: string; reason: string }
+  } {
     this.db.exec('BEGIN IMMEDIATE')
     try {
       const federated = this.getFederatedDispatch(params.dispatchId)
@@ -5150,18 +5185,14 @@ export class OrchestrationDb {
           `Federated Dispatch ${params.dispatchId} was not found.`
         )
       }
-      if (params.sequence <= federated.to_home_imported_sequence) {
-        const existing = this.getMessageById(params.message.id)
-        if (!existing) {
-          throw new OrchestrationError(
-            'operation_unknown',
-            `Federated relay sequence ${params.sequence} was committed without its message.`
-          )
-        }
-        this.db.exec('COMMIT')
-        return { message: existing, duplicate: true }
+      const duplicate = params.sequence <= federated.to_home_imported_sequence
+      if (duplicate && !this.getMessageById(params.message.id)) {
+        throw new OrchestrationError(
+          'operation_unknown',
+          `Federated relay sequence ${params.sequence} was committed without its message.`
+        )
       }
-      if (params.sequence !== federated.to_home_imported_sequence + 1) {
+      if (!duplicate && params.sequence !== federated.to_home_imported_sequence + 1) {
         throw new OrchestrationError(
           'operation_unknown',
           `Federated relay for ${params.dispatchId} is not contiguous after sequence ${federated.to_home_imported_sequence}.`
@@ -5188,32 +5219,45 @@ export class OrchestrationDb {
           dispatchId: params.dispatchId
         })
       }
-      if (params.lifecycle.kind === 'heartbeat') {
+      let lifecycle:
+        | WorkerReportSettlement
+        | { action: 'rejected'; code: string; reason: string }
+        | undefined
+      if (params.lifecycle.kind === 'heartbeat' && !duplicate) {
         this.recordHeartbeat(params.dispatchId, params.lifecycle.at)
       } else if (params.lifecycle.kind === 'worker_report') {
-        const settlement = this.settleWorkerReportInTransaction({
+        lifecycle = this.settleWorkerReportInTransaction({
           taskId: params.lifecycle.taskId,
           dispatchId: params.dispatchId,
           outcome: params.lifecycle.outcome,
           result: params.lifecycle.result
         })
-        if (settlement.action === 'rejected') {
+        if (lifecycle.action === 'rejected' && !duplicate) {
           message = this.convertLifecycleMessageToRejection(
             message.id,
-            settlement.code,
-            settlement.reason
+            lifecycle.code,
+            lifecycle.reason
           ) as MessageRow
         }
       } else if (params.lifecycle.kind === 'rejected') {
-        message = this.convertLifecycleMessageToRejection(
-          message.id,
-          params.lifecycle.code,
-          params.lifecycle.reason
-        ) as MessageRow
+        lifecycle = {
+          action: 'rejected',
+          code: params.lifecycle.code,
+          reason: params.lifecycle.reason
+        }
+        if (!duplicate) {
+          message = this.convertLifecycleMessageToRejection(
+            message.id,
+            params.lifecycle.code,
+            params.lifecycle.reason
+          ) as MessageRow
+        }
+      }
+      if (!duplicate) {
+        this.setFederatedHomeImportSequence(params.dispatchId, params.sequence)
       }
-      this.setFederatedHomeImportSequence(params.dispatchId, params.sequence)
       this.db.exec('COMMIT')
-      return { message, duplicate: false }
+      return { message, duplicate, ...(lifecycle ? { lifecycle } : {}) }
     } catch (error) {
       this.db.exec('ROLLBACK')
       throw error
@@ -5314,19 +5358,37 @@ export class OrchestrationDb {
 
   private settleRemoteAttachmentInRelayTransaction(
     dispatchId: string,
-    outcome: WorkerReportOutcome | undefined
+    outcome: WorkerReportOutcome | undefined,
+    stage = 'worker_report_queued'
   ): void {
     if (!outcome) {
       return
     }
+    const attachment = this.getRemoteDispatchAttachment(dispatchId)
+    const state = outcome === 'succeeded' ? 'succeeded' : 'failed'
+    if (!attachment) {
+      throw new OrchestrationError(
+        'dispatch_not_found',
+        `Remote Dispatch ${dispatchId} was not found.`
+      )
+    }
+    if (attachment.state === state) {
+      return
+    }
+    if (attachment.state !== 'ready') {
+      throw new OrchestrationError(
+        'request_mismatch',
+        `Remote Dispatch ${dispatchId} cannot settle as ${state} from ${attachment.state}.`
+      )
+    }
     this.db
       .prepare(
         `UPDATE remote_dispatch_attachments
-         SET state = ?, stage = 'worker_report_queued', capability_hash = NULL,
+         SET state = ?, stage = ?, capability_hash = NULL,
              updated_at = datetime('now')
          WHERE dispatch_id = ? AND state = 'ready'`
       )
-      .run(outcome === 'succeeded' ? 'succeeded' : 'failed', dispatchId)
+      .run(state, stage, dispatchId)
   }
 
   isDispatchProcessCurrent(params: {
@@ -5818,12 +5880,12 @@ export class OrchestrationDb {
       if (!worker) {
         throw new OrchestrationError('dispatch_not_found', `Dispatch ${dispatchId} was not found.`)
       }
-      if (!['succeeded', 'failed'].includes(worker.state)) {
+      if (!WORKER_SETTLED_STATES.includes(worker.state)) {
         // Why: release is post-completion cleanup only; recording intent for an unsettled or
         // uncertain worker would let recovery close a terminal the coordinator never reviewed.
         throw new OrchestrationError(
           'dispatch_inactive',
-          `Dispatch ${dispatchId} is ${worker.state}; only a succeeded or failed worker can release. Use worker-stop to cancel an active worker.`
+          `Dispatch ${dispatchId} is ${worker.state}; only a settled worker can release. Use worker-stop to cancel an active worker.`
         )
       }
       const resource = this.getWorkerTerminalResourceByOwner(dispatchId)
@@ -5838,6 +5900,10 @@ export class OrchestrationDb {
         this.db.exec('COMMIT')
         return { disposition: 'already_released', resource }
       }
+      if (worker.state === 'stopped' || worker.state === 'abandoned') {
+        this.db.exec('COMMIT')
+        return { disposition: 'retained', resource, reason: 'identity_unproven' }
+      }
       if (resource.ownership_state === 'external') {
         this.db.exec('COMMIT')
         return {
@@ -5886,6 +5952,66 @@ export class OrchestrationDb {
     }
   }
 
+  settleDeadWorkerTerminalRelease(params: {
+    requestingDispatchId: string
+    resourceId: string
+    processIncarnation: string
+  }):
+    | { disposition: 'released'; resource: WorkerTerminalResourceRow }
+    | { disposition: 'retained'; resource: WorkerTerminalResourceRow } {
+    this.db.exec('BEGIN IMMEDIATE')
+    try {
+      const resource = this.getWorkerTerminalResource(params.resourceId)
+      if (!resource) {
+        throw new OrchestrationError(
+          'dispatch_not_found',
+          `Worker terminal resource ${params.resourceId} was not found.`
+        )
+      }
+      const priorOwners = parseWorkerTerminalPriorOwnerIds(resource.prior_owner_dispatch_ids)
+      const requesterRelated =
+        resource.owner_dispatch_id === params.requestingDispatchId ||
+        priorOwners?.includes(params.requestingDispatchId) === true
+      const requester = this.getWorkerDispatch(params.requestingDispatchId)
+      const owner = this.getWorkerDispatch(resource.owner_dispatch_id)
+      const requesterSettled = Boolean(requester && WORKER_SETTLED_STATES.includes(requester.state))
+      const ownerSettled = Boolean(owner && WORKER_SETTLED_STATES.includes(owner.state))
+      if (
+        !priorOwners ||
+        !requesterRelated ||
+        !requesterSettled ||
+        !ownerSettled ||
+        resource.process_incarnation !== params.processIncarnation ||
+        resource.ownership_state === 'released' ||
+        !['not_requested', 'retained', 'unknown'].includes(resource.release_state)
+      ) {
+        this.db.exec('COMMIT')
+        return { disposition: 'retained', resource }
+      }
+      this.db
+        .prepare(
+          `UPDATE worker_terminal_resources
+           SET release_state = 'released', ownership_state = 'released', retained_reason = NULL,
+               release_requested_at = COALESCE(release_requested_at, datetime('now')),
+               release_completed_at = datetime('now'), release_error = NULL,
+               updated_at = datetime('now')
+           WHERE id = ? AND process_incarnation = ? AND ownership_state != 'released'
+             AND release_state IN ('not_requested', 'retained', 'unknown')`
+        )
+        .run(params.resourceId, params.processIncarnation)
+      const released = this.getWorkerTerminalResource(
+        params.resourceId
+      ) as WorkerTerminalResourceRow
+      this.db.exec('COMMIT')
+      return released.release_state === 'released'
+        ? { disposition: 'released', resource: released }
+        : { disposition: 'retained', resource: released }
+    } catch (error) {
+      this.db.exec('ROLLBACK')
+      throw error
+    }
+  }
+
   storeWorkerTerminalArchive(params: {
     dispatchId: string
     resourceId: string
@@ -6804,3 +6930,18 @@ export class OrchestrationDb {
     this.db.close()
   }
 }
+
+function parseFederatedWorkerReportOutcome(payload: string): WorkerReportOutcome | undefined {
+  try {
+    const message = JSON.parse(payload) as { payload?: unknown }
+    if (typeof message.payload !== 'string') {
+      return undefined
+    }
+    const report = JSON.parse(message.payload) as { outcome?: unknown }
+    return report.outcome === 'succeeded' || report.outcome === 'failed'
+      ? report.outcome
+      : undefined
+  } catch {
+    return undefined
+  }
+}
diff --git a/src/main/runtime/orchestration/federation-lifecycle-settlement.ts b/src/main/runtime/orchestration/federation-lifecycle-settlement.ts
new file mode 100644
index 00000000000..921db91b728
--- /dev/null
+++ b/src/main/runtime/orchestration/federation-lifecycle-settlement.ts
@@ -0,0 +1,70 @@
+import type { OrcaRuntimeService } from '../orca-runtime'
+
+export type FederatedLifecycleSettlement =
+  | { action: 'completed' | 'failed'; authority: 'run_home' }
+  | { action: 'rejected'; code: string; reason: string; authority: 'run_home' }
+
+type Waiter = (settlement: FederatedLifecycleSettlement) => void
+
+const waitersByRuntime = new WeakMap<OrcaRuntimeService, Map<string, Set<Waiter>>>()
+
+export function publishFederatedLifecycleSettlement(
+  runtime: OrcaRuntimeService,
+  dispatchId: string,
+  sequence: number,
+  settlement: FederatedLifecycleSettlement
+): void {
+  const waiters = waitersByRuntime.get(runtime)?.get(settlementKey(dispatchId, sequence))
+  for (const waiter of waiters ?? []) {
+    waiter(settlement)
+  }
+}
+
+export function waitForFederatedLifecycleSettlement(
+  runtime: OrcaRuntimeService,
+  dispatchId: string,
+  sequence: number,
+  options: { timeoutMs: number; signal?: AbortSignal }
+): Promise<FederatedLifecycleSettlement | undefined> {
+  return new Promise((resolve) => {
+    if (options.signal?.aborted) {
+      resolve(undefined)
+      return
+    }
+    const runtimeWaiters = getRuntimeWaiters(runtime)
+    const key = settlementKey(dispatchId, sequence)
+    const waiters = runtimeWaiters.get(key) ?? new Set<Waiter>()
+    runtimeWaiters.set(key, waiters)
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const finish = (settlement?: FederatedLifecycleSettlement) => {
+      if (timer) {
+        clearTimeout(timer)
+      }
+      options.signal?.removeEventListener('abort', onAbort)
+      waiters.delete(onSettlement)
+      if (waiters.size === 0) {
+        runtimeWaiters.delete(key)
+      }
+      resolve(settlement)
+    }
+    const onSettlement: Waiter = (settlement) => finish(settlement)
+    const onAbort = () => finish()
+    waiters.add(onSettlement)
+    options.signal?.addEventListener('abort', onAbort, { once: true })
+    timer = setTimeout(() => finish(), options.timeoutMs)
+  })
+}
+
+function getRuntimeWaiters(runtime: OrcaRuntimeService): Map<string, Set<Waiter>> {
+  const existing = waitersByRuntime.get(runtime)
+  if (existing) {
+    return existing
+  }
+  const created = new Map<string, Set<Waiter>>()
+  waitersByRuntime.set(runtime, created)
+  return created
+}
+
+function settlementKey(dispatchId: string, sequence: number): string {
+  return `${dispatchId}:${sequence}`
+}
diff --git a/src/main/runtime/orchestration/federation-sync.ts b/src/main/runtime/orchestration/federation-sync.ts
index 5ad4f1fc09a..13ec9dce561 100644
--- a/src/main/runtime/orchestration/federation-sync.ts
+++ b/src/main/runtime/orchestration/federation-sync.ts
@@ -5,6 +5,8 @@ import {
   type WorkerReportOutcome
 } from './types'
 import type { OrcaRuntimeService } from '../orca-runtime'
+import type { FederatedLifecycleSettlement } from './federation-lifecycle-settlement'
+import { ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION } from '../../../shared/protocol-version'
 import { OrchestrationError } from './orchestration-error'
 import {
   acquireFederationAckLease,
@@ -58,6 +60,8 @@ export async function syncFederatedDispatch(
     )
   }
   const ackLease = acquireFederationAckLease(runtime, dispatchId)
+  const supportsLifecycleSettlement =
+    federated.protocol_version >= ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION
 
   const pulled = (await runtime.callOrchestrationWorkerServer(
     federated.environment_id,
@@ -65,12 +69,17 @@ export async function syncFederatedDispatch(
     {
       dispatchId,
       afterSequence: federated.to_home_imported_sequence,
+      ...(supportsLifecycleSettlement ? { replayUnacknowledged: true } : {}),
       limit: 50
     },
     15_000
   )) as { runtimeEpoch: string; items: PulledRelayItem[] }
-  let cursor = federated.to_home_imported_sequence
+  let cursor =
+    supportsLifecycleSettlement && pulled.items.length > 0
+      ? pulled.items[0].sequence - 1
+      : federated.to_home_imported_sequence
   let imported = 0
+  const settlements: { sequence: number; lifecycle: FederatedLifecycleSettlement }[] = []
   for (const item of pulled.items) {
     if (item.dispatch_id !== dispatchId || item.sequence !== cursor + 1) {
       throw new OrchestrationError(
@@ -96,6 +105,18 @@ export async function syncFederatedDispatch(
       },
       lifecycle: parseFederatedLifecycle(message, item.message_id, dispatchId, dispatch.task_id)
     })
+    if (stored.lifecycle && supportsLifecycleSettlement) {
+      settlements.push({
+        sequence: item.sequence,
+        lifecycle:
+          stored.lifecycle.action === 'settled'
+            ? {
+                action: stored.lifecycle.outcome === 'succeeded' ? 'completed' : 'failed',
+                authority: 'run_home'
+              }
+            : { ...stored.lifecycle, authority: 'run_home' }
+      })
+    }
     cursor = item.sequence
     runtime.notifyMessageArrived(stored.message.to_handle, stored.message.type)
     imported += stored.duplicate ? 0 : 1
@@ -110,7 +131,11 @@ export async function syncFederatedDispatch(
     await runtime.callOrchestrationWorkerServer(
       federated.environment_id,
       'orchestration.federationAck',
-      { dispatchId, throughSequence: cursor },
+      {
+        dispatchId,
+        throughSequence: cursor,
+        ...(settlements.length > 0 ? { settlements } : {})
+      },
       15_000,
       { orchestrationRequestId: `relay_ack_${dispatchId}_${cursor}` }
     )
diff --git a/src/main/runtime/orchestration/lifecycle-reconciliation.ts b/src/main/runtime/orchestration/lifecycle-reconciliation.ts
index 3d2793413b7..7e9c2bc0efa 100644
--- a/src/main/runtime/orchestration/lifecycle-reconciliation.ts
+++ b/src/main/runtime/orchestration/lifecycle-reconciliation.ts
@@ -1,17 +1,6 @@
 import type { OrchestrationDb } from './db'
 import type { MessageRow, WorkerReportOutcome } from './types'
-import { parsePaneKey } from '../../../shared/stable-pane-id'
-
-// Why: the tab half can change on pane break-out, while opaque legacy keys
-// have no safe equivalence beyond exact equality.
-function isSamePane(assigneePaneKey: string, senderPaneKey: string): boolean {
-  if (assigneePaneKey === senderPaneKey) {
-    return true
-  }
-  const assigneeLeaf = parsePaneKey(assigneePaneKey)?.leafId
-  const senderLeaf = parsePaneKey(senderPaneKey)?.leafId
-  return Boolean(assigneeLeaf && senderLeaf && assigneeLeaf === senderLeaf)
-}
+import { isEquivalentPaneKey } from '../../../shared/stable-pane-id'
 
 function hasLifecycleAuthority(
   dispatch: { assignee_handle: string | null; assignee_pane_key: string | null },
@@ -19,7 +8,7 @@ function hasLifecycleAuthority(
 ): boolean {
   if (dispatch.assignee_pane_key) {
     return Boolean(
-      msg.sender_pane_key && isSamePane(dispatch.assignee_pane_key, msg.sender_pane_key)
+      msg.sender_pane_key && isEquivalentPaneKey(dispatch.assignee_pane_key, msg.sender_pane_key)
     )
   }
   // Why: rows created before pane identity existed can only use the exact
diff --git a/src/main/runtime/orchestration/setup-completion-signal.ts b/src/main/runtime/orchestration/setup-completion-signal.ts
index 23e22008387..15c74d2294e 100644
--- a/src/main/runtime/orchestration/setup-completion-signal.ts
+++ b/src/main/runtime/orchestration/setup-completion-signal.ts
@@ -61,7 +61,7 @@ export function createSetupCompletionScanner(
       }
       const combined = `${carry}${data}`
       const markerIndex = combined.lastIndexOf(expectedPrefix)
-      if (markerIndex >= 0) {
+      if (markerIndex !== -1) {
         const suffix = combined.slice(markerIndex + expectedPrefix.length)
         const match = suffix.match(/^(-?\d+)\r?\n/)
         if (match) {
diff --git a/src/main/runtime/orchestration/worker-terminal-process-liveness.ts b/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
new file mode 100644
index 00000000000..5a6e92c7878
--- /dev/null
+++ b/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
@@ -0,0 +1,62 @@
+import type { PtyProcessInfo } from '../../providers/pty-process-info'
+
+export type WorkerTerminalHostScope =
+  | { kind: 'local'; hostId: 'local' }
+  | { kind: 'wsl'; hostId: 'local'; distro: string }
+  | { kind: 'ssh'; targetId: string }
+
+export function parseWorkerTerminalHostScope(value: string | null): WorkerTerminalHostScope | null {
+  if (!value) {
+    return null
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(value)
+  } catch {
+    return null
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    return null
+  }
+  const scope = parsed as Record<string, unknown>
+  if (scope.kind === 'local' && scope.hostId === 'local') {
+    return { kind: 'local', hostId: 'local' }
+  }
+  if (
+    scope.kind === 'wsl' &&
+    scope.hostId === 'local' &&
+    typeof scope.distro === 'string' &&
+    scope.distro.length > 0
+  ) {
+    return { kind: 'wsl', hostId: 'local', distro: scope.distro }
+  }
+  if (scope.kind === 'ssh' && typeof scope.targetId === 'string' && scope.targetId.length > 0) {
+    return { kind: 'ssh', targetId: scope.targetId }
+  }
+  return null
+}
+
+export function classifyWorkerTerminalProcessIncarnation(
+  processIncarnation: string,
+  sessions: readonly PtyProcessInfo[]
+): 'live' | 'dead' | 'unknown' {
+  const possibleMatches = sessions.filter((session) =>
+    processIncarnation.startsWith(`${session.id}:`)
+  )
+  if (
+    possibleMatches.some((session) => {
+      const incarnationId = session.incarnationId
+      if (!incarnationId || incarnationId !== incarnationId.trim()) {
+        return false
+      }
+      return `${session.id}:${incarnationId}` === processIncarnation
+    })
+  ) {
+    return 'live'
+  }
+  return possibleMatches.some(
+    (session) => !session.incarnationId || session.incarnationId !== session.incarnationId.trim()
+  )
+    ? 'unknown'
+    : 'dead'
+}
diff --git a/src/main/runtime/quarter-circle-title-send-authorization.test.ts b/src/main/runtime/quarter-circle-title-send-authorization.test.ts
new file mode 100644
index 00000000000..d8e58073cb0
--- /dev/null
+++ b/src/main/runtime/quarter-circle-title-send-authorization.test.ts
@@ -0,0 +1,212 @@
+// STA-4028 (regression from #13925): quarter circles are ordinary progress glyphs —
+// ora, installers, any TUI animates them — so a title carrying nothing else must not
+// authorize a guarded send, which auto-submits with Enter into whatever owns the pane.
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from './orca-runtime'
+import { assertTerminalAgentSendable } from './rpc/terminal-agent-send-guard'
+import { detectAgentStatusFromTitle } from '../../shared/agent-detection'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const TAB_ID = 'tab-1'
+const WORKTREE_ID = 'wt-1'
+const PTY_ID = 'pty-1'
+
+// Captured from Claude Code 2.1.228 while it read this repository's package.json.
+const SPINNER_ONLY_TITLE = '◑ Check package version in package.json'
+const SPINNER_WITH_IDENTITY_TITLE = '◐ Claude Code'
+const BRAILLE_SPINNER_ONLY_TITLE = '⠂ Deploying release 4.2'
+
+async function createRuntimeWithTitle(
+  paneTitle: string,
+  foregroundProcess: string | null,
+  launchAgent?: 'claude',
+  verifiedLaunch = true
+): Promise<{
+  runtime: OrcaRuntimeService
+  handle: string
+  getForegroundProcess: ReturnType<typeof vi.fn>
+}> {
+  const runtime = new OrcaRuntimeService(null)
+  const internals = runtime as unknown as {
+    resolveTerminalWorkspaceLaunchScope: (selector: string) => Promise<unknown>
+  }
+  vi.spyOn(internals, 'resolveTerminalWorkspaceLaunchScope').mockResolvedValue({
+    id: WORKTREE_ID,
+    path: '/repo/app',
+    connectionId: null,
+    repo: null,
+    folderWorkspace: null
+  })
+  const getForegroundProcess = vi.fn(async () => foregroundProcess)
+  runtime.setPtyController({
+    spawn: vi.fn().mockResolvedValue({ id: PTY_ID, incarnationId: 'initial-incarnation' }),
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess
+  })
+  const terminal = await runtime.createTerminal(`id:${WORKTREE_ID}`, {
+    tabId: TAB_ID,
+    leafId: LEAF_ID,
+    title: 'Terminal',
+    ...(launchAgent
+      ? {
+          launchAgent,
+          ...(verifiedLaunch
+            ? { launchConfig: { agentCommand: 'claude', agentArgs: '', agentEnv: {} } }
+            : {})
+        }
+      : {})
+  })
+  runtime.attachWindow(1)
+  runtime.syncWindowGraph(1, {
+    tabs: [
+      {
+        tabId: TAB_ID,
+        worktreeId: WORKTREE_ID,
+        title: 'Terminal',
+        activeLeafId: LEAF_ID,
+        layout: null
+      }
+    ],
+    leaves: [
+      {
+        tabId: TAB_ID,
+        worktreeId: WORKTREE_ID,
+        leafId: LEAF_ID,
+        paneRuntimeId: 1,
+        ptyId: PTY_ID,
+        paneTitle
+      }
+    ]
+  })
+  return { runtime, handle: terminal.handle, getForegroundProcess }
+}
+
+const AUTHORIZED = 'authorized'
+
+async function guardedSendResult(runtime: OrcaRuntimeService, handle: string): Promise<string> {
+  try {
+    await assertTerminalAgentSendable({ runtime, handle, assertWritable: () => {} })
+    return AUTHORIZED
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error)
+  }
+}
+
+describe('quarter-circle title send authorization (STA-4028)', () => {
+  it('refuses a guarded send when a quarter-circle spinner is the only agent evidence', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_ONLY_TITLE, 'node')
+
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: false
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe('terminal_guard_no_agent')
+  })
+
+  it('refuses a guarded send when the foreground process cannot be read at all', async () => {
+    // Why: SSH and folder-workspace panes can fail the foreground read; no evidence
+    // stays a refusal rather than falling back to the glyph.
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_ONLY_TITLE, null)
+
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe('terminal_guard_no_agent')
+  })
+
+  it('authorizes a guarded send when the foreground process is a recognized agent', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_ONLY_TITLE, 'claude')
+
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: true,
+      status: 'working'
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe(AUTHORIZED)
+  })
+
+  it('authorizes a managed Claude launch when the foreground process is unavailable', async () => {
+    const { runtime, handle, getForegroundProcess } = await createRuntimeWithTitle(
+      SPINNER_ONLY_TITLE,
+      null,
+      'claude'
+    )
+    expect(
+      (
+        runtime as unknown as {
+          ptysById: Map<string, { launchAgent: string | null; launchToken: string | null }>
+        }
+      ).ptysById.get(PTY_ID)
+    ).toMatchObject({ launchAgent: 'claude', launchToken: expect.any(String) })
+
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: true,
+      status: 'working'
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe(AUTHORIZED)
+    expect(getForegroundProcess).not.toHaveBeenCalled()
+  })
+
+  it('does not trust an unverified Claude launch hint', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(
+      SPINNER_ONLY_TITLE,
+      null,
+      'claude',
+      false
+    )
+
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe('terminal_guard_no_agent')
+  })
+
+  it('does not carry managed Claude identity into a replacement PTY incarnation', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_ONLY_TITLE, null, 'claude')
+    const pty = (
+      runtime as unknown as {
+        ptysById: Map<
+          string,
+          { incarnationId: string | null; launchIncarnationId: string | null; launchToken: string }
+        >
+      }
+    ).ptysById.get(PTY_ID)
+    expect(pty).toMatchObject({
+      incarnationId: 'initial-incarnation',
+      launchIncarnationId: 'initial-incarnation'
+    })
+
+    runtime.onPtySpawned(PTY_ID, 'replacement-incarnation', { awaitsRegistration: false })
+
+    expect(pty).toMatchObject({
+      incarnationId: 'replacement-incarnation',
+      launchIncarnationId: 'initial-incarnation',
+      launchToken: expect.any(String)
+    })
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: false
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe('terminal_guard_no_agent')
+  })
+
+  it('authorizes a guarded send when the busy title itself names the agent', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_WITH_IDENTITY_TITLE, null)
+
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: true,
+      status: 'working'
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe(AUTHORIZED)
+  })
+
+  it('leaves braille-spinner authorization unchanged', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(BRAILLE_SPINNER_ONLY_TITLE, null)
+
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe(AUTHORIZED)
+  })
+
+  it('keeps the quarter-circle glyph a working activity signal (#13889)', async () => {
+    expect(detectAgentStatusFromTitle(SPINNER_ONLY_TITLE)).toBe('working')
+    expect(detectAgentStatusFromTitle(SPINNER_WITH_IDENTITY_TITLE)).toBe('working')
+  })
+})
diff --git a/src/main/runtime/repo-worktree-admin-fingerprint.test.ts b/src/main/runtime/repo-worktree-admin-fingerprint.test.ts
new file mode 100644
index 00000000000..15d4aad4484
--- /dev/null
+++ b/src/main/runtime/repo-worktree-admin-fingerprint.test.ts
@@ -0,0 +1,152 @@
+// Real-binary coverage: the fingerprint's whole job is to predict what `git worktree list` would
+// report, so a mocked filesystem would only prove the assumptions, not the Git layout they model.
+import { execFile } from 'node:child_process'
+import { mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { readRepoWorktreeAdminFingerprint } from './repo-worktree-admin-fingerprint'
+
+const execFileAsync = promisify(execFile)
+
+let scratchDir = ''
+let repoPath = ''
+let worktreePath = ''
+
+async function git(args: string[], cwd: string): Promise<string> {
+  const { stdout } = await execFileAsync('git', args, { cwd })
+  return stdout
+}
+
+async function fingerprint(path = repoPath): Promise<string | null> {
+  return await readRepoWorktreeAdminFingerprint(path)
+}
+
+beforeEach(async () => {
+  // realpath: macOS hands out /var/... temp paths while Git records /private/var/... in `gitdir`.
+  scratchDir = await realpath(await mkdtemp(join(tmpdir(), 'orca-worktree-fingerprint-')))
+  repoPath = join(scratchDir, 'repo')
+  worktreePath = join(scratchDir, 'trees', 'feature')
+  await mkdir(repoPath, { recursive: true })
+  await mkdir(join(scratchDir, 'trees'), { recursive: true })
+  await git(['init', '-q'], repoPath)
+  await git(['config', 'user.email', 'fingerprint@example.invalid'], repoPath)
+  await git(['config', 'user.name', 'Fingerprint'], repoPath)
+  await writeFile(join(repoPath, 'seed.txt'), 'seed\n')
+  await git(['add', '-A'], repoPath)
+  await git(['commit', '-qm', 'seed'], repoPath)
+  await git(['worktree', 'add', '-q', worktreePath, '-b', 'feature'], repoPath)
+})
+
+afterEach(async () => {
+  await rm(scratchDir, { recursive: true, force: true })
+})
+
+describe('readRepoWorktreeAdminFingerprint', () => {
+  it('is stable while nothing changes', async () => {
+    const first = await fingerprint()
+    expect(first).not.toBeNull()
+    expect(await fingerprint()).toBe(first)
+  })
+
+  it('changes when a worktree is added', async () => {
+    const before = await fingerprint()
+    await git(
+      ['worktree', 'add', '-q', join(scratchDir, 'trees', 'second'), '-b', 'second'],
+      repoPath
+    )
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('changes when a worktree is removed', async () => {
+    const before = await fingerprint()
+    await git(['worktree', 'remove', worktreePath], repoPath)
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('changes when a worktree directory is deleted outside Git', async () => {
+    // The admin dir is untouched by `rm -rf`, but the row's `prunable` flag flips.
+    const before = await fingerprint()
+    await rm(worktreePath, { recursive: true, force: true })
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('changes when a worktree is moved', async () => {
+    const before = await fingerprint()
+    await git(['worktree', 'move', worktreePath, join(scratchDir, 'trees', 'moved')], repoPath)
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('changes when a worktree is locked', async () => {
+    const before = await fingerprint()
+    await git(['worktree', 'lock', worktreePath], repoPath)
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('changes when a linked worktree switches branch', async () => {
+    const before = await fingerprint()
+    // A longer ref name keeps the difference visible even on a coarse mtime clock.
+    await git(['checkout', '-q', '-b', 'feature-with-a-much-longer-name'], worktreePath)
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('changes when a linked worktree records a commit', async () => {
+    // Committing rewrites refs/heads/feature and leaves HEAD alone, but moves the reported HEAD oid.
+    const before = await fingerprint()
+    await writeFile(join(worktreePath, 'work.txt'), 'work\n')
+    await git(['add', '-A'], worktreePath)
+    await git(['commit', '-qm', 'work'], worktreePath)
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('changes when the main worktree records a commit', async () => {
+    const before = await fingerprint()
+    await writeFile(join(repoPath, 'more.txt'), 'more\n')
+    await git(['add', '-A'], repoPath)
+    await git(['commit', '-qm', 'more'], repoPath)
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('still tracks a tip whose loose ref has been packed away', async () => {
+    await git(['pack-refs', '--all'], repoPath)
+    const before = await fingerprint()
+    await writeFile(join(worktreePath, 'packed.txt'), 'packed\n')
+    await git(['add', '-A'], worktreePath)
+    await git(['commit', '-qm', 'packed'], worktreePath)
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('changes when the main worktree switches branch', async () => {
+    const before = await fingerprint()
+    await git(['checkout', '-q', '-b', 'main-with-a-much-longer-name'], repoPath)
+    expect(await fingerprint()).not.toBe(before)
+  })
+
+  it('resolves the same admin state from a linked worktree path', async () => {
+    // A linked worktree can itself be the registered repo path; both must describe one common dir.
+    expect(await fingerprint(worktreePath)).toBe(await fingerprint(repoPath))
+  })
+
+  it('reads a bare repo through its own gitdir', async () => {
+    const barePath = join(scratchDir, 'bare.git')
+    await git(['clone', '-q', '--bare', repoPath, barePath], scratchDir)
+    const before = await fingerprint(barePath)
+    expect(before).not.toBeNull()
+    await git(
+      ['worktree', 'add', '-q', join(scratchDir, 'trees', 'from-bare'), '-b', 'bare-tree'],
+      barePath
+    )
+    expect(await fingerprint(barePath)).not.toBe(before)
+  })
+
+  it('returns null for a directory that is not a git repo', async () => {
+    const plainPath = join(scratchDir, 'plain')
+    await mkdir(plainPath, { recursive: true })
+    expect(await fingerprint(plainPath)).toBeNull()
+  })
+
+  it('returns null for a missing path', async () => {
+    expect(await fingerprint(join(scratchDir, 'absent'))).toBeNull()
+  })
+})
diff --git a/src/main/runtime/repo-worktree-admin-fingerprint.ts b/src/main/runtime/repo-worktree-admin-fingerprint.ts
new file mode 100644
index 00000000000..1c3cf103e67
--- /dev/null
+++ b/src/main/runtime/repo-worktree-admin-fingerprint.ts
@@ -0,0 +1,191 @@
+import { readdir, readFile, stat } from 'node:fs/promises'
+import path from 'node:path'
+import { mapWithConcurrency } from '../../shared/map-with-concurrency'
+
+// NUL can appear in neither a path nor a Git ref, so field boundaries stay unambiguous.
+const FIELD_SEPARATOR = '\u0000'
+const MISSING = '-'
+// Why: this runs per repo on a polling path, so a repo with hundreds of worktrees must not queue its
+// whole admin dir onto the fs threadpool at once. Mirrors SPARSE_CHECKOUT_DETECTION_CONCURRENCY.
+const LINKED_WORKTREE_PROBE_CONCURRENCY = 8
+
+/**
+ * Cheap, subprocess-free summary of a local repo's Git worktree administrative state.
+ *
+ * Equal fingerprints mean `git worktree list --porcelain` would report the same rows, so a caller
+ * can extend a scan cache instead of spawning Git. `null` means "cannot prove unchanged" (not a
+ * Git repo, unreadable layout, permission error) and callers must fall back to a real scan.
+ *
+ * Not covered: sparse-checkout pattern edits, and a tip moved through a ref store this cannot read
+ * exactly (packed refs, the reftable backend), which fall back to a coarser mtime + size stamp.
+ * Callers bound both with a periodic unconditional rescan.
+ */
+export async function readRepoWorktreeAdminFingerprint(repoPath: string): Promise<string | null> {
+  try {
+    const commonDir = await resolveGitCommonDir(repoPath)
+    if (!commonDir) {
+      return null
+    }
+    const adminDir = path.join(commonDir, 'worktrees')
+    const names = await readLinkedWorktreeNames(adminDir)
+    const [mainHead, mainExists, packedRefs, reftable] = await Promise.all([
+      readHeadStamp(commonDir, commonDir),
+      readExistenceStamp(repoPath),
+      // A tip whose loose ref file was packed away still moves these.
+      readFileStamp(path.join(commonDir, 'packed-refs')),
+      readFileStamp(path.join(commonDir, 'reftable'))
+    ])
+    const linked = await mapWithConcurrency(
+      names,
+      LINKED_WORKTREE_PROBE_CONCURRENCY,
+      async (name) => await readLinkedWorktreeStamp(commonDir, adminDir, name)
+    )
+    return [mainHead, mainExists, packedRefs, reftable, String(names.length), ...linked].join(
+      FIELD_SEPARATOR
+    )
+  } catch {
+    return null
+  }
+}
+
+async function readLinkedWorktreeStamp(
+  commonDir: string,
+  adminDir: string,
+  name: string
+): Promise<string> {
+  const entryDir = path.join(adminDir, name)
+  // `gitdir` holds "<worktree>/.git"; its contents follow `git worktree move` and `git worktree repair`.
+  const gitdirTarget = await readTrimmedFile(path.join(entryDir, 'gitdir'))
+  const [head, locked, worktreeExists] = await Promise.all([
+    readHeadStamp(commonDir, entryDir),
+    readExistenceStamp(path.join(entryDir, 'locked')),
+    // Deleting a worktree directory outside Orca flips its `prunable` row without touching the admin dir.
+    gitdirTarget ? readExistenceStamp(path.dirname(gitdirTarget)) : Promise.resolve(MISSING)
+  ])
+  return [name, gitdirTarget ?? MISSING, head, locked, worktreeExists].join(FIELD_SEPARATOR)
+}
+
+/**
+ * Identify the commit `git worktree list` would print for one checkout: the HEAD line itself plus,
+ * when HEAD is a symref, the tip it names. Reading the tip is what makes a plain commit visible —
+ * committing rewrites `refs/heads/<branch>` and leaves HEAD untouched.
+ */
+async function readHeadStamp(commonDir: string, headDir: string): Promise<string> {
+  const head = await readTrimmedFile(path.join(headDir, 'HEAD'))
+  if (!head) {
+    return MISSING
+  }
+  const refName = head.match(/^ref:\s*(.+?)\s*$/)?.[1]
+  if (!refName || !isSafeRefName(refName)) {
+    // Detached HEAD already holds the object id, and an unrecognized HEAD is covered by its own text.
+    return head
+  }
+  // Per-worktree refs (`refs/bisect`, `refs/worktree`) live beside the checkout; branches are shared.
+  const tip =
+    (await readTrimmedFile(path.join(headDir, refName))) ??
+    (await readTrimmedFile(path.join(commonDir, refName)))
+  return [head, tip ?? MISSING].join(FIELD_SEPARATOR)
+}
+
+/** Keep a hand-edited HEAD from steering the probe outside the repo's ref store. */
+function isSafeRefName(refName: string): boolean {
+  const segments = refName.split(/[\\/]/)
+  return (
+    segments[0] === 'refs' &&
+    segments.length > 1 &&
+    segments.every((segment) => segment.length > 0 && segment !== '.' && segment !== '..') &&
+    !path.isAbsolute(refName)
+  )
+}
+
+async function readLinkedWorktreeNames(adminDir: string): Promise<string[]> {
+  try {
+    const entries = await readdir(adminDir, { withFileTypes: true })
+    return entries
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .sort()
+  } catch (err) {
+    // A repo with no linked worktrees has no admin dir at all; anything else is a real read failure.
+    if (isMissingEntryError(err)) {
+      return []
+    }
+    throw err
+  }
+}
+
+async function resolveGitCommonDir(repoPath: string): Promise<string | null> {
+  const gitDir = await resolveGitDir(repoPath)
+  if (!gitDir) {
+    return null
+  }
+  // A linked worktree's gitdir points at the shared admin root through `commondir`.
+  const commonDir = await readTrimmedFile(path.join(gitDir, 'commondir'))
+  return commonDir ? path.resolve(gitDir, commonDir) : gitDir
+}
+
+async function resolveGitDir(repoPath: string): Promise<string | null> {
+  const dotGitPath = path.join(repoPath, '.git')
+  let dotGitStats: Awaited<ReturnType<typeof stat>> | null = null
+  try {
+    dotGitStats = await stat(dotGitPath)
+  } catch (err) {
+    if (!isMissingEntryError(err)) {
+      throw err
+    }
+  }
+  if (!dotGitStats) {
+    // Bare repo, or a repo path that already is a gitdir.
+    return (await readExistenceStamp(path.join(repoPath, 'HEAD'))) === 'y' ? repoPath : null
+  }
+  if (dotGitStats.isDirectory()) {
+    return dotGitPath
+  }
+  if (!dotGitStats.isFile()) {
+    return null
+  }
+  const contents = await readTrimmedFile(dotGitPath)
+  const match = contents?.match(/^gitdir:\s*(.+?)\s*$/m)
+  return match ? path.resolve(repoPath, match[1]) : null
+}
+
+async function readTrimmedFile(filePath: string): Promise<string | null> {
+  try {
+    const trimmed = (await readFile(filePath, 'utf-8')).trim()
+    return trimmed.length > 0 ? trimmed : null
+  } catch (err) {
+    if (isMissingEntryError(err)) {
+      return null
+    }
+    throw err
+  }
+}
+
+async function readFileStamp(filePath: string): Promise<string> {
+  try {
+    const stats = await stat(filePath)
+    return `${stats.mtimeMs}:${stats.size}`
+  } catch (err) {
+    if (isMissingEntryError(err)) {
+      return MISSING
+    }
+    throw err
+  }
+}
+
+async function readExistenceStamp(targetPath: string): Promise<string> {
+  try {
+    await stat(targetPath)
+    return 'y'
+  } catch (err) {
+    if (isMissingEntryError(err)) {
+      return 'n'
+    }
+    throw err
+  }
+}
+
+function isMissingEntryError(err: unknown): boolean {
+  const code = (err as NodeJS.ErrnoException | null)?.code
+  return code === 'ENOENT' || code === 'ENOTDIR'
+}
diff --git a/src/main/runtime/rpc/core.ts b/src/main/runtime/rpc/core.ts
index 8e09e942a08..fa3c812ce82 100644
--- a/src/main/runtime/rpc/core.ts
+++ b/src/main/runtime/rpc/core.ts
@@ -46,6 +46,7 @@ export type RpcRequest = {
   authToken: string
   method: string
   params?: unknown
+  expectedRuntimeId?: string
   orchestrationCapability?: string
   orchestrationContractVersion?: number
   orchestrationRequestId?: string
@@ -107,13 +108,13 @@ export type RpcContext = {
   ) => () => void
 }
 
-export type RpcHandler<TParams> = (params: TParams, ctx: RpcContext) => Promise<unknown> | unknown
+export type RpcHandler<TParams> = (params: TParams, ctx: RpcContext) => unknown
 
 // Why: RpcMethod erases the param type; centralizing the cast in defineMethod sidesteps RpcHandler's contravariance.
 export type RpcMethod = {
   readonly name: string
   readonly params: ZodType | null
-  readonly handler: (params: unknown, ctx: RpcContext) => Promise<unknown> | unknown
+  readonly handler: (params: unknown, ctx: RpcContext) => unknown
 }
 
 type DefineMethodSpec<TSchema extends ZodType | null> = {
diff --git a/src/main/runtime/rpc/dispatcher-computer-errors.test.ts b/src/main/runtime/rpc/dispatcher-computer-errors.test.ts
index 862973e3913..10bc94b771b 100644
--- a/src/main/runtime/rpc/dispatcher-computer-errors.test.ts
+++ b/src/main/runtime/rpc/dispatcher-computer-errors.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { z } from 'zod'
 import { RpcDispatcher } from './dispatcher'
 import { defineMethod, InvalidArgumentError, type RpcRequest } from './core'
@@ -41,6 +41,26 @@ const METHODS = [
 ]
 
 describe('RpcDispatcher computer-use validation errors', () => {
+  it('rejects a replacement runtime before invoking a one-shot handler', async () => {
+    const handler = vi.fn(() => ({ ok: true }))
+    const dispatcher = new RpcDispatcher({
+      runtime: makeRuntime(),
+      methods: [defineMethod({ name: 'terminal.create', params: z.object({}), handler })]
+    })
+
+    const response = await dispatcher.dispatch({
+      ...makeRequest('terminal.create', {}),
+      expectedRuntimeId: 'previous-runtime'
+    })
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: 'runtime_replaced' },
+      _meta: { runtimeId: 'test-runtime' }
+    })
+    expect(handler).not.toHaveBeenCalled()
+  })
+
   it('adds recovery steps to one-shot computer schema failures', async () => {
     const dispatcher = new RpcDispatcher({ runtime: makeRuntime(), methods: METHODS })
 
diff --git a/src/main/runtime/rpc/dispatcher.ts b/src/main/runtime/rpc/dispatcher.ts
index be11b2b0c64..995d0f00d64 100644
--- a/src/main/runtime/rpc/dispatcher.ts
+++ b/src/main/runtime/rpc/dispatcher.ts
@@ -43,6 +43,14 @@ export class RpcDispatcher {
 
   async dispatch(request: RpcRequest, options?: { signal?: AbortSignal }): Promise<RpcResponse> {
     const meta = this.meta()
+    if (request.expectedRuntimeId && request.expectedRuntimeId !== meta.runtimeId) {
+      return errorResponse(
+        request.id,
+        meta,
+        'runtime_replaced',
+        'The runtime changed before the request could be applied. Refresh and try again.'
+      )
+    }
     const method = this.registry.get(request.method)
     if (!method) {
       return errorResponse(
@@ -139,6 +147,19 @@ export class RpcDispatcher {
     options?: RpcDispatchStreamingOptions
   ): Promise<void> {
     const meta = this.meta()
+    if (request.expectedRuntimeId && request.expectedRuntimeId !== meta.runtimeId) {
+      reply(
+        JSON.stringify(
+          errorResponse(
+            request.id,
+            meta,
+            'runtime_replaced',
+            'The runtime changed before the request could be applied. Refresh and try again.'
+          )
+        )
+      )
+      return
+    }
     const method = this.registry.get(request.method)
     if (!method) {
       reply(
diff --git a/src/main/runtime/rpc/methods/client-ui.ts b/src/main/runtime/rpc/methods/client-ui.ts
index 540333bf5ac..73326756cd9 100644
--- a/src/main/runtime/rpc/methods/client-ui.ts
+++ b/src/main/runtime/rpc/methods/client-ui.ts
@@ -8,7 +8,7 @@ import {
 } from './client-ui-schemas'
 // Type-only side effect: keeps the schema/PersistedUIState parity assertions in
 // the typecheck graph so drift fails the build instead of a paired client.
-import type {} from './ui-state-schema-parity-checks'
+
 import { TerminalQuickCommandsUpdate } from './terminal-quick-command-rpc-schema'
 
 export const CLIENT_UI_METHODS: RpcMethod[] = [
diff --git a/src/main/runtime/rpc/methods/files-terminal-path-resolution.test.ts b/src/main/runtime/rpc/methods/files-terminal-path-resolution.test.ts
index 2055222ff7f..d589b74116c 100644
--- a/src/main/runtime/rpc/methods/files-terminal-path-resolution.test.ts
+++ b/src/main/runtime/rpc/methods/files-terminal-path-resolution.test.ts
@@ -40,7 +40,8 @@ describe('files.resolveTerminalPath RPC', () => {
       '/repo',
       undefined,
       'term-1',
-      false
+      false,
+      null
     )
     expect(response).toMatchObject({
       ok: true,
@@ -67,7 +68,30 @@ describe('files.resolveTerminalPath RPC', () => {
       null,
       undefined,
       null,
-      true
+      true,
+      null
+    )
+  })
+
+  it('forwards optional native-chat provenance', async () => {
+    const { runtime, dispatcher } = createDispatcher()
+
+    await dispatcher.dispatch(
+      makeRequest('files.resolveTerminalPath', {
+        worktree: 'id:wt-1',
+        pathText: '/outside/result.html',
+        nativeChatContext: { tabId: 'tab-1', sessionId: 'session-1' }
+      })
+    )
+
+    expect(runtime.resolveTerminalPath).toHaveBeenLastCalledWith(
+      'id:wt-1',
+      '/outside/result.html',
+      null,
+      undefined,
+      null,
+      false,
+      { tabId: 'tab-1', sessionId: 'session-1' }
     )
   })
 })
diff --git a/src/main/runtime/rpc/methods/files.ts b/src/main/runtime/rpc/methods/files.ts
index ffaa48b510e..741fc65635f 100644
--- a/src/main/runtime/rpc/methods/files.ts
+++ b/src/main/runtime/rpc/methods/files.ts
@@ -78,6 +78,12 @@ const ResolveTerminalPath = WorktreeSelector.extend({
   crossWorkspace: z
     .unknown()
     .transform((v) => v === true)
+    .optional(),
+  nativeChatContext: z
+    .object({
+      tabId: z.string().min(1),
+      sessionId: z.string().min(1)
+    })
     .optional()
 })
 
@@ -257,7 +263,8 @@ export const FILE_METHODS: RpcAnyMethod[] = [
         params.cwd ?? null,
         clientId,
         params.terminal ?? null,
-        params.crossWorkspace === true
+        params.crossWorkspace === true,
+        params.nativeChatContext ?? null
       )
   }),
   defineMethod({
diff --git a/src/main/runtime/rpc/methods/folder-workspace.ts b/src/main/runtime/rpc/methods/folder-workspace.ts
index 9f36b7eb4dc..aa39654d9f8 100644
--- a/src/main/runtime/rpc/methods/folder-workspace.ts
+++ b/src/main/runtime/rpc/methods/folder-workspace.ts
@@ -6,6 +6,7 @@ import { TaskSourceContextSchema } from '../../../../shared/task-source-context-
 import { WorkspaceLinkedItemSchema } from '../../../../shared/workspace-linked-item-schema'
 import { isWorkspaceLinkedItemSourceContextMatch } from '../../../../shared/workspace-linked-item-source-context'
 import { resolveRpcWorkspaceCreatorProvenance } from '../workspace-creator-context'
+import { DiffCommentSchema } from '../../../../shared/diff-comment-schema'
 
 const FolderWorkspaceLinkedTask = WorkspaceLinkedItemSchema.nullable()
 
@@ -59,7 +60,8 @@ const FolderWorkspaceUpdate = z.object({
       createdWithAgent: z.string().refine(isTuiAgent).optional(),
       pendingFirstAgentMessageRename: z.boolean().optional(),
       firstAgentMessageRenameError: z.string().nullable().optional(),
-      lastActivityAt: OptionalFiniteNumber
+      lastActivityAt: OptionalFiniteNumber,
+      diffComments: z.array(DiffCommentSchema).optional()
     })
     .superRefine(assertLinkedTaskSourceContextMatch)
 })
diff --git a/src/main/runtime/rpc/methods/git-params.ts b/src/main/runtime/rpc/methods/git-params.ts
index 0fe273108a5..00ec4bb6913 100644
--- a/src/main/runtime/rpc/methods/git-params.ts
+++ b/src/main/runtime/rpc/methods/git-params.ts
@@ -179,7 +179,6 @@ export const GitGenerateCommitMessage = WorktreeSelector.extend({
   sourceControlAi: SourceControlAiSettings.optional(),
   sourceControlAiResolvedParams: ResolvedSourceControlAiGenerationParams.optional(),
   agentCmdOverrides: z.record(z.string(), z.string()).optional(),
-  enableGitHubAttribution: z.boolean().optional(),
   commitMessageDiscoveryHostKey: z.string().optional()
 })
 
diff --git a/src/main/runtime/rpc/methods/git.test.ts b/src/main/runtime/rpc/methods/git.test.ts
index bf6b0838e22..e6ab9f3340d 100644
--- a/src/main/runtime/rpc/methods/git.test.ts
+++ b/src/main/runtime/rpc/methods/git.test.ts
@@ -530,7 +530,6 @@ describe('git RPC methods', () => {
         worktree: 'id:wt-1',
         commitMessageAi,
         agentCmdOverrides,
-        enableGitHubAttribution: true,
         commitMessageDiscoveryHostKey: 'runtime:env-1'
       })
     )
@@ -538,7 +537,6 @@ describe('git RPC methods', () => {
     expect(runtime.generateRuntimeCommitMessage).toHaveBeenCalledWith('id:wt-1', {
       commitMessageAi,
       agentCmdOverrides,
-      enableGitHubAttribution: true,
       commitMessageDiscoveryHostKey: 'runtime:env-1'
     })
   })
diff --git a/src/main/runtime/rpc/methods/git.ts b/src/main/runtime/rpc/methods/git.ts
index c30e80f4338..9363551507e 100644
--- a/src/main/runtime/rpc/methods/git.ts
+++ b/src/main/runtime/rpc/methods/git.ts
@@ -33,7 +33,6 @@ type CommitMessageGenerationOverride = {
   sourceControlAi?: GlobalSettings['sourceControlAi']
   sourceControlAiResolvedParams?: ResolvedSourceControlAiGenerationParams
   agentCmdOverrides?: GlobalSettings['agentCmdOverrides']
-  enableGitHubAttribution?: boolean
   commitMessageDiscoveryHostKey?: string
 }
 
@@ -44,7 +43,6 @@ function buildCommitMessageGenerationOverride(params: {
   sourceControlAi?: unknown
   sourceControlAiResolvedParams?: unknown
   agentCmdOverrides?: unknown
-  enableGitHubAttribution?: boolean
   commitMessageDiscoveryHostKey?: string
 }): CommitMessageGenerationOverride | undefined {
   if (
@@ -52,7 +50,6 @@ function buildCommitMessageGenerationOverride(params: {
     params.sourceControlAi === undefined &&
     params.sourceControlAiResolvedParams === undefined &&
     params.agentCmdOverrides === undefined &&
-    params.enableGitHubAttribution === undefined &&
     params.commitMessageDiscoveryHostKey === undefined
   ) {
     return undefined
@@ -75,9 +72,6 @@ function buildCommitMessageGenerationOverride(params: {
           agentCmdOverrides: params.agentCmdOverrides as GlobalSettings['agentCmdOverrides']
         }
       : {}),
-    ...(params.enableGitHubAttribution !== undefined
-      ? { enableGitHubAttribution: params.enableGitHubAttribution }
-      : {}),
     ...(params.commitMessageDiscoveryHostKey !== undefined
       ? { commitMessageDiscoveryHostKey: params.commitMessageDiscoveryHostKey }
       : {})
diff --git a/src/main/runtime/rpc/methods/linear-agent-access.test.ts b/src/main/runtime/rpc/methods/linear-agent-access.test.ts
index 945eadb20b8..56c32168460 100644
--- a/src/main/runtime/rpc/methods/linear-agent-access.test.ts
+++ b/src/main/runtime/rpc/methods/linear-agent-access.test.ts
@@ -355,7 +355,7 @@ type LinearUnconfirmedBuilder = {
     target: unknown,
     extra?: unknown
   ): Error & { data?: { cause?: string; nextSteps?: string[] } }
-  resolveLinearAgentState(input: string, states: unknown[]): unknown | null
+  resolveLinearAgentState(input: string, states: unknown[]): unknown
   linearCreatedIssueMatchesIntent(issue: unknown, intent: unknown): boolean
   linearSavedIssueMatchesIntent(issue: unknown, intent: unknown): boolean
   notifyLinearLinkedIssueUpdated(
@@ -372,13 +372,13 @@ type LinearRetryLookupTester = {
     parentId: string | null,
     workspaceId: string,
     required: boolean
-  ): Promise<unknown | null>
+  ): Promise<unknown>
   getMatchingLinearAttachmentWrite(
     writeId: string,
     issueId: string,
     workspaceId: string,
     required: boolean
-  ): Promise<unknown | null>
+  ): Promise<unknown>
   getMatchingLinearCreatedIssue(
     writeId: string,
     teamId: string,
@@ -386,7 +386,7 @@ type LinearRetryLookupTester = {
     workspaceId: string,
     required: boolean,
     intent?: unknown
-  ): Promise<unknown | null>
+  ): Promise<unknown>
   refetchLinearCommentAfterDuplicate(
     writeId: string,
     issueId: string,
diff --git a/src/main/runtime/rpc/methods/linear-agent-project-access.test.ts b/src/main/runtime/rpc/methods/linear-agent-project-access.test.ts
index cd51e8a0798..9e0f1568050 100644
--- a/src/main/runtime/rpc/methods/linear-agent-project-access.test.ts
+++ b/src/main/runtime/rpc/methods/linear-agent-project-access.test.ts
@@ -10,7 +10,7 @@ type LinearProjectResolverTester = {
     id: string
     name: string
   }>
-  readLinearProjectByIdForCreate(id: string, workspaceId: string): Promise<unknown | null>
+  readLinearProjectByIdForCreate(id: string, workspaceId: string): Promise<unknown>
   readLinearProjectsForCreate(query: string, workspaceId: string): Promise<unknown[]>
   readLinearProjectsByExactNameForCreate(name: string, workspaceId: string): Promise<unknown[]>
 }
diff --git a/src/main/runtime/rpc/methods/native-chat.ts b/src/main/runtime/rpc/methods/native-chat.ts
index 5a15b3a8d8f..3b8d42287de 100644
--- a/src/main/runtime/rpc/methods/native-chat.ts
+++ b/src/main/runtime/rpc/methods/native-chat.ts
@@ -138,7 +138,7 @@ function sanitizeToolInput(
   const result: Record<string, unknown> = {}
   let count = 0
   for (const key in value) {
-    if (!Object.prototype.hasOwnProperty.call(value, key)) {
+    if (!Object.hasOwn(value, key)) {
       continue
     }
     if (count >= MOBILE_TOOL_INPUT_ITEMS_CAP || budget.remaining <= 0) {
@@ -148,7 +148,7 @@ function sanitizeToolInput(
     let boundedKey = key.slice(0, Math.min(key.length, budget.remaining, 128))
     // Why: sibling keys sharing a >=128-char (or budget-truncated) prefix collapse
     // to the same bounded key; suffix collisions so neither field is silently lost.
-    if (Object.prototype.hasOwnProperty.call(result, boundedKey)) {
+    if (Object.hasOwn(result, boundedKey)) {
       boundedKey = `${boundedKey}~${count}`
     }
     budget.remaining -= boundedKey.length
diff --git a/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts b/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
index 23a6dc0928f..561c35603f2 100644
--- a/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
@@ -4,6 +4,8 @@ import {
   ORCHESTRATION_CONTRACT_RUNTIME_CAPABILITY,
   ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION,
   ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY,
   ORCHESTRATION_FEDERATION_RUNTIME_CAPABILITY
 } from '../../../../shared/protocol-version'
 import { orchestrationMigrationData } from '../../../../shared/orchestration-rpc-contract'
@@ -82,11 +84,16 @@ export async function startFederatedWorker(args: {
     capabilities: status.capabilities,
     serverName: server.name
   })
-  const federationProtocolVersion = status.capabilities?.includes(
+  const supportsControlMail = status.capabilities?.includes(
     ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY
   )
-    ? ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION
-    : 1
+  const federationProtocolVersion =
+    supportsControlMail &&
+    status.capabilities?.includes(ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY)
+      ? ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION
+      : supportsControlMail
+        ? ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION
+        : 1
 
   const setupDecision = createsWorktree ? (params.setup ?? 'run') : 'not_applicable'
   const started = db.createStartingWorkerDispatch({
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts b/src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts
new file mode 100644
index 00000000000..894462e5397
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts
@@ -0,0 +1,448 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ORCHESTRATION_CONTRACT_VERSION,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import type { RuntimeRpcResponse } from '../../../../shared/runtime-rpc-envelope'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import { OrchestrationDb } from '../../orchestration/db'
+import type { OrchestrationEnvironmentTransport } from '../../orchestration/environment-transport'
+import { waitForFederatedLifecycleSettlement } from '../../orchestration/federation-lifecycle-settlement'
+import { RpcDispatcher } from '../dispatcher'
+import { ORCHESTRATION_METHODS } from './orchestration'
+import { createFederationWorkerStartRequest as startRequest } from './orchestration-federation-test-request'
+
+describe('orchestration federation lifecycle settlement', () => {
+  let homeDb: OrchestrationDb
+  let workerDb: OrchestrationDb
+  let homeRuntime: OrcaRuntimeService
+  let workerRuntime: OrcaRuntimeService
+  let homeDispatcher: RpcDispatcher
+  let workerDispatcher: RpcDispatcher
+  let workerCapabilities: string[]
+  let failNextAckBeforeDelivery: boolean
+
+  beforeEach(() => {
+    homeDb = new OrchestrationDb(':memory:')
+    workerDb = new OrchestrationDb(':memory:')
+    workerRuntime = new OrcaRuntimeService()
+    workerRuntime.setOrchestrationDb(workerDb)
+    workerDispatcher = new RpcDispatcher({ runtime: workerRuntime, methods: ORCHESTRATION_METHODS })
+    workerCapabilities = [...(workerRuntime.getStatus().capabilities ?? [])]
+    failNextAckBeforeDelivery = false
+    const transport: OrchestrationEnvironmentTransport = {
+      resolve: () => ({
+        environmentId: 'environment_windows',
+        name: 'windows',
+        peerFingerprint: 'windows_peer_fingerprint'
+      }),
+      call: async (_selector, method, params, _timeoutMs, envelope) => {
+        if (method === 'status.get') {
+          return {
+            id: 'status',
+            ok: true,
+            result: { ...workerRuntime.getStatus(), capabilities: workerCapabilities },
+            _meta: { runtimeId: workerRuntime.getRuntimeId() }
+          }
+        }
+        if (method === 'orchestration.federationAck' && failNextAckBeforeDelivery) {
+          failNextAckBeforeDelivery = false
+          throw new Error('connection lost before acknowledgment')
+        }
+        return (await workerDispatcher.dispatch({
+          id: `remote_${method}`,
+          authToken: 'run-home-device-token',
+          method,
+          params,
+          orchestrationContractVersion: envelope?.orchestrationContractVersion,
+          orchestrationRequestId: envelope?.orchestrationRequestId,
+          orchestrationCapability: envelope?.orchestrationCapability
+        })) as RuntimeRpcResponse<unknown>
+      }
+    }
+    homeRuntime = new OrcaRuntimeService(null, undefined, {
+      orchestrationEnvironmentTransport: transport
+    })
+    homeRuntime.setOrchestrationDb(homeDb)
+    homeDispatcher = new RpcDispatcher({ runtime: homeRuntime, methods: ORCHESTRATION_METHODS })
+    vi.spyOn(homeRuntime, 'getTerminalPaneKey').mockReturnValue(
+      'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+    )
+    configureWorkerRuntime()
+  })
+
+  afterEach(() => {
+    homeRuntime.stopOrchestrationFederationRelay()
+    homeDb.close()
+    workerDb.close()
+  })
+
+  function configureWorkerRuntime(): void {
+    vi.spyOn(workerRuntime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+    vi.spyOn(workerRuntime, 'showRepo').mockResolvedValue({
+      id: 'windows-repo',
+      kind: 'git'
+    } as never)
+    vi.spyOn(workerRuntime, 'createManagedWorktree').mockResolvedValue({
+      worktree: { id: 'repo::windows-worktree', repoId: 'repo' },
+      startupTerminal: { spawned: true, handle: 'term_windows_worker' },
+      setupReceipt: {
+        requested: 'run',
+        hookFound: true,
+        startupPolicy: 'start-immediately',
+        state: 'running'
+      }
+    } as never)
+    vi.spyOn(workerRuntime, 'listTerminals').mockResolvedValue({
+      terminals: [{ handle: 'term_windows_worker', title: 'Codex' }],
+      totalCount: 1,
+      truncated: false
+    } as never)
+    vi.spyOn(workerRuntime, 'waitForTerminal').mockResolvedValue({
+      handle: 'term_windows_worker',
+      condition: 'tui-idle',
+      satisfied: true,
+      status: 'running',
+      exitCode: null
+    })
+    vi.spyOn(workerRuntime, 'getTerminalPaneKey').mockReturnValue(
+      'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+    )
+    vi.spyOn(workerRuntime, 'getTerminalProcessIncarnation').mockReturnValue(
+      'windows_runtime:pty:1'
+    )
+    vi.spyOn(workerRuntime, 'getTerminalOrchestrationCliCommand').mockReturnValue('orca')
+    vi.spyOn(workerRuntime, 'sendTerminalAgentPrompt').mockResolvedValue({
+      handle: 'term_windows_worker',
+      accepted: true,
+      bytesWritten: 1
+    })
+  }
+
+  function createHomeTask() {
+    const run = homeDb.createRun({
+      objective: 'Mac to Windows',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey: 'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+    })
+    return homeDb.createTask({ spec: 'Audit Windows behavior', runId: run.id })
+  }
+
+  async function sendRemoteCompletion(taskId: string, reportedTaskId: string, sync = true) {
+    await homeDispatcher.dispatch(startRequest(taskId))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(taskId)!
+    const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
+    const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
+    const sent = workerDispatcher.dispatch({
+      id: 'rpc_waiting_worker_done',
+      authToken: 'worker-local-token',
+      orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+      orchestrationRequestId: 'waiting_worker_done_request',
+      orchestrationCapability: capability,
+      method: 'orchestration.send',
+      params: {
+        from: 'term_windows_worker',
+        subject: 'Done',
+        type: 'worker_done',
+        payload: JSON.stringify({
+          taskId: reportedTaskId,
+          dispatchId: dispatch.id,
+          outcome: 'succeeded'
+        })
+      }
+    })
+    await vi.waitFor(() =>
+      expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+    )
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.state).toBe('ready')
+    if (sync) {
+      await homeRuntime.syncOrchestrationFederation()
+    }
+    return { sent, dispatch }
+  }
+
+  it('waits for Run-home settlement when an older CLI omits the wait hint', async () => {
+    const task = createHomeTask()
+
+    const { sent, dispatch } = await sendRemoteCompletion(task.id, task.id)
+
+    await expect(sent).resolves.toMatchObject({
+      ok: true,
+      result: { lifecycle: { action: 'completed', authority: 'run_home' } }
+    })
+    expect(homeDb.getTask(task.id)?.status).toBe('completed')
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)).toMatchObject({
+      state: 'succeeded',
+      stage: 'worker_report_settled',
+      capability_hash: null
+    })
+  })
+
+  it('returns a Run-home rejection for a mismatched remote task', async () => {
+    const task = createHomeTask()
+
+    const { sent } = await sendRemoteCompletion(task.id, 'task_wrong')
+
+    await expect(sent).resolves.toMatchObject({
+      ok: true,
+      result: {
+        lifecycle: {
+          action: 'rejected',
+          code: 'task_dispatch_mismatch',
+          authority: 'run_home'
+        }
+      }
+    })
+    expect(homeDb.getTask(task.id)?.status).toBe('dispatched')
+  })
+
+  it('rejects before queueing when the negotiated protocol lacks settlement verdicts', async () => {
+    workerCapabilities = workerCapabilities.filter(
+      (capability) =>
+        capability !== ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY
+    )
+    const task = createHomeTask()
+
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
+    const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
+
+    await expect(
+      workerDispatcher.dispatch({
+        id: 'rpc_unsupported_worker_done',
+        authToken: 'worker-local-token',
+        orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+        orchestrationRequestId: 'unsupported_worker_done_request',
+        orchestrationCapability: capability,
+        method: 'orchestration.send',
+        params: {
+          from: 'term_windows_worker',
+          subject: 'Done',
+          type: 'worker_done',
+          payload: JSON.stringify({
+            taskId: task.id,
+            dispatchId: dispatch.id,
+            outcome: 'succeeded'
+          })
+        }
+      })
+    ).resolves.toMatchObject({
+      ok: false,
+      error: { code: 'capability_unsupported' }
+    })
+    expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toEqual([])
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.protocol_version).toBe(2)
+  })
+
+  it('does not settle an attachment from a verdict for non-lifecycle mail', async () => {
+    const task = createHomeTask()
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const relay = workerDb.enqueueFederationRelay({
+      dispatchId: dispatch.id,
+      direction: 'to_home',
+      kind: 'status',
+      payload: '{}'
+    })
+
+    await expect(
+      workerDispatcher.dispatch({
+        id: 'rpc_unrelated_settlement',
+        authToken: 'run-home-device-token',
+        orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+        orchestrationRequestId: 'unrelated_settlement_request',
+        method: 'orchestration.federationAck',
+        params: {
+          dispatchId: dispatch.id,
+          throughSequence: relay.sequence,
+          settlements: [
+            {
+              sequence: relay.sequence,
+              lifecycle: { action: 'completed', authority: 'run_home' }
+            }
+          ]
+        }
+      })
+    ).resolves.toMatchObject({ ok: false, error: { code: 'request_mismatch' } })
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.state).toBe('ready')
+    expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+  })
+
+  it('does not settle an attachment from a verdict that contradicts the queued outcome', async () => {
+    const task = createHomeTask()
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const relay = workerDb.enqueueFederationRelay({
+      dispatchId: dispatch.id,
+      direction: 'to_home',
+      kind: 'worker_done',
+      payload: JSON.stringify({
+        payload: JSON.stringify({
+          taskId: task.id,
+          dispatchId: dispatch.id,
+          outcome: 'failed'
+        })
+      })
+    })
+
+    await expect(
+      workerDispatcher.dispatch({
+        id: 'rpc_contradictory_settlement',
+        authToken: 'run-home-device-token',
+        orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+        orchestrationRequestId: 'contradictory_settlement_request',
+        method: 'orchestration.federationAck',
+        params: {
+          dispatchId: dispatch.id,
+          throughSequence: relay.sequence,
+          settlements: [
+            {
+              sequence: relay.sequence,
+              lifecycle: { action: 'completed', authority: 'run_home' }
+            }
+          ]
+        }
+      })
+    ).resolves.toMatchObject({ ok: false, error: { code: 'request_mismatch' } })
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.state).toBe('ready')
+    expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+  })
+
+  it('returns operation_unknown when Run-home settlement waiting is aborted', async () => {
+    const task = createHomeTask()
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
+    const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
+    const controller = new AbortController()
+    const sent = workerDispatcher.dispatch(
+      {
+        id: 'rpc_aborted_worker_done',
+        authToken: 'worker-local-token',
+        orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+        orchestrationRequestId: 'aborted_worker_done_request',
+        orchestrationCapability: capability,
+        method: 'orchestration.send',
+        params: {
+          from: 'term_windows_worker',
+          subject: 'Done',
+          type: 'worker_done',
+          payload: JSON.stringify({
+            taskId: task.id,
+            dispatchId: dispatch.id,
+            outcome: 'succeeded'
+          })
+        }
+      },
+      { signal: controller.signal }
+    )
+    await vi.waitFor(() =>
+      expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+    )
+
+    controller.abort()
+
+    await expect(sent).resolves.toMatchObject({
+      ok: false,
+      error: { code: 'operation_unknown' }
+    })
+  })
+
+  it('does not register a waiter for an already-aborted signal', async () => {
+    const controller = new AbortController()
+    controller.abort()
+    const addEventListener = vi.spyOn(controller.signal, 'addEventListener')
+
+    await expect(
+      waitForFederatedLifecycleSettlement(workerRuntime, 'ctx_aborted', 1, {
+        timeoutMs: 0,
+        signal: controller.signal
+      })
+    ).resolves.toBeUndefined()
+    expect(addEventListener).not.toHaveBeenCalled()
+  })
+
+  it('replays a committed settlement after the first acknowledgment is lost', async () => {
+    const task = createHomeTask()
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
+    const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
+    const sent = workerDispatcher.dispatch({
+      id: 'rpc_replayed_worker_done',
+      authToken: 'worker-local-token',
+      orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+      orchestrationRequestId: 'replayed_worker_done_request',
+      orchestrationCapability: capability,
+      method: 'orchestration.send',
+      params: {
+        from: 'term_windows_worker',
+        subject: 'Done',
+        type: 'worker_done',
+        waitForLifecycleSettlement: true,
+        payload: JSON.stringify({
+          taskId: task.id,
+          dispatchId: dispatch.id,
+          outcome: 'succeeded'
+        })
+      }
+    })
+    await vi.waitFor(() =>
+      expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+    )
+    failNextAckBeforeDelivery = true
+
+    await expect(homeRuntime.syncOrchestrationFederatedDispatch(dispatch.id)).rejects.toThrow(
+      'connection lost before acknowledgment'
+    )
+    expect(homeDb.getTask(task.id)?.status).toBe('completed')
+    await homeRuntime.syncOrchestrationFederatedDispatch(dispatch.id)
+
+    await expect(sent).resolves.toMatchObject({
+      ok: true,
+      result: { lifecycle: { action: 'completed', authority: 'run_home' } }
+    })
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)).toMatchObject({
+      state: 'succeeded',
+      stage: 'worker_report_settled',
+      capability_hash: null
+    })
+  })
+
+  it('replays a rejection without mutating its durable message twice', async () => {
+    const task = createHomeTask()
+    const { sent, dispatch } = await sendRemoteCompletion(task.id, 'task_wrong', false)
+    failNextAckBeforeDelivery = true
+
+    await expect(homeRuntime.syncOrchestrationFederatedDispatch(dispatch.id)).rejects.toThrow(
+      'connection lost before acknowledgment'
+    )
+    const [relay] = workerDb.listPendingFederationRelay(dispatch.id, 'to_home')
+    const firstMessage = homeDb.getMessageById(relay.message_id)
+    await homeRuntime.syncOrchestrationFederatedDispatch(dispatch.id)
+
+    await expect(sent).resolves.toMatchObject({
+      ok: true,
+      result: {
+        lifecycle: {
+          action: 'rejected',
+          code: 'task_dispatch_mismatch',
+          authority: 'run_home'
+        }
+      }
+    })
+    expect(homeDb.getMessageById(relay.message_id)).toMatchObject({
+      subject: firstMessage?.subject,
+      body: firstMessage?.body,
+      payload: firstMessage?.payload
+    })
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.state).toBe('ready')
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-relay.ts b/src/main/runtime/rpc/methods/orchestration-federation-relay.ts
index fbc3e97fb3b..848b711b851 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation-relay.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation-relay.ts
@@ -2,18 +2,42 @@ import { z } from 'zod'
 import { ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION } from '../../../../shared/protocol-version'
 import { importFederatedControlMessage } from '../../orchestration/federation-control-message'
 import { OrchestrationError } from '../../orchestration/orchestration-error'
+import {
+  publishFederatedLifecycleSettlement,
+  type FederatedLifecycleSettlement
+} from '../../orchestration/federation-lifecycle-settlement'
 import { defineMethod, type RpcMethod } from '../core'
 import { OptionalFiniteNumber, requiredString } from '../schemas'
 
 const FederationPullParams = z.object({
   dispatchId: requiredString('Missing Dispatch ID'),
   afterSequence: OptionalFiniteNumber,
+  replayUnacknowledged: z.boolean().optional(),
   limit: OptionalFiniteNumber
 })
 
 const FederationAckParams = z.object({
   dispatchId: requiredString('Missing Dispatch ID'),
-  throughSequence: z.number().int().nonnegative()
+  throughSequence: z.number().int().nonnegative(),
+  settlements: z
+    .array(
+      z.object({
+        sequence: z.number().int().positive(),
+        lifecycle: z.discriminatedUnion('action', [
+          z.object({
+            action: z.enum(['completed', 'failed']),
+            authority: z.literal('run_home')
+          }),
+          z.object({
+            action: z.literal('rejected'),
+            code: z.string(),
+            reason: z.string(),
+            authority: z.literal('run_home')
+          })
+        ])
+      })
+    )
+    .optional()
 })
 
 const FederationImportParams = z.object({
@@ -39,12 +63,16 @@ export const ORCHESTRATION_FEDERATION_RELAY_METHODS: RpcMethod[] = [
       return {
         dispatchId: params.dispatchId,
         runtimeEpoch: runtime.getRuntimeId(),
-        items: runtime.getOrchestrationDb().listFederationRelay({
-          dispatchId: params.dispatchId,
-          direction: 'to_home',
-          afterSequence: params.afterSequence ?? 0,
-          limit: params.limit
-        })
+        items: params.replayUnacknowledged
+          ? runtime
+              .getOrchestrationDb()
+              .listPendingFederationRelay(params.dispatchId, 'to_home', params.limit)
+          : runtime.getOrchestrationDb().listFederationRelay({
+              dispatchId: params.dispatchId,
+              direction: 'to_home',
+              afterSequence: params.afterSequence ?? 0,
+              limit: params.limit
+            })
       }
     }
   }),
@@ -53,11 +81,42 @@ export const ORCHESTRATION_FEDERATION_RELAY_METHODS: RpcMethod[] = [
     params: FederationAckParams,
     handler: (params, { runtime, authenticatedCallerFingerprint }) => {
       requireHomeAttachment(runtime, params.dispatchId, authenticatedCallerFingerprint)
+      const settlements = (params.settlements ?? []).filter(
+        (settlement) => settlement.sequence <= params.throughSequence
+      )
+      const terminalSettlements = settlements.filter(
+        (settlement) =>
+          settlement.lifecycle.action === 'completed' || settlement.lifecycle.action === 'failed'
+      )
+      if (terminalSettlements.length > 1) {
+        throw new OrchestrationError(
+          'request_mismatch',
+          `Federation acknowledgment for ${params.dispatchId} contains conflicting settlements.`
+        )
+      }
+      const terminalSettlement = terminalSettlements[0]
       runtime.getOrchestrationDb().acknowledgeFederationRelay({
         dispatchId: params.dispatchId,
         direction: 'to_home',
-        throughSequence: params.throughSequence
+        throughSequence: params.throughSequence,
+        ...(!terminalSettlement
+          ? {}
+          : {
+              settleRemoteReport: {
+                sequence: terminalSettlement.sequence,
+                outcome:
+                  terminalSettlement.lifecycle.action === 'completed' ? 'succeeded' : 'failed'
+              }
+            })
       })
+      for (const settlement of settlements) {
+        publishFederatedLifecycleSettlement(
+          runtime,
+          params.dispatchId,
+          settlement.sequence,
+          settlement.lifecycle as FederatedLifecycleSettlement
+        )
+      }
       return { dispatchId: params.dispatchId, acknowledgedThrough: params.throughSequence }
     }
   }),
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts b/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
index e6bea35c20a..9c03345ef88 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
@@ -6,7 +6,7 @@ export const FederationAttachStartParams = z.object({
   dispatchId: requiredString('Missing Dispatch ID'),
   taskId: requiredString('Missing Task ID'),
   taskSpec: requiredString('Missing Task spec'),
-  protocolVersion: z.union([z.literal(1), z.literal(2)]),
+  protocolVersion: z.union([z.literal(1), z.literal(2), z.literal(3)]),
   worktree: requiredString('Missing remote worktree selector'),
   name: OptionalString,
   repo: OptionalString,
diff --git a/src/main/runtime/rpc/methods/orchestration-federation.test.ts b/src/main/runtime/rpc/methods/orchestration-federation.test.ts
index 94674ee84cc..ca850587ff0 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation.test.ts
@@ -194,7 +194,7 @@ describe('orchestration federation', () => {
     const attachment = workerDb.getRemoteDispatchAttachment(dispatch.id)
     expect(attachment).toMatchObject({
       task_id: task.id,
-      protocol_version: 2,
+      protocol_version: 3,
       state: 'ready',
       worktree_id: 'repo::windows-worktree',
       terminal_handle: 'term_windows_worker'
@@ -356,11 +356,8 @@ describe('orchestration federation', () => {
         })
       }
     })
-    expect(sent).toMatchObject({
-      ok: true,
-      result: { relay: { dispatchId: dispatch.id, accepted: true } }
-    })
-    expect(homeDb.getTask(task.id)?.status).toBe('dispatched')
+    expect(sent).toMatchObject({ ok: true, result: { lifecycle: { action: 'completed' } } })
+    expect(homeDb.getTask(task.id)?.status).toBe('completed')
 
     await homeRuntime.syncOrchestrationFederation()
 
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-release.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-release.test.ts
index 25670dda1e7..d2c17db9ba0 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-release.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-release.test.ts
@@ -21,6 +21,7 @@ describe('orchestration worker release', () => {
   let runtime: OrcaRuntimeService
   let ctx: RpcContext
   let activeRunId: string
+  let inspectProcessLiveness: ReturnType<typeof vi.fn>
 
   const coordinatorPaneKey = 'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
   const workerPaneKey = 'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
@@ -30,6 +31,12 @@ describe('orchestration worker release', () => {
     dbOpen = true
     runtime = new OrcaRuntimeService()
     runtime.setOrchestrationDb(db)
+    inspectProcessLiveness = vi.fn().mockResolvedValue('live')
+    ;(
+      runtime as unknown as {
+        inspectTerminalProcessIncarnationLiveness: typeof inspectProcessLiveness
+      }
+    ).inspectTerminalProcessIncarnationLiveness = inspectProcessLiveness
     vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
       handle === 'term_coord'
         ? coordinatorPaneKey
@@ -215,7 +222,7 @@ describe('orchestration worker release', () => {
     setup()
     const { dispatchId } = await startWorker()
     await expect(call('orchestration.workerRelease', { dispatch: dispatchId })).rejects.toThrow(
-      /only a succeeded or failed worker can release/
+      /only a settled worker can release/
     )
     expect(runtime.closeTerminal).not.toHaveBeenCalled()
     expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).toBe('not_requested')
@@ -232,6 +239,44 @@ describe('orchestration worker release', () => {
     expect(runtime.closeTerminal).not.toHaveBeenCalled()
   })
 
+  it('reconciles a dead external terminal without closing a process', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker('succeeded', { terminal: 'term_worker' })
+    inspectProcessLiveness.mockResolvedValue('dead')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: dispatchId })
+    ).resolves.toMatchObject({ state: 'released', processAction: 'none' })
+    expect(inspectProcessLiveness).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  it('retains dead inventory evidence when persisted ownership history is invalid', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker('succeeded', { terminal: 'term_worker' })
+    const resource = db.getWorkerTerminalResourceByOwner(dispatchId)
+    const raw = (
+      db as unknown as { db: { prepare: (sql: string) => { run: (...args: unknown[]) => void } } }
+    ).db
+    raw
+      .prepare('UPDATE worker_terminal_resources SET prior_owner_dispatch_ids = ? WHERE id = ?')
+      .run('{invalid', resource?.id)
+    inspectProcessLiveness.mockResolvedValue('dead')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: dispatchId })
+    ).resolves.toMatchObject({ state: 'retained', processAction: 'none' })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).not.toBe('released')
+  })
+
   it('retains a user-taken-over terminal durably', async () => {
     setup()
     const { dispatchId } = await startSettledWorker()
@@ -248,6 +293,50 @@ describe('orchestration worker release', () => {
     expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.ownership_state).toBe('user_owned')
   })
 
+  it('reconciles a dead user-taken-over terminal without closing a process', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    await call('orchestration.workerTerminalUserInput', { paneKey: workerPaneKey })
+    inspectProcessLiveness.mockResolvedValue('dead')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: dispatchId })
+    ).resolves.toMatchObject({ state: 'released', processAction: 'none' })
+    expect(inspectProcessLiveness).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  it.each(['stopped', 'abandoned'] as const)(
+    'reconciles a dead %s worker without closing a process',
+    async (state) => {
+      setup()
+      const { dispatchId } = await startWorker()
+      if (state === 'stopped') {
+        db.beginWorkerStop(dispatchId)
+        db.settleWorkerStop(dispatchId)
+      } else {
+        db.abandonWorkerDispatch(dispatchId)
+      }
+      inspectProcessLiveness.mockResolvedValue('dead')
+
+      await expect(
+        call('orchestration.workerRelease', { dispatch: dispatchId })
+      ).resolves.toMatchObject({ state: 'released', processAction: 'none' })
+      expect(runtime.closeTerminal).not.toHaveBeenCalled()
+      expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+        ownership_state: 'released',
+        release_state: 'released'
+      })
+    }
+  )
+
   it('lets user takeover cancel a release while output capture is pending', async () => {
     setup()
     const { dispatchId } = await startSettledWorker()
@@ -617,6 +706,7 @@ describe('orchestration worker release', () => {
     expect(transferred?.terminal_handle).toBe('term_reminted')
     expect(db.getWorkerTerminalResourceByOwner(first.dispatchId)).toBeUndefined()
 
+    inspectProcessLiveness.mockResolvedValueOnce('dead')
     const oldRelease = (await call('orchestration.workerRelease', {
       dispatch: first.dispatchId
     })) as { state: string; reason?: string }
@@ -632,6 +722,27 @@ describe('orchestration worker release', () => {
     expect(runtime.closeTerminal).toHaveBeenCalledWith('term_reminted')
   })
 
+  it('reconciles dead transferred ownership after the current owner settles', async () => {
+    setup()
+    const first = await startSettledWorker('succeeded')
+    const second = await startWorker({ terminal: 'term_reminted' })
+    settle(second.taskId, second.dispatchId, 'succeeded')
+    inspectProcessLiveness.mockResolvedValue('dead')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: first.dispatchId })
+    ).resolves.toMatchObject({ state: 'released', processAction: 'none' })
+    expect(inspectProcessLiveness).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(second.dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
   it('rejects exact reuse after release intent instead of closing the new worker', async () => {
     setup()
     const first = await startSettledWorker('succeeded')
@@ -744,9 +855,14 @@ describe('orchestration worker release', () => {
     expect(listed.workers).toContainEqual(
       expect.objectContaining({ dispatchId, terminalState: 'retained' })
     )
-    await expect(call('orchestration.workerRelease', { dispatch: dispatchId })).rejects.toThrow(
-      /only a succeeded or failed worker can release/
-    )
+    await expect(
+      call('orchestration.workerRelease', { dispatch: dispatchId })
+    ).resolves.toMatchObject({
+      state: 'retained',
+      reason: 'identity_unproven',
+      processAction: 'none'
+    })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
   })
 
   it('worker-show exposes the terminal resource', async () => {
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-release.ts b/src/main/runtime/rpc/methods/orchestration-worker-release.ts
index f01cd72de47..446887f581a 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-release.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-release.ts
@@ -54,12 +54,36 @@ export const ORCHESTRATION_WORKER_RELEASE_METHODS: RpcMethod[] = [
         }
       }
       if (requested.disposition === 'retained') {
+        const resource = requested.resource
+        const processIncarnation = resource?.process_incarnation
+        if (
+          processIncarnation &&
+          (await runtime.inspectTerminalProcessIncarnationLiveness(
+            processIncarnation,
+            resource.host_scope
+          )) === 'dead'
+        ) {
+          const reconciled = db.settleDeadWorkerTerminalRelease({
+            requestingDispatchId: params.dispatch,
+            resourceId: resource.id,
+            processIncarnation
+          })
+          if (reconciled.disposition === 'released') {
+            runtime.notifyMessageArrived(`dispatch:${params.dispatch}`, 'status')
+            return {
+              dispatchId: params.dispatch,
+              state: 'released',
+              processAction: 'none',
+              archive: archiveSummary(reconciled.resource)
+            }
+          }
+        }
         return {
           dispatchId: params.dispatch,
           state: 'retained',
           reason: requested.reason,
           processAction: 'none',
-          archive: archiveSummary(requested.resource)
+          archive: archiveSummary(resource)
         }
       }
       return completeWorkerTerminalRelease({
diff --git a/src/main/runtime/rpc/methods/orchestration.test.ts b/src/main/runtime/rpc/methods/orchestration.test.ts
index 6fb19e0a4c1..f95b20a8b05 100644
--- a/src/main/runtime/rpc/methods/orchestration.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration.test.ts
@@ -415,7 +415,7 @@ describe('orchestration RPC methods', () => {
       )
       vi.spyOn(runtime, 'deliverPendingMessagesForHandle').mockImplementation(() => {})
 
-      await call('orchestration.send', {
+      const result = await call('orchestration.send', {
         from: 'term_worker',
         to: 'term_coord',
         subject: 'Done',
@@ -429,6 +429,7 @@ describe('orchestration RPC methods', () => {
 
       expect(db.getTask(task.id)?.status).toBe('completed')
       expect(db.getDispatchContextById(dispatch.id)?.status).toBe('completed')
+      expect(result).toMatchObject({ lifecycle: { action: 'completed' } })
     })
 
     it('rejects an identity-less lifecycle send resolved through the coordinator handle', async () => {
@@ -482,7 +483,7 @@ describe('orchestration RPC methods', () => {
       }
 
       expect(db.getTask(task.id)?.status).toBe('completed')
-      expect(result.lifecycle).toBeUndefined()
+      expect(result.lifecycle).toMatchObject({ action: 'completed' })
       expect(result.message).toMatchObject({
         type: 'worker_done',
         subject: 'Done'
diff --git a/src/main/runtime/rpc/methods/orchestration.ts b/src/main/runtime/rpc/methods/orchestration.ts
index fdcb9168e69..f3dee4d2171 100644
--- a/src/main/runtime/rpc/methods/orchestration.ts
+++ b/src/main/runtime/rpc/methods/orchestration.ts
@@ -13,6 +13,7 @@ import { buildDispatchPreamble } from '../../orchestration/preamble'
 import { formatMessageBanner } from '../../orchestration/formatter'
 import { isGroupAddress, resolveGroupAddress } from '../../orchestration/groups'
 import { reconcileLifecycleMessage } from '../../orchestration/lifecycle-reconciliation'
+import { waitForFederatedLifecycleSettlement } from '../../orchestration/federation-lifecycle-settlement'
 import { abbreviateOrchestrationTasks } from '../../../../shared/orchestration-task-summary'
 import {
   ORCHESTRATION_LEGACY_RUN_ID,
@@ -28,7 +29,10 @@ import { OrchestrationError } from '../../orchestration/orchestration-error'
 import type { OrcaRuntimeService } from '../../orca-runtime'
 import type { RunRow } from '../../orchestration/types'
 import { encodeFederatedControlMessage } from '../../orchestration/federation-control-message'
-import { ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION } from '../../../../shared/protocol-version'
+import {
+  ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION
+} from '../../../../shared/protocol-version'
 
 const TASK_STATUSES: TaskStatus[] = [
   'pending',
@@ -86,6 +90,7 @@ const SendParams = z
     // Why: pane key is the remint-stable identity used to verify worker_done/heartbeat ownership; the from handle stays routing metadata.
     senderPaneKey: OptionalString,
     run: OptionalString,
+    waitForLifecycleSettlement: OptionalBoolean,
     devMode: OptionalBoolean
   })
   .superRefine((params, ctx) => {
@@ -392,7 +397,8 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
         orchestrationCapability,
         legacyCoordinatorRunId,
         revalidateLegacyCoordinator,
-        orchestrationCompatibilityCallerAuthority
+        orchestrationCompatibilityCallerAuthority,
+        signal
       }
     ) => {
       const db = runtime.getOrchestrationDb()
@@ -445,6 +451,16 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
             'Remote worker_done requires outcome=succeeded|failed.'
           )
         }
+        if (
+          outcome &&
+          remoteAttachment.protocol_version <
+            ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION
+        ) {
+          throw new OrchestrationError(
+            'capability_unsupported',
+            'The Run-home runtime cannot confirm worker_done settlement. Update it before retrying; no report was queued.'
+          )
+        }
         const relay = db.enqueueFederationRelay({
           dispatchId: remoteAttachment.dispatch_id,
           direction: 'to_home',
@@ -457,9 +473,20 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
             priority: params.priority ?? 'normal',
             threadId: params.threadId ?? null,
             payload: params.payload ?? null
-          }),
-          settleRemoteOutcome: outcome
+          })
         })
+        const lifecycle = outcome
+          ? await waitForFederatedLifecycleSettlement(runtime, relay.dispatch_id, relay.sequence, {
+              timeoutMs: 30_000,
+              signal
+            })
+          : undefined
+        if (outcome && !lifecycle) {
+          throw new OrchestrationError(
+            'operation_unknown',
+            'worker_done was queued, but the Run-home runtime did not confirm settlement. Verify the Task and Dispatch before retrying.'
+          )
+        }
         return {
           relay: {
             messageId: relay.message_id,
@@ -468,9 +495,7 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
             destination: 'run_home',
             accepted: true
           },
-          ...(outcome
-            ? { lifecycle: { action: outcome === 'succeeded' ? 'completed' : 'failed' } }
-            : {})
+          ...(lifecycle ? { lifecycle } : {})
         }
       }
       const routing = resolveMessageRun(runtime, {
@@ -628,6 +653,10 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
             runtime.notifyMessageArrived(to, rejection.type)
             return { message: rejection, lifecycle: reconciled }
           }
+          runtime.notifyMessageArrived(to, msg.type)
+          return msg.type === 'worker_done'
+            ? { message: msg, lifecycle: reconciled }
+            : { message: msg }
         }
         runtime.notifyMessageArrived(to, msg.type)
         return { message: msg }
diff --git a/src/main/runtime/rpc/methods/repo-update-schema.ts b/src/main/runtime/rpc/methods/repo-update-schema.ts
index 6fdb59c3ae9..aaa0d886fb0 100644
--- a/src/main/runtime/rpc/methods/repo-update-schema.ts
+++ b/src/main/runtime/rpc/methods/repo-update-schema.ts
@@ -54,6 +54,7 @@ export function createRepoUpdateSchema<T extends z.ZodRawShape>(
       externalWorktreeVisibilityPromptDismissedAt: z.number().finite().optional(),
       externalWorktreeInboxBaselinePaths: z.array(z.string()).optional(),
       importedExternalWorktreePaths: z.array(z.string()).optional(),
+      agentWorktreeVisibility: z.enum(['hide', 'show']).optional(),
       externalWorktreeDiscoverySuppressedAt: z.number().finite().nullable().optional(),
       projectGroupId: OptionalString.nullable().optional(),
       projectGroupOrder: OptionalFiniteNumber,
diff --git a/src/main/runtime/rpc/methods/repo.test.ts b/src/main/runtime/rpc/methods/repo.test.ts
index 09991c4103e..7c31660c1c4 100644
--- a/src/main/runtime/rpc/methods/repo.test.ts
+++ b/src/main/runtime/rpc/methods/repo.test.ts
@@ -303,6 +303,33 @@ describe('repo RPC methods', () => {
     })
   })
 
+  it('persists agent worktree visibility updates', async () => {
+    const runtime = {
+      getRuntimeId: () => 'test-runtime',
+      updateRepo: vi.fn().mockResolvedValue({
+        id: 'repo-1',
+        path: '/srv/repo',
+        agentWorktreeVisibility: 'show'
+      })
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: REPO_METHODS })
+
+    const response = await dispatcher.dispatch(
+      makeRequest('repo.update', {
+        repo: 'repo-1',
+        updates: { agentWorktreeVisibility: 'show' }
+      })
+    )
+
+    expect(runtime.updateRepo).toHaveBeenCalledWith('repo-1', {
+      agentWorktreeVisibility: 'show'
+    })
+    expect(response).toMatchObject({
+      ok: true,
+      result: { repo: { id: 'repo-1', agentWorktreeVisibility: 'show' } }
+    })
+  })
+
   it('persists resolved GitHub upstream metadata updates', async () => {
     const runtime = {
       getRuntimeId: () => 'test-runtime',
diff --git a/src/main/runtime/rpc/methods/skills.test.ts b/src/main/runtime/rpc/methods/skills.test.ts
index a4335ec2e62..cd82be0ca3a 100644
--- a/src/main/runtime/rpc/methods/skills.test.ts
+++ b/src/main/runtime/rpc/methods/skills.test.ts
@@ -7,7 +7,10 @@ vi.mock('../../../skills/skill-discovery-target', () => ({
 }))
 
 import { SKILL_METHODS } from './skills'
-import { resolveSkillDiscoveryTarget } from '../../../skills/skill-discovery-target'
+import {
+  discoverSkillsOnTarget,
+  resolveSkillDiscoveryTarget
+} from '../../../skills/skill-discovery-target'
 
 const WSL_RUNTIME = {
   status: 'resolved',
@@ -65,4 +68,20 @@ describe('skills.discover RPC', () => {
       expect.objectContaining({ projectRuntime: WSL_RUNTIME })
     )
   })
+
+  it('only bypasses the host scan cache when the caller asks for a refresh', async () => {
+    await discoverMethod().handler({ cwd: '/repo' }, makeContext({}))
+    expect(vi.mocked(discoverSkillsOnTarget)).toHaveBeenLastCalledWith(expect.anything(), [], {
+      refresh: false
+    })
+
+    await discoverMethod().handler({ cwd: '/repo', refresh: true }, makeContext({}))
+    expect(vi.mocked(discoverSkillsOnTarget)).toHaveBeenLastCalledWith(expect.anything(), [], {
+      refresh: true
+    })
+  })
+
+  it('accepts a params payload from an older client that cannot send refresh', () => {
+    expect(discoverMethod().params?.parse({ cwd: '/repo' })).toEqual({ cwd: '/repo' })
+  })
 })
diff --git a/src/main/runtime/rpc/methods/skills.ts b/src/main/runtime/rpc/methods/skills.ts
index 346198aeffc..f6e5acbe6d9 100644
--- a/src/main/runtime/rpc/methods/skills.ts
+++ b/src/main/runtime/rpc/methods/skills.ts
@@ -19,7 +19,9 @@ export const SKILL_METHODS: RpcMethod[] = [
             ...params,
             projectRuntime: runtime.resolveProjectRuntimeForWorktree(params.worktreeId)
           }
-      return discoverSkillsOnTarget(resolveSkillDiscoveryTarget(target), runtime.listRepos())
+      return discoverSkillsOnTarget(resolveSkillDiscoveryTarget(target), runtime.listRepos(), {
+        refresh: params.refresh === true
+      })
     }
   })
 ]
diff --git a/src/main/runtime/rpc/methods/terminal-split-env.test.ts b/src/main/runtime/rpc/methods/terminal-split-env.test.ts
new file mode 100644
index 00000000000..3bbf1291f00
--- /dev/null
+++ b/src/main/runtime/rpc/methods/terminal-split-env.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import type { RpcRequest } from '../core'
+import { RpcDispatcher } from '../dispatcher'
+import { TERMINAL_METHODS } from './terminal'
+
+describe('terminal split environment forwarding', () => {
+  it('forwards requested environment deletions to the runtime owner', async () => {
+    const splitTerminal = vi.fn().mockResolvedValue({ handle: 'term-split' })
+    const runtime = {
+      getRuntimeId: () => 'runtime-1',
+      splitTerminal
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const request: RpcRequest = {
+      id: 'split-1',
+      authToken: 'token',
+      method: 'terminal.split',
+      params: {
+        terminal: 'term-1',
+        direction: 'horizontal',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION']
+      }
+    }
+
+    await dispatcher.dispatch(request)
+
+    expect(splitTerminal).toHaveBeenCalledWith('term-1', {
+      direction: 'horizontal',
+      command: undefined,
+      env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+      envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
+      telemetrySource: undefined
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/terminal.ts b/src/main/runtime/rpc/methods/terminal.ts
index 1cdec021e55..32c31149f3f 100644
--- a/src/main/runtime/rpc/methods/terminal.ts
+++ b/src/main/runtime/rpc/methods/terminal.ts
@@ -99,6 +99,8 @@ type SnapshotFrameOptions = {
   source?: 'headless' | 'renderer'
   oscLinks?: TerminalOscLinkRange[]
   pendingEscapeTailAnsi?: string
+  /** Effective kitty flags proven at this frame's own `seq`. */
+  kittyKeyboardFlags?: number
 }
 
 type SerializedSnapshot = {
@@ -113,6 +115,7 @@ type SerializedSnapshot = {
   scrollbackRows: number
   truncatedByByteBudget: boolean
   pendingEscapeTailAnsi?: string
+  kittyKeyboardFlags?: number
 } | null
 
 type TerminalViewportClient = {
@@ -648,6 +651,15 @@ function sendSnapshotFrames(
         source: options.source,
         oscLinks: options.oscLinks,
         pendingEscapeTailAnsi: options.pendingEscapeTailAnsi,
+        // Why conditional and additive: old clients ignore the unknown field,
+        // and a new client must read absence as unknown rather than zero, so
+        // no opcode or capability negotiation is involved (Rule 1 of
+        // docs/reference/remote-wire-compatibility.md).
+        // Why `seq` is required: the flags are only proven at this frame's own
+        // seq, so without a replay boundary the client cannot order them.
+        ...(typeof options.seq === 'number' && options.kittyKeyboardFlags !== undefined
+          ? { kittyKeyboardFlags: options.kittyKeyboardFlags }
+          : {}),
         truncated: options.truncated === true,
         truncatedByByteBudget: options.truncatedByByteBudget === true
       })
@@ -973,6 +985,7 @@ const TerminalSplit = TerminalHandle.extend({
     .optional(),
   command: OptionalString,
   env: z.record(z.string(), z.string()).optional(),
+  envToDelete: z.array(z.string().min(1).max(256)).max(32).optional(),
   telemetrySource: z.enum(TERMINAL_PANE_SPLIT_SOURCES).optional()
 })
 
@@ -1460,6 +1473,7 @@ export const TERMINAL_METHODS: RpcAnyMethod[] = [
         direction: params.direction,
         command: params.command,
         env: params.env,
+        envToDelete: params.envToDelete,
         telemetrySource: params.telemetrySource
       })
     })
@@ -1840,6 +1854,7 @@ export const TERMINAL_METHODS: RpcAnyMethod[] = [
               reason: 'ack-pending-overflow',
               seq: serialized.seq,
               source: serialized.source,
+              kittyKeyboardFlags: serialized.kittyKeyboardFlags,
               truncatedByByteBudget: serialized.truncatedByByteBudget,
               data: serialized.data
             }
@@ -2327,6 +2342,7 @@ export const TERMINAL_METHODS: RpcAnyMethod[] = [
             seq: serialized?.seq,
             cwd: serialized?.cwd,
             source: serialized?.source,
+            kittyKeyboardFlags: serialized?.kittyKeyboardFlags,
             oscLinks: serialized?.oscLinks,
             pendingEscapeTailAnsi: serialized?.pendingEscapeTailAnsi,
             truncated: false,
@@ -2669,6 +2685,7 @@ export const TERMINAL_METHODS: RpcAnyMethod[] = [
               truncated: initialOutputOverflowed,
               truncatedByByteBudget: serialized?.truncatedByByteBudget,
               source: serialized?.source,
+              kittyKeyboardFlags: serialized?.kittyKeyboardFlags,
               oscLinks: serialized?.oscLinks,
               pendingEscapeTailAnsi: serialized?.pendingEscapeTailAnsi,
               data:
diff --git a/src/main/runtime/rpc/methods/worktree-schemas.test.ts b/src/main/runtime/rpc/methods/worktree-schemas.test.ts
index e1eb22f2c52..5737e2c4c8d 100644
--- a/src/main/runtime/rpc/methods/worktree-schemas.test.ts
+++ b/src/main/runtime/rpc/methods/worktree-schemas.test.ts
@@ -109,14 +109,14 @@ describe('worktree RPC schemas', () => {
     const parsed = WorktreeSet.parse({ worktree: 'id:r1::/repos/wt', displayName: '' })
 
     expect(parsed.displayName).toBe('')
-    expect(Object.prototype.hasOwnProperty.call(parsed, 'displayName')).toBe(true)
+    expect(Object.hasOwn(parsed, 'displayName')).toBe(true)
   })
 
   it('still omits a display name that was never sent', () => {
     const parsed = WorktreeSet.parse({ worktree: 'id:r1::/repos/wt', comment: 'note' })
 
     expect(parsed.displayName).toBeUndefined()
-    expect(Object.prototype.hasOwnProperty.call(parsed, 'displayName')).toBe(false)
+    expect(Object.hasOwn(parsed, 'displayName')).toBe(false)
   })
 
   it('ignores a non-string display name rather than persisting it', () => {
diff --git a/src/main/runtime/rpc/orchestration-legacy-compatibility.ts b/src/main/runtime/rpc/orchestration-legacy-compatibility.ts
index 291d35b895f..31d3b5b1952 100644
--- a/src/main/runtime/rpc/orchestration-legacy-compatibility.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-compatibility.ts
@@ -206,7 +206,7 @@ export class OrchestrationLegacyCompatibility {
     request: RpcRequest,
     params: unknown,
     signal?: AbortSignal
-  ): Promise<unknown | undefined> {
+  ): Promise<unknown> {
     if (request.method === 'orchestration.send') {
       return await handleLegacyLifecycleSend({
         runtime: this.runtime,
diff --git a/src/main/runtime/rpc/orchestration-legacy-lifecycle.ts b/src/main/runtime/rpc/orchestration-legacy-lifecycle.ts
index 9ffe17cca6e..7e76128bd19 100644
--- a/src/main/runtime/rpc/orchestration-legacy-lifecycle.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-lifecycle.ts
@@ -17,7 +17,7 @@ export async function handleLegacyLifecycleSend(args: {
   authority: LegacyCompatibilityAuthority
   request: RpcRequest
   params: LegacySendParams
-}): Promise<unknown | undefined> {
+}): Promise<unknown> {
   const { runtime, authority, request, params } = args
   if (!['heartbeat', 'worker_done', 'escalation'].includes(params.type ?? '')) {
     return undefined
diff --git a/src/main/runtime/rpc/orchestration-legacy-mail.ts b/src/main/runtime/rpc/orchestration-legacy-mail.ts
index e41e0c11509..c83d7ffdf2f 100644
--- a/src/main/runtime/rpc/orchestration-legacy-mail.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-mail.ts
@@ -20,7 +20,7 @@ export async function handleLegacyCheck(args: {
   request: RpcRequest
   params: LegacyCheckParams
   signal?: AbortSignal
-}): Promise<unknown | undefined> {
+}): Promise<unknown> {
   const { runtime, authority, request, params, signal } = args
   if (params.run) {
     return undefined
@@ -138,7 +138,7 @@ export async function handleLegacyReply(args: {
   authority: LegacyCompatibilityAuthority
   request: RpcRequest
   params: LegacyReplyParams
-}): Promise<unknown | undefined> {
+}): Promise<unknown> {
   const { runtime, authority, request, params } = args
   const db = runtime.getOrchestrationDb()
   const original = db.getMessageById(params.id)
diff --git a/src/main/runtime/rpc/orchestration-legacy-process-identity.ts b/src/main/runtime/rpc/orchestration-legacy-process-identity.ts
index 35054c61279..14e4f3e46f3 100644
--- a/src/main/runtime/rpc/orchestration-legacy-process-identity.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-process-identity.ts
@@ -1,6 +1,8 @@
-import { parsePaneKey } from '../../../shared/stable-pane-id'
+import { isEquivalentPaneKey } from '../../../shared/stable-pane-id'
 import { OrchestrationError } from '../orchestration/orchestration-error'
 
+// Why: legacy rows carry nullable pane keys, and a missing key is never proof of
+// identity — so absence is refused here rather than inside the shared comparison.
 export function equivalentLegacyPaneKey(
   a: string | null | undefined,
   b: string | null | undefined
@@ -8,12 +10,7 @@ export function equivalentLegacyPaneKey(
   if (!a || !b) {
     return false
   }
-  if (a === b) {
-    return true
-  }
-  const aLeaf = parsePaneKey(a)?.leafId
-  const bLeaf = parsePaneKey(b)?.leafId
-  return Boolean(aLeaf && bLeaf && aLeaf === bLeaf)
+  return isEquivalentPaneKey(a, b)
 }
 
 export function legacyReadOnlyError(): OrchestrationError {
diff --git a/src/main/runtime/rpc/orchestration-legacy-question.ts b/src/main/runtime/rpc/orchestration-legacy-question.ts
index 69dec720a3a..cd463155619 100644
--- a/src/main/runtime/rpc/orchestration-legacy-question.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-question.ts
@@ -17,7 +17,7 @@ export async function handleLegacyAsk(args: {
   request: RpcRequest
   params: LegacyAskParams
   signal?: AbortSignal
-}): Promise<unknown | undefined> {
+}): Promise<unknown> {
   const { runtime, authority, request, params, signal } = args
   const dispatch = authority.resolveAskDispatch(request, params)
   if (!dispatch || dispatch.contract_version !== LEGACY_CONTRACT_VERSION) {
diff --git a/src/main/runtime/rpc/orchestration-mutation-executor.ts b/src/main/runtime/rpc/orchestration-mutation-executor.ts
index 2334cd709eb..701970eb58c 100644
--- a/src/main/runtime/rpc/orchestration-mutation-executor.ts
+++ b/src/main/runtime/rpc/orchestration-mutation-executor.ts
@@ -22,7 +22,7 @@ export class OrchestrationMutationExecutor {
   async run(
     request: RpcRequest,
     params: unknown,
-    invoke: (mutation?: DurableMutationInvocation) => Promise<unknown> | unknown,
+    invoke: (mutation?: DurableMutationInvocation) => unknown,
     callerFingerprintOverride?: string
   ): Promise<unknown> {
     const requestId = request.orchestrationRequestId
diff --git a/src/main/runtime/rpc/orchestration-mutation-ledger.test.ts b/src/main/runtime/rpc/orchestration-mutation-ledger.test.ts
index 4062dacf9a1..a9cbfbc5ab7 100644
--- a/src/main/runtime/rpc/orchestration-mutation-ledger.test.ts
+++ b/src/main/runtime/rpc/orchestration-mutation-ledger.test.ts
@@ -38,7 +38,7 @@ describe('durable orchestration mutation ledger', () => {
     }
   })
 
-  function createHarness(dbPath: string | ':memory:' = ':memory:') {
+  function createHarness(dbPath: (string & {}) | ':memory:' = ':memory:') {
     const db = new OrchestrationDb(dbPath)
     const runtime = new OrcaRuntimeService()
     runtime.setOrchestrationDb(db)
diff --git a/src/main/runtime/rpc/streaming.test.ts b/src/main/runtime/rpc/streaming.test.ts
index 382353de803..4b4ce8a9f21 100644
--- a/src/main/runtime/rpc/streaming.test.ts
+++ b/src/main/runtime/rpc/streaming.test.ts
@@ -231,6 +231,28 @@ describe('RpcDispatcher streaming', () => {
     expect(response.streaming).toBeUndefined()
   })
 
+  it('rejects a replacement runtime before streaming dispatch invokes a mutation', async () => {
+    const messages: string[] = []
+    const handler = vi.fn(() => ({ terminal: { handle: 'terminal-1' } }))
+    const dispatcher = new RpcDispatcher({
+      runtime: stubRuntime(),
+      methods: [defineMethod({ name: 'terminal.create', params: z.object({}), handler })]
+    })
+
+    await dispatcher.dispatchStreaming(
+      { ...makeRequest('terminal.create', {}), expectedRuntimeId: 'previous-runtime' },
+      (message) => messages.push(message)
+    )
+
+    expect(messages).toHaveLength(1)
+    expect(JSON.parse(messages[0]!)).toMatchObject({
+      ok: false,
+      error: { code: 'runtime_replaced' },
+      _meta: { runtimeId: 'test-runtime' }
+    })
+    expect(handler).not.toHaveBeenCalled()
+  })
+
   it('returns error for unknown method via dispatchStreaming', async () => {
     const messages: string[] = []
     const dispatcher = new RpcDispatcher({
diff --git a/src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts b/src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts
new file mode 100644
index 00000000000..2671449b606
--- /dev/null
+++ b/src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts
@@ -0,0 +1,71 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../orca-runtime'
+import { RpcDispatcher } from './dispatcher'
+import type { RpcRequest } from './core'
+import { TERMINAL_METHODS } from './methods/terminal'
+
+function request(method: string, params: unknown): RpcRequest {
+  return { id: 'request-1', authToken: 'test-token', method, params }
+}
+
+describe('OpenCode guarded terminal send', () => {
+  afterEach(() => vi.useRealTimers())
+
+  it('refuses a marker title left on a shell without writing notes', async () => {
+    vi.useFakeTimers()
+    const write = vi.fn(() => true)
+    const runtime = new OrcaRuntimeService()
+    runtime.setPtyController({
+      write,
+      kill: () => true,
+      getForegroundProcess: async () => 'zsh'
+    })
+    runtime.attachWindow(1)
+    runtime.syncWindowGraph(1, {
+      tabs: [
+        {
+          tabId: 'tab-1',
+          worktreeId: 'repo-1::/tmp/worktree',
+          title: 'OC | zsh',
+          activeLeafId: 'pane-1',
+          layout: null
+        }
+      ],
+      leaves: [
+        {
+          tabId: 'tab-1',
+          worktreeId: 'repo-1::/tmp/worktree',
+          leafId: 'pane-1',
+          paneRuntimeId: 1,
+          ptyId: 'pty-1',
+          paneTitle: 'OC | zsh'
+        }
+      ]
+    })
+    const [terminal] = (await runtime.listTerminals()).terminals
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+
+    await expect(
+      dispatcher.dispatch(request('terminal.agentStatus', { terminal: terminal.handle }))
+    ).resolves.toMatchObject({
+      ok: true,
+      result: { agentStatus: { isRunningAgent: false, status: null } }
+    })
+
+    const send = dispatcher.dispatch(
+      request('terminal.send', {
+        terminal: terminal.handle,
+        text: '$(touch should-not-run)',
+        requireAgentStatus: 'sendable',
+        client: { id: 'desktop-1', type: 'desktop' }
+      })
+    )
+    await vi.advanceTimersByTimeAsync(1_500)
+
+    await expect(send).resolves.toMatchObject({
+      ok: true,
+      result: { send: { accepted: false, bytesWritten: 0, refusedReason: 'no-agent' } }
+    })
+    expect(write).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/runtime-rpc.test.ts b/src/main/runtime/runtime-rpc.test.ts
index 2df636da4c0..5ccffe24550 100644
--- a/src/main/runtime/runtime-rpc.test.ts
+++ b/src/main/runtime/runtime-rpc.test.ts
@@ -6026,7 +6026,7 @@ describe('OrcaRuntimeRpcServer WebSocket bind host (STA-2370)', () => {
     const wideStartGate = new Promise<void>((resolve) => {
       releaseWideStart = resolve
     })
-    let wideStopSpy: ReturnType<typeof vi.spyOn> | null = null
+    let wideStopSpy: ReturnType<typeof vi.spyOn> = null
     vi.spyOn(target, 'startWebSocketTransport').mockImplementation(async (opts) => {
       if (opts.host === '0.0.0.0') {
         // Why: hold the widen mid-flight (loopback already stopped) so stop() must race the rebind.
diff --git a/src/main/runtime/runtime-rpc.ts b/src/main/runtime/runtime-rpc.ts
index b783382c544..326801c6fa9 100644
--- a/src/main/runtime/runtime-rpc.ts
+++ b/src/main/runtime/runtime-rpc.ts
@@ -1409,7 +1409,7 @@ export class OrcaRuntimeRpcServer {
     // never orphan a running 0.0.0.0 listener outside activeTransports (and thus outside stop()).
     this.activeTransports[index] = widened.transport
     const metaIndex = this.transports.findIndex((meta) => meta.kind === 'websocket')
-    if (metaIndex >= 0) {
+    if (metaIndex !== -1) {
       this.transports[metaIndex] = { kind: 'websocket', endpoint: widened.endpoint }
     }
     try {
@@ -1451,7 +1451,7 @@ export class OrcaRuntimeRpcServer {
       )
       this.activeTransports.splice(index, 1)
       const metaIndex = this.transports.findIndex((meta) => meta.kind === 'websocket')
-      if (metaIndex >= 0) {
+      if (metaIndex !== -1) {
         this.transports.splice(metaIndex, 1)
       }
       this.wsBoundHost = null
@@ -1466,7 +1466,7 @@ export class OrcaRuntimeRpcServer {
     // orphan a live transport outside activeTransports (and thus outside stop()).
     this.activeTransports[index] = restored.transport
     const metaIndex = this.transports.findIndex((meta) => meta.kind === 'websocket')
-    if (metaIndex >= 0) {
+    if (metaIndex !== -1) {
       this.transports[metaIndex] = { kind: 'websocket', endpoint: restored.endpoint }
     }
     try {
diff --git a/src/main/runtime/ssh-pane-recovery-grant-reachability.test.ts b/src/main/runtime/ssh-pane-recovery-grant-reachability.test.ts
new file mode 100644
index 00000000000..5369e403195
--- /dev/null
+++ b/src/main/runtime/ssh-pane-recovery-grant-reachability.test.ts
@@ -0,0 +1,157 @@
+/**
+ * Characterisation oracle for the 30-second SSH pane recovery grant in
+ * `OrcaRuntimeService.recoverTerminalPane`.
+ *
+ * The grant is the branch that, for a DISCONNECTED pane backed by a recently
+ * expired SSH lease, calls `createTerminal` to spawn a replacement shell. This
+ * file does not argue that the grant is wrong; it RECORDS that the branch is
+ * already dead at the id shapes production mints, so that deleting it is
+ * provably inert rather than assumed to be. Test 1 is written to survive that
+ * deletion unchanged: `terminal_not_recoverable` is the answer both before and
+ * after, and the anti-vacuity assertions pin that control genuinely reaches the
+ * grant gate instead of bailing out earlier.
+ *
+ * Why the branch is dead: the gate compares `pty.ptyId` (runtime, APP form —
+ * `SshPtyProvider` hands ids back through `toAppSshPtyId`, and that is the id
+ * `ipc/pty.ts` passes to `runtime.registerPty`) against `lease.ptyId` (durable,
+ * RELAY-native — `persistence.ts` normalizes every stored lease through
+ * `toRelaySshPtyId`). The comparison at `getRecentExpiredSshLease` is a raw
+ * `===` with no namespace normalization, so the two strings can never be equal.
+ *
+ * Honest limit on the claim. For an SSH pane the refusal is unreachable BY
+ * CONSTRUCTION: an app-form id always carries the `ssh:<conn>@@` prefix that
+ * the relay-native lease id, by definition, does not. For a LOCAL pane the
+ * argument is weaker — a local pty id is not namespaced, so the gate is
+ * unreachable only up to a random-UUID string collision with a stored lease id
+ * that also matches the worktree, tab and leaf. That is not a construction
+ * proof, just an astronomically unlikely one. Do not overclaim it.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { toAppSshPtyId, toRelaySshPtyId } from '../providers/ssh-pty-id'
+import { OrcaRuntimeService } from './orca-runtime'
+
+const CONNECTION_ID = 'ssh-target-1'
+const RELAY_PTY_ID = 'pty-7'
+// Both id forms come from the production helpers so this oracle tracks the real
+// namespace split rather than restating it as two hand-typed literals.
+const APP_PTY_ID = toAppSshPtyId(CONNECTION_ID, RELAY_PTY_ID)
+const STORED_LEASE_PTY_ID = toRelaySshPtyId(CONNECTION_ID, APP_PTY_ID)
+
+const REPO_ID = 'repo-1'
+const WORKTREE_PATH = '/tmp/orca-grant-reachability'
+const WORKTREE_ID = `${REPO_ID}::${WORKTREE_PATH}`
+const TAB_ID = 'tab-grant'
+// Persistence drops any leafId that is not a terminal leaf UUID, and the gate
+// compares it, so the lease only qualifies with a real one.
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const PANE_KEY = `${TAB_ID}:${LEAF_ID}`
+
+function createStore() {
+  const now = Date.now()
+  return {
+    getRepo: (id: string) => createStore.repos.find((repo) => repo.id === id),
+    getRepos: () => createStore.repos,
+    getAllWorktreeMeta: () => ({
+      [WORKTREE_ID]: {
+        displayName: 'grant',
+        comment: '',
+        linkedIssue: null,
+        linkedPR: null,
+        linkedLinearIssue: null,
+        linkedGitLabMR: null,
+        linkedGitLabIssue: null,
+        isArchived: false,
+        isUnread: false,
+        isPinned: false,
+        sortOrder: 0,
+        lastActivityAt: 0
+      }
+    }),
+    getWorktreeMeta: () => undefined,
+    getSettings: () => ({
+      workspaceDir: '/tmp/workspaces',
+      nestWorkspaces: false,
+      refreshLocalBaseRefOnWorktreeCreate: false,
+      branchPrefix: 'none',
+      branchPrefixCustom: ''
+    }),
+    getProjects: () => [],
+    getSparsePresets: () => [],
+    // Seeded to qualify on EVERY predicate of getRecentExpiredSshLease except
+    // the ptyId comparison: expired, same worktree/tab/leaf, inside the grace.
+    getSshRemotePtyLeases: () => [
+      {
+        targetId: CONNECTION_ID,
+        ptyId: STORED_LEASE_PTY_ID,
+        worktreeId: WORKTREE_ID,
+        tabId: TAB_ID,
+        leafId: LEAF_ID,
+        state: 'expired' as const,
+        createdAt: now,
+        updatedAt: now
+      }
+    ]
+  }
+}
+createStore.repos = [
+  { id: REPO_ID, path: WORKTREE_PATH, displayName: 'repo', badgeColor: 'blue', addedAt: 1 }
+]
+
+/** Register one SSH-owned pty under `runtimePtyId`, then kill its shell. */
+function createDisconnectedPane(runtimePtyId: string) {
+  const runtime = new OrcaRuntimeService(createStore() as never)
+  runtime.registerPty(runtimePtyId, WORKTREE_ID, CONNECTION_ID, {
+    tabId: TAB_ID,
+    leafId: LEAF_ID
+  })
+  const handle = runtime.resolveTerminalPane(PANE_KEY, WORKTREE_ID).handle
+  runtime.onPtyExit(runtimePtyId, -1)
+  return { runtime, handle }
+}
+
+describe('SSH pane recovery grant reachability', () => {
+  it('refuses a pane whose SSH shell died, at the id shapes production actually mints', async () => {
+    // The split itself, named: the durable lease id and the runtime pty id for
+    // the SAME shell are different strings.
+    expect(STORED_LEASE_PTY_ID).not.toBe(APP_PTY_ID)
+
+    const { runtime, handle } = createDisconnectedPane(APP_PTY_ID)
+    const createTerminal = vi.spyOn(runtime, 'createTerminal')
+
+    // Anti-vacuity: control must actually arrive at the grant gate. A truthy
+    // handle rules out an early `terminal_not_found`; connected === false rules
+    // out the still-connected branch that also throws not_recoverable.
+    expect(handle).toBeTruthy()
+    expect(runtime.resolveTerminalPane(PANE_KEY, WORKTREE_ID).connected).toBe(false)
+
+    await expect(runtime.recoverTerminalPane(PANE_KEY, WORKTREE_ID, handle)).rejects.toThrow(
+      'terminal_not_recoverable'
+    )
+    expect(createTerminal).not.toHaveBeenCalled()
+  })
+
+  // INVERTED BY THE DELETION, and that inversion is the point.
+  //
+  // Before the grant was removed, this case RESOLVED with a replacement: the same seeded lease,
+  // with the runtime pty registered under the bare relay id instead of the app-form one, opened
+  // the gate. That is what made the case above attributable to the namespace and to nothing else —
+  // the lease qualified on state, worktree, tab, leaf and grace window, and only the id comparison
+  // stood between it and a spawn.
+  //
+  // The shape was never reachable in production (a lease implies a truthy connectionId, which
+  // implies an app-form id), so flipping it to a refusal changes no real behaviour — which is
+  // exactly what "the deletion is inert" means. Kept rather than dropped so the counterfactual
+  // stays on record: no id shape authorizes a spawn now, not merely the one production mints.
+  it('refuses even the id shape that used to open the grant', async () => {
+    const { runtime, handle } = createDisconnectedPane(RELAY_PTY_ID)
+    const createTerminal = vi.spyOn(runtime, 'createTerminal')
+
+    expect(handle).toBeTruthy()
+    expect(runtime.resolveTerminalPane(PANE_KEY, WORKTREE_ID).connected).toBe(false)
+
+    await expect(runtime.recoverTerminalPane(PANE_KEY, WORKTREE_ID, handle)).rejects.toThrow(
+      'terminal_not_recoverable'
+    )
+    expect(createTerminal).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/terminal-list-stale-leaf-liveness.test.ts b/src/main/runtime/terminal-list-stale-leaf-liveness.test.ts
index 5cbb967da76..9ca0c021333 100644
--- a/src/main/runtime/terminal-list-stale-leaf-liveness.test.ts
+++ b/src/main/runtime/terminal-list-stale-leaf-liveness.test.ts
@@ -148,6 +148,23 @@ describe('listTerminals liveness truth for restored leaves', () => {
     })
   })
 
+  it('keeps a leaf connected when the snapshot missed it but provider liveness is unknown', async () => {
+    const runtime = makeRuntimeWithLeaf({
+      leafPtyId: 'pty-provider-disconnected',
+      controllerSessions: [],
+      hasPty: () => null
+    })
+
+    const { terminals } = await runtime.listTerminals(`id:${WORKTREE_ID}`)
+
+    expect(terminals).toHaveLength(1)
+    expect(terminals[0]).toMatchObject({
+      ptyId: 'pty-provider-disconnected',
+      connected: true,
+      writable: true
+    })
+  })
+
   it('does not demote remote-runtime-scoped leaves the local inventory never covers', async () => {
     const runtime = makeRuntimeWithLeaf({
       leafPtyId: 'remote:env-1@@term_abc',
diff --git a/src/main/runtime/windows-firewall-remote-scope.ts b/src/main/runtime/windows-firewall-remote-scope.ts
index 9845413d079..6968435a8aa 100644
--- a/src/main/runtime/windows-firewall-remote-scope.ts
+++ b/src/main/runtime/windows-firewall-remote-scope.ts
@@ -109,7 +109,7 @@ function maskPrefixLength(maskText: string, version: IpVersion): number | null {
 function parseIpRange(scope: string): IpRange | null {
   const trimmed = scope.trim()
   const dashIndex = trimmed.indexOf('-')
-  if (dashIndex >= 0) {
+  if (dashIndex !== -1) {
     if (dashIndex !== trimmed.lastIndexOf('-')) {
       return null
     }
@@ -122,7 +122,7 @@ function parseIpRange(scope: string): IpRange | null {
   }
 
   const slashIndex = trimmed.indexOf('/')
-  if (slashIndex >= 0) {
+  if (slashIndex !== -1) {
     if (slashIndex !== trimmed.lastIndexOf('/')) {
       return null
     }
@@ -195,7 +195,7 @@ function expandEmbeddedIpv4(address: string): string | null {
   }
   const lastColon = address.lastIndexOf(':')
   const ipv4 = parseIpv4(address.slice(lastColon + 1))
-  if (lastColon < 0 || !ipv4) {
+  if (lastColon === -1 || !ipv4) {
     return null
   }
   const high = ((ipv4.value >> 16n) & 0xffffn).toString(16)
diff --git a/src/main/runtime/workspace-namespace-terminal-identity.test.ts b/src/main/runtime/workspace-namespace-terminal-identity.test.ts
new file mode 100644
index 00000000000..d3e1a3d19bc
--- /dev/null
+++ b/src/main/runtime/workspace-namespace-terminal-identity.test.ts
@@ -0,0 +1,365 @@
+import { describe, expect, it } from 'vitest'
+import { FLOATING_TERMINAL_WORKTREE_ID, getDefaultWorkspaceSession } from '../../shared/constants'
+import { makePaneKey } from '../../shared/stable-pane-id'
+import type { WorkspaceSessionState } from '../../shared/types'
+import { FOLDER_WORKSPACE_INSTANCE_SEPARATOR } from '../../shared/worktree-id'
+import { OrcaRuntimeService } from './orca-runtime'
+
+/**
+ * Journey: git-worktree, folder-workspace and floating namespaces must all resolve
+ * terminal identity from one stable host-local workspace id. Neither the filesystem
+ * path, the client's repository id, nor the caller's target id may stand in for it.
+ * Drive-letter and UNC ids normalize host-independently and are covered here; the
+ * Windows PTY lifecycle behind them is not.
+ */
+
+const GIT_REPO_ID = 'repo-git'
+const GIT_ROOT_PATH = '/tmp/ns/checkout'
+const GIT_ROOT_ID = `${GIT_REPO_ID}::${GIT_ROOT_PATH}`
+const GIT_CHILD_PATH = `${GIT_ROOT_PATH}/.claude/worktrees/child`
+const GIT_CHILD_ID = `${GIT_REPO_ID}::${GIT_CHILD_PATH}`
+
+const FOLDER_REPO_ID = 'repo-folder'
+const FOLDER_PATH = '/tmp/ns/folder'
+const FOLDER_ROOT_ID = `${FOLDER_REPO_ID}::${FOLDER_PATH}`
+const FOLDER_A = `${FOLDER_ROOT_ID}${FOLDER_WORKSPACE_INSTANCE_SEPARATOR}aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa`
+const FOLDER_B = `${FOLDER_ROOT_ID}${FOLDER_WORKSPACE_INSTANCE_SEPARATOR}bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb`
+
+// Same directory, re-added as a second project: only the repo id differs.
+const ALIAS_REPO_ID = 'repo-folder-alias'
+const ALIAS_ID = `${ALIAS_REPO_ID}::${FOLDER_PATH}`
+
+const PTY_GIT_ROOT = `${GIT_ROOT_ID}@@pty-git-root`
+const PTY_GIT_CHILD = `${GIT_CHILD_ID}@@pty-git-child`
+const PTY_A = `${FOLDER_A}@@pty-a`
+const PTY_B = `${FOLDER_B}@@pty-b`
+const PTY_FOLDER_ROOT = `${FOLDER_ROOT_ID}@@pty-folder-root`
+const PTY_ALIAS = `${ALIAS_ID}@@pty-alias`
+const PTY_FLOATING = 'floating-pty'
+
+const LEAF_A = 'a1111111-1111-4111-8111-111111111111'
+const LEAF_B = 'b2222222-2222-4222-8222-222222222222'
+
+const REPOS = [
+  { id: GIT_REPO_ID, path: GIT_ROOT_PATH, displayName: 'checkout', badgeColor: 'blue', addedAt: 1 },
+  {
+    id: FOLDER_REPO_ID,
+    path: FOLDER_PATH,
+    displayName: 'folder',
+    badgeColor: 'green',
+    addedAt: 2,
+    kind: 'folder'
+  },
+  {
+    id: ALIAS_REPO_ID,
+    path: FOLDER_PATH,
+    displayName: 'folder-alias',
+    badgeColor: 'red',
+    addedAt: 3,
+    kind: 'folder'
+  }
+] as const
+
+const ALL_WORKSPACE_IDS = [GIT_ROOT_ID, GIT_CHILD_ID, FOLDER_ROOT_ID, FOLDER_A, FOLDER_B, ALIAS_ID]
+
+type ControllerSession = {
+  id: string
+  worktreeId?: string
+  cwd?: string
+  title?: string
+  incarnationId?: string
+  terminalHandle?: string
+}
+
+type RuntimeInternals = {
+  buildResolvedWorktreeFromId: (worktreeId: string) => unknown
+  refreshPtyWorktreeRecordsWithControllerInventory: (
+    resolvedWorktrees: unknown[],
+    targetWorktreeId?: string | null
+  ) => Promise<{ livePtyIds: Set<string> } | null>
+  getLivePtyIdsForWorktree: (worktreeId: string) => Set<string>
+  hasExactPersistedTerminalSurfaceIdentity: (expected: {
+    worktreeId: string
+    tabId: string
+    leafId: string
+    ptyId: string
+    incarnationId: string
+  }) => boolean
+  ptysById: Map<string, { worktreeId: string; connected: boolean }>
+  recordPtyWorktree: (ptyId: string, worktreeId: string, state?: Record<string, unknown>) => unknown
+}
+
+function createRuntimeInternals(options: {
+  session?: WorkspaceSessionState
+  sessions?: ControllerSession[]
+}): RuntimeInternals {
+  const meta = Object.fromEntries(ALL_WORKSPACE_IDS.map((id) => [id, { hostId: 'local' }]))
+  const store = {
+    getRepos: () => REPOS,
+    getRepo: (id: string) => REPOS.find((repo) => repo.id === id),
+    getAllWorktreeMeta: () => meta,
+    getWorktreeMeta: (worktreeId: string) => meta[worktreeId],
+    setWorktreeMeta: (worktreeId: string, patch: Record<string, unknown>) => {
+      meta[worktreeId] = { ...meta[worktreeId], ...patch }
+      return meta[worktreeId]
+    },
+    getWorkspaceSession: () => options.session ?? getDefaultWorkspaceSession(),
+    setWorkspaceSession: () => {},
+    flushOrThrow: () => {}
+  } as never
+  const runtime = new OrcaRuntimeService(store)
+  runtime.setPtyController({
+    write: () => true,
+    kill: () => true,
+    stopAndWait: async () => true,
+    getForegroundProcess: async () => null,
+    listProcesses: async () => options.sessions ?? []
+  } as never)
+  return runtime as unknown as RuntimeInternals
+}
+
+function resolveWorktrees(internals: RuntimeInternals, ids: readonly string[]): unknown[] {
+  return ids.map((id) => internals.buildResolvedWorktreeFromId(id))
+}
+
+/** Persisted layout binding each folder sibling's own PTY to its own tab and leaf. */
+function persistedFolderSiblingSession(): WorkspaceSessionState {
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: {
+      [FOLDER_A]: [{ id: 'tab-a', worktreeId: FOLDER_A, title: 'A' }],
+      [FOLDER_B]: [{ id: 'tab-b', worktreeId: FOLDER_B, title: 'B' }]
+    } as never,
+    terminalLayoutsByTabId: {
+      'tab-a': { root: null, activeLeafId: LEAF_A, ptyIdsByLeafId: { [LEAF_A]: PTY_A } },
+      'tab-b': { root: null, activeLeafId: LEAF_B, ptyIdsByLeafId: { [LEAF_B]: PTY_B } }
+    } as never,
+    terminalPtyIncarnationsByPaneKey: {
+      [makePaneKey('tab-a', LEAF_A)]: 'inc-a',
+      [makePaneKey('tab-b', LEAF_B)]: 'inc-b'
+    }
+  }
+}
+
+describe('workspace namespaces keep terminal identity host-local and per-workspace', () => {
+  describe('git worktree namespace', () => {
+    it('binds a nested worktree PTY to the nested worktree, not the targeted parent', async () => {
+      // cwd alone cannot separate a parent checkout from a worktree nested inside it.
+      const internals = createRuntimeInternals({
+        sessions: [{ id: 'unattributed-pty', cwd: `${GIT_CHILD_PATH}/src`, title: 'child work' }]
+      })
+      const resolved = resolveWorktrees(internals, [GIT_ROOT_ID, GIT_CHILD_ID])
+
+      const scopedToParent = await internals.refreshPtyWorktreeRecordsWithControllerInventory(
+        resolved,
+        GIT_ROOT_ID
+      )
+      const scopedToChild = await internals.refreshPtyWorktreeRecordsWithControllerInventory(
+        resolved,
+        GIT_CHILD_ID
+      )
+
+      expect([...(scopedToParent?.livePtyIds ?? [])]).toEqual([])
+      expect([...(scopedToChild?.livePtyIds ?? [])]).toEqual(['unattributed-pty'])
+      expect(internals.ptysById.get('unattributed-pty')?.worktreeId).toBe(GIT_CHILD_ID)
+    })
+
+    it('keeps a checkout and the worktree nested inside it in separate namespaces', async () => {
+      const internals = createRuntimeInternals({
+        sessions: [
+          { id: PTY_GIT_ROOT, worktreeId: GIT_ROOT_ID, cwd: GIT_ROOT_PATH, title: 'git' },
+          { id: PTY_GIT_CHILD, worktreeId: GIT_CHILD_ID, cwd: GIT_CHILD_PATH, title: 'child' }
+        ]
+      })
+      const resolved = resolveWorktrees(internals, [GIT_ROOT_ID, GIT_CHILD_ID])
+
+      await internals.refreshPtyWorktreeRecordsWithControllerInventory(resolved)
+
+      expect(internals.ptysById.get(PTY_GIT_ROOT)?.worktreeId).toBe(GIT_ROOT_ID)
+      expect(internals.ptysById.get(PTY_GIT_CHILD)?.worktreeId).toBe(GIT_CHILD_ID)
+      expect([...internals.getLivePtyIdsForWorktree(GIT_ROOT_ID)]).toEqual([PTY_GIT_ROOT])
+      expect([...internals.getLivePtyIdsForWorktree(GIT_CHILD_ID)]).toEqual([PTY_GIT_CHILD])
+    })
+  })
+
+  describe('folder workspace namespace', () => {
+    it('does not let the caller target stand in for an attributed PTY owner', async () => {
+      const internals = createRuntimeInternals({
+        sessions: [{ id: PTY_B, worktreeId: FOLDER_B, cwd: FOLDER_PATH, title: 'b' }]
+      })
+      const resolved = resolveWorktrees(internals, [FOLDER_A, FOLDER_B])
+
+      await internals.refreshPtyWorktreeRecordsWithControllerInventory(resolved)
+      const scopedToA = await internals.refreshPtyWorktreeRecordsWithControllerInventory(
+        resolved,
+        FOLDER_A
+      )
+
+      expect([...(scopedToA?.livePtyIds ?? [])]).toEqual([])
+      expect(internals.ptysById.get(PTY_B)?.worktreeId).toBe(FOLDER_B)
+    })
+
+    it('keeps each sibling terminal bound to its own workspace across a reconnect', async () => {
+      const sessions: ControllerSession[] = [
+        {
+          id: PTY_A,
+          worktreeId: FOLDER_A,
+          cwd: FOLDER_PATH,
+          title: 'a',
+          incarnationId: 'inc-a',
+          terminalHandle: 'term_a'
+        },
+        {
+          id: PTY_B,
+          worktreeId: FOLDER_B,
+          cwd: FOLDER_PATH,
+          title: 'b',
+          incarnationId: 'inc-b',
+          terminalHandle: 'term_b'
+        }
+      ]
+      const internals = createRuntimeInternals({
+        session: persistedFolderSiblingSession(),
+        sessions
+      })
+      const resolved = resolveWorktrees(internals, [FOLDER_A, FOLDER_B])
+
+      // Reconnect resync: each workspace re-lists the same controller inventory.
+      const afterA = await internals.refreshPtyWorktreeRecordsWithControllerInventory(
+        resolved,
+        FOLDER_A
+      )
+      const afterB = await internals.refreshPtyWorktreeRecordsWithControllerInventory(
+        resolved,
+        FOLDER_B
+      )
+
+      expect([...(afterA?.livePtyIds ?? [])]).toEqual([PTY_A])
+      expect([...(afterB?.livePtyIds ?? [])]).toEqual([PTY_B])
+      expect(internals.ptysById.get(PTY_A)?.worktreeId).toBe(FOLDER_A)
+      expect(internals.ptysById.get(PTY_B)?.worktreeId).toBe(FOLDER_B)
+      expect(
+        internals.hasExactPersistedTerminalSurfaceIdentity({
+          worktreeId: FOLDER_B,
+          tabId: 'tab-b',
+          leafId: LEAF_B,
+          ptyId: PTY_B,
+          incarnationId: 'inc-b'
+        })
+      ).toBe(true)
+      // A sibling must never satisfy the other's persisted surface identity.
+      expect(
+        internals.hasExactPersistedTerminalSurfaceIdentity({
+          worktreeId: FOLDER_A,
+          tabId: 'tab-b',
+          leafId: LEAF_B,
+          ptyId: PTY_B,
+          incarnationId: 'inc-b'
+        })
+      ).toBe(false)
+    })
+
+    it('does not treat one directory as one namespace across two projects', async () => {
+      // Same directory added twice: the ids differ only by the client's repo id.
+      const internals = createRuntimeInternals({
+        sessions: [
+          { id: PTY_A, worktreeId: FOLDER_A, cwd: FOLDER_PATH, title: 'a' },
+          { id: PTY_FOLDER_ROOT, worktreeId: FOLDER_ROOT_ID, cwd: FOLDER_PATH, title: 'root' },
+          { id: PTY_ALIAS, worktreeId: ALIAS_ID, cwd: FOLDER_PATH, title: 'alias' }
+        ]
+      })
+      const resolved = resolveWorktrees(internals, [FOLDER_A, FOLDER_B, FOLDER_ROOT_ID, ALIAS_ID])
+
+      await internals.refreshPtyWorktreeRecordsWithControllerInventory(resolved)
+
+      expect(internals.ptysById.get(PTY_A)?.worktreeId).toBe(FOLDER_A)
+      expect(internals.ptysById.get(PTY_FOLDER_ROOT)?.worktreeId).toBe(FOLDER_ROOT_ID)
+      expect(internals.ptysById.get(PTY_ALIAS)?.worktreeId).toBe(ALIAS_ID)
+      expect([...internals.getLivePtyIdsForWorktree(ALIAS_ID)]).toEqual([PTY_ALIAS])
+      expect([...internals.getLivePtyIdsForWorktree(FOLDER_ROOT_ID)]).toEqual([PTY_FOLDER_ROOT])
+      expect([...internals.getLivePtyIdsForWorktree(FOLDER_A)]).toEqual([PTY_A])
+      expect([...internals.getLivePtyIdsForWorktree(FOLDER_B)]).toEqual([])
+    })
+  })
+
+  describe('floating workspace namespace', () => {
+    it('never lets a repo workspace claim a floating terminal or vice versa', async () => {
+      const internals = createRuntimeInternals({
+        sessions: [
+          {
+            id: PTY_FLOATING,
+            worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+            cwd: FOLDER_PATH,
+            title: 'floating'
+          },
+          { id: PTY_A, worktreeId: FOLDER_A, cwd: FOLDER_PATH, title: 'a' }
+        ]
+      })
+      const resolved = resolveWorktrees(internals, [FOLDER_A, FOLDER_B])
+
+      await internals.refreshPtyWorktreeRecordsWithControllerInventory(resolved)
+      const scopedToA = await internals.refreshPtyWorktreeRecordsWithControllerInventory(
+        resolved,
+        FOLDER_A
+      )
+
+      // The floating id carries no repo/path pair, so it can only equal itself.
+      expect([...(scopedToA?.livePtyIds ?? [])]).toEqual([PTY_A])
+      expect(internals.ptysById.get(PTY_FLOATING)?.worktreeId).toBe(FLOATING_TERMINAL_WORKTREE_ID)
+      expect([...internals.getLivePtyIdsForWorktree(FLOATING_TERMINAL_WORKTREE_ID)]).toEqual([
+        PTY_FLOATING
+      ])
+      expect([...internals.getLivePtyIdsForWorktree(FOLDER_A)]).toEqual([PTY_A])
+    })
+
+    it('does not resolve a floating terminal onto a workspace that shares its cwd', () => {
+      const internals = createRuntimeInternals({})
+      internals.recordPtyWorktree(PTY_FLOATING, FLOATING_TERMINAL_WORKTREE_ID, { connected: true })
+      internals.recordPtyWorktree(PTY_A, FOLDER_A, { connected: true })
+
+      expect([...internals.getLivePtyIdsForWorktree(FOLDER_ROOT_ID)]).toEqual([])
+      expect([...internals.getLivePtyIdsForWorktree(FLOATING_TERMINAL_WORKTREE_ID)]).toEqual([
+        PTY_FLOATING
+      ])
+    })
+  })
+
+  // Only the id-normalization half of the Windows namespaces is host-independent.
+  // Spawning and reconnecting a real drive/UNC PTY still needs a Windows host.
+  describe('drive-letter and UNC namespaces (id normalization only)', () => {
+    it('folds drive spelling and WSL UNC aliases but keeps distinct roots apart', () => {
+      const internals = createRuntimeInternals({})
+      internals.recordPtyWorktree('pty-c', 'repo-win::C:\\ws\\proj', { connected: true })
+      internals.recordPtyWorktree('pty-d', 'repo-win::D:\\ws\\proj', { connected: true })
+      internals.recordPtyWorktree('pty-share', 'repo-win::\\\\server\\share\\proj', {
+        connected: true
+      })
+      internals.recordPtyWorktree('pty-other-share', 'repo-win::\\\\server\\other\\proj', {
+        connected: true
+      })
+      internals.recordPtyWorktree('pty-wsl', 'repo-win::\\\\wsl$\\Ubuntu\\home\\me', {
+        connected: true
+      })
+
+      expect([...internals.getLivePtyIdsForWorktree('repo-win::c:/ws/proj')]).toEqual(['pty-c'])
+      expect([...internals.getLivePtyIdsForWorktree('repo-win::D:/ws/proj')]).toEqual(['pty-d'])
+      expect([...internals.getLivePtyIdsForWorktree('repo-win::\\\\server\\share\\proj')]).toEqual([
+        'pty-share'
+      ])
+      expect([
+        ...internals.getLivePtyIdsForWorktree('repo-win::\\\\wsl.localhost\\ubuntu\\home\\me')
+      ]).toEqual(['pty-wsl'])
+    })
+
+    it('keeps a folder workspace instance on a drive path distinct from its root', () => {
+      const driveRoot = 'repo-win::C:\\ws\\proj'
+      const driveInstance = `${driveRoot}${FOLDER_WORKSPACE_INSTANCE_SEPARATOR}dddddddd-dddd-4ddd-8ddd-dddddddddddd`
+      const internals = createRuntimeInternals({})
+      internals.recordPtyWorktree('pty-drive-root', driveRoot, { connected: true })
+      internals.recordPtyWorktree('pty-drive-instance', driveInstance, { connected: true })
+
+      expect([...internals.getLivePtyIdsForWorktree(driveRoot)]).toEqual(['pty-drive-root'])
+      expect([...internals.getLivePtyIdsForWorktree(driveInstance)]).toEqual(['pty-drive-instance'])
+    })
+  })
+})
diff --git a/src/main/runtime/workspace-session-failed-write-rollback.ts b/src/main/runtime/workspace-session-failed-write-rollback.ts
index 9460c27b6ed..f770511bb27 100644
--- a/src/main/runtime/workspace-session-failed-write-rollback.ts
+++ b/src/main/runtime/workspace-session-failed-write-rollback.ts
@@ -2,7 +2,7 @@ import { isDeepStrictEqual } from 'node:util'
 import type { WorkspaceSessionState } from '../../shared/types'
 
 const MISSING = Symbol('missing')
-type RollbackValue = unknown | typeof MISSING
+type RollbackValue = unknown
 
 function isRecord(value: RollbackValue): value is Record<string, unknown> {
   return (
diff --git a/src/main/runtime/workspace-session-terminal-membership-authority.ts b/src/main/runtime/workspace-session-terminal-membership-authority.ts
index 9dace4c8cb1..9509f14eb26 100644
--- a/src/main/runtime/workspace-session-terminal-membership-authority.ts
+++ b/src/main/runtime/workspace-session-terminal-membership-authority.ts
@@ -161,6 +161,30 @@ export function advanceTerminalTopologyRevision(
   }
 }
 
+/**
+ * The tab whose live layout holds this leaf. Only the leaf half of a pane key is stable — breaking
+ * a pane out into its own tab moves the leaf and leaves any stored tabId naming the tab it left.
+ */
+export function findTerminalTabIdForLeaf(
+  session: WorkspaceSessionState | undefined,
+  leafId: string
+): string | undefined {
+  // Only a still-existing tab counts: a layout entry outlives its tab, and binding a live shell to
+  // a deleted one registers a pane under a ghost. Scanned across worktrees rather than under one
+  // key so the answer cannot hinge on a worktreeId matching exactly (`::workspace:` suffixes).
+  const liveTabIds = new Set(
+    Object.values(session?.tabsByWorktree ?? {}).flatMap((tabs) => tabs.map((tab) => tab.id))
+  )
+  for (const [tabId, layout] of Object.entries(session?.terminalLayoutsByTabId ?? {})) {
+    const leafIds = new Set<string>()
+    collectLeafIds(layout.root, leafIds)
+    if (liveTabIds.has(tabId) && leafIds.has(leafId)) {
+      return tabId
+    }
+  }
+  return undefined
+}
+
 export function hasHostAuthoritativeTerminalMembership(
   session: WorkspaceSessionState | undefined,
   worktreeId: string
diff --git a/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts b/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts
new file mode 100644
index 00000000000..05c0fe9cd6f
--- /dev/null
+++ b/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts
@@ -0,0 +1,326 @@
+// The fingerprint's own behaviour is covered against real Git in repo-worktree-admin-fingerprint.test.ts.
+// This suite pins the cache wiring: when the probe may skip a `git worktree list`, and when it may not.
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const electronMocks = vi.hoisted(() => {
+  const ipcMain = {
+    on: vi.fn(() => ipcMain),
+    removeListener: vi.fn(() => ipcMain),
+    emit: vi.fn(() => true)
+  }
+  return {
+    BrowserWindow: { fromId: vi.fn((): unknown => null) },
+    webContents: { fromId: vi.fn((): unknown => null) },
+    ipcMain,
+    app: { getPath: vi.fn(() => '/tmp'), isPackaged: false }
+  }
+})
+vi.mock('electron', () => electronMocks)
+
+const getSshGitProviderMock = vi.hoisted(() => vi.fn())
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  getSshGitProvider: getSshGitProviderMock,
+  getSshGitProviderGeneration: vi.fn(() => 0),
+  SSH_GIT_PROVIDER_UNAVAILABLE_MESSAGE: 'unavailable',
+  requireSshGitProvider: (connectionId: string) => getSshGitProviderMock(connectionId)
+}))
+
+const listWorktreesStrictMock = vi.hoisted(() => vi.fn())
+vi.mock('../git/worktree', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  listWorktreesStrict: listWorktreesStrictMock
+}))
+
+const readRepoWorktreeAdminFingerprintMock = vi.hoisted(() => vi.fn())
+vi.mock('./repo-worktree-admin-fingerprint', () => ({
+  readRepoWorktreeAdminFingerprint: readRepoWorktreeAdminFingerprintMock
+}))
+
+import { OrcaRuntimeService, WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS } from './orca-runtime'
+
+const REPO_ID = 'repo-local'
+const REPO_PATH = '/Users/me/dev/app'
+const WORKTREE_PATH = '/Users/me/dev/app-feature'
+const WORKTREE_ID = `${REPO_ID}::${WORKTREE_PATH}`
+const MAIN_WORKTREE_ID = `${REPO_ID}::${REPO_PATH}`
+const SCAN_TTL_MS = 30_000
+
+function makeMeta(overrides: Record<string, unknown> = {}) {
+  return {
+    displayName: 'feature',
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    linkedGitLabMR: null,
+    linkedGitLabIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    ...overrides
+  }
+}
+
+function makeStore(options: { connectionId?: string; repoCount?: number; repoPath?: string } = {}) {
+  const metaById: Record<string, ReturnType<typeof makeMeta>> = {
+    [WORKTREE_ID]: makeMeta(),
+    [MAIN_WORKTREE_ID]: makeMeta({ displayName: 'main' })
+  }
+  const basePath = options.repoPath ?? REPO_PATH
+  const repos = Array.from({ length: options.repoCount ?? 1 }, (_unused, index) => ({
+    id: index === 0 ? REPO_ID : `${REPO_ID}-${index}`,
+    path: index === 0 ? basePath : `${basePath}-${index}`,
+    displayName: 'app',
+    badgeColor: 'blue',
+    addedAt: 1,
+    ...(options.connectionId === undefined ? {} : { connectionId: options.connectionId })
+  }))
+  const store = {
+    getRepo: (id: string) => store.getRepos().find((repo) => repo.id === id),
+    getRepos: () => repos,
+    getAllWorktreeMeta: () => metaById,
+    getWorktreeMeta: (id: string) => metaById[id],
+    setWorktreeMeta: (id: string, meta: Record<string, unknown>) => {
+      metaById[id] = { ...(metaById[id] ?? makeMeta()), ...meta } as never
+      return metaById[id]
+    },
+    removeWorktreeMeta: () => {},
+    getAllWorktreeLineage: () => ({}),
+    getAllWorkspaceLineage: () => ({}),
+    removeWorktreeLineage: vi.fn(),
+    removeWorkspaceLineage: vi.fn(),
+    getGitHubCache: () => undefined as never,
+    getSettings: () => ({
+      workspaceDir: '/tmp/workspaces',
+      nestWorkspaces: false,
+      refreshLocalBaseRefOnWorktreeCreate: false,
+      branchPrefix: 'none',
+      branchPrefixCustom: ''
+    }),
+    getProjects: () => []
+  }
+  return store
+}
+
+type RuntimeInternals = { listResolvedWorktrees: () => Promise<unknown> }
+
+function makeRuntime(
+  options: { connectionId?: string; repoCount?: number; repoPath?: string } = {}
+): {
+  runtime: OrcaRuntimeService
+  list: () => Promise<unknown>
+} {
+  const runtime = new OrcaRuntimeService(makeStore(options) as never)
+  return {
+    runtime,
+    list: () => (runtime as unknown as RuntimeInternals).listResolvedWorktrees()
+  }
+}
+
+function scanCount(): number {
+  return listWorktreesStrictMock.mock.calls.length
+}
+
+describe('worktree scan admin-fingerprint gate', () => {
+  beforeEach(() => {
+    getSshGitProviderMock.mockReset()
+    listWorktreesStrictMock.mockReset()
+    listWorktreesStrictMock.mockResolvedValue([
+      { path: REPO_PATH, head: 'abc', branch: 'main', isBare: false, isMainWorktree: true },
+      { path: WORKTREE_PATH, head: 'def', branch: 'feature', isBare: false, isMainWorktree: false }
+    ])
+    readRepoWorktreeAdminFingerprintMock.mockReset()
+    readRepoWorktreeAdminFingerprintMock.mockResolvedValue('fp-1')
+  })
+
+  it('skips the Git scan past the TTL while the admin fingerprint is unchanged', async () => {
+    vi.useFakeTimers()
+    try {
+      const { list } = makeRuntime()
+
+      await list()
+      expect(scanCount()).toBe(1)
+
+      vi.advanceTimersByTime(SCAN_TTL_MS + 1_000)
+      await list()
+      expect(scanCount()).toBe(1)
+
+      // The suppressed read must still re-arm the TTL rather than probing on every poll.
+      vi.advanceTimersByTime(1_000)
+      await list()
+      expect(scanCount()).toBe(1)
+      expect(readRepoWorktreeAdminFingerprintMock).toHaveBeenCalledTimes(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('rescans at the TTL once the admin fingerprint changes', async () => {
+    vi.useFakeTimers()
+    try {
+      const { list } = makeRuntime()
+
+      await list()
+      expect(scanCount()).toBe(1)
+
+      readRepoWorktreeAdminFingerprintMock.mockResolvedValue('fp-2')
+      vi.advanceTimersByTime(SCAN_TTL_MS + 1_000)
+      await list()
+      expect(scanCount()).toBe(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('reconciles with a real scan once the bounded interval elapses', async () => {
+    vi.useFakeTimers()
+    try {
+      const { list } = makeRuntime()
+
+      await list()
+      expect(scanCount()).toBe(1)
+
+      // Keep polling past the TTL with an unchanged fingerprint; only the reconcile deadline rescans.
+      for (
+        let elapsed = 31_000;
+        elapsed < WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS;
+        elapsed += 31_000
+      ) {
+        vi.advanceTimersByTime(31_000)
+        await list()
+      }
+      expect(scanCount()).toBe(1)
+
+      vi.advanceTimersByTime(WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS)
+      await list()
+      expect(scanCount()).toBe(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('still rescans immediately when an event invalidates the repo', async () => {
+    vi.useFakeTimers()
+    try {
+      const { runtime, list } = makeRuntime()
+
+      await list()
+      expect(scanCount()).toBe(1)
+
+      runtime.notifyBranchRenamed(REPO_ID)
+      await list()
+      expect(scanCount()).toBe(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('scans when the probe cannot describe the repo', async () => {
+    vi.useFakeTimers()
+    try {
+      readRepoWorktreeAdminFingerprintMock.mockResolvedValue(null)
+      const { list } = makeRuntime()
+
+      await list()
+      vi.advanceTimersByTime(SCAN_TTL_MS + 1_000)
+      await list()
+
+      expect(scanCount()).toBe(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('never probes a repo whose scan TTL already reaches the reconcile interval', async () => {
+    // Agent-scratch roots carry a 5-minute TTL, so a fingerprint could never be reused. Reading one
+    // would be pure work on a polling path.
+    vi.useFakeTimers()
+    try {
+      const { list } = makeRuntime({ repoPath: '/tmp/.codex-tmp/capsule-a' })
+
+      await list()
+      vi.advanceTimersByTime(WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS + 1_000)
+      await list()
+
+      expect(scanCount()).toBe(2)
+      expect(readRepoWorktreeAdminFingerprintMock).not.toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('never consults the probe for SSH repos', async () => {
+    vi.useFakeTimers()
+    try {
+      const listWorktrees = vi.fn(async () => [
+        { path: REPO_PATH, head: 'abc', branch: 'main', isBare: false, isMainWorktree: true }
+      ])
+      getSshGitProviderMock.mockReturnValue({ listWorktrees })
+      const { list } = makeRuntime({ connectionId: 'ssh-remote-1' })
+
+      await list()
+      vi.advanceTimersByTime(SCAN_TTL_MS + 1_000)
+      await list()
+
+      expect(listWorktrees).toHaveBeenCalledTimes(2)
+      expect(readRepoWorktreeAdminFingerprintMock).not.toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not extend a failed scan on an unchanged fingerprint', async () => {
+    vi.useFakeTimers()
+    try {
+      listWorktreesStrictMock.mockRejectedValue(new Error('git unavailable'))
+      const { list } = makeRuntime()
+
+      await list()
+      expect(scanCount()).toBe(1)
+
+      vi.advanceTimersByTime(SCAN_TTL_MS + 1_000)
+      await list()
+      expect(scanCount()).toBe(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('bounds Git fan-out under a sustained 1 Hz polling workload', async () => {
+    // Reproduces the reported steady state: 10 idle repos, a caller polling faster than the
+    // resolved-snapshot TTL. Before the gate this cost one `git worktree list` per repo per 30 s.
+    vi.useFakeTimers()
+    try {
+      const REPOS = 10
+      const POLL_SECONDS = 30 * 60
+      const { list } = makeRuntime({ repoCount: REPOS })
+
+      for (let second = 0; second < POLL_SECONDS; second += 1) {
+        await list()
+        vi.advanceTimersByTime(1_000)
+      }
+
+      // One scan per repo per cache refresh: the TTL alone would refresh 60x per repo, the
+      // reconcile deadline refreshes 6x. 600 -> 60 `git worktree list` spawns per half hour.
+      const ttlOnlyScans = (REPOS * POLL_SECONDS * 1_000) / SCAN_TTL_MS
+      const reconcileScans =
+        (REPOS * POLL_SECONDS * 1_000) / WORKTREE_SCAN_ADMIN_RECONCILE_INTERVAL_MS
+      expect(ttlOnlyScans).toBe(600)
+      expect(reconcileScans).toBe(60)
+      expect(scanCount()).toBe(reconcileScans)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('shares one probe and one scan across concurrent callers', async () => {
+    const { list } = makeRuntime()
+
+    await Promise.all([list(), list(), list()])
+
+    expect(scanCount()).toBe(1)
+    expect(readRepoWorktreeAdminFingerprintMock).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/shell-prompt-readiness-probe.test.ts b/src/main/shell-prompt-readiness-probe.test.ts
new file mode 100644
index 00000000000..c2c783953ac
--- /dev/null
+++ b/src/main/shell-prompt-readiness-probe.test.ts
@@ -0,0 +1,227 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const lineEditorProbe = vi.hoisted(() => vi.fn())
+const processReadinessProbe = vi.hoisted(() => vi.fn())
+const resolveExecutablePath = vi.hoisted(() => vi.fn((value: string) => Promise.resolve(value)))
+vi.mock('../shared/pty-slave-line-discipline-echo', () => ({
+  createPtySlaveLineEditorProbe: () => lineEditorProbe
+}))
+vi.mock('../shared/shell-process-readiness', () => ({
+  readShellProcessReadiness: processReadinessProbe,
+  resolveShellExecutablePath: resolveExecutablePath
+}))
+
+import { createShellPromptReadinessProbe } from './shell-prompt-readiness-probe'
+
+describe('shell prompt readiness probe', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    lineEditorProbe.mockReset()
+    processReadinessProbe.mockReset()
+    resolveExecutablePath.mockClear()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('accepts only the identified shell pid in line-editor mode and foreground', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({ executablePath: '/bin/zsh', foreground: true })
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(onPromptReady).toHaveBeenCalledOnce()
+  })
+
+  it('preserves an unset child PATH for executable resolution', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({ executablePath: '/bin/zsh', foreground: true })
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(resolveExecutablePath).toHaveBeenCalledWith('/bin/zsh', process.cwd(), undefined)
+  })
+
+  it.each([
+    ['silent read', 'other', { executablePath: '/bin/zsh', foreground: true }],
+    ['background shell', 'line-editor', { executablePath: '/bin/zsh', foreground: false }],
+    ['different foreground process', 'line-editor', null],
+    [
+      'non-shell replacement image',
+      'line-editor',
+      { executablePath: '/usr/bin/sqlite3', foreground: true }
+    ],
+    [
+      'non-shell image with the shell basename',
+      'line-editor',
+      { executablePath: '/tmp/zsh', foreground: true }
+    ]
+  ])('rejects %s', async (_name, terminalState, rows) => {
+    lineEditorProbe.mockResolvedValue(terminalState)
+    processReadinessProbe.mockResolvedValue(rows)
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(onPromptReady).not.toHaveBeenCalled()
+    if (terminalState === 'other') {
+      expect(processReadinessProbe).not.toHaveBeenCalled()
+    }
+  })
+
+  it('does no external work when the ready marker cancels the settle window', async () => {
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    probe?.dispose()
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(lineEditorProbe).not.toHaveBeenCalled()
+    expect(processReadinessProbe).not.toHaveBeenCalled()
+  })
+
+  it('invalidates an in-flight result when newer output arrives', async () => {
+    const pending: { resolve?: (value: string) => void } = {}
+    lineEditorProbe.mockImplementation(
+      () => new Promise((resolve) => (pending.resolve = resolve as (value: string) => void))
+    )
+    processReadinessProbe.mockResolvedValue({ executablePath: '/bin/zsh', foreground: true })
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+    probe?.notifyOutput('\x1b[?2004h')
+    pending.resolve?.('line-editor')
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onPromptReady).not.toHaveBeenCalled()
+    expect(processReadinessProbe).not.toHaveBeenCalled()
+  })
+
+  it('does not inspect a process after disposal during a line-editor probe', async () => {
+    const pending: { resolve?: (value: string) => void } = {}
+    lineEditorProbe.mockImplementation(
+      () => new Promise((resolve) => (pending.resolve = resolve as (value: string) => void))
+    )
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+    probe?.dispose()
+    pending.resolve?.('line-editor')
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(processReadinessProbe).not.toHaveBeenCalled()
+  })
+
+  it('invalidates process readiness that resolves after disposal', async () => {
+    const pending: { resolve?: (value: { executablePath: string; foreground: boolean }) => void } =
+      {}
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockImplementation(
+      () => new Promise((resolve) => (pending.resolve = resolve))
+    )
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+    probe?.dispose()
+    pending.resolve?.({ executablePath: '/bin/zsh', foreground: true })
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onPromptReady).not.toHaveBeenCalled()
+  })
+
+  it('ignores slow startup output until the line editor enables its protocol', async () => {
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    for (let index = 0; index < 20; index += 1) {
+      probe?.notifyOutput(`startup ${index}\n`)
+      await vi.advanceTimersByTimeAsync(20)
+    }
+
+    expect(lineEditorProbe).not.toHaveBeenCalled()
+    expect(processReadinessProbe).not.toHaveBeenCalled()
+  })
+
+  it('bounds rejected line-editor retries', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({
+      executablePath: '/usr/bin/sqlite3',
+      foreground: true
+    })
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    for (let index = 0; index < 10; index += 1) {
+      probe?.notifyOutput('\x1b[?2004h')
+      await vi.advanceTimersByTimeAsync(10)
+    }
+
+    expect(lineEditorProbe).toHaveBeenCalledTimes(4)
+    expect(processReadinessProbe).toHaveBeenCalledTimes(4)
+  })
+})
diff --git a/src/main/shell-prompt-readiness-probe.ts b/src/main/shell-prompt-readiness-probe.ts
new file mode 100644
index 00000000000..11583fd2de7
--- /dev/null
+++ b/src/main/shell-prompt-readiness-probe.ts
@@ -0,0 +1,107 @@
+import { createPtySlaveLineEditorProbe } from '../shared/pty-slave-line-discipline-echo'
+import {
+  readShellProcessReadiness,
+  resolveShellExecutablePath
+} from '../shared/shell-process-readiness'
+import {
+  createLineEditorReadyOutputScanState,
+  scanForLineEditorReadyOutput
+} from './line-editor-ready-output-scanner'
+import { basename } from 'node:path'
+
+export const SHELL_PROMPT_PROBE_SETTLE_MS = 50
+export const MAX_SHELL_PROMPT_PROBES = 4
+
+export type ShellPromptReadinessProbe = {
+  notifyOutput(data: string): void
+  dispose(): void
+}
+
+export function createShellPromptReadinessProbe(options: {
+  slavePath: string | undefined
+  getShellPid: () => number | null
+  shellPath: string | undefined
+  shellCwd?: string
+  shellPathEnv?: string
+  onPromptReady: () => void
+  settleMs?: number
+}): ShellPromptReadinessProbe | null {
+  const lineEditorProbe = createPtySlaveLineEditorProbe(options.slavePath)
+  if (!lineEditorProbe) {
+    return null
+  }
+  const settleMs = options.settleMs ?? SHELL_PROMPT_PROBE_SETTLE_MS
+  const expectedShellName = options.shellPath ? basename(options.shellPath).toLowerCase() : null
+  const outputScanState = createLineEditorReadyOutputScanState()
+  let disposed = false
+  let timer: ReturnType<typeof setTimeout> | null = null
+  let generation = 0
+  let probesStarted = 0
+
+  const probe = async (scheduledGeneration: number): Promise<void> => {
+    if (disposed || scheduledGeneration !== generation) {
+      return
+    }
+    const shellPid = options.getShellPid()
+    if (!shellPid || (await lineEditorProbe()) !== 'line-editor') {
+      return
+    }
+    if (disposed || scheduledGeneration !== generation) {
+      return
+    }
+    const [shell, expectedPath] = await Promise.all([
+      readShellProcessReadiness(shellPid),
+      options.shellPath
+        ? resolveShellExecutablePath(
+            options.shellPath,
+            options.shellCwd ?? process.cwd(),
+            options.shellPathEnv
+          )
+        : Promise.resolve(null)
+    ])
+    if (disposed || scheduledGeneration !== generation) {
+      return
+    }
+    if (
+      !shell?.foreground ||
+      !expectedShellName ||
+      !expectedPath ||
+      basename(shell.executablePath).toLowerCase() !== expectedShellName ||
+      shell.executablePath !== expectedPath
+    ) {
+      return
+    }
+    disposed = true
+    options.onPromptReady()
+  }
+
+  return {
+    notifyOutput(data: string): void {
+      if (
+        disposed ||
+        probesStarted >= MAX_SHELL_PROMPT_PROBES ||
+        !scanForLineEditorReadyOutput(outputScanState, data)
+      ) {
+        return
+      }
+      generation += 1
+      const scheduledGeneration = generation
+      if (timer) {
+        clearTimeout(timer)
+      }
+      timer = setTimeout(() => {
+        timer = null
+        probesStarted += 1
+        void probe(scheduledGeneration).catch(() => {})
+      }, settleMs)
+    },
+    dispose(): void {
+      disposed = true
+      generation += 1
+      if (timer) {
+        clearTimeout(timer)
+        timer = null
+      }
+    }
+  }
+}
diff --git a/src/main/shell-ready-marker-scanner.ts b/src/main/shell-ready-marker-scanner.ts
index 0e6250e1c4e..a8b58499852 100644
--- a/src/main/shell-ready-marker-scanner.ts
+++ b/src/main/shell-ready-marker-scanner.ts
@@ -11,6 +11,10 @@ export type ShellReadyScanResult = {
   postMarkerBytesObserved: boolean
 }
 
+type ShellReadyBoundaryScanResult = ShellReadyScanResult & {
+  postMarkerOutputIndex: number | null
+}
+
 export function createShellReadyScanState(): ShellReadyScanState {
   return { matchPos: 0, heldBytes: '' }
 }
@@ -22,7 +26,10 @@ export function drainShellReadyHeldBytes(state: ShellReadyScanState): string {
   return heldBytes
 }
 
-export function scanForShellReady(state: ShellReadyScanState, data: string): ShellReadyScanResult {
+export function scanForShellReadyBoundary(
+  state: ShellReadyScanState,
+  data: string
+): ShellReadyBoundaryScanResult {
   let output = ''
 
   for (let i = 0; i < data.length; i += 1) {
@@ -49,7 +56,8 @@ export function scanForShellReady(state: ShellReadyScanState, data: string): She
       return {
         output: output + remaining,
         matched: true,
-        postMarkerBytesObserved: remaining.length > 0
+        postMarkerBytesObserved: remaining.length > 0,
+        postMarkerOutputIndex: output.length
       }
     } else {
       output += state.heldBytes
@@ -64,5 +72,15 @@ export function scanForShellReady(state: ShellReadyScanState, data: string): She
     }
   }
 
-  return { output, matched: false, postMarkerBytesObserved: false }
+  return {
+    output,
+    matched: false,
+    postMarkerBytesObserved: false,
+    postMarkerOutputIndex: null
+  }
+}
+
+export function scanForShellReady(state: ShellReadyScanState, data: string): ShellReadyScanResult {
+  const { postMarkerOutputIndex: _, ...result } = scanForShellReadyBoundary(state, data)
+  return result
 }
diff --git a/src/main/shell-startup-identity-scanner.test.ts b/src/main/shell-startup-identity-scanner.test.ts
new file mode 100644
index 00000000000..2b1607c23e6
--- /dev/null
+++ b/src/main/shell-startup-identity-scanner.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createShellStartupIdentityScanState,
+  drainShellStartupIdentityHeldBytes,
+  scanForShellStartupIdentity
+} from './shell-startup-identity-scanner'
+
+describe('shell startup identity scanner', () => {
+  it('strips a split identity marker and returns its shell pid', () => {
+    const state = createShellStartupIdentityScanState()
+    expect(scanForShellStartupIdentity(state, 'before\x1b]777;orca-shell-st')).toEqual({
+      output: 'before',
+      shellPid: null
+    })
+    expect(scanForShellStartupIdentity(state, 'art:12345\x07after')).toEqual({
+      output: 'after',
+      shellPid: 12345
+    })
+  })
+
+  it('forwards lookalikes unchanged', () => {
+    const state = createShellStartupIdentityScanState()
+    const input = 'a\x1b]777;orca-shell-start:nope\x07b'
+    expect(scanForShellStartupIdentity(state, input)).toEqual({ output: input, shellPid: null })
+  })
+
+  it('forwards an unrelated OSC ending in digits', () => {
+    const state = createShellStartupIdentityScanState()
+    const input = '\x1b]1337;remote-session:12345'
+    expect(scanForShellStartupIdentity(state, input)).toEqual({ output: input, shellPid: null })
+    expect(state.heldBytes).toBe('')
+  })
+
+  it('releases an incomplete marker on teardown', () => {
+    const state = createShellStartupIdentityScanState()
+    scanForShellStartupIdentity(state, '\x1b]777;orca-shell-start:12')
+    expect(drainShellStartupIdentityHeldBytes(state)).toBe('\x1b]777;orca-shell-start:12')
+  })
+
+  it('does not retain an unbounded digit stream', () => {
+    const state = createShellStartupIdentityScanState()
+    const input = `\x1b]777;orca-shell-start:${'1'.repeat(100)}`
+    expect(scanForShellStartupIdentity(state, input).output).toBe(input)
+    expect(state.heldBytes).toBe('')
+  })
+})
diff --git a/src/main/shell-startup-identity-scanner.ts b/src/main/shell-startup-identity-scanner.ts
new file mode 100644
index 00000000000..234b69e6bbf
--- /dev/null
+++ b/src/main/shell-startup-identity-scanner.ts
@@ -0,0 +1,72 @@
+export const SHELL_STARTUP_IDENTITY_PREFIX = '\x1b]777;orca-shell-start:'
+const POSSIBLE_PID_SUFFIX = /^\d{0,20}$/
+
+export type ShellStartupIdentityScanState = {
+  heldBytes: string
+}
+
+export type ShellStartupIdentityScanResult = {
+  output: string
+  shellPid: number | null
+}
+
+export function createShellStartupIdentityScanState(): ShellStartupIdentityScanState {
+  return { heldBytes: '' }
+}
+
+export function drainShellStartupIdentityHeldBytes(state: ShellStartupIdentityScanState): string {
+  const heldBytes = state.heldBytes
+  state.heldBytes = ''
+  return heldBytes
+}
+
+function isPossibleMarker(candidate: string): boolean {
+  if (candidate.length <= SHELL_STARTUP_IDENTITY_PREFIX.length) {
+    return SHELL_STARTUP_IDENTITY_PREFIX.startsWith(candidate)
+  }
+  if (!candidate.startsWith(SHELL_STARTUP_IDENTITY_PREFIX)) {
+    return false
+  }
+  const suffix = candidate.slice(SHELL_STARTUP_IDENTITY_PREFIX.length)
+  return POSSIBLE_PID_SUFFIX.test(suffix)
+}
+
+export function scanForShellStartupIdentity(
+  state: ShellStartupIdentityScanState,
+  data: string
+): ShellStartupIdentityScanResult {
+  let pending = state.heldBytes + data
+  let output = ''
+  state.heldBytes = ''
+
+  while (pending.length > 0) {
+    const start = pending.indexOf(SHELL_STARTUP_IDENTITY_PREFIX[0] as string)
+    if (start === -1) {
+      output += pending
+      break
+    }
+    output += pending.slice(0, start)
+    const candidate = pending.slice(start)
+    if (isPossibleMarker(candidate)) {
+      state.heldBytes = candidate
+      break
+    }
+    if (candidate.startsWith(SHELL_STARTUP_IDENTITY_PREFIX)) {
+      const suffix = candidate.slice(SHELL_STARTUP_IDENTITY_PREFIX.length)
+      const terminator = suffix.indexOf('\x07')
+      const pidText = terminator === -1 ? '' : suffix.slice(0, terminator)
+      if (/^\d+$/.test(pidText)) {
+        const shellPid = Number(pidText)
+        const markerLength = SHELL_STARTUP_IDENTITY_PREFIX.length + terminator + 1
+        return {
+          output: output + candidate.slice(markerLength),
+          shellPid: Number.isSafeInteger(shellPid) && shellPid > 0 ? shellPid : null
+        }
+      }
+    }
+    output += candidate[0]
+    pending = candidate.slice(1)
+  }
+
+  return { output, shellPid: null }
+}
diff --git a/src/main/shell-startup-output-scanner.test.ts b/src/main/shell-startup-output-scanner.test.ts
new file mode 100644
index 00000000000..1a0930b9395
--- /dev/null
+++ b/src/main/shell-startup-output-scanner.test.ts
@@ -0,0 +1,121 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createShellStartupOutputScanState,
+  drainShellStartupOutputScanState,
+  scanShellStartupOutput
+} from './shell-startup-output-scanner'
+
+const READY_MARKER = '\x1b]777;orca-shell-ready\x07'
+const IDENTITY_MARKER = '\x1b]777;orca-shell-start:12345\x07'
+
+function scanChunks(chunks: string[]): {
+  output: string
+  shellPid: number | null
+  ready: boolean
+  postMarkerBytesObserved: boolean
+} {
+  const state = createShellStartupOutputScanState()
+  let output = ''
+  let shellPid: number | null = null
+  let ready = false
+  let postMarkerBytesObserved = false
+
+  for (const chunk of chunks) {
+    const scanned = scanShellStartupOutput(state, chunk)
+    output += scanned.output
+    shellPid ??= scanned.shellPid
+    ready ||= scanned.ready
+    postMarkerBytesObserved ||= scanned.postMarkerBytesObserved
+  }
+  return { output, shellPid, ready, postMarkerBytesObserved }
+}
+
+function expectEverySplitToProduce(
+  input: string,
+  expected: Omit<ReturnType<typeof scanChunks>, 'postMarkerBytesObserved'>
+): void {
+  for (let split = 0; split <= input.length; split += 1) {
+    const { postMarkerBytesObserved: _, ...scanned } = scanChunks([
+      input.slice(0, split),
+      input.slice(split)
+    ])
+    expect(scanned, `split ${split}`).toEqual(expected)
+  }
+}
+
+describe('shell startup output scanner', () => {
+  it.each([
+    ['after the ready marker', [READY_MARKER, '\x1b[?2004hfish> ']],
+    ['after the ESC introducer', [`${READY_MARKER}\x1b`, '[?2004hfish> ']]
+  ])('preserves Fish output split %s', (_boundary, chunks) => {
+    const state = createShellStartupOutputScanState()
+    let output = ''
+
+    for (const chunk of chunks) {
+      output += scanShellStartupOutput(state, chunk).output
+    }
+
+    expect(output).toBe('\x1b[?2004hfish> ')
+  })
+
+  it('preserves every post-ready byte at every chunk boundary', () => {
+    expectEverySplitToProduce(`${READY_MARKER}${IDENTITY_MARKER}prompt`, {
+      output: `${IDENTITY_MARKER}prompt`,
+      shellPid: null,
+      ready: true
+    })
+    expectEverySplitToProduce(`${READY_MARKER}\x1b[?2004hfish> `, {
+      output: '\x1b[?2004hfish> ',
+      shellPid: null,
+      ready: true
+    })
+  })
+
+  it('strips pre-ready markers at every chunk boundary', () => {
+    expectEverySplitToProduce(`${IDENTITY_MARKER}${READY_MARKER}prompt`, {
+      output: 'prompt',
+      shellPid: 12345,
+      ready: true
+    })
+  })
+
+  it('strips identity and readiness markers from one chunk', () => {
+    const state = createShellStartupOutputScanState()
+    const scanned = scanShellStartupOutput(state, `${IDENTITY_MARKER}${READY_MARKER}prompt`)
+
+    expect(scanned).toEqual({
+      output: 'prompt',
+      shellPid: 12345,
+      ready: true,
+      postMarkerBytesObserved: true
+    })
+  })
+
+  it('counts an identity-held byte as post-marker output', () => {
+    const state = createShellStartupOutputScanState()
+
+    expect(scanShellStartupOutput(state, `${READY_MARKER}\x1b`)).toEqual({
+      output: '\x1b',
+      shellPid: null,
+      ready: true,
+      postMarkerBytesObserved: true
+    })
+  })
+
+  it('drains every incomplete scanner prefix in byte order', () => {
+    const state = createShellStartupOutputScanState()
+    expect(scanShellStartupOutput(state, '\x1b]777;orca-shell-st').output).toBe('')
+
+    expect(drainShellStartupOutputScanState(state)).toBe('\x1b]777;orca-shell-st')
+  })
+
+  it('drains simultaneous identity and readiness prefixes in input order', () => {
+    const state = createShellStartupOutputScanState()
+    expect(scanShellStartupOutput(state, '\x1b]777;orca-shell-st').output).toBe('')
+    expect(scanShellStartupOutput(state, '\x1b]777;orca-shell-rea').output).toBe('')
+
+    expect(drainShellStartupOutputScanState(state)).toBe(
+      '\x1b]777;orca-shell-st\x1b]777;orca-shell-rea'
+    )
+  })
+})
diff --git a/src/main/shell-startup-output-scanner.ts b/src/main/shell-startup-output-scanner.ts
new file mode 100644
index 00000000000..b87626c24eb
--- /dev/null
+++ b/src/main/shell-startup-output-scanner.ts
@@ -0,0 +1,68 @@
+import {
+  createShellReadyScanState,
+  drainShellReadyHeldBytes,
+  scanForShellReadyBoundary,
+  type ShellReadyScanState
+} from './shell-ready-marker-scanner'
+import {
+  createShellStartupIdentityScanState,
+  drainShellStartupIdentityHeldBytes,
+  scanForShellStartupIdentity,
+  type ShellStartupIdentityScanState
+} from './shell-startup-identity-scanner'
+
+export type ShellStartupOutputScanState = {
+  ready: ShellReadyScanState
+  identity: ShellStartupIdentityScanState | null
+}
+
+export type ShellStartupOutputScanResult = {
+  output: string
+  shellPid: number | null
+  ready: boolean
+  postMarkerBytesObserved: boolean
+}
+
+export function createShellStartupOutputScanState(): ShellStartupOutputScanState {
+  return {
+    ready: createShellReadyScanState(),
+    identity: createShellStartupIdentityScanState()
+  }
+}
+
+export function scanShellStartupOutput(
+  state: ShellStartupOutputScanState,
+  data: string
+): ShellStartupOutputScanResult {
+  const readiness = scanForShellReadyBoundary(state.ready, data)
+  const postMarkerOutputIndex = readiness.postMarkerOutputIndex ?? readiness.output.length
+  const identityInput = readiness.output.slice(0, postMarkerOutputIndex)
+  let shellPid: number | null = null
+  let output = identityInput
+  if (state.identity) {
+    const identity = scanForShellStartupIdentity(state.identity, identityInput)
+    output = identity.output
+    shellPid = identity.shellPid
+    if (shellPid) {
+      state.identity = null
+    }
+  }
+
+  if (readiness.matched && state.identity) {
+    output += drainShellStartupIdentityHeldBytes(state.identity)
+    state.identity = null
+  }
+  output += readiness.output.slice(postMarkerOutputIndex)
+  return {
+    output,
+    shellPid,
+    ready: readiness.matched,
+    postMarkerBytesObserved: readiness.postMarkerBytesObserved
+  }
+}
+
+export function drainShellStartupOutputScanState(state: ShellStartupOutputScanState): string {
+  const output = state.identity ? drainShellStartupIdentityHeldBytes(state.identity) : ''
+  state.identity = null
+  return output + drainShellReadyHeldBytes(state.ready)
+}
diff --git a/src/main/shell-templates.ts b/src/main/shell-templates.ts
index e6372979069..5b481217d90 100644
--- a/src/main/shell-templates.ts
+++ b/src/main/shell-templates.ts
@@ -5,11 +5,17 @@ function quotePosixSingle(value: string): string {
   return `'${value.replace(/'/g, `'\\''`)}'`
 }
 
+export const SHELL_STARTUP_IDENTITY_MARKER_BLOCK = `if [[ "\${ORCA_SHELL_STARTUP_IDENTITY:-0}" == "1" ]]; then
+  unset ORCA_SHELL_STARTUP_IDENTITY
+  printf "\\033]777;orca-shell-start:%s\\007" "$$"
+fi`
+
 export function getZshEnvTemplate(zshDir: string, headerPrefix = ''): string {
   const header = headerPrefix
     ? `Orca ${headerPrefix} zsh shell-ready wrapper`
     : 'Orca zsh shell-ready wrapper'
   return `# ${header}
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 # Why: capture the runtime wrapper dir before it is unset below. On WSL this
 # file is generated with a Windows path but sourced via /mnt/c, so the baked
 # literal is unusable there and ZDOTDIR must be restored from this value.
diff --git a/src/main/skills/discovery.test.ts b/src/main/skills/discovery.test.ts
index 9f94e9f8347..55dcb55ed36 100644
--- a/src/main/skills/discovery.test.ts
+++ b/src/main/skills/discovery.test.ts
@@ -1,8 +1,8 @@
 import { mkdtemp, mkdir, symlink, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-import { buildSkillDiscoverySources, discoverSkills } from './discovery'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { buildSkillDiscoverySources, clearSkillRootScanCache, discoverSkills } from './discovery'
 import { TUI_AGENT_CONFIG } from '../../shared/tui-agent-config'
 import type { Repo } from '../../shared/types'
 
@@ -18,6 +18,12 @@ function makeRepo(path: string, connectionId: string | null = null): Repo {
   }
 }
 
+beforeEach(() => {
+  // Roots are shared between scans for a few seconds; each case owns its own tree.
+  clearSkillRootScanCache()
+  vi.spyOn(console, 'info').mockImplementation(() => undefined)
+})
+
 describe('skill discovery', () => {
   it('discovers home and repo SKILL.md packages with provider metadata', async () => {
     const root = await mkdtemp(join(tmpdir(), 'orca-skills-'))
diff --git a/src/main/skills/discovery.ts b/src/main/skills/discovery.ts
index 00edfc8e705..07bebe52b29 100644
--- a/src/main/skills/discovery.ts
+++ b/src/main/skills/discovery.ts
@@ -1,7 +1,6 @@
-import type { Dirent } from 'node:fs'
-import { open, readdir, realpath, stat } from 'node:fs/promises'
+import { open, realpath, stat } from 'node:fs/promises'
 import { homedir } from 'node:os'
-import { basename, dirname, isAbsolute, join, relative, sep } from 'node:path'
+import { basename, dirname, relative, sep } from 'node:path'
 import { summarizeSkillMarkdown } from '../../shared/skill-metadata'
 import type { Repo } from '../../shared/types'
 import type {
@@ -18,12 +17,41 @@ import {
   type SkillScanRoot
 } from './skill-discovery-sources'
 import { discoverClaudePluginSkillSources } from './claude-plugin-skill-sources'
+import { countPackageFiles, findSkillFiles } from './skill-root-file-walk'
+import { runSkillCandidateTasks } from './skill-candidate-concurrency'
+import { SkillScanCoalescer, type SkillScanOutcome } from './skill-scan-coalescer'
 
 export { buildSkillDiscoverySources } from './skill-discovery-sources'
 
-const SKILL_FILE_NAME = 'SKILL.md'
 const MAX_MARKDOWN_BYTES = 256 * 1024
-const MAX_SKILL_FILES = 200
+// Why: the fixed home roots are identical for every target, so one worktree pane
+// per open workspace used to re-walk the same directories once per pane. Sharing
+// them for a few seconds is what bounds that fan-out.
+export const SKILL_ROOT_SCAN_TTL_MS = 10_000
+// Why: sized off the root formula, not a round number. One scan builds
+// `12 fixed home roots + 2 per local repo (+ cwd) + plugin roots`, so a bound
+// smaller than a single scan's root count makes that scan evict its own earlier
+// entries and the cache degrades to a ~0% hit rate — exactly the walk this
+// exists to prevent. The live key space is the union across targets — the fixed
+// home roots plus two per repo plus two per distinct workspace cwd — so this holds
+// a few hundred repos with panes open, not an unbounded install. Past that the LRU
+// keeps the hot home roots and the repo roots thrash, which degrades rather than
+// breaks. Most repo roots do not exist, and a missing root caches as
+// `{exists: false, skills: []}`.
+const MAX_CACHED_SKILL_ROOTS = 1_024
+// Why: roots grow with the repo count, so an uncapped id list would make one log
+// line grow with the install. Root *ids* are safe to log where labels and paths
+// are not — a repo/plugin id is already a hash.
+export const MAX_LOGGED_ROOT_IDS = 12
+
+type RootScan = { exists: boolean; skills: ScannedSkill[] }
+
+const rootScans = new SkillScanCoalescer<RootScan>(MAX_CACHED_SKILL_ROOTS)
+
+/** Drop every shared root scan, e.g. after a skill install/update mutates disk. */
+export function clearSkillRootScanCache(): void {
+  rootScans.clear()
+}
 
 async function pathExists(pathValue: string): Promise<boolean> {
   try {
@@ -34,129 +62,6 @@ async function pathExists(pathValue: string): Promise<boolean> {
   }
 }
 
-function isWithinDepth(rootPath: string, childPath: string, maxDepth: number): boolean {
-  const rel = relative(rootPath, childPath)
-  if (!rel) {
-    return true
-  }
-  // Why: `..cache` is a valid child name; only a real parent traversal escapes.
-  if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-    return false
-  }
-  return rel.split(sep).length <= maxDepth
-}
-
-async function findSkillFiles(rootPath: string, maxDepth: number): Promise<string[]> {
-  const out: string[] = []
-  const visitedDirectoryPaths = new Set<string>()
-  async function visit(dirPath: string): Promise<void> {
-    if (!isWithinDepth(rootPath, dirPath, maxDepth)) {
-      return
-    }
-    let resolvedDirPath: string
-    try {
-      resolvedDirPath = await realpath(dirPath)
-    } catch {
-      return
-    }
-    if (visitedDirectoryPaths.has(resolvedDirPath)) {
-      return
-    }
-    visitedDirectoryPaths.add(resolvedDirPath)
-
-    let entries: Dirent[]
-    try {
-      entries = await readdir(dirPath, { withFileTypes: true })
-    } catch {
-      return
-    }
-    for (const entry of entries) {
-      const entryPath = join(dirPath, entry.name)
-      if (entry.name === SKILL_FILE_NAME) {
-        if (entry.isFile()) {
-          out.push(entryPath)
-          continue
-        }
-        if (entry.isSymbolicLink()) {
-          try {
-            if ((await stat(entryPath)).isFile()) {
-              out.push(entryPath)
-            }
-          } catch {
-            // Broken links are not valid skill files.
-          }
-        }
-        continue
-      }
-      if (entry.isDirectory()) {
-        await visit(entryPath)
-        continue
-      }
-      if (entry.isSymbolicLink()) {
-        // Why: users commonly symlink agent skill dirs across providers; follow
-        // directory links but guard by realpath so recursive links cannot loop.
-        try {
-          if ((await stat(entryPath)).isDirectory()) {
-            await visit(entryPath)
-          }
-        } catch {
-          // Broken links are not valid skill directories.
-        }
-      }
-    }
-  }
-  await visit(rootPath)
-  return out
-}
-
-async function countFiles(dirPath: string): Promise<number> {
-  let count = 0
-  const visitedDirectoryPaths = new Set<string>()
-  async function visit(currentPath: string): Promise<void> {
-    if (count >= MAX_SKILL_FILES) {
-      return
-    }
-    let resolvedPath: string
-    try {
-      resolvedPath = await realpath(currentPath)
-    } catch {
-      return
-    }
-    if (visitedDirectoryPaths.has(resolvedPath)) {
-      return
-    }
-    visitedDirectoryPaths.add(resolvedPath)
-
-    let entries: Dirent[]
-    try {
-      entries = await readdir(currentPath, { withFileTypes: true })
-    } catch {
-      return
-    }
-    for (const entry of entries) {
-      if (count >= MAX_SKILL_FILES) {
-        return
-      }
-      const entryPath = join(currentPath, entry.name)
-      if (entry.isFile()) {
-        count += 1
-      } else if (entry.isDirectory()) {
-        await visit(entryPath)
-      } else if (entry.isSymbolicLink()) {
-        try {
-          if ((await stat(entryPath)).isFile()) {
-            count += 1
-          }
-        } catch {
-          // Broken links do not contribute to the skill package file count.
-        }
-      }
-    }
-  }
-  await visit(dirPath)
-  return count
-}
-
 async function readSkillSummary(skillFilePath: string): Promise<{
   name: string | null
   description: string | null
@@ -187,8 +92,11 @@ type ScannedSkill = DiscoveredSkill & { canonicalSkillFilePath: string }
 async function scanRoot(root: SkillScanRoot): Promise<ScannedSkill[]> {
   const maxDepth = root.sourceKind === 'plugin' ? 9 : 4
   const skillFiles = await findSkillFiles(root.path, maxDepth)
-  const skills = await Promise.all(
-    skillFiles.map(async (skillFilePath): Promise<ScannedSkill | null> => {
+  // Why: a root can hold many packages and each one costs a summary read plus a
+  // package walk. Unbounded fan-out here is what turned one scan into a burst of
+  // filesystem-metadata work across every core.
+  const skills = await runSkillCandidateTasks(
+    skillFiles.map((skillFilePath) => async (): Promise<ScannedSkill | null> => {
       // Why: path identity belongs to the scanning host; canonicalizing before
       // returning prevents symlinked roots from becoming duplicate picker rows.
       const canonicalSkillFilePath = await realpath(skillFilePath).catch(() => skillFilePath)
@@ -211,7 +119,7 @@ async function scanRoot(root: SkillScanRoot): Promise<ScannedSkill[]> {
         directoryPath,
         skillFilePath,
         installed: true,
-        fileCount: await countFiles(directoryPath),
+        fileCount: await countPackageFiles(directoryPath),
         updatedAt: summary.updatedAt,
         canonicalSkillFilePath
       } satisfies ScannedSkill
@@ -220,13 +128,66 @@ async function scanRoot(root: SkillScanRoot): Promise<ScannedSkill[]> {
   return skills.filter((skill): skill is ScannedSkill => skill !== null)
 }
 
+// Why: two roots can share a path (e.g. `~/.claude/skills` is both a home root
+// and a repo root when the home dir is the workspace), and their scan differs
+// only by depth, which `sourceKind` decides.
+function rootScanKey(root: SkillScanRoot): string {
+  return `${root.sourceKind}\0${root.path}`
+}
+
+function scanRootShared(
+  root: SkillScanRoot,
+  refresh: boolean
+): Promise<SkillScanOutcome<RootScan>> {
+  return rootScans.run(rootScanKey(root), { ttlMs: SKILL_ROOT_SCAN_TTL_MS, refresh }, async () => {
+    const exists = await pathExists(root.path)
+    return { exists, skills: exists ? await scanRoot(root) : [] }
+  })
+}
+
+function mergeScannedSkill(seen: Map<string, DiscoveredSkill>, skill: ScannedSkill): void {
+  // Why: overlapping repo/cwd roots and symlinked provider homes can reach
+  // the same file. Keep the first source's higher-level scope identity, but
+  // record every contributing root so per-agent visibility survives dedup.
+  const existing = seen.get(skill.canonicalSkillFilePath)
+  if (!existing) {
+    const { canonicalSkillFilePath, ...publicSkill } = skill
+    // Copy: a shared root scan hands the same skill object to every caller, so the
+    // result each one owns must not alias the cached arrays.
+    seen.set(canonicalSkillFilePath, {
+      ...publicSkill,
+      providers: [...publicSkill.providers],
+      rootPaths: [skill.rootPath]
+    })
+    return
+  }
+  if (existing.rootPaths && !existing.rootPaths.includes(skill.rootPath)) {
+    existing.rootPaths.push(skill.rootPath)
+  }
+  // Why: providers is per-agent visibility just like rootPaths; keeping only
+  // the first root's tags makes a shared/symlinked skill under-report which
+  // agents can see it on the Settings provider badges/filter. Reassign a
+  // fresh array — `providers` aliases the scan root's array, so pushing in
+  // place would mutate the root and every sibling skill/source sharing it.
+  const mergedProviders = [...existing.providers]
+  for (const provider of skill.providers) {
+    if (!mergedProviders.includes(provider)) {
+      mergedProviders.push(provider)
+    }
+  }
+  existing.providers = mergedProviders
+}
+
 export async function discoverSkills(args: {
   repos?: Repo[]
   homeDir?: string
   cwd?: string
   includeCwd?: boolean
+  refresh?: boolean
 }): Promise<SkillDiscoveryResult> {
+  const startedAt = Date.now()
   const homeDir = args.homeDir ?? homedir()
+  const refresh = args.refresh === true
   const roots = [
     ...buildSkillDiscoverySources({ ...args, homeDir }),
     // Why: plugin discovery is native-chat data keyed to an explicit workspace.
@@ -235,51 +196,36 @@ export async function discoverSkills(args: {
       ? await discoverClaudePluginSkillSources({ homeDir, cwd: args.cwd })
       : [])
   ]
-  const sources: SkillDiscoverySource[] = []
-  const skillGroups = await Promise.all(
-    roots.map(async (root) => {
-      const exists = await pathExists(root.path)
-      sources.push({
-        ...root,
-        providers: [...root.providers],
-        exists,
-        skippedReason: exists ? undefined : 'missing'
-      })
-      if (!exists) {
-        return []
-      }
-      return scanRoot(root)
-    })
-  )
+  const scans = await Promise.all(roots.map((root) => scanRootShared(root, refresh)))
+  const sources: SkillDiscoverySource[] = roots.map((root, index) => ({
+    ...root,
+    providers: [...root.providers],
+    exists: scans[index].value.exists,
+    skippedReason: scans[index].value.exists ? undefined : 'missing'
+  }))
   const seen = new Map<string, DiscoveredSkill>()
-  for (const skill of skillGroups.flat()) {
-    // Why: overlapping repo/cwd roots and symlinked provider homes can reach
-    // the same file. Keep the first source's higher-level scope identity, but
-    // record every contributing root so per-agent visibility survives dedup.
-    const existing = seen.get(skill.canonicalSkillFilePath)
-    if (existing) {
-      if (existing.rootPaths && !existing.rootPaths.includes(skill.rootPath)) {
-        existing.rootPaths.push(skill.rootPath)
-      }
-      // Why: providers is per-agent visibility just like rootPaths; keeping only
-      // the first root's tags makes a shared/symlinked skill under-report which
-      // agents can see it on the Settings provider badges/filter. Reassign a
-      // fresh array — `providers` aliases the scan root's array, so pushing in
-      // place would mutate the root and every sibling skill/source sharing it.
-      const mergedProviders = [...existing.providers]
-      for (const provider of skill.providers) {
-        if (!mergedProviders.includes(provider)) {
-          mergedProviders.push(provider)
-        }
-      }
-      existing.providers = mergedProviders
-      continue
+  for (const { value } of scans) {
+    for (const skill of value.skills) {
+      mergeScannedSkill(seen, skill)
     }
-    const { canonicalSkillFilePath, ...publicSkill } = skill
-    seen.set(canonicalSkillFilePath, { ...publicSkill, rootPaths: [skill.rootPath] })
+  }
+  const skills = Array.from(seen.values()).sort(compareSkills)
+  // Why: root *ids* — a repo/plugin id is already a hash, while its label carries
+  // the repo or plugin name and its path carries the user's directory names. A
+  // fully cached scan did no filesystem work, so it stays silent rather than
+  // burying the bursts this line exists to make visible.
+  const walked = roots.filter((_, index) => !scans[index].cached).map((root) => root.id)
+  if (walked.length > 0) {
+    // `present` is not derivable from the rest: "walked 500 roots, 3 existed" is
+    // the shape that says the root set, not the tree, is what costs. The id list
+    // is capped because roots grow with the repo count.
+    const present = sources.filter((source) => source.exists).length
+    console.info(
+      `[skills] scan roots=${roots.length} present=${present} walked=${walked.length} skills=${skills.length} ms=${Date.now() - startedAt} ids=${walked.slice(0, MAX_LOGGED_ROOT_IDS).join(',')}`
+    )
   }
   return {
-    skills: Array.from(seen.values()).sort(compareSkills),
+    skills,
     sources: sources.sort((a, b) =>
       a.label.localeCompare(b.label, undefined, { sensitivity: 'base' })
     ),
diff --git a/src/main/skills/skill-discovery-concurrency.test.ts b/src/main/skills/skill-discovery-concurrency.test.ts
new file mode 100644
index 00000000000..162ea10cf89
--- /dev/null
+++ b/src/main/skills/skill-discovery-concurrency.test.ts
@@ -0,0 +1,195 @@
+import { mkdir, mkdtemp, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join, sep } from 'node:path'
+import type * as FsPromises from 'node:fs/promises'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+// Why: the regression is measured in filesystem syscalls, not in returned data, so
+// the walk's own readdir is what the assertions below count.
+const { readdirPaths } = vi.hoisted(() => ({ readdirPaths: [] as string[] }))
+
+vi.mock('node:fs/promises', async () => {
+  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
+  return {
+    ...actual,
+    readdir: (path: Parameters<typeof actual.readdir>[0], ...rest: unknown[]) => {
+      readdirPaths.push(String(path))
+      return (actual.readdir as (...args: unknown[]) => unknown)(path, ...rest)
+    }
+  }
+})
+
+const { clearSkillRootScanCache, discoverSkills, MAX_LOGGED_ROOT_IDS } = await import('./discovery')
+
+async function writeSkill(directory: string, name: string): Promise<void> {
+  await mkdir(directory, { recursive: true })
+  await writeFile(join(directory, 'SKILL.md'), `---\nname: ${name}\ndescription: d\n---\n`)
+}
+
+/** A home with three provider roots populated, plus `paneCount` workspace roots. */
+async function buildFixture(
+  paneCount: number
+): Promise<{ home: string; panes: string[]; noWorkspace: string }> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-skill-concurrency-'))
+  const home = join(root, 'home')
+  await writeSkill(join(home, '.agents', 'skills', 'shared'), 'shared')
+  await writeSkill(join(home, '.claude', 'skills', 'review'), 'review')
+  await writeSkill(join(home, '.codex', 'skills', 'plan'), 'plan')
+  const panes: string[] = []
+  for (let index = 0; index < paneCount; index += 1) {
+    const pane = join(root, `pane-${index}`)
+    await writeSkill(join(pane, '.agents', 'skills', `pane-${index}`), `pane-${index}`)
+    panes.push(pane)
+  }
+  // Why: with no cwd the source builder falls back to process.cwd(), which would
+  // drag this repo's own skills into every count below.
+  return { home, panes, noWorkspace: join(root, 'no-workspace') }
+}
+
+// One populated root costs three readdirs per real walk: the root itself, the
+// package directory while looking for SKILL.md, and the package directory again
+// while counting its files. Anything above that is a root walked more than once.
+const READDIR_CALLS_PER_POPULATED_ROOT = 3
+
+function readdirCountUnder(path: string): number {
+  return readdirPaths.filter(
+    (candidate) => candidate === path || candidate.startsWith(`${path}${sep}`)
+  ).length
+}
+
+beforeEach(() => {
+  clearSkillRootScanCache()
+  readdirPaths.length = 0
+  vi.spyOn(console, 'info').mockImplementation(() => undefined)
+})
+
+afterEach(() => {
+  clearSkillRootScanCache()
+  vi.restoreAllMocks()
+})
+
+describe('bounded concurrent skill discovery', () => {
+  it('collapses a burst of identical scans into one walk of each root', async () => {
+    const { home, noWorkspace } = await buildFixture(0)
+    const claudeRoot = join(home, '.claude', 'skills')
+
+    const results = await Promise.all(
+      Array.from({ length: 32 }, () =>
+        discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace })
+      )
+    )
+
+    expect(results).toHaveLength(32)
+    for (const result of results) {
+      expect(result.skills.map((skill) => skill.name).sort()).toEqual(['plan', 'review', 'shared'])
+    }
+    expect(readdirCountUnder(claudeRoot)).toBe(READDIR_CALLS_PER_POPULATED_ROOT)
+  })
+
+  it('shares the fixed home roots across panes that only differ by workspace', async () => {
+    const { home, panes } = await buildFixture(8)
+
+    const results = await Promise.all(
+      panes.flatMap((pane) =>
+        Array.from({ length: 4 }, () => discoverSkills({ homeDir: home, repos: [], cwd: pane }))
+      )
+    )
+
+    expect(results).toHaveLength(32)
+    // Every pane still sees the shared home skills plus its own workspace skill.
+    for (const [index, result] of results.entries()) {
+      const paneIndex = Math.floor(index / 4)
+      expect(result.skills.map((skill) => skill.name).sort()).toEqual([
+        `pane-${paneIndex}`,
+        'plan',
+        'review',
+        'shared'
+      ])
+    }
+    // The home roots are walked once for all 32 scans; only the per-pane roots repeat.
+    expect(readdirCountUnder(join(home, '.agents', 'skills'))).toBe(
+      READDIR_CALLS_PER_POPULATED_ROOT
+    )
+    expect(readdirCountUnder(join(home, '.claude', 'skills'))).toBe(
+      READDIR_CALLS_PER_POPULATED_ROOT
+    )
+    expect(readdirCountUnder(join(home, '.codex', 'skills'))).toBe(READDIR_CALLS_PER_POPULATED_ROOT)
+    for (const pane of panes) {
+      expect(readdirCountUnder(join(pane, '.agents', 'skills'))).toBe(
+        READDIR_CALLS_PER_POPULATED_ROOT
+      )
+    }
+  })
+
+  it('reports missing roots without walking them', async () => {
+    const { home, noWorkspace } = await buildFixture(0)
+
+    const result = await discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace })
+
+    const missing = result.sources.find((source) => source.id === 'home-cursor')
+    expect(missing?.exists).toBe(false)
+    expect(missing?.skippedReason).toBe('missing')
+    expect(readdirCountUnder(join(home, '.cursor', 'skills'))).toBe(0)
+  })
+
+  it('re-reads disk when a caller refreshes, and serves the new result afterwards', async () => {
+    const { home, noWorkspace } = await buildFixture(0)
+    await discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace })
+    await writeSkill(join(home, '.agents', 'skills', 'added-later'), 'added-later')
+
+    const stale = await discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace })
+    expect(stale.skills.map((skill) => skill.name)).not.toContain('added-later')
+
+    const refreshed = await discoverSkills({
+      homeDir: home,
+      repos: [],
+      cwd: noWorkspace,
+      refresh: true
+    })
+    expect(refreshed.skills.map((skill) => skill.name)).toContain('added-later')
+
+    // Why: asserting only that the skill is present would pass with no caching at
+    // all — the roots would simply re-walk and find it. The refresh has to leave
+    // every root cached, or the next scan re-walks the whole set.
+    readdirPaths.length = 0
+    const afterRefresh = await discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace })
+    expect(afterRefresh.skills.map((skill) => skill.name)).toContain('added-later')
+    expect(readdirPaths).toEqual([])
+  })
+
+  it('gives every caller its own arrays so a shared scan cannot be mutated across results', async () => {
+    const { home, noWorkspace } = await buildFixture(0)
+
+    const [first, second] = await Promise.all([
+      discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace }),
+      discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace })
+    ])
+
+    const firstShared = first.skills.find((skill) => skill.name === 'shared')
+    const secondShared = second.skills.find((skill) => skill.name === 'shared')
+    expect(firstShared?.providers).not.toBe(secondShared?.providers)
+    expect(firstShared?.rootPaths).not.toBe(secondShared?.rootPaths)
+  })
+
+  it('logs the roots it walked, by id, and never a filesystem path', async () => {
+    const { home, noWorkspace } = await buildFixture(0)
+    const info = vi.spyOn(console, 'info').mockImplementation(() => undefined)
+
+    await discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace })
+
+    const line = String(info.mock.calls.at(0)?.at(0))
+    // `present` is the signal that separates "big tree" from "big root set", and
+    // is not derivable from the other counts.
+    expect(line).toContain('[skills] scan roots=14 present=3 walked=14 skills=3')
+    expect(line).toContain('home-claude')
+    expect(line).not.toContain(home)
+    expect(line).not.toContain(tmpdir())
+    // The id list is capped so one line cannot grow with the repo count.
+    expect(line.slice(line.indexOf('ids=')).split(',')).toHaveLength(MAX_LOGGED_ROOT_IDS)
+
+    info.mockClear()
+    await discoverSkills({ homeDir: home, repos: [], cwd: noWorkspace })
+    // A fully cached scan did no filesystem work, so it must stay silent.
+    expect(info).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/skills/skill-discovery-target.test.ts b/src/main/skills/skill-discovery-target.test.ts
new file mode 100644
index 00000000000..f136536b189
--- /dev/null
+++ b/src/main/skills/skill-discovery-target.test.ts
@@ -0,0 +1,158 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { SkillDiscoveryResult } from '../../shared/skills'
+import type { Repo } from '../../shared/types'
+
+const { nativeScans, wslScans } = vi.hoisted(() => ({
+  nativeScans: [] as unknown[],
+  wslScans: [] as unknown[]
+}))
+
+const emptyResult = (): SkillDiscoveryResult => ({ skills: [], sources: [], scannedAt: 1 })
+
+vi.mock('./discovery', () => ({
+  clearSkillRootScanCache: vi.fn(),
+  discoverSkills: vi.fn(async (args: unknown) => {
+    nativeScans.push(args)
+    return emptyResult()
+  })
+}))
+
+vi.mock('./skill-discovery-wsl', () => ({
+  discoverSkillsInWsl: vi.fn(async (args: unknown) => {
+    wslScans.push(args)
+    return emptyResult()
+  })
+}))
+
+const { clearSkillDiscoveryCaches, discoverSkillsOnTarget } =
+  await import('./skill-discovery-target')
+const { clearSkillRootScanCache } = await import('./discovery')
+
+function makeRepo(path: string): Repo {
+  return {
+    id: `repo-${path}`,
+    path,
+    displayName: 'Repo',
+    badgeColor: '#737373',
+    addedAt: 1,
+    kind: 'git',
+    connectionId: null
+  }
+}
+
+beforeEach(() => {
+  clearSkillDiscoveryCaches()
+  nativeScans.length = 0
+  wslScans.length = 0
+  vi.mocked(clearSkillRootScanCache).mockClear()
+})
+
+afterEach(() => {
+  clearSkillDiscoveryCaches()
+})
+
+describe('discoverSkillsOnTarget', () => {
+  it('collapses simultaneous identical requests from several clients into one scan', async () => {
+    await Promise.all(
+      Array.from({ length: 12 }, () =>
+        discoverSkillsOnTarget({ kind: 'native-host', cwd: '/workspace' }, [])
+      )
+    )
+
+    expect(nativeScans).toHaveLength(1)
+  })
+
+  it('does not let two workspaces share a scan', async () => {
+    await Promise.all([
+      discoverSkillsOnTarget({ kind: 'native-host', cwd: '/workspace-a' }, []),
+      discoverSkillsOnTarget({ kind: 'native-host', cwd: '/workspace-b' }, [])
+    ])
+
+    expect(nativeScans).toEqual([
+      { repos: [], cwd: '/workspace-a', refresh: false },
+      { repos: [], cwd: '/workspace-b', refresh: false }
+    ])
+  })
+
+  it('does not let two repo lists share a scan', async () => {
+    await Promise.all([
+      discoverSkillsOnTarget({ kind: 'native-host', cwd: undefined }, [makeRepo('/repo-a')]),
+      discoverSkillsOnTarget({ kind: 'native-host', cwd: undefined }, [makeRepo('/repo-b')])
+    ])
+
+    expect(nativeScans).toHaveLength(2)
+  })
+
+  // Why: two clients can hold the same repo set in a different stored order. If the
+  // digest is order-sensitive they get different keys and each runs a full native
+  // scan — the fan-out this cache exists to bound. ttl is 0 here, so the pin is
+  // that two *concurrent* callers coalesce, which they only do on an equal key.
+  it('keeps repo-list identity stable regardless of stored order', async () => {
+    const repos = [makeRepo('/repo-a'), makeRepo('/repo-b')]
+    await discoverSkillsOnTarget({ kind: 'native-host', cwd: undefined }, repos)
+    await Promise.all([
+      discoverSkillsOnTarget({ kind: 'native-host', cwd: undefined }, repos.toReversed()),
+      discoverSkillsOnTarget({ kind: 'native-host', cwd: undefined }, repos)
+    ])
+
+    expect(nativeScans).toHaveLength(2)
+  })
+
+  it('forwards refresh to the native scan so it re-reads disk', async () => {
+    await discoverSkillsOnTarget({ kind: 'native-host', cwd: '/workspace' }, [], { refresh: true })
+
+    expect(nativeScans).toEqual([{ repos: [], cwd: '/workspace', refresh: true }])
+  })
+
+  it('reuses a WSL result rather than booting wsl.exe again', async () => {
+    const target = {
+      kind: 'wsl',
+      distro: 'Ubuntu',
+      homeDir: '/home/dev',
+      cwd: '/home/dev/repo'
+    } as const
+
+    await discoverSkillsOnTarget(target, [])
+    await discoverSkillsOnTarget(target, [])
+
+    expect(wslScans).toHaveLength(1)
+  })
+
+  it('never shares a WSL result across distros or workspaces', async () => {
+    await discoverSkillsOnTarget(
+      { kind: 'wsl', distro: 'Ubuntu', homeDir: '/home/dev', cwd: '/home/dev/a' },
+      []
+    )
+    await discoverSkillsOnTarget(
+      { kind: 'wsl', distro: 'Fedora', homeDir: '/home/dev', cwd: '/home/dev/a' },
+      []
+    )
+    await discoverSkillsOnTarget(
+      { kind: 'wsl', distro: 'Ubuntu', homeDir: '/home/dev', cwd: '/home/dev/b' },
+      []
+    )
+
+    expect(wslScans).toHaveLength(3)
+  })
+
+  it('re-reads a WSL target when the caller refreshes', async () => {
+    const target = {
+      kind: 'wsl',
+      distro: 'Ubuntu',
+      homeDir: '/home/dev',
+      cwd: '/home/dev/repo'
+    } as const
+
+    await discoverSkillsOnTarget(target, [])
+    await discoverSkillsOnTarget(target, [], { refresh: true })
+    await discoverSkillsOnTarget(target, [])
+
+    // The refreshed result replaces the cached one, so the third call is free.
+    expect(wslScans).toHaveLength(2)
+  })
+
+  it('drops the root cache too when the host clears its scans', () => {
+    clearSkillDiscoveryCaches()
+    expect(clearSkillRootScanCache).toHaveBeenCalled()
+  })
+})
diff --git a/src/main/skills/skill-discovery-target.ts b/src/main/skills/skill-discovery-target.ts
index 2be10232c8c..3670aef905e 100644
--- a/src/main/skills/skill-discovery-target.ts
+++ b/src/main/skills/skill-discovery-target.ts
@@ -1,8 +1,25 @@
 import type { Repo } from '../../shared/types'
 import type { SkillDiscoveryResult, SkillDiscoveryTarget } from '../../shared/skills'
 import { getDefaultWslDistro, getWslHome, parseWslPath, toLinuxPath } from '../wsl'
-import { discoverSkills } from './discovery'
+import { clearSkillRootScanCache, discoverSkills } from './discovery'
 import { discoverSkillsInWsl } from './skill-discovery-wsl'
+import { stablePathId } from './skill-discovery-sources'
+import { getRepoExecutionHostId } from '../../shared/execution-host'
+import { SkillScanCoalescer } from './skill-scan-coalescer'
+
+// Why: on WSL the unit of cost is the wsl.exe boot plus one `find` per skill, so
+// the whole result is what must be shared. The native path shares at root level
+// instead, and only needs concurrent callers collapsed into one walk.
+const WSL_RESULT_TTL_MS = 10_000
+const MAX_CACHED_SKILL_TARGETS = 32
+
+const targetScans = new SkillScanCoalescer<SkillDiscoveryResult>(MAX_CACHED_SKILL_TARGETS)
+
+/** Drop every shared scan; used when a skill update run has rewritten disk. */
+export function clearSkillDiscoveryCaches(): void {
+  targetScans.clear()
+  clearSkillRootScanCache()
+}
 
 export type ResolvedSkillDiscoveryTarget =
   | { kind: 'native-host'; cwd: string | undefined }
@@ -53,18 +70,50 @@ export function resolveSkillDiscoveryTarget(
   return { kind: 'wsl', distro: wslDistro, homeDir: linuxHomeDir, cwd }
 }
 
+// Why: repos widen the native root set, so two targets that differ only by the
+// stored repo list must not share a scan. Paths are digested rather than joined
+// so the key cannot grow with a large repo list.
+function repoDigest(repos: readonly Repo[]): string {
+  return stablePathId(
+    repos
+      // Why: the source builder keeps only locally-executed repos, so the same
+      // path reassigned to another execution host is a different root set.
+      .map((repo) => `${getRepoExecutionHostId(repo)}\0${repo.path}`)
+      .sort((left, right) => left.localeCompare(right))
+      // NUL is the one byte a path cannot contain, so no repo list can be spelled
+      // two ways that digest alike.
+      .join('\0')
+  )
+}
+
+// Keys use exact paths — lowercasing would alias two roots that are distinct on Linux.
+function scanKey(target: ResolvedSkillDiscoveryTarget, repos: readonly Repo[]): string {
+  return target.kind === 'wsl'
+    ? `wsl\0${target.distro}\0${target.homeDir}\0${target.cwd}`
+    : `native\0${target.cwd ?? ''}\0${target.cwd ? '' : repoDigest(repos)}`
+}
+
 export async function discoverSkillsOnTarget(
   target: ResolvedSkillDiscoveryTarget,
-  repos: readonly Repo[]
+  repos: readonly Repo[],
+  options: { refresh?: boolean } = {}
 ): Promise<SkillDiscoveryResult> {
-  if (target.kind === 'wsl') {
-    return discoverSkillsInWsl({
-      distro: target.distro,
-      homeDir: target.homeDir,
-      cwd: target.cwd
-    })
-  }
-  return target.cwd
-    ? discoverSkills({ repos: [], cwd: target.cwd })
-    : discoverSkills({ repos: [...repos] })
+  const refresh = options.refresh === true
+  const outcome = await targetScans.run(
+    scanKey(target, repos),
+    { ttlMs: target.kind === 'wsl' ? WSL_RESULT_TTL_MS : 0, refresh },
+    async () => {
+      if (target.kind === 'wsl') {
+        return discoverSkillsInWsl({
+          distro: target.distro,
+          homeDir: target.homeDir,
+          cwd: target.cwd
+        })
+      }
+      return target.cwd
+        ? discoverSkills({ repos: [], cwd: target.cwd, refresh })
+        : discoverSkills({ repos: [...repos], refresh })
+    }
+  )
+  return outcome.value
 }
diff --git a/src/main/skills/skill-root-file-walk.test.ts b/src/main/skills/skill-root-file-walk.test.ts
new file mode 100644
index 00000000000..654312d7f5d
--- /dev/null
+++ b/src/main/skills/skill-root-file-walk.test.ts
@@ -0,0 +1,74 @@
+import { mkdir, mkdtemp, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import {
+  countPackageFiles,
+  findSkillFiles,
+  MAX_SKILL_PACKAGE_DEPTH,
+  MAX_SKILL_PACKAGE_FILES
+} from './skill-root-file-walk'
+
+async function makeTree(): Promise<string> {
+  return mkdtemp(join(tmpdir(), 'orca-skill-walk-'))
+}
+
+async function writeFileAt(path: string, content = 'x'): Promise<void> {
+  await mkdir(join(path, '..'), { recursive: true })
+  await writeFile(path, content)
+}
+
+describe('countPackageFiles', () => {
+  it('prunes node_modules so a vendored dependency tree is not the file count', async () => {
+    const pkg = join(await makeTree(), 'skill')
+    await writeFileAt(join(pkg, 'SKILL.md'))
+    for (let index = 0; index < 50; index += 1) {
+      await writeFileAt(join(pkg, 'node_modules', `dep-${index}`, 'index.js'))
+    }
+
+    expect(await countPackageFiles(pkg)).toBe(1)
+  })
+
+  it('stops at the depth bound instead of walking an arbitrarily deep payload', async () => {
+    const pkg = join(await makeTree(), 'skill')
+    await writeFileAt(join(pkg, 'SKILL.md'))
+    const deep = join(pkg, ...Array.from({ length: MAX_SKILL_PACKAGE_DEPTH + 2 }, () => 'nested'))
+    await writeFileAt(join(deep, 'buried.txt'))
+    const reachable = join(pkg, ...Array.from({ length: MAX_SKILL_PACKAGE_DEPTH }, () => 'ok'))
+    await writeFileAt(join(reachable, 'shallow.txt'))
+
+    // The reachable file is counted; the one past the bound is not.
+    expect(await countPackageFiles(pkg)).toBe(2)
+  })
+
+  // Why: discovery counts `dirname(SKILL.md)`, and a package can vanish between
+  // being found and being counted — an uninstall mid-scan is exactly that race.
+  it('returns zero for a directory it cannot read', async () => {
+    expect(await countPackageFiles(join(await makeTree(), 'absent'))).toBe(0)
+  })
+
+  it('stops at the file bound', async () => {
+    const pkg = join(await makeTree(), 'skill')
+    for (let index = 0; index < MAX_SKILL_PACKAGE_FILES + 25; index += 1) {
+      await writeFileAt(join(pkg, `file-${index}.txt`))
+    }
+
+    expect(await countPackageFiles(pkg)).toBe(MAX_SKILL_PACKAGE_FILES)
+  })
+})
+
+describe('findSkillFiles', () => {
+  it('finds packages inside the depth bound and ignores deeper ones', async () => {
+    const root = join(await makeTree(), 'skills')
+    await writeFileAt(join(root, 'near', 'SKILL.md'))
+    await writeFileAt(join(root, 'a', 'b', 'c', 'd', 'far', 'SKILL.md'))
+
+    const found = await findSkillFiles(root, 4)
+
+    expect(found).toEqual([join(root, 'near', 'SKILL.md')])
+  })
+
+  it('returns nothing for a missing root rather than throwing', async () => {
+    expect(await findSkillFiles(join(await makeTree(), 'absent'), 4)).toEqual([])
+  })
+})
diff --git a/src/main/skills/skill-root-file-walk.ts b/src/main/skills/skill-root-file-walk.ts
new file mode 100644
index 00000000000..ab7aedc4249
--- /dev/null
+++ b/src/main/skills/skill-root-file-walk.ts
@@ -0,0 +1,145 @@
+import type { Dirent } from 'node:fs'
+import { readdir, realpath, stat } from 'node:fs/promises'
+import { isAbsolute, join, relative, sep } from 'node:path'
+
+export const SKILL_FILE_NAME = 'SKILL.md'
+export const MAX_SKILL_PACKAGE_FILES = 200
+// Why: `fileCount` is a display number, so the walk that produces it must not be
+// able to cost more than the walk that found the skill. A package deeper than this
+// under-reports its size; it never hides the skill.
+export const MAX_SKILL_PACKAGE_DEPTH = 6
+
+function isWithinDepth(rootPath: string, childPath: string, maxDepth: number): boolean {
+  const rel = relative(rootPath, childPath)
+  if (!rel) {
+    return true
+  }
+  // Why: `..cache` is a valid child name; only a real parent traversal escapes.
+  if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    return false
+  }
+  return rel.split(sep).length <= maxDepth
+}
+
+async function readEntries(dirPath: string): Promise<Dirent[] | null> {
+  try {
+    return await readdir(dirPath, { withFileTypes: true })
+  } catch {
+    return null
+  }
+}
+
+export async function findSkillFiles(rootPath: string, maxDepth: number): Promise<string[]> {
+  const out: string[] = []
+  const visitedDirectoryPaths = new Set<string>()
+  async function visit(dirPath: string): Promise<void> {
+    if (!isWithinDepth(rootPath, dirPath, maxDepth)) {
+      return
+    }
+    let resolvedDirPath: string
+    try {
+      resolvedDirPath = await realpath(dirPath)
+    } catch {
+      return
+    }
+    if (visitedDirectoryPaths.has(resolvedDirPath)) {
+      return
+    }
+    visitedDirectoryPaths.add(resolvedDirPath)
+
+    const entries = await readEntries(dirPath)
+    if (!entries) {
+      return
+    }
+    for (const entry of entries) {
+      const entryPath = join(dirPath, entry.name)
+      if (entry.name === SKILL_FILE_NAME) {
+        if (entry.isFile()) {
+          out.push(entryPath)
+          continue
+        }
+        if (entry.isSymbolicLink()) {
+          try {
+            if ((await stat(entryPath)).isFile()) {
+              out.push(entryPath)
+            }
+          } catch {
+            // Broken links are not valid skill files.
+          }
+        }
+        continue
+      }
+      if (entry.isDirectory()) {
+        await visit(entryPath)
+        continue
+      }
+      if (entry.isSymbolicLink()) {
+        // Why: users commonly symlink agent skill dirs across providers; follow
+        // directory links but guard by realpath so recursive links cannot loop.
+        try {
+          if ((await stat(entryPath)).isDirectory()) {
+            await visit(entryPath)
+          }
+        } catch {
+          // Broken links are not valid skill directories.
+        }
+      }
+    }
+  }
+  await visit(rootPath)
+  return out
+}
+
+/**
+ * Files in a skill package, for the picker's size column. Bounded by count and
+ * depth, and `node_modules` is pruned the way the plugin cache scan prunes it —
+ * vendored dependencies are payload, not part of the skill.
+ */
+export async function countPackageFiles(dirPath: string): Promise<number> {
+  let count = 0
+  const visitedDirectoryPaths = new Set<string>()
+  async function visit(currentPath: string, depth: number): Promise<void> {
+    if (count >= MAX_SKILL_PACKAGE_FILES || depth > MAX_SKILL_PACKAGE_DEPTH) {
+      return
+    }
+    let resolvedPath: string
+    try {
+      resolvedPath = await realpath(currentPath)
+    } catch {
+      return
+    }
+    if (visitedDirectoryPaths.has(resolvedPath)) {
+      return
+    }
+    visitedDirectoryPaths.add(resolvedPath)
+
+    const entries = await readEntries(currentPath)
+    if (!entries) {
+      return
+    }
+    for (const entry of entries) {
+      if (count >= MAX_SKILL_PACKAGE_FILES) {
+        return
+      }
+      if (entry.name === 'node_modules') {
+        continue
+      }
+      const entryPath = join(currentPath, entry.name)
+      if (entry.isFile()) {
+        count += 1
+      } else if (entry.isDirectory()) {
+        await visit(entryPath, depth + 1)
+      } else if (entry.isSymbolicLink()) {
+        try {
+          if ((await stat(entryPath)).isFile()) {
+            count += 1
+          }
+        } catch {
+          // Broken links do not contribute to the skill package file count.
+        }
+      }
+    }
+  }
+  await visit(dirPath, 0)
+  return count
+}
diff --git a/src/main/skills/skill-scan-coalescer.test.ts b/src/main/skills/skill-scan-coalescer.test.ts
new file mode 100644
index 00000000000..7a8d1bb1539
--- /dev/null
+++ b/src/main/skills/skill-scan-coalescer.test.ts
@@ -0,0 +1,222 @@
+import { describe, expect, it } from 'vitest'
+import { SkillScanCoalescer } from './skill-scan-coalescer'
+
+function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise
+  })
+  return { promise, resolve }
+}
+
+describe('SkillScanCoalescer', () => {
+  it('collapses concurrent callers on one key into a single scan', async () => {
+    const coalescer = new SkillScanCoalescer<number>(8)
+    const gate = deferred<number>()
+    let runs = 0
+    const task = (): Promise<number> => {
+      runs += 1
+      return gate.promise
+    }
+
+    const outcomes = Promise.all([
+      coalescer.run('root', { ttlMs: 0 }, task),
+      coalescer.run('root', { ttlMs: 0 }, task),
+      coalescer.run('root', { ttlMs: 0 }, task)
+    ])
+    gate.resolve(7)
+
+    expect((await outcomes).map((outcome) => outcome.value)).toEqual([7, 7, 7])
+    expect((await outcomes).map((outcome) => outcome.cached)).toEqual([false, true, true])
+    expect(runs).toBe(1)
+  })
+
+  it('keeps distinct keys isolated, including paths differing only by case', async () => {
+    const coalescer = new SkillScanCoalescer<string>(8)
+    const seen: string[] = []
+    const run = (key: string): Promise<{ value: string }> =>
+      coalescer.run(key, { ttlMs: 1_000 }, async () => {
+        seen.push(key)
+        return key
+      })
+
+    const [lower, upper] = await Promise.all([run('/home/a/Skills'), run('/home/a/skills')])
+
+    expect(lower.value).toBe('/home/a/Skills')
+    expect(upper.value).toBe('/home/a/skills')
+    expect(seen).toHaveLength(2)
+  })
+
+  it('reuses a result inside the ttl and rescans after it lapses', async () => {
+    let now = 1_000
+    const coalescer = new SkillScanCoalescer<number>(8, () => now)
+    let runs = 0
+    const task = async (): Promise<number> => {
+      runs += 1
+      return runs
+    }
+
+    expect((await coalescer.run('root', { ttlMs: 100 }, task)).cached).toBe(false)
+    now = 1_050
+    const cached = await coalescer.run('root', { ttlMs: 100 }, task)
+    expect(cached).toEqual({ value: 1, cached: true })
+    now = 1_101
+    expect(await coalescer.run('root', { ttlMs: 100 }, task)).toEqual({ value: 2, cached: false })
+    expect(runs).toBe(2)
+  })
+
+  it('retains nothing when the ttl is zero', async () => {
+    const coalescer = new SkillScanCoalescer<number>(8)
+    let runs = 0
+    const task = async (): Promise<number> => {
+      runs += 1
+      return runs
+    }
+
+    await coalescer.run('root', { ttlMs: 0 }, task)
+    await coalescer.run('root', { ttlMs: 0 }, task)
+
+    expect(runs).toBe(2)
+  })
+
+  it('bypasses cached and in-flight results when refreshing', async () => {
+    let now = 1_000
+    const coalescer = new SkillScanCoalescer<number>(8, () => now)
+    let runs = 0
+    const task = async (): Promise<number> => {
+      runs += 1
+      return runs
+    }
+
+    await coalescer.run('root', { ttlMs: 10_000 }, task)
+    const refreshed = await coalescer.run('root', { ttlMs: 10_000, refresh: true }, task)
+
+    expect(refreshed).toEqual({ value: 2, cached: false })
+    // The refreshed result is what later readers see, not the entry it replaced.
+    expect(await coalescer.run('root', { ttlMs: 10_000 }, task)).toEqual({ value: 2, cached: true })
+    expect(runs).toBe(2)
+  })
+
+  // Why: discovery issues one refreshing run() per root, synchronously. An
+  // invalidation counter shared across keys would let only the last-issued root
+  // publish and silently discard the rest, so every later scan re-walks them.
+  it('caches every key when a refresh fans out across roots', async () => {
+    const coalescer = new SkillScanCoalescer<string>(64)
+    const keys = ['root-a', 'root-b', 'root-c', 'root-d']
+
+    await Promise.all(
+      keys.map((key) => coalescer.run(key, { ttlMs: 10_000, refresh: true }, async () => key))
+    )
+    const readBack = await Promise.all(
+      keys.map((key) => coalescer.run(key, { ttlMs: 10_000 }, async () => 're-walked'))
+    )
+
+    expect(readBack.map((outcome) => outcome.cached)).toEqual([true, true, true, true])
+    expect(readBack.map((outcome) => outcome.value)).toEqual(keys)
+  })
+
+  it('does not let a scan that started before a refresh publish its stale result', async () => {
+    const coalescer = new SkillScanCoalescer<string>(8)
+    const slowScan = deferred<string>()
+
+    // A focus/mount scan is already in flight when the user installs a skill.
+    const inFlight = coalescer.run('root', { ttlMs: 10_000 }, () => slowScan.promise)
+    const refreshed = await coalescer.run(
+      'root',
+      { ttlMs: 10_000, refresh: true },
+      async () => 'after-install'
+    )
+    expect(refreshed.value).toBe('after-install')
+
+    // The older scan now lands. It must not overwrite the post-install entry with
+    // a pre-install listing and a fresh lifetime.
+    slowScan.resolve('before-install')
+    await inFlight
+
+    expect(await coalescer.run('root', { ttlMs: 10_000 }, async () => 'rescanned')).toEqual({
+      value: 'after-install',
+      cached: true
+    })
+  })
+
+  it('does not let a scan that started before clear() repopulate the cache', async () => {
+    const coalescer = new SkillScanCoalescer<string>(8)
+    const slowScan = deferred<string>()
+
+    const inFlight = coalescer.run('root', { ttlMs: 10_000 }, () => slowScan.promise)
+    // A skill update run rewrote disk while that scan was walking it.
+    coalescer.clear()
+    slowScan.resolve('pre-update')
+    await inFlight
+
+    expect(await coalescer.run('root', { ttlMs: 10_000 }, async () => 'post-update')).toEqual({
+      value: 'post-update',
+      cached: false
+    })
+  })
+
+  it('does not cache a failed scan', async () => {
+    const coalescer = new SkillScanCoalescer<number>(8)
+    let runs = 0
+
+    await expect(
+      coalescer.run('root', { ttlMs: 10_000 }, async () => {
+        runs += 1
+        throw new Error('scan failed')
+      })
+    ).rejects.toThrow('scan failed')
+    expect(await coalescer.run('root', { ttlMs: 10_000 }, async () => 5)).toEqual({
+      value: 5,
+      cached: false
+    })
+    expect(runs).toBe(1)
+  })
+
+  it('evicts the least recently used entry past the bound', async () => {
+    let now = 1_000
+    const coalescer = new SkillScanCoalescer<string>(2, () => now)
+    const scan = (key: string): Promise<{ cached: boolean }> =>
+      coalescer.run(key, { ttlMs: 10_000 }, async () => key)
+
+    await scan('a')
+    await scan('b')
+    // Reading 'a' promotes it, so 'b' is the eviction candidate when 'c' arrives.
+    expect((await scan('a')).cached).toBe(true)
+    await scan('c')
+
+    expect((await scan('a')).cached).toBe(true)
+    expect((await scan('b')).cached).toBe(false)
+  })
+
+  // ttl is non-zero on purpose: with ttl 0 nothing is ever written, which hides
+  // whether the abandoned scan can still publish over the replacement's result.
+  it('stops joining a scan that never settles, and never lets it publish later', async () => {
+    let now = 1_000
+    const coalescer = new SkillScanCoalescer<number>(8, () => now)
+    const wedged = deferred<number>()
+    let runs = 0
+    const task = (): Promise<number> => {
+      runs += 1
+      // The first scan models a root on a stalled mount: its readdir never settles.
+      return runs === 1 ? wedged.promise : Promise.resolve(runs)
+    }
+
+    void coalescer.run('root', { ttlMs: 10_000 }, task)
+    now = 1_100
+    // Still young enough to share.
+    const joined = coalescer.run('root', { ttlMs: 10_000 }, task)
+    now = 40_000
+
+    expect(await coalescer.run('root', { ttlMs: 10_000 }, task)).toEqual({
+      value: 2,
+      cached: false
+    })
+    expect(runs).toBe(2)
+
+    // The wedged callers still receive its eventual value rather than being orphaned...
+    wedged.resolve(99)
+    expect((await joined).value).toBe(99)
+    // ...but it must not overwrite the replacement's newer result with a fresh ttl.
+    expect(await coalescer.run('root', { ttlMs: 10_000 }, task)).toEqual({ value: 2, cached: true })
+  })
+})
diff --git a/src/main/skills/skill-scan-coalescer.ts b/src/main/skills/skill-scan-coalescer.ts
new file mode 100644
index 00000000000..422a3045783
--- /dev/null
+++ b/src/main/skills/skill-scan-coalescer.ts
@@ -0,0 +1,121 @@
+/** `cached` is false when this call did the filesystem work, for diagnostics. */
+export type SkillScanOutcome<T> = { value: T; cached: boolean }
+
+export type SkillScanRunOptions = {
+  /** 0 keeps nothing after the scan settles, so the entry only dedups concurrent callers. */
+  ttlMs: number
+  /** Skip every cached and in-flight result and re-read disk. */
+  refresh?: boolean
+}
+
+type CacheEntry<T> = { value: T; expiresAt: number }
+type PendingEntry<T> = { promise: Promise<T>; startedAt: number }
+
+// Why: a root on a stalled network mount can leave a readdir that never settles.
+// Joining it forever would make one wedged mount permanently wedge discovery for
+// every later caller — worse than before this cache existed, where each caller at
+// least retried. Past this age a new caller starts its own scan instead; the old
+// promise is dropped, so at most one pending entry per key survives.
+const MAX_JOINABLE_SCAN_AGE_MS = 30_000
+
+/**
+ * Shares one filesystem scan between concurrent callers and, optionally, reuses
+ * its result for a short window.
+ *
+ * Keys are used verbatim — callers must not normalize case, because two paths
+ * that differ only by case can be two different targets on Linux.
+ */
+export class SkillScanCoalescer<T> {
+  private readonly pending = new Map<string, PendingEntry<T>>()
+  private readonly cache = new Map<string, CacheEntry<T>>()
+
+  constructor(
+    private readonly maximumEntries: number,
+    private readonly now: () => number = Date.now
+  ) {}
+
+  async run(
+    key: string,
+    options: SkillScanRunOptions,
+    task: () => Promise<T>
+  ): Promise<SkillScanOutcome<T>> {
+    if (options.refresh) {
+      // Why: a forced caller is answering a mutation it just made, so it must not
+      // join a scan that may have started before that mutation. Concurrent forced
+      // callers therefore duplicate; they are rare (install / explicit recheck).
+      this.cache.delete(key)
+      return { value: await this.start(key, options.ttlMs, task), cached: false }
+    }
+    const fresh = this.readFresh(key)
+    if (fresh) {
+      return { value: fresh.value, cached: true }
+    }
+    const inFlight = this.pending.get(key)
+    if (inFlight && this.now() - inFlight.startedAt < MAX_JOINABLE_SCAN_AGE_MS) {
+      return { value: await inFlight.promise, cached: true }
+    }
+    return { value: await this.start(key, options.ttlMs, task), cached: false }
+  }
+
+  /** Drop every cached and in-flight entry (e.g. after a skill update run). */
+  clear(): void {
+    this.cache.clear()
+    this.pending.clear()
+  }
+
+  private start(key: string, ttlMs: number, task: () => Promise<T>): Promise<T> {
+    const promise = task()
+      .then((value) => {
+        // Why: owning the pending slot is what makes a scan publishable, and it is
+        // per key by construction. Deleting the cache entry is not enough to
+        // invalidate — a scan that began before the mutation resolves afterwards
+        // and would re-cache its pre-mutation result with a fresh lifetime. This
+        // one check covers all three ways it can be superseded: `clear()` empties
+        // `pending`, a refresh overwrites the slot, and so does the replacement
+        // for a scan abandoned past MAX_JOINABLE_SCAN_AGE_MS.
+        if (ttlMs > 0 && this.pending.get(key)?.promise === promise) {
+          this.write(key, value, ttlMs)
+        }
+        return value
+      })
+      .finally(() => {
+        // Why: a newer forced scan may already own this key; only the entry that
+        // registered itself may remove itself.
+        if (this.pending.get(key)?.promise === promise) {
+          this.pending.delete(key)
+        }
+      })
+    // Why: rejections must not surface as an unhandled rejection on the shared
+    // promise before the caller that started it awaits.
+    promise.catch(() => undefined)
+    this.pending.set(key, { promise, startedAt: this.now() })
+    return promise
+  }
+
+  private readFresh(key: string): CacheEntry<T> | null {
+    const entry = this.cache.get(key)
+    if (!entry) {
+      return null
+    }
+    if (entry.expiresAt <= this.now()) {
+      this.cache.delete(key)
+      return null
+    }
+    // Refresh recency so a hot root outlives a one-off target under the bound.
+    this.cache.delete(key)
+    this.cache.set(key, entry)
+    return entry
+  }
+
+  private write(key: string, value: T, ttlMs: number): void {
+    this.cache.delete(key)
+    this.cache.set(key, { value, expiresAt: this.now() + ttlMs })
+    while (this.cache.size > this.maximumEntries) {
+      const oldestKey = this.cache.keys().next().value
+      if (oldestKey === undefined) {
+        break
+      }
+      this.cache.delete(oldestKey)
+    }
+  }
+}
diff --git a/src/main/source-control/forge-provider.ts b/src/main/source-control/forge-provider.ts
index 775943052da..a3aef433110 100644
--- a/src/main/source-control/forge-provider.ts
+++ b/src/main/source-control/forge-provider.ts
@@ -66,7 +66,7 @@ export type ForgeReviewByNumberInput = ForgeProviderRepositoryContext & {
 export type ForgeProvider = {
   id: ForgeProviderId
   supportsReviewCreation: boolean
-  resolveRepository(context: ForgeProviderRepositoryContext): Promise<unknown | null>
+  resolveRepository(context: ForgeProviderRepositoryContext): Promise<unknown>
   getReviewForBranch(input: ForgeReviewForBranchInput): Promise<HostedReviewInfo | null>
   getReviewByNumber(input: ForgeReviewByNumberInput): Promise<HostedReviewInfo | null>
   createReview?(
diff --git a/src/main/source-control/stacked-hosted-review-creation.ts b/src/main/source-control/stacked-hosted-review-creation.ts
index 0a36588f493..53327cbd404 100644
--- a/src/main/source-control/stacked-hosted-review-creation.ts
+++ b/src/main/source-control/stacked-hosted-review-creation.ts
@@ -38,9 +38,8 @@ export async function createStackedHostedReview(
           url: created.existingReview.url
         }
       }
-    } else {
-      currentReview = { number: created.number, url: created.url }
     }
+    currentReview = { number: created.number, url: created.url }
   }
   if (!currentReview) {
     return {
diff --git a/src/main/ssh-pane-binding-partition.test.ts b/src/main/ssh-pane-binding-partition.test.ts
new file mode 100644
index 00000000000..a630f62a941
--- /dev/null
+++ b/src/main/ssh-pane-binding-partition.test.ts
@@ -0,0 +1,399 @@
+/**
+ * STA-3077 step P: an SSH pane's durable binding must live in ONE partition.
+ *
+ * Today it lives in two. Main's spawn writes `ssh:<target>`
+ * (ipc/pty.ts persistPtyBinding(binding, toSshExecutionHostId(connectionId))),
+ * the relay's reattach write passes no hostId and lands in `local`
+ * (ssh-relay-session.ts restoreReattachedPtyRuntime), and the renderer keeps SSH
+ * worktrees in `local` on purpose (buildHostIdByWorktreeId). Supersession then
+ * reads a binding no live writer maintains, so it compares the arriving lease
+ * against a stale pty id, bails, and leaves the predecessor live. That is the
+ * reported 2 -> 19 -> 20 mechanism.
+ *
+ * These oracles assert cardinality and identity — one pane, one live claim, and
+ * the surviving claim is the shell the pane is bound to — never which function
+ * ran, so they stay valid under any single-accessor implementation.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../shared/constants'
+import { LOCAL_EXECUTION_HOST_ID, toSshExecutionHostId } from '../shared/execution-host'
+import { toAppSshPtyId, toRelaySshPtyId } from '../shared/ssh-pty-id'
+
+const testState = { dir: '' }
+
+vi.mock('electron', () => ({
+  app: { getPath: () => testState.dir },
+  safeStorage: { isEncryptionAvailable: () => false }
+}))
+vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn() }))
+
+const TARGET = 'ssh-target-1'
+const SSH_PARTITION = toSshExecutionHostId(TARGET)
+const WORKTREE = 'repo-1:wt-1'
+const TAB = 'tab-1'
+/** Must be a real layout leaf UUID — the store drops any other spelling. */
+const LEAF = '3f1c9a2e-7b4d-4e1a-9c8f-2d5e6a7b8c90'
+
+const appPtyId = (relayPtyId: string): string => toAppSshPtyId(TARGET, relayPtyId)
+
+async function createStore(state: Record<string, unknown> = {}) {
+  mkdirSync(testState.dir, { recursive: true })
+  writeFileSync(
+    join(testState.dir, 'orca-data.json'),
+    JSON.stringify({ ...getDefaultPersistedState(testState.dir), ...state }),
+    'utf-8'
+  )
+  vi.resetModules()
+  const { Store, initDataPath } = await import('./persistence')
+  initDataPath()
+  return new Store()
+}
+
+type TestStore = Awaited<ReturnType<typeof createStore>>
+
+/** One SSH pane, bound to `relayPtyId`, as a partition stores it. */
+function paneSession(relayPtyId: string) {
+  const ptyId = appPtyId(relayPtyId)
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: {
+      [WORKTREE]: [
+        {
+          id: TAB,
+          ptyId,
+          worktreeId: WORKTREE,
+          title: 'Terminal 1',
+          defaultTitle: 'Terminal 1',
+          customTitle: null,
+          color: null,
+          sortOrder: 0,
+          createdAt: 1
+        }
+      ]
+    },
+    terminalLayoutsByTabId: {
+      [TAB]: {
+        root: { type: 'leaf' as const, leafId: LEAF },
+        activeLeafId: LEAF,
+        expandedLeafId: null,
+        ptyIdsByLeafId: { [LEAF]: ptyId }
+      }
+    }
+  }
+}
+
+/** session:set for an SSH worktree — buildHostIdByWorktreeId sends it to `local`. */
+function rendererPublishesPane(store: TestStore, relayPtyId: string): void {
+  store.setWorkspaceSession(paneSession(relayPtyId) as never, LOCAL_EXECUTION_HOST_ID)
+}
+
+/** A mid-session write into `ssh:<target>` — orphan adoption still targets that partition, so the
+ *  one-time load fold cannot be the only thing keeping the two homes from reappearing. */
+function somethingRewritesTheSshPartition(store: TestStore, relayPtyId: string): void {
+  store.setWorkspaceSession(paneSession(relayPtyId) as never, SSH_PARTITION)
+}
+
+/** ssh-relay-session.ts:2504 — the reattach bind. No hostId, refuses to create. */
+function relayReattachBindsPane(store: TestStore, relayPtyId: string): boolean | null {
+  return store.persistPtyBinding({
+    worktreeId: WORKTREE,
+    tabId: TAB,
+    leafId: LEAF,
+    ptyId: appPtyId(relayPtyId),
+    incarnationId: `inc-${relayPtyId}`,
+    mayCreate: false
+  })
+}
+
+/** ipc/pty.ts:6493 — the spawn's lease upsert, ahead of its binding write. */
+function sshSpawnUpsertsLease(store: TestStore, relayPtyId: string): void {
+  store.upsertSshRemotePtyLease({
+    targetId: TARGET,
+    ptyId: toRelaySshPtyId(TARGET, appPtyId(relayPtyId)),
+    worktreeId: WORKTREE,
+    tabId: TAB,
+    leafId: LEAF,
+    state: 'attached',
+    lastAttachedAt: Date.now()
+  })
+}
+
+function liveLeaseIdsForPane(store: TestStore): string[] {
+  return store
+    .getSshRemotePtyLeases(TARGET)
+    .filter(
+      (lease) =>
+        lease.tabId === TAB &&
+        lease.leafId === LEAF &&
+        lease.state !== 'terminated' &&
+        lease.state !== 'expired'
+    )
+    .map((lease) => lease.ptyId)
+    .sort()
+}
+
+/** The argument text of every `callee(...)` call in a production source file. */
+function callArgumentsIn(source: string, callee: string): string[] {
+  const calls: string[] = []
+  for (let index = source.indexOf(`${callee}(`); index !== -1; ) {
+    let cursor = index + callee.length
+    const start = cursor + 1
+    for (let depth = 0; cursor < source.length; cursor += 1) {
+      if (source[cursor] === '(') {
+        depth += 1
+      } else if (source[cursor] === ')' && --depth === 0) {
+        break
+      }
+    }
+    calls.push(source.slice(start, cursor))
+    index = source.indexOf(`${callee}(`, cursor)
+  }
+  return calls
+}
+
+/** On-disk state from an earlier session: both partitions name the same shell,
+ *  because main's spawn wrote `ssh:<target>` and the renderer published `local`.
+ *  They diverge as soon as the relay's reattach write updates only `local`. */
+function diskAfterEarlierSession(relayPtyId: string) {
+  return {
+    workspaceSession: paneSession(relayPtyId),
+    workspaceSessionsByHostId: { [SSH_PARTITION]: paneSession(relayPtyId) }
+  }
+}
+
+beforeEach(() => {
+  testState.dir = mkdtempSync(join(tmpdir(), 'orca-sta3077-partition-'))
+})
+
+describe('STA-3077 step P: one pane, one live claim across partitions', () => {
+  // The pane is bound to pty-2 in `local` (the relay's reattach write put it
+  // there); the SSH partition still names the predecessor pty-1. Supersession
+  // reads ssh-first, sees pty-1 != pty-2, and bails — both shells stay claimed.
+  it('supersedes the predecessor when the pane is bound in the local partition', async () => {
+    const store = await createStore(diskAfterEarlierSession('pty-1'))
+    sshSpawnUpsertsLease(store, 'pty-1')
+    expect(relayReattachBindsPane(store, 'pty-2')).toBe(true)
+
+    sshSpawnUpsertsLease(store, 'pty-2')
+
+    expect(liveLeaseIdsForPane(store)).toEqual(['pty-2'])
+  })
+
+  // reattachKnownPtys calls this first, so a wrong winner here is what fans the
+  // reconnect out over a dead id and grafts a pane the user never opened.
+  it('keeps the lease the live pane binding names when healing duplicates', async () => {
+    const store = await createStore(diskAfterEarlierSession('pty-1'))
+    sshSpawnUpsertsLease(store, 'pty-1')
+    sshSpawnUpsertsLease(store, 'pty-2')
+    expect(relayReattachBindsPane(store, 'pty-2')).toBe(true)
+
+    await store.supersedeDuplicatePaneLeases(TARGET)
+
+    expect(liveLeaseIdsForPane(store)).toEqual(['pty-2'])
+  })
+
+  // Isolates the reader from the one-time load fold. Without this clause the fold masks the
+  // partition preference — it deletes the divergent copy at boot, so restoring the ssh-first
+  // hedge stays green and the reader guard ships unproven. Anything that writes `ssh:<target>`
+  // after load (orphan adoption still does) would then revive the defect inside one session.
+  it('supersedes the predecessor when the ssh partition is rewritten mid-session', async () => {
+    const store = await createStore(diskAfterEarlierSession('pty-1'))
+    sshSpawnUpsertsLease(store, 'pty-1')
+    expect(relayReattachBindsPane(store, 'pty-2')).toBe(true)
+    somethingRewritesTheSshPartition(store, 'pty-1')
+
+    sshSpawnUpsertsLease(store, 'pty-2')
+
+    expect(liveLeaseIdsForPane(store)).toEqual(['pty-2'])
+  })
+
+  // The reported growth: live claims must not scale with reconnect count.
+  it('holds the live claim count flat across ten reconnects of one pane', async () => {
+    const store = await createStore(diskAfterEarlierSession('pty-0'))
+    sshSpawnUpsertsLease(store, 'pty-0')
+
+    for (let reconnect = 1; reconnect <= 10; reconnect += 1) {
+      expect(relayReattachBindsPane(store, `pty-${reconnect}`)).toBe(true)
+      sshSpawnUpsertsLease(store, `pty-${reconnect}`)
+    }
+
+    expect(liveLeaseIdsForPane(store)).toEqual(['pty-10'])
+  })
+})
+
+describe('STA-3077: a decision made from one plane only mutates that plane', () => {
+  // Arbitration ranks using the desktop plane's binding. The headless plane's binding never gets a
+  // vote, so deleting it here would strand a shell its owner may still be using — and that owner
+  // would then have no durable record to reattach by. An explicit expiry is different: the pty is
+  // gone for everyone, and that path still scrubs both.
+  it('leaves the headless plane binding intact when supersession retires its lease', async () => {
+    const sshSession = paneSession('pty-old') as unknown as Record<string, unknown>
+    const store = await createStore({
+      workspaceSession: paneSession('pty-new'),
+      workspaceSessionsByHostId: { [SSH_PARTITION]: sshSession }
+    })
+    sshSpawnUpsertsLease(store, 'pty-old')
+
+    // Local names pty-new, so arbitration expires pty-old without the other plane being consulted.
+    sshSpawnUpsertsLease(store, 'pty-new')
+
+    expect(liveLeaseIdsForPane(store)).toEqual(['pty-new'])
+    expect(
+      store.getWorkspaceSession(SSH_PARTITION).terminalLayoutsByTabId?.[TAB]?.ptyIdsByLeafId?.[LEAF]
+    ).toBe(appPtyId('pty-old'))
+  })
+})
+
+describe('STA-3077: a pane moved between tabs still supersedes its own predecessor', () => {
+  // The reported cardinality growth, in its surviving form. A lease freezes its tabId at write
+  // time. Break the pane out into a new tab and its next lease carries the NEW tab, so matching
+  // siblings on tabId means the two leases for one pane never meet — the predecessor is never
+  // superseded and the count grows on every reconnect, exactly as reported.
+  function leaseInTab(store: TestStore, relayPtyId: string, tabId: string): void {
+    store.upsertSshRemotePtyLease({
+      targetId: TARGET,
+      ptyId: toRelaySshPtyId(TARGET, appPtyId(relayPtyId)),
+      worktreeId: WORKTREE,
+      tabId,
+      leafId: LEAF,
+      state: 'attached',
+      lastAttachedAt: Date.now()
+    })
+  }
+  const liveForLeaf = (store: TestStore): string[] =>
+    store
+      .getSshRemotePtyLeases(TARGET)
+      .filter((l) => l.leafId === LEAF && l.state !== 'terminated' && l.state !== 'expired')
+      .map((l) => l.ptyId)
+      .sort()
+
+  it('supersedes a predecessor whose lease names the tab the pane left', async () => {
+    const store = await createStore()
+    leaseInTab(store, 'pty-old', TAB)
+
+    leaseInTab(store, 'pty-new', 'tab-moved-to')
+
+    expect(liveForLeaf(store)).toEqual(['pty-new'])
+  })
+
+  it('holds the count flat across ten reconnects that each land in a new tab', async () => {
+    const store = await createStore()
+    leaseInTab(store, 'pty-0', TAB)
+    for (let n = 1; n <= 10; n += 1) {
+      leaseInTab(store, `pty-${n}`, `tab-${n}`)
+    }
+
+    expect(liveForLeaf(store)).toEqual(['pty-10'])
+  })
+})
+
+describe('STA-3077: arbitration follows the pane, not the tab it was written in', () => {
+  // A lease freezes its tabId when written; `detachTerminalPaneToTab` then moves the live pane and
+  // its PTY into a new tab. Looking the binding up under the frozen tab finds nothing, so the bound
+  // shell loses to recency and supersession retires the pane's OWN shell in favour of a stale one.
+  it('finds the binding after the pane has been moved to another tab', async () => {
+    const MOVED_TAB = 'tab-moved-to'
+    const store = await createStore()
+    // The renderer publishes the pane in its NEW tab; the lease still names the old one.
+    store.setWorkspaceSession(
+      {
+        ...getDefaultWorkspaceSession(),
+        tabsByWorktree: { [WORKTREE]: [{ id: MOVED_TAB, worktreeId: WORKTREE }] },
+        terminalLayoutsByTabId: {
+          [MOVED_TAB]: {
+            root: { type: 'leaf' as const, leafId: LEAF },
+            activeLeafId: LEAF,
+            expandedLeafId: null,
+            ptyIdsByLeafId: { [LEAF]: appPtyId('pty-bound') }
+          }
+        }
+      } as never,
+      LOCAL_EXECUTION_HOST_ID
+    )
+    sshSpawnUpsertsLease(store, 'pty-bound')
+    // A newer, unbound lease arrives for the same pane under the lease's frozen tab.
+    sshSpawnUpsertsLease(store, 'pty-newer')
+
+    await store.supersedeDuplicatePaneLeases(TARGET)
+
+    // The bound shell must win. Keyed on the frozen tab, it is invisible and recency retires it.
+    expect(liveLeaseIdsForPane(store)).toEqual(['pty-bound'])
+  })
+})
+
+describe('STA-3077 step P: the desktop plane resolves from its own home', () => {
+  // INVERTED. This clause used to require the two partitions to AGREE after load, which assumed
+  // `ssh:<target>` was a stale spill of this plane's state. It is not — it is the headless/CLI
+  // plane's own home, which that plane writes and reads deliberately (STA-3463, STA-3465). The
+  // property that actually matters is narrower and stronger: what the desktop plane resolves must
+  // follow `local` alone, whatever the other plane holds. Asserting agreement made a migration look
+  // necessary that in fact erased another plane's live state.
+  it('resolves to the local binding regardless of what the ssh partition holds', async () => {
+    const store = await createStore(diskAfterEarlierSession('pty-1'))
+
+    rendererPublishesPane(store, 'pty-1')
+    expect(relayReattachBindsPane(store, 'pty-2')).toBe(true)
+    // The other plane names the predecessor. It does not get a vote here — local speaking about
+    // this leaf IS the desktop plane's live view, and letting the other copy outrank it is the
+    // STA-3077 defect. Its binding to the loser is then scrubbed with every other reference to
+    // that retired lease, so the two planes do not drift further apart.
+    somethingRewritesTheSshPartition(store, 'pty-1')
+    sshSpawnUpsertsLease(store, 'pty-2')
+
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId?.[TAB]?.ptyIdsByLeafId?.[LEAF]).toBe(
+      appPtyId('pty-2')
+    )
+    expect(liveLeaseIdsForPane(store)).toEqual(['pty-2'])
+  })
+})
+
+describe('STA-3077 step P: every production caller names that one home', () => {
+  const summarize = (source: string): string => source.replace(/\s+/g, ' ').trim().slice(0, 90)
+
+  // A guard that behaves correctly is not evidence that both writers reach it,
+  // and the defect IS that they disagree — so pin the call sites too.
+  it('has no SSH pane binding write that selects the ssh partition', () => {
+    const file = 'src/main/ipc/pty.ts'
+    const calls = callArgumentsIn(readFileSync(file, 'utf-8'), 'persistPtyBinding')
+    expect(calls.length, `${file} no longer writes pane bindings`).toBeGreaterThan(0)
+
+    const partitioned = calls
+      .filter((call) => call.includes('toSshExecutionHostId'))
+      .map((call) => `${file}: ${summarize(call)}`)
+
+    expect(partitioned).toEqual([])
+  })
+
+  // STRENGTHENED, not relaxed. This clause used to require the relay to hold a `persistPtyBinding`
+  // call of its own and merely forbid an ssh-partition argument on it. Step F removed that call:
+  // the relay binds through the one `bindPaneShell` producer, which is what makes the superseded-
+  // pane fence live on reattach. Requiring ZERO direct writes here is the stronger property — a
+  // second bind producer is exactly the defect that let spawn and reattach disagree.
+  it('has no pane binding write in the relay that bypasses the one bind producer', () => {
+    const source = readFileSync('src/main/ssh/ssh-relay-session.ts', 'utf-8')
+
+    expect(callArgumentsIn(source, 'persistPtyBinding').map(summarize)).toEqual([])
+    expect(source).toContain('bindPaneShell(')
+  })
+
+  // The readers must land in the same place; one that still consults
+  // `ssh:<target>` reinstates the disagreement from the other side.
+  it('has no stable-pane owner reader that selects the ssh partition', () => {
+    const source = readFileSync('src/main/ipc/pty.ts', 'utf-8')
+    const start = source.indexOf('function resolvePersistedStablePaneOwner')
+    const readers = source.slice(start, source.indexOf('type StablePaneSpawnContext'))
+    expect(start, 'stable-pane owner readers moved').toBeGreaterThan(0)
+    expect(readers).toContain('getWorkspaceSession(')
+
+    const partitioned = readers
+      .split('\n')
+      .filter((line) => line.includes('toSshExecutionHostId'))
+      .map(summarize)
+
+    expect(partitioned).toEqual([])
+  })
+})
diff --git a/src/main/ssh-reattach-pane-cardinality.test.ts b/src/main/ssh-reattach-pane-cardinality.test.ts
new file mode 100644
index 00000000000..8f5665981c4
--- /dev/null
+++ b/src/main/ssh-reattach-pane-cardinality.test.ts
@@ -0,0 +1,742 @@
+/**
+ * STA-3077 behavioral oracles: reconnecting an SSH workspace must not add panes
+ * the user never opened, and must not accumulate remote shells.
+ *
+ * These assert observable behavior, not a mechanism, so they stay valid under
+ * any implementation that fixes the defect. Each case names the root cause it
+ * pins from the #12264 diagnosis.
+ *
+ * Reported symptom: relay PTY count went 2 -> 19 -> 20 across three reconnects.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { getDefaultPersistedState } from '../shared/constants'
+
+const testState = { dir: '' }
+
+vi.mock('electron', () => ({
+  app: { getPath: () => testState.dir },
+  safeStorage: { isEncryptionAvailable: () => false }
+}))
+vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn() }))
+
+const TARGET = 'ssh-target-1'
+const WORKTREE = 'repo-1:wt-1'
+const TAB = 'tab-1'
+/** Must be a real layout leaf UUID — the store drops any other spelling. */
+const LEAF = '3f1c9a2e-7b4d-4e1a-9c8f-2d5e6a7b8c90'
+
+async function createStore(state: Record<string, unknown> = {}) {
+  mkdirSync(testState.dir, { recursive: true })
+  writeFileSync(
+    join(testState.dir, 'orca-data.json'),
+    JSON.stringify({ ...getDefaultPersistedState(testState.dir), ...state }),
+    'utf-8'
+  )
+  vi.resetModules()
+  const { Store, initDataPath } = await import('./persistence')
+  initDataPath()
+  return new Store()
+}
+
+beforeEach(() => {
+  testState.dir = mkdtempSync(join(tmpdir(), 'orca-sta3077-'))
+})
+
+/** One pane's lease, as the reattach path records it. */
+function leaseFor(ptyId: string, updatedAt: number) {
+  return {
+    targetId: TARGET,
+    ptyId,
+    worktreeId: WORKTREE,
+    tabId: TAB,
+    leafId: LEAF,
+    state: 'attached' as const,
+    updatedAt
+  }
+}
+
+function liveLeasesForPane(store: {
+  getSshRemotePtyLeases: (targetId?: string) => readonly {
+    ptyId: string
+    tabId?: string
+    leafId?: string
+    state: string
+  }[]
+}) {
+  return store
+    .getSshRemotePtyLeases(TARGET)
+    .filter(
+      (lease) =>
+        lease.tabId === TAB &&
+        lease.leafId === LEAF &&
+        lease.state !== 'terminated' &&
+        lease.state !== 'expired'
+    )
+}
+
+describe('STA-3077: one pane owns at most one live remote PTY lease', () => {
+  // RC1: lease uniqueness keys on (targetId, ptyId) only, so a pane whose PTY id
+  // changes leaves its predecessor behind with nothing to retire it.
+  it('does not accumulate a second live lease when one pane re-leases a new PTY id', async () => {
+    const store = await createStore()
+
+    store.upsertSshRemotePtyLease(leaseFor('relay-pty-a', 1))
+    store.upsertSshRemotePtyLease(leaseFor('relay-pty-b', 2))
+
+    expect(liveLeasesForPane(store)).toHaveLength(1)
+  })
+
+  // RC1: the reported 2 -> 19 -> 20 growth. Lease count must not scale with
+  // reconnect count for a fixed set of panes.
+  it('keeps live lease count flat across repeated reconnects of one pane', async () => {
+    const store = await createStore()
+
+    for (let reconnect = 0; reconnect < 10; reconnect += 1) {
+      store.upsertSshRemotePtyLease(leaseFor(`relay-pty-${reconnect}`, reconnect + 1))
+    }
+
+    expect(liveLeasesForPane(store)).toHaveLength(1)
+  })
+})
+
+describe('STA-3077: superseding respects the durable pane binding', () => {
+  // Spawn-shaped setup: the creating branches are intentionally allowed here.
+  function bindPaneTo(store: Awaited<ReturnType<typeof createStore>>, ptyId: string) {
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: TAB,
+      leafId: LEAF,
+      ptyId,
+      incarnationId: `inc-${ptyId}`
+    })
+  }
+
+  it('scrubs the predecessor binding when the arriving lease is the bound one', async () => {
+    const store = await createStore()
+    bindPaneTo(store, 'relay-pty-a')
+    store.upsertSshRemotePtyLease(leaseFor('relay-pty-a', 1))
+    bindPaneTo(store, 'relay-pty-b')
+    store.upsertSshRemotePtyLease(leaseFor('relay-pty-b', 2))
+
+    expect(liveLeasesForPane(store).map((lease) => lease.ptyId)).toEqual(['relay-pty-b'])
+    const layout = store.getWorkspaceSession().terminalLayoutsByTabId?.[TAB]
+    expect(layout?.ptyIdsByLeafId?.[LEAF]).toBe('relay-pty-b')
+  })
+
+  // Expiring the bound predecessor here would detach a live pane, so both stay
+  // live and reattach arbitrates with the binding in hand.
+  it('defers instead of expiring the lease the pane is bound to', async () => {
+    const store = await createStore()
+    bindPaneTo(store, 'relay-pty-a')
+    store.upsertSshRemotePtyLease(leaseFor('relay-pty-a', 1))
+    store.upsertSshRemotePtyLease(leaseFor('relay-pty-b', 2))
+
+    expect(
+      liveLeasesForPane(store)
+        .map((lease) => lease.ptyId)
+        .sort()
+    ).toEqual(['relay-pty-a', 'relay-pty-b'])
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId?.[TAB]?.ptyIdsByLeafId?.[LEAF]).toBe(
+      'relay-pty-a'
+    )
+
+    // Arbitration keeps the bound lease, not the newer one.
+    expect(await store.supersedeDuplicatePaneLeases(TARGET)).toBe(1)
+    expect(liveLeasesForPane(store).map((lease) => lease.ptyId)).toEqual(['relay-pty-a'])
+  })
+})
+
+describe('STA-3077: existing duplicate leases are healed, not revived', () => {
+  // Installs that predate pane-keyed supersession already carry the duplicates
+  // this bug accumulated. Preventing new ones does not help them.
+  it('retires every stale duplicate for a pane and keeps the newest', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: Array.from({ length: 20 }, (_, index) => ({
+        ...leaseFor(`relay-pty-${index}`, index + 1),
+        createdAt: index + 1
+      }))
+    })
+
+    const retired = await store.supersedeDuplicatePaneLeases(TARGET)
+
+    expect(retired).toBe(19)
+    expect(liveLeasesForPane(store).map((lease) => lease.ptyId)).toEqual(['relay-pty-19'])
+  })
+
+  // Recency alone would retire the lease the pane is actually bound to whenever a
+  // newer unbound lease exists, detaching a live pane instead of healing it.
+  it('keeps the durably bound lease even when an unbound one is newer', async () => {
+    const store = await createStore()
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: TAB,
+      leafId: LEAF,
+      ptyId: 'relay-pty-bound',
+      incarnationId: 'inc-bound'
+    })
+    store.upsertSshRemotePtyLease({ ...leaseFor('relay-pty-bound', 1), createdAt: 1 })
+    // Arrives later but no pane is bound to it.
+    store.upsertSshRemotePtyLease({ ...leaseFor('relay-pty-newer', 99), createdAt: 99 })
+
+    await store.supersedeDuplicatePaneLeases(TARGET)
+
+    expect(liveLeasesForPane(store).map((lease) => lease.ptyId)).toEqual(['relay-pty-bound'])
+  })
+
+  // A retirement that is not durable must not be believed: it would read as
+  // retired in memory and attached on disk for the rest of the session.
+  it('rolls the retirement back when the durable write fails', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    // The durable write is the async twin: retirement runs on reconnect, and the sync flush
+    // fsyncs a multi-MB file from the main thread. Reaching for a private name is not ideal,
+    // but the property under test is the rollback, and it must follow whichever writer the
+    // retirement actually awaits.
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockRejectedValue(new Error('disk full'))
+
+    expect(await store.supersedeDuplicatePaneLeases(TARGET)).toBe(0)
+    expect(liveLeasesForPane(store)).toHaveLength(2)
+  })
+
+  it('does not chase store mutations after the retirement generation is durable', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    const internal = store as unknown as { enqueueWrite: () => Promise<void> }
+    const enqueueWrite = internal.enqueueWrite.bind(store)
+    let injectedMutation = false
+    const enqueueSpy = vi.spyOn(internal, 'enqueueWrite').mockImplementation(async () => {
+      await enqueueWrite()
+      if (!injectedMutation) {
+        injectedMutation = true
+        store.updateUI({ sidebarWidth: 777 })
+      }
+    })
+
+    expect(await store.supersedeDuplicatePaneLeases(TARGET)).toBe(1)
+
+    expect(enqueueSpy).toHaveBeenCalledOnce()
+    enqueueSpy.mockRestore()
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+  })
+
+  it('retries when a mutation invalidates the retirement write before rename', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    const internal = store as unknown as { writeToDiskAsync: () => Promise<void> }
+    const writeToDiskAsync = internal.writeToDiskAsync.bind(store)
+    let injectedMutation = false
+    const writeSpy = vi.spyOn(internal, 'writeToDiskAsync').mockImplementation(async () => {
+      const write = writeToDiskAsync()
+      if (!injectedMutation) {
+        injectedMutation = true
+        store.updateUI({ sidebarWidth: 778 })
+      }
+      await write
+    })
+
+    expect(await store.supersedeDuplicatePaneLeases(TARGET)).toBe(1)
+
+    expect(writeSpy).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not undo a concurrent confirmation of the provisional expired state', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.supersedeDuplicatePaneLeases(TARGET)
+    store.markSshRemotePtyLease(TARGET, 'relay-pty-a', 'expired')
+    rejectWrite(new Error('disk full'))
+
+    expect(await retirement).toBe(0)
+    expect(
+      store.getSshRemotePtyLeases(TARGET).find((lease) => lease.ptyId === 'relay-pty-a')?.state
+    ).toBe('expired')
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+  })
+
+  it('rolls back after a rejected concurrent attach request', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.supersedeDuplicatePaneLeases(TARGET)
+    store.markSshRemotePtyLease(TARGET, 'relay-pty-a', 'attached')
+    rejectWrite(new Error('disk full'))
+
+    expect(await retirement).toBe(0)
+    expect(
+      store.getSshRemotePtyLeases(TARGET).find((lease) => lease.ptyId === 'relay-pty-a')?.state
+    ).toBe('attached')
+  })
+
+  it('does not revive a provisional loser after a concurrent same-pane upsert', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.supersedeDuplicatePaneLeases(TARGET)
+    store.upsertSshRemotePtyLease({ ...leaseFor('relay-pty-c', 3), createdAt: 3 })
+    rejectWrite(new Error('disk full'))
+
+    expect(await retirement).toBe(0)
+    expect(liveLeasesForPane(store).map((lease) => lease.ptyId)).toEqual(['relay-pty-c'])
+  })
+
+  it('does not restore attached state over a concurrent detach', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.supersedeDuplicatePaneLeases(TARGET)
+    store.markSshRemotePtyLeasesForShutdown(TARGET, 'detached')
+    rejectWrite(new Error('disk full'))
+
+    expect(await retirement).toBe(0)
+    expect(
+      store.getSshRemotePtyLeases(TARGET).find((lease) => lease.ptyId === 'relay-pty-a')?.state
+    ).toBe('expired')
+    expect(
+      store.getSshRemotePtyLeases(TARGET).find((lease) => lease.ptyId === 'relay-pty-b')?.state
+    ).toBe('detached')
+  })
+
+  it('does not roll back concurrent session or lease changes after a failed write', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.supersedeDuplicatePaneLeases(TARGET)
+    store.markSshRemotePtyLease(TARGET, 'relay-pty-a', 'terminated')
+    const concurrentTab = 'tab-concurrent'
+    const concurrentLeaf = '8a2b4c6d-1e3f-4a5b-8c7d-9e0f1a2b3c4d'
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: concurrentTab,
+      leafId: concurrentLeaf,
+      ptyId: 'relay-pty-concurrent',
+      incarnationId: 'inc-concurrent'
+    })
+    rejectWrite(new Error('disk full'))
+
+    expect(await retirement).toBe(0)
+    expect(
+      store.getSshRemotePtyLeases(TARGET).find((lease) => lease.ptyId === 'relay-pty-a')?.state
+    ).toBe('terminated')
+    expect(
+      store.getWorkspaceSession().terminalLayoutsByTabId?.[concurrentTab]?.ptyIdsByLeafId?.[
+        concurrentLeaf
+      ]
+    ).toBe('relay-pty-concurrent')
+  })
+
+  it('does not restore a binding for a lease removed during a failed write', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: TAB,
+      leafId: LEAF,
+      ptyId: 'relay-pty-a',
+      incarnationId: 'inc-a'
+    })
+    delete store.getWorkspaceSession().terminalLayoutsByTabId?.[TAB]?.ptyIdsByLeafId?.[LEAF]
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.supersedeDuplicatePaneLeases(TARGET)
+    store.removeSshRemotePtyLease(TARGET, 'relay-pty-a')
+    rejectWrite(new Error('disk full'))
+
+    expect(await retirement).toBe(0)
+    expect(store.getSshRemotePtyLeases(TARGET).some((lease) => lease.ptyId === 'relay-pty-a')).toBe(
+      false
+    )
+    expect(
+      store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]?.find((tab) => tab.id === TAB)?.ptyId
+    ).toBeNull()
+  })
+
+  it('restores a tab binding into the moved leaf after a concurrent session replacement', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: TAB,
+      leafId: LEAF,
+      ptyId: 'relay-pty-a',
+      incarnationId: 'inc-a'
+    })
+    delete store.getWorkspaceSession().terminalLayoutsByTabId?.[TAB]?.ptyIdsByLeafId?.[LEAF]
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.supersedeDuplicatePaneLeases(TARGET)
+    expect(
+      store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]?.find((tab) => tab.id === TAB)?.ptyId
+    ).toBeNull()
+    const movedTabId = 'tab-moved'
+    const replacement = structuredClone(store.getWorkspaceSession())
+    const movedTab = replacement.tabsByWorktree?.[WORKTREE]?.find((tab) => tab.id === TAB)
+    if (!movedTab || !replacement.terminalLayoutsByTabId?.[TAB]) {
+      throw new Error('expected source tab and layout')
+    }
+    movedTab.id = movedTabId
+    replacement.terminalLayoutsByTabId[movedTabId] = replacement.terminalLayoutsByTabId[TAB]
+    delete replacement.terminalLayoutsByTabId[TAB]
+    store.setWorkspaceSession(replacement)
+    rejectWrite(new Error('disk full'))
+
+    expect(await retirement).toBe(0)
+    expect(
+      store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]?.find((tab) => tab.id === movedTabId)
+        ?.ptyId
+    ).toBe('relay-pty-a')
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+  })
+
+  it('does not restore a retired binding after the leaf is deleted', async () => {
+    const otherTab = 'tab-other'
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2, tabId: otherTab }
+      ]
+    })
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: TAB,
+      leafId: LEAF,
+      ptyId: 'relay-pty-a',
+      incarnationId: 'inc-a'
+    })
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: otherTab,
+      leafId: LEAF,
+      ptyId: 'relay-pty-b',
+      incarnationId: 'inc-b'
+    })
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.supersedeDuplicatePaneLeases(TARGET)
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId?.[TAB]?.ptyIdsByLeafId?.[LEAF]).toBe(
+      undefined
+    )
+    const replacement = structuredClone(store.getWorkspaceSession())
+    replacement.tabsByWorktree![WORKTREE] = []
+    replacement.terminalLayoutsByTabId = {}
+    store.setWorkspaceSession(replacement)
+    rejectWrite(new Error('disk full'))
+
+    expect(await retirement).toBe(0)
+    expect(store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]).toEqual([])
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId).toEqual({})
+  })
+
+  it('leaves distinct panes alone', async () => {
+    const otherLeaf = '8a2b4c6d-1e3f-4a5b-8c7d-9e0f1a2b3c4d'
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2, leafId: otherLeaf }
+      ]
+    })
+
+    expect(await store.supersedeDuplicatePaneLeases(TARGET)).toBe(0)
+    expect(store.getSshRemotePtyLeases(TARGET).filter((l) => l.state === 'attached')).toHaveLength(
+      2
+    )
+  })
+
+  // A lease is rebuilt field by field on load, so a field added to the type but not to the
+  // normalizer is dropped on every boot — it would look right in memory and be gone on the next
+  // start, which is how a fence ships silently permitting everything. A synthesized identity is
+  // refused outright rather than carried: it is not stable across reconnects, so one persisted by
+  // another build would later read as a different shell and strand a live pane.
+  it('keeps a host-attested incarnation across a reload and refuses a synthesized one', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1, incarnationId: 'inc-host-a' },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2, incarnationId: 'legacy:23:0:relay-pty-b' }
+      ]
+    })
+
+    const byPtyId = new Map(store.getSshRemotePtyLeases(TARGET).map((l) => [l.ptyId, l]))
+    expect(byPtyId.get('relay-pty-a')?.incarnationId).toBe('inc-host-a')
+    expect(byPtyId.get('relay-pty-b')?.incarnationId).toBeUndefined()
+  })
+})
+
+describe('SSH reconnect lease retirement batching', () => {
+  it('keeps concurrent terminal state when the asynchronous write fails', async () => {
+    const store = await createStore({
+      sshRemotePtyLeases: [
+        { ...leaseFor('relay-pty-a', 1), createdAt: 1 },
+        { ...leaseFor('relay-pty-b', 2), createdAt: 2 }
+      ]
+    })
+    let rejectWrite: (error: Error) => void = () => {}
+    vi.spyOn(
+      store as unknown as { flushDurableStateOrThrowAsync: () => Promise<void> },
+      'flushDurableStateOrThrowAsync'
+    ).mockImplementation(
+      () =>
+        new Promise((_, reject) => {
+          rejectWrite = reject
+        })
+    )
+
+    const retirement = store.markSshRemotePtyLeasesTerminatedAsync(TARGET, ['relay-pty-a'])
+    const concurrentTab = 'tab-concurrent'
+    const concurrentLeaf = '8a2b4c6d-1e3f-4a5b-8c7d-9e0f1a2b3c4d'
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: concurrentTab,
+      leafId: concurrentLeaf,
+      ptyId: 'relay-pty-concurrent',
+      incarnationId: 'inc-concurrent'
+    })
+    rejectWrite(new Error('disk full'))
+
+    await expect(retirement).rejects.toThrow('disk full')
+    expect(
+      store.getWorkspaceSession().terminalLayoutsByTabId?.[concurrentTab]?.ptyIdsByLeafId?.[
+        concurrentLeaf
+      ]
+    ).toBe('relay-pty-concurrent')
+  })
+})
+
+describe('STA-3077: reattach binds panes, it never creates them', () => {
+  // RC3: persistPtyBinding has four creating branches (mint tab, mint root leaf,
+  // split root and graft leaf, mint layout). They are load-bearing for spawn and
+  // wrong for reattach, where the pane either exists or is gone for good.
+  it('does not mint a tab for a pane that no longer exists', async () => {
+    const store = await createStore()
+
+    store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: TAB,
+      leafId: LEAF,
+      ptyId: 'relay-pty-a',
+      incarnationId: 'inc-a',
+      mayCreate: false
+    })
+
+    const session = store.getWorkspaceSession()
+    expect(session.tabsByWorktree?.[WORKTREE] ?? []).toHaveLength(0)
+    expect(session.terminalLayoutsByTabId?.[TAB]).toBeUndefined()
+  })
+
+  // Unknown is not dead: failing to resolve a pane must not be reported as
+  // success, and must not terminate anything.
+  it('reports an unresolved reattach rather than silently succeeding', async () => {
+    const store = await createStore()
+
+    const bound = store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: TAB,
+      leafId: LEAF,
+      ptyId: 'relay-pty-a',
+      incarnationId: 'inc-a',
+      mayCreate: false
+    })
+
+    expect(bound).toBe(false)
+  })
+})
+
+describe('STA-3077: exact-binding compare-and-swap', () => {
+  // Already correct at HEAD. Pinned so a fix cannot regress it: a stale renderer
+  // replay must not overwrite a binding the host has since re-admitted.
+  it('refuses a write whose expected binding no longer matches', async () => {
+    const store = await createStore()
+
+    const stale = store.persistPtyBinding({
+      worktreeId: WORKTREE,
+      tabId: TAB,
+      leafId: LEAF,
+      ptyId: 'relay-pty-b',
+      incarnationId: 'inc-b',
+      expectedBinding: { ptyId: 'relay-pty-a', incarnationId: 'inc-a' }
+    })
+
+    expect(stale).toBe(false)
+  })
+})
+
+describe('STA-3077 step F: live-layout tab resolution is reattach-only', () => {
+  // The lease's tabId is the frozen side on reattach, so the live layout outranks it there. On a
+  // SPAWN the opposite holds: the caller's tabId is fresh truth and the persisted layout is the
+  // stale side, because the renderer publishes membership on a debounce. Breaking a pane out into
+  // a new tab and spawning into it inside that window would otherwise resolve back to the tab the
+  // pane just left, writing the durable binding and the fence under one tab while the lease and
+  // the runtime registration use the other — the split-coordinate defect step F exists to remove.
+  it('resolves the live tab only on the reattach bind, never on a spawn', async () => {
+    const { readFileSync } = await import('node:fs')
+    const relay = readFileSync('src/main/ssh/ssh-relay-session.ts', 'utf-8')
+    const ipc = readFileSync('src/main/ipc/pty.ts', 'utf-8')
+
+    // The reattach holds a tabId frozen in a lease, so it must resolve the live one first.
+    expect(relay).toContain('resolvePaneShellTabId(')
+    // Resolving BEFORE the durable write is what keeps a thrown write from losing the answer and
+    // registering the pane in the graph under the tab it left.
+    expect(relay.indexOf('resolvePaneShellTabId(')).toBeLessThan(relay.indexOf('bindPaneShell({'))
+    // Spawn callers hold the fresh tabId; none of them may consult the debounced layout.
+    expect(ipc).toContain('bindPaneShell({')
+    expect(ipc.split('bindPaneShell({').slice(1).join('')).not.toContain('resolvePaneShellTabId')
+  })
+})
+
+describe('STA-3077: the reattach path actually refuses to create', () => {
+  // This is the oracle the store-level tests could not provide: `mayCreate`
+  // existed and was correct, but no production caller passed it, so reattach
+  // still grafted panes. Pin the wiring, not just the capability.
+  // The reattach bind now goes through the one `bindPaneShell` producer, and it
+  // still refuses to create.
+  it('passes mayCreate:false from the SSH reattach binding write', async () => {
+    const { readFileSync } = await import('node:fs')
+    const source = readFileSync('src/main/ssh/ssh-relay-session.ts', 'utf-8')
+    const bindCall = source.slice(
+      source.indexOf('restoreReattachedPtyRuntime'),
+      source.indexOf('private async attachPtyWithRetry')
+    )
+    expect(bindCall).toContain('bindPaneShell')
+    expect(bindCall).toContain('mayCreate: false')
+  })
+
+  // Strengthened, not relaxed: counting guards against calls went vacuous once
+  // the direct store calls disappeared, so pin both halves instead.
+  it('has no production persistPtyBinding caller that can create during reattach', async () => {
+    const { readFileSync } = await import('node:fs')
+    const source = readFileSync('src/main/ssh/ssh-relay-session.ts', 'utf-8')
+    // Every bind in the relay session is a reattach; none may grow topology.
+    expect(source.split('persistPtyBinding(').length - 1).toBe(0)
+    const binds = source.split('bindPaneShell(').length - 1
+    expect(binds).toBeGreaterThan(0)
+    // Each `bindPaneShell(` call site must carry its own `mayCreate: false`.
+    const guardedBinds = source
+      .split('bindPaneShell(')
+      .slice(1)
+      .filter((tail) => tail.slice(0, tail.indexOf('})')).includes('mayCreate: false')).length
+    expect(guardedBinds).toBe(binds)
+  })
+})
diff --git a/src/main/ssh/sftp-namespace-resolution.test.ts b/src/main/ssh/sftp-namespace-resolution.test.ts
index 98ba2637c7d..5239e834152 100644
--- a/src/main/ssh/sftp-namespace-resolution.test.ts
+++ b/src/main/ssh/sftp-namespace-resolution.test.ts
@@ -35,10 +35,7 @@ const MARKER_STATS = {
   size: 0
 }
 
-function makeSftp(options: {
-  startPath?: string | Error | unknown
-  lstat?: (path: string) => LstatOutcome
-}): {
+function makeSftp(options: { startPath?: unknown; lstat?: (path: string) => LstatOutcome }): {
   sftp: SFTPWrapper
   realpathCalls: string[]
   lstatCalls: string[]
diff --git a/src/main/ssh/ssh-channel-multiplexer.ts b/src/main/ssh/ssh-channel-multiplexer.ts
index 0000f2f353b..d87a7ad8f5b 100644
--- a/src/main/ssh/ssh-channel-multiplexer.ts
+++ b/src/main/ssh/ssh-channel-multiplexer.ts
@@ -39,7 +39,7 @@ export type SshMultiplexerRequestOptions = {
 
 export type NotificationHandler = (method: string, params: Record<string, unknown>) => void
 export type MethodNotificationHandler = (params: Record<string, unknown>) => void
-export type RequestHandler = (params: Record<string, unknown>) => Promise<unknown> | unknown
+export type RequestHandler = (params: Record<string, unknown>) => unknown
 
 export type MultiplexerDisposeReason = 'shutdown' | 'connection_lost'
 
diff --git a/src/main/ssh/ssh-relay-orphan-abandon-paths.test.ts b/src/main/ssh/ssh-relay-orphan-abandon-paths.test.ts
index 9d08ac7da0f..9de9e9f1100 100644
--- a/src/main/ssh/ssh-relay-orphan-abandon-paths.test.ts
+++ b/src/main/ssh/ssh-relay-orphan-abandon-paths.test.ts
@@ -69,6 +69,7 @@ vi.mock('../providers/ssh-git-provider', () => ({
   SshGitProvider: class MockSshGitProvider {}
 }))
 vi.mock('../ipc/pty', () => ({
+  resolvePaneShellTabId: vi.fn(() => undefined),
   registerSshPtyProvider: vi.fn(),
   unregisterSshPtyProvider: vi.fn(),
   getSshPtyProvider: vi.fn(),
@@ -186,24 +187,24 @@ describe('SshRelaySession abandoned remote PTYs', () => {
     expect(clearProviderPtyState).not.toHaveBeenCalledWith(APP_PTY_ID)
   })
 
-  it('retires the lease without a kill when the relay proves the PTY is gone', async () => {
-    // pty.attach verifies process liveness before answering not-found, so this is the one branch
-    // with positive proof of death — and a dead process needs no shutdown request.
+  // INVERTED for STA-3077 step E-0. This case previously asserted that a bare not-found retires the
+  // lease and reports `pty:exit { code: -1 }`, on the premise that attach proves liveness before
+  // answering not-found. It does not: the relay answers not-found for a pane-identity mismatch and
+  // for any id it merely cannot hand back, so the premise licensed a fabricated death certificate.
+  // The clause is kept — inverted — so the new intent stays covered rather than silently dropped.
+  it('leaves the shell running when the relay only reports the PTY as not found', async () => {
     const { deps, shutdown } = await establishWithFailingReattach(
       new Error('PTY "pty-live" not found')
     )
 
     expect(shutdown).not.toHaveBeenCalled()
-    expect(deps.mockStore.markSshRemotePtyLease).toHaveBeenCalledWith(
+    expect(deps.mockStore.markSshRemotePtyLease).not.toHaveBeenCalledWith(
       'target-1',
       'pty-live',
       'expired'
     )
-    expect(clearProviderPtyState).toHaveBeenCalledWith(APP_PTY_ID)
-    expect(deps.mockWindow.webContents.send).toHaveBeenCalledWith('pty:exit', {
-      id: APP_PTY_ID,
-      code: -1
-    })
+    expect(clearProviderPtyState).not.toHaveBeenCalledWith(APP_PTY_ID)
+    expect(deps.mockWindow.webContents.send).not.toHaveBeenCalledWith('pty:exit', expect.anything())
   })
 
   it('keeps a recovered session attached when reattach succeeds after an earlier drop', async () => {
diff --git a/src/main/ssh/ssh-relay-reattach-exit-proof.test.ts b/src/main/ssh/ssh-relay-reattach-exit-proof.test.ts
new file mode 100644
index 00000000000..dc4bae2e8d2
--- /dev/null
+++ b/src/main/ssh/ssh-relay-reattach-exit-proof.test.ts
@@ -0,0 +1,358 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { formatPtyExitedError } from '../../shared/ssh-pty-failure-tokens'
+import { SshRelaySession } from './ssh-relay-session'
+import { createMockDeps, mockDeploySuccess } from './ssh-relay-session-test-fixtures'
+
+const { acceptOutputExitMock, muxRequestMock } = vi.hoisted(() => ({
+  acceptOutputExitMock: vi.fn().mockResolvedValue(undefined),
+  muxRequestMock: vi.fn()
+}))
+
+vi.mock('./ssh-relay-deploy', () => ({ deployAndLaunchRelay: vi.fn() }))
+vi.mock('./ssh-pty-consumer-session', () => ({
+  openSshPtyConsumerSession: vi.fn(
+    async (_mux: unknown, options: { clientInstanceId: string }) => ({
+      clientInstanceId: options.clientInstanceId,
+      clientGeneration: 1,
+      ownerGeneration: 1,
+      ownerLease: 'test-owner-lease'
+    })
+  )
+}))
+vi.mock('../ipc/ssh-pty-output-intake-registry', () => ({
+  acceptSshPtyOutputData: vi.fn().mockResolvedValue(undefined),
+  acceptSshPtyOutputExit: acceptOutputExitMock,
+  allocateSshPtyProviderGeneration: vi.fn(() => 17),
+  beginSshPtyOutputGenerationMigration: vi.fn(() => ({
+    byPty: new Map(),
+    completion: Promise.resolve()
+  })),
+  closeSshPtyOutputGeneration: vi.fn(),
+  getSshPtyAcceptedSourceCheckpoints: vi.fn(() => []),
+  applySshPtySourceRecoveryCancellationProof: vi.fn(() => true),
+  installSshPtySourceAckPublisher: vi.fn(() => () => {}),
+  installSshPtySourceCancellationPublisher: vi.fn(() => () => {})
+}))
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn().mockResolvedValue('') }))
+vi.mock('./ssh-remote-orca-cli', () => ({
+  runRemoteOrcaCli: vi.fn().mockResolvedValue({ exitCode: 0, stdout: '', stderr: '' })
+}))
+vi.mock('./ssh-channel-multiplexer', () => ({
+  SshChannelMultiplexer: class MockSshChannelMultiplexer {
+    notify = vi.fn()
+    notifyWithSettlement = vi.fn()
+    request = muxRequestMock
+    onNotification = vi.fn().mockReturnValue(() => {})
+    onNotificationByMethod = vi.fn().mockReturnValue(() => {})
+    onRequest = vi.fn().mockReturnValue(() => {})
+    onDispose = vi.fn().mockReturnValue(() => {})
+    dispose = vi.fn()
+    isDisposed = vi.fn().mockReturnValue(false)
+  }
+}))
+vi.mock('../agent-hooks/remote-managed-hook-installers', () => ({
+  installRemoteManagedAgentHooks: vi.fn().mockResolvedValue([])
+}))
+vi.mock('../providers/ssh-pty-provider', () => ({
+  SshPtyProvider: class MockSshPtyProvider {
+    onData = vi.fn().mockReturnValue(() => {})
+    onReplay = vi.fn().mockReturnValue(() => {})
+    onExit = vi.fn().mockReturnValue(() => {})
+    attach = vi.fn().mockResolvedValue(undefined)
+    attachForReconnect = vi.fn().mockResolvedValue({})
+    dispose = vi.fn()
+  }
+}))
+vi.mock('../providers/ssh-filesystem-provider', () => ({
+  SshFilesystemProvider: class MockSshFilesystemProvider {
+    dispose = vi.fn()
+  }
+}))
+vi.mock('../providers/ssh-git-provider', () => ({
+  SshGitProvider: class MockSshGitProvider {}
+}))
+vi.mock('../ipc/pty', () => ({
+  resolvePaneShellTabId: vi.fn(() => undefined),
+  registerSshPtyProvider: vi.fn(),
+  unregisterSshPtyProvider: vi.fn(),
+  getSshPtyProvider: vi.fn(),
+  getPtyIdsForConnection: vi.fn().mockReturnValue([]),
+  clearPtyOwnershipForConnection: vi.fn(),
+  clearProviderPtyState: vi.fn(),
+  deletePtyOwnership: vi.fn(),
+  setPtyOwnership: vi.fn(),
+  restorePtyIncarnation: vi.fn(),
+  isCurrentPtyExit: vi.fn(() => true),
+  answerStartupTerminalColorQueriesForPty: vi.fn((_id: string, data: string) => data)
+}))
+vi.mock('../providers/ssh-filesystem-dispatch', () => ({
+  registerSshFilesystemProvider: vi.fn(),
+  unregisterSshFilesystemProvider: vi.fn(),
+  getSshFilesystemProvider: vi.fn().mockReturnValue({ dispose: vi.fn() })
+}))
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  registerSshGitProvider: vi.fn(),
+  unregisterSshGitProvider: vi.fn()
+}))
+
+const {
+  registerSshPtyProvider,
+  getSshPtyProvider,
+  getPtyIdsForConnection,
+  clearProviderPtyState,
+  deletePtyOwnership
+} = await import('../ipc/pty')
+
+const TARGET_ID = 'target-1'
+const RELAY_PTY_ID = 'pty-live'
+const APP_PTY_ID = 'ssh:target-1@@pty-live'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const PROVIDER_GENERATION = 17
+
+// The relay's own not-found wording; `isSshPtyNotFoundError` matches it and nothing narrows it
+// further, so it arrives carrying no evidence about whether the shell is alive.
+const UNPROVEN_NOT_FOUND = `PTY "${RELAY_PTY_ID}" not found`
+
+function detachedLease() {
+  return {
+    targetId: TARGET_ID,
+    ptyId: RELAY_PTY_ID,
+    state: 'detached' as const,
+    worktreeId: 'worktree-1',
+    tabId: 'tab-1',
+    leafId: LEAF_ID,
+    incarnationId: 'inc-proven-exit'
+  }
+}
+
+/**
+ * STA-3077 / design E-0: a reattach that ends in a bare not-found tells us the relay cannot hand
+ * this id back — never that the process died. Synthesizing `pty:exit { code: -1 }` from it is a
+ * fabricated death certificate: the renderer treats it as a real exit and the surviving remote
+ * shell (and any agent inside it) is written off. Only an exit the relay actually observed may
+ * report an exit; everything else routes into the non-destructive detached branch.
+ */
+describe('SshRelaySession reattach failures never fabricate an exit', () => {
+  let warn: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    muxRequestMock.mockReset()
+    muxRequestMock.mockResolvedValue([])
+    acceptOutputExitMock.mockResolvedValue(undefined)
+    mockDeploySuccess()
+    vi.mocked(getPtyIdsForConnection).mockReturnValue([])
+    warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    vi.spyOn(console, 'info').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  /** Drives the real connect-path reattach loop, so the failure reaches the handler as production does. */
+  async function reattachFailsWith(message: string): Promise<{
+    deps: ReturnType<typeof createMockDeps>
+    attachForReconnect: ReturnType<typeof vi.fn>
+  }> {
+    const deps = createMockDeps()
+    const attachForReconnect = vi.fn().mockRejectedValue(new Error(message))
+    vi.mocked(getSshPtyProvider).mockReturnValue({
+      attachForReconnect,
+      shutdown: vi.fn().mockResolvedValue(undefined),
+      dispose: vi.fn()
+    } as unknown as ReturnType<typeof getSshPtyProvider>)
+    vi.mocked(deps.mockStore.getSshRemotePtyLeases).mockReturnValue([detachedLease()] as ReturnType<
+      typeof deps.mockStore.getSshRemotePtyLeases
+    >)
+    const session = new SshRelaySession(
+      TARGET_ID,
+      deps.getMainWindow,
+      deps.mockStore,
+      deps.mockPortForward
+    )
+
+    await session.establish(deps.mockConn)
+    // Precondition, not a claim: if the reattach never ran, every "did not destroy" clause below
+    // would pass for the wrong reason.
+    expect(attachForReconnect).toHaveBeenCalled()
+
+    return { deps, attachForReconnect }
+  }
+
+  function warnings(): string[] {
+    return warn.mock.calls.map((call) => String(call[0]))
+  }
+
+  it('reaches the failure handler through the real reattach path', async () => {
+    // Producer pin: without this the remaining clauses could pass on a path production never takes.
+    const { attachForReconnect } = await reattachFailsWith(UNPROVEN_NOT_FOUND)
+
+    expect(attachForReconnect.mock.calls[0]?.[0]).toBe(RELAY_PTY_ID)
+  })
+
+  it('sends no synthetic pty:exit to the pane on an unproven not-found', async () => {
+    const { deps } = await reattachFailsWith(UNPROVEN_NOT_FOUND)
+
+    expect(deps.mockWindow.webContents.send).not.toHaveBeenCalledWith('pty:exit', expect.anything())
+  })
+
+  it('keeps pty ownership on an unproven not-found', async () => {
+    await reattachFailsWith(UNPROVEN_NOT_FOUND)
+
+    expect(deletePtyOwnership).not.toHaveBeenCalledWith(APP_PTY_ID)
+  })
+
+  it('keeps provider pty state on an unproven not-found', async () => {
+    await reattachFailsWith(UNPROVEN_NOT_FOUND)
+
+    expect(clearProviderPtyState).not.toHaveBeenCalledWith(APP_PTY_ID)
+  })
+
+  it('leaves the lease terminable instead of expiring it on an unproven not-found', async () => {
+    const { deps } = await reattachFailsWith(UNPROVEN_NOT_FOUND)
+
+    expect(deps.mockStore.markSshRemotePtyLease).not.toHaveBeenCalledWith(
+      TARGET_ID,
+      RELAY_PTY_ID,
+      'expired'
+    )
+  })
+
+  // The counterpart. An exit the relay watched settles it, so the record is retired rather than
+  // re-attached on every future reconnect for the life of the install. `terminated`, not `expired`:
+  // expiry is the state the recovery grant reads, and retiring a record must not also authorise a
+  // replacement.
+  it('retires the lease on an exit the relay proved', async () => {
+    const { deps } = await reattachFailsWith(
+      formatPtyExitedError(RELAY_PTY_ID, 0, 'inc-proven-exit')
+    )
+
+    expect(deps.mockStore.markSshRemotePtyLeasesTerminatedAsync).toHaveBeenCalledWith(TARGET_ID, [
+      RELAY_PTY_ID
+    ])
+  })
+
+  it('persists a reconnect batch of proven exits in one async write', async () => {
+    const deps = createMockDeps()
+    const secondPtyId = 'pty-second'
+    const secondIncarnationId = 'inc-proven-second-exit'
+    const attachForReconnect = vi.fn().mockImplementation((ptyId: string) => {
+      const incarnationId = ptyId === RELAY_PTY_ID ? 'inc-proven-exit' : secondIncarnationId
+      return Promise.reject(new Error(formatPtyExitedError(ptyId, 0, incarnationId)))
+    })
+    vi.mocked(getSshPtyProvider).mockReturnValue({
+      attachForReconnect,
+      shutdown: vi.fn().mockResolvedValue(undefined),
+      dispose: vi.fn()
+    } as unknown as ReturnType<typeof getSshPtyProvider>)
+    vi.mocked(deps.mockStore.getSshRemotePtyLeases).mockReturnValue([
+      detachedLease(),
+      {
+        ...detachedLease(),
+        ptyId: secondPtyId,
+        leafId: '22222222-2222-4222-8222-222222222222',
+        incarnationId: secondIncarnationId
+      }
+    ] as ReturnType<typeof deps.mockStore.getSshRemotePtyLeases>)
+    const session = new SshRelaySession(
+      TARGET_ID,
+      deps.getMainWindow,
+      deps.mockStore,
+      deps.mockPortForward
+    )
+
+    await session.establish(deps.mockConn)
+
+    expect(deps.mockStore.markSshRemotePtyLeasesTerminatedAsync).toHaveBeenCalledOnce()
+    expect(deps.mockStore.markSshRemotePtyLeasesTerminatedAsync).toHaveBeenCalledWith(TARGET_ID, [
+      RELAY_PTY_ID,
+      secondPtyId
+    ])
+    expect(deps.mockStore.markSshRemotePtyLease).not.toHaveBeenCalled()
+  })
+
+  it('does not retire the lease for proof naming another PTY', async () => {
+    const { deps } = await reattachFailsWith(
+      formatPtyExitedError('pty-some-other-shell', 0, 'inc-proven-exit')
+    )
+
+    expect(deps.mockStore.markSshRemotePtyLeasesTerminatedAsync).not.toHaveBeenCalled()
+  })
+
+  it('does not retire the lease for proof naming another incarnation', async () => {
+    const { deps } = await reattachFailsWith(
+      formatPtyExitedError(RELAY_PTY_ID, 0, 'inc-some-other-shell')
+    )
+
+    expect(deps.mockStore.markSshRemotePtyLeasesTerminatedAsync).not.toHaveBeenCalled()
+  })
+
+  it('does not retire the lease when the failure proves nothing', async () => {
+    const { deps } = await reattachFailsWith(UNPROVEN_NOT_FOUND)
+
+    expect(deps.mockStore.markSshRemotePtyLeasesTerminatedAsync).not.toHaveBeenCalled()
+  })
+
+  it('routes an unproven not-found into the non-destructive detached branch', async () => {
+    // That branch announces itself with the "leaving detached" warning; the destructive one says
+    // "dropping stale". The log is how the two are told apart from outside the session.
+    await reattachFailsWith(UNPROVEN_NOT_FOUND)
+
+    expect(warnings().some((line) => line.includes(RELAY_PTY_ID) && /detached/i.test(line))).toBe(
+      true
+    )
+  })
+
+  it('does not take the drop-stale branch on an unproven not-found', async () => {
+    await reattachFailsWith(UNPROVEN_NOT_FOUND)
+
+    expect(warnings().some((line) => /Dropping stale PTY/i.test(line))).toBe(false)
+  })
+
+  it('still reports an exit the relay actually observed', async () => {
+    // Contrast: the only evidence that authorizes a death claim is an exit the relay saw on a live
+    // stream. Removing the fabricated one must not mute this one.
+    const deps = createMockDeps()
+    vi.mocked(getSshPtyProvider).mockReturnValue({
+      dispose: vi.fn()
+    } as unknown as ReturnType<typeof getSshPtyProvider>)
+    vi.mocked(deps.mockStore.getSshRemotePtyLeases).mockReturnValue(
+      [] as ReturnType<typeof deps.mockStore.getSshRemotePtyLeases>
+    )
+    const session = new SshRelaySession(
+      TARGET_ID,
+      deps.getMainWindow,
+      deps.mockStore,
+      deps.mockPortForward
+    )
+    await session.establish(deps.mockConn)
+    const provider = vi.mocked(registerSshPtyProvider).mock.calls[0]?.[1] as unknown as {
+      onExit: ReturnType<typeof vi.fn>
+    }
+    const onExit = provider.onExit.mock.calls[0]?.[0] as (payload: unknown) => void
+
+    onExit({
+      id: APP_PTY_ID,
+      code: 3,
+      incarnationId: 'incarnation-1',
+      providerGeneration: PROVIDER_GENERATION,
+      ptyIncarnation: 'incarnation-1'
+    })
+
+    await vi.waitFor(() =>
+      expect(acceptOutputExitMock).toHaveBeenCalledWith({
+        id: APP_PTY_ID,
+        code: 3,
+        providerGeneration: PROVIDER_GENERATION,
+        ptyIncarnation: 'incarnation-1'
+      })
+    )
+    expect(deps.mockStore.markSshRemotePtyLease).toHaveBeenCalledWith(
+      TARGET_ID,
+      RELAY_PTY_ID,
+      'terminated'
+    )
+    expect(deletePtyOwnership).toHaveBeenCalledWith(APP_PTY_ID)
+  })
+})
diff --git a/src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts b/src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts
index f54afef3f89..17952f4ade0 100644
--- a/src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts
+++ b/src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts
@@ -156,6 +156,7 @@ function createSession(targetId: string): InstanceType<typeof SshRelaySession> {
     upsertSshPtyConsumerRecovery: vi.fn(),
     removeSshPtyConsumerRecovery: vi.fn(),
     getSshRemotePtyLeases: vi.fn().mockReturnValue([]),
+    supersedeDuplicatePaneLeases: vi.fn().mockReturnValue(0),
     markSshRemotePtyLease: vi.fn(),
     markSshRemotePtyLeases: vi.fn(),
     markSshRemotePtyLeasesAsync: vi.fn(),
diff --git a/src/main/ssh/ssh-relay-session-data-delivery.test.ts b/src/main/ssh/ssh-relay-session-data-delivery.test.ts
index 2eca6802f28..2a6edf1840e 100644
--- a/src/main/ssh/ssh-relay-session-data-delivery.test.ts
+++ b/src/main/ssh/ssh-relay-session-data-delivery.test.ts
@@ -403,7 +403,6 @@ describe('SshRelaySession data delivery', () => {
     expect(retryCalls[0]).toHaveProperty('resume')
     expect(attachForReconnectMock).toHaveBeenCalledWith(
       'pty-1',
-      undefined,
       Object.freeze({ status: 'checkpointUnavailable' })
     )
     second.dispose()
@@ -762,7 +761,6 @@ describe('SshRelaySession data delivery', () => {
 
     expect(attachForReconnectMock).toHaveBeenCalledWith(
       'pty-1',
-      undefined,
       expect.objectContaining({
         status: 'checkpoint',
         deliveryToken: 'old-token',
diff --git a/src/main/ssh/ssh-relay-session-model-migration.test.ts b/src/main/ssh/ssh-relay-session-model-migration.test.ts
index ae5db55e0cc..ab1512d82dc 100644
--- a/src/main/ssh/ssh-relay-session-model-migration.test.ts
+++ b/src/main/ssh/ssh-relay-session-model-migration.test.ts
@@ -199,7 +199,6 @@ describe('SshRelaySession model migration', () => {
 
     expect(attachForReconnectMock).toHaveBeenCalledWith(
       'pty-1',
-      undefined,
       Object.freeze({
         status: 'checkpoint',
         clientGeneration: 1,
@@ -259,7 +258,6 @@ describe('SshRelaySession model migration', () => {
 
     expect(attachForReconnectMock).toHaveBeenCalledWith(
       'pty-1',
-      undefined,
       Object.freeze({ status: 'checkpointUnavailable' })
     )
   })
diff --git a/src/main/ssh/ssh-relay-session-reattach-pane-fence.test.ts b/src/main/ssh/ssh-relay-session-reattach-pane-fence.test.ts
new file mode 100644
index 00000000000..5c52aac8ea9
--- /dev/null
+++ b/src/main/ssh/ssh-relay-session-reattach-pane-fence.test.ts
@@ -0,0 +1,334 @@
+/**
+ * The superseded-PTY fence must be LIVE on the relay reattach path — the path it
+ * was built for. Production wiring only: the real `pty:spawn`/`pty:write`
+ * handlers from src/main/ipc/pty.ts and a real `SshRelaySession` whose reconnect
+ * drives `restoreReattachedPtyRuntime`; only the wire below the provider is fake.
+ *
+ * Today reattach binds the pane through `runtime.registerPty` while spawn binds
+ * through `rememberPaneKeyForPty`, so the fence maps never learn the successor
+ * and a keystroke queued for the superseded PTY still reaches the host.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { makePaneKey } from '../../shared/stable-pane-id'
+
+const handlers = new Map<string, (event: unknown, args: unknown) => unknown>()
+const listeners = new Map<string, (event: unknown, args: unknown) => unknown>()
+
+vi.mock('electron', () => ({
+  BrowserWindow: undefined,
+  app: {
+    isPackaged: true,
+    getPath: () => '/tmp/orca-reattach-fence-test',
+    getVersion: () => '0.0.0-test'
+  },
+  powerMonitor: { on: vi.fn() },
+  nativeTheme: { shouldUseDarkColors: true },
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => unknown) => {
+      handlers.set(channel, handler)
+    },
+    on: (channel: string, listener: (event: unknown, args: unknown) => unknown) => {
+      listeners.set(channel, listener)
+    },
+    removeHandler: (channel: string) => handlers.delete(channel),
+    removeAllListeners: (channel: string) => listeners.delete(channel)
+  }
+}))
+
+const { providerInstances, spawnedPtyIds, attachIncarnationId } = vi.hoisted(() => ({
+  providerInstances: [] as unknown[],
+  spawnedPtyIds: [] as string[],
+  attachIncarnationId: 'incarnation-reattached'
+}))
+
+vi.mock('./ssh-relay-deploy', () => ({ deployAndLaunchRelay: vi.fn() }))
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn().mockResolvedValue('') }))
+vi.mock('./ssh-remote-orca-cli', () => ({
+  runRemoteOrcaCli: vi.fn().mockResolvedValue({ exitCode: 0, stdout: '', stderr: '' })
+}))
+vi.mock('./ssh-pty-consumer-session', () => ({
+  openSshPtyConsumerSession: vi.fn(
+    async (_mux: unknown, options: { clientInstanceId: string }) => ({
+      clientInstanceId: options.clientInstanceId,
+      clientGeneration: 1,
+      ownerGeneration: 1,
+      ownerLease: 'test-owner-lease'
+    })
+  )
+}))
+vi.mock('./ssh-channel-multiplexer', () => ({
+  SshChannelMultiplexer: class MockSshChannelMultiplexer {
+    notify = vi.fn()
+    notifyWithSettlement = vi.fn()
+    request = vi.fn().mockResolvedValue([])
+    onNotification = vi.fn().mockReturnValue(() => {})
+    onNotificationByMethod = vi.fn().mockReturnValue(() => {})
+    onRequest = vi.fn().mockReturnValue(() => {})
+    onDispose = vi.fn().mockReturnValue(() => {})
+    dispose = vi.fn()
+    isDisposed = vi.fn().mockReturnValue(false)
+  }
+}))
+vi.mock('../agent-hooks/remote-managed-hook-installers', () => ({
+  installRemoteManagedAgentHooks: vi.fn()
+}))
+// The relay session constructs and registers this provider itself, so the real
+// pty.ts registry hands the same instance to pty:spawn and pty:write.
+vi.mock('../providers/ssh-pty-provider', () => ({
+  isSshPtyNotFoundError: (error: unknown) => String(error).includes('not found'),
+  isSshPtyIdentityMismatchError: (error: unknown) => String(error).includes('identity mismatch'),
+  SshPtyProvider: class MockSshPtyProvider {
+    spawn = vi.fn(async () => ({ id: spawnedPtyIds.shift() ?? 'ssh:target-1@@pty-unexpected' }))
+    write = vi.fn()
+    resize = vi.fn()
+    shutdown = vi.fn()
+    sendSignal = vi.fn()
+    getCwd = vi.fn()
+    getInitialCwd = vi.fn()
+    clearBuffer = vi.fn()
+    acknowledgeDataEvent = vi.fn()
+    hasChildProcesses = vi.fn()
+    getForegroundProcess = vi.fn()
+    serialize = vi.fn()
+    revive = vi.fn()
+    listProcesses = vi.fn(async () => [])
+    getDefaultShell = vi.fn()
+    getProfiles = vi.fn()
+    onData = vi.fn().mockReturnValue(() => {})
+    onReplay = vi.fn().mockReturnValue(() => {})
+    onExit = vi.fn().mockReturnValue(() => {})
+    attach = vi.fn().mockResolvedValue(undefined)
+    attachForReconnect = vi.fn().mockResolvedValue({ incarnationId: attachIncarnationId })
+    dispose = vi.fn()
+
+    constructor() {
+      providerInstances.push(this)
+    }
+  }
+}))
+vi.mock('../providers/ssh-filesystem-provider', () => ({
+  SshFilesystemProvider: class MockSshFilesystemProvider {
+    dispose = vi.fn()
+  }
+}))
+vi.mock('../providers/ssh-git-provider', () => ({
+  SshGitProvider: class MockSshGitProvider {}
+}))
+vi.mock('../providers/ssh-filesystem-dispatch', () => ({
+  registerSshFilesystemProvider: vi.fn(),
+  unregisterSshFilesystemProvider: vi.fn(),
+  getSshFilesystemProvider: vi.fn().mockReturnValue({ dispose: vi.fn() })
+}))
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  registerSshGitProvider: vi.fn(),
+  unregisterSshGitProvider: vi.fn()
+}))
+
+const { SshRelaySession } = await import('./ssh-relay-session')
+const { deployAndLaunchRelay } = await import('./ssh-relay-deploy')
+const {
+  registerPtyHandlers,
+  unregisterSshPtyProvider,
+  getPtyIdForPaneKey,
+  getPtyIdsForConnection,
+  deletePtyOwnership
+} = await import('../ipc/pty')
+
+const TARGET = 'target-1'
+const TAB_ID = 'tab-1'
+
+type ProviderMock = { write: ReturnType<typeof vi.fn> }
+
+function makeMainWindow() {
+  const webContents = {
+    id: 1,
+    send: vi.fn(),
+    on: vi.fn(),
+    once: vi.fn(),
+    removeListener: vi.fn(),
+    isDestroyed: () => false
+  }
+  return { isDestroyed: () => false, isVisible: () => true, isMinimized: () => false, webContents }
+}
+
+/** A live layout in which `leafId` sits in `tabId` — the tab the pane is in RIGHT NOW.
+ *  The tab must also exist in `tabsByWorktree`: resolution ignores a layout whose tab is gone, so
+ *  a fixture without one would resolve nothing and the clause would pass for the wrong reason. */
+function sessionWithLeafInTab(tabId: string, leafId: string) {
+  return {
+    tabsByWorktree: { 'worktree-1': [{ id: tabId, worktreeId: 'worktree-1' }] },
+    terminalLayoutsByTabId: {
+      [tabId]: { root: { type: 'leaf' as const, leafId }, ptyIdsByLeafId: {} }
+    }
+  }
+}
+
+function makeStore(leases: unknown[], session?: ReturnType<typeof sessionWithLeafInTab>) {
+  return {
+    ...(session ? { getWorkspaceSession: vi.fn(() => session) } : {}),
+    getRepos: vi.fn().mockReturnValue([]),
+    getSshPtyConsumerRecovery: vi.fn().mockReturnValue(null),
+    upsertSshPtyConsumerRecovery: vi.fn(),
+    removeSshPtyConsumerRecovery: vi.fn(),
+    getSshRemotePtyLeases: vi.fn(() => leases),
+    supersedeDuplicatePaneLeases: vi.fn().mockReturnValue(0),
+    markSshRemotePtyLease: vi.fn(),
+    markSshRemotePtyLeases: vi.fn(),
+    markSshRemotePtyLeasesAsync: vi.fn(),
+    markSshRemotePtyLeasesForShutdown: vi.fn(),
+    markSshRemotePtyLeasesAttachedAsync: vi.fn(),
+    upsertSshRemotePtyLease: vi.fn(),
+    persistPtyBinding: vi.fn().mockReturnValue(true)
+  }
+}
+
+/**
+ * One pane: spawned over SSH, then rebound by a reconnect whose durable lease
+ * names a different remote PTY — the STA-3077 shape.
+ */
+async function spawnThenReattachPane(leafId: string, currentTabId?: string) {
+  const mainWindow = makeMainWindow()
+  const predecessorPtyId = `ssh:${TARGET}@@pty-old-${leafId.slice(0, 4)}`
+  const reattachedRelayPtyId = `pty-new-${leafId.slice(0, 4)}`
+  const leases: unknown[] = []
+  const store = makeStore(
+    leases,
+    currentTabId ? sessionWithLeafInTab(currentTabId, leafId) : undefined
+  )
+  const runtime = { onPtySpawned: vi.fn(), registerPty: vi.fn() }
+  const session = new SshRelaySession(
+    TARGET,
+    vi.fn().mockReturnValue(mainWindow) as never,
+    store as never,
+    { removeAllForwards: vi.fn() } as never,
+    runtime as never
+  )
+
+  registerPtyHandlers(
+    mainWindow as never,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    store as never
+  )
+  await session.establish({} as never)
+
+  spawnedPtyIds.push(predecessorPtyId)
+  await handlers.get('pty:spawn')!(null, {
+    cols: 80,
+    rows: 24,
+    env: { ORCA_PANE_KEY: makePaneKey(TAB_ID, leafId) },
+    connectionId: TARGET,
+    worktreeId: 'worktree-1',
+    tabId: TAB_ID,
+    leafId
+  })
+
+  // The relay restarted; the pane's durable lease now names a different shell.
+  leases.push({
+    targetId: TARGET,
+    ptyId: reattachedRelayPtyId,
+    state: 'detached' as const,
+    worktreeId: 'worktree-1',
+    tabId: TAB_ID,
+    leafId
+  })
+  await session.reconnect({} as never)
+  // Reconnect builds a fresh provider; writes route through the live one.
+  const provider = providerInstances.at(-1) as ProviderMock
+
+  const write = (id: string): void => {
+    listeners.get('pty:write')!({ sender: mainWindow.webContents }, { id, data: 'x' })
+  }
+  return {
+    runtime,
+    paneKey: makePaneKey(currentTabId ?? TAB_ID, leafId),
+    predecessorPtyId,
+    reattachedPtyId: `ssh:${TARGET}@@${reattachedRelayPtyId}`,
+    provider,
+    write,
+    dispose: () => {
+      deletePtyOwnership(predecessorPtyId)
+      deletePtyOwnership(`ssh:${TARGET}@@${reattachedRelayPtyId}`)
+      unregisterSshPtyProvider(TARGET)
+    }
+  }
+}
+
+describe('a relay reattach binds the pane through the same producer as spawn', () => {
+  let cleanup: (() => void) | undefined
+
+  beforeEach(() => {
+    handlers.clear()
+    listeners.clear()
+    providerInstances.length = 0
+    spawnedPtyIds.length = 0
+    vi.mocked(deployAndLaunchRelay).mockResolvedValue({
+      transport: { write: vi.fn(), onData: vi.fn(), onClose: vi.fn() },
+      platform: 'linux-x64'
+    } as never)
+  })
+
+  afterEach(() => {
+    cleanup?.()
+    cleanup = undefined
+  })
+
+  it('refuses a queued write to the PTY the reattach superseded', async () => {
+    const pane = await spawnThenReattachPane('11111111-1111-4111-8111-111111111111')
+    cleanup = pane.dispose
+    pane.provider.write.mockClear()
+    // Still an owned, routable PTY — so only the fence can refuse the write.
+    expect(getPtyIdsForConnection(TARGET)).toContain(pane.predecessorPtyId)
+
+    // A keystroke the renderer queued before the reconnect, still addressed to
+    // the shell the pane no longer owns.
+    pane.write(pane.predecessorPtyId)
+    await Promise.resolve()
+
+    expect(pane.provider.write).not.toHaveBeenCalled()
+  })
+
+  it('resolves the pane to the reattached PTY', async () => {
+    const pane = await spawnThenReattachPane('22222222-2222-4222-8222-222222222222')
+    cleanup = pane.dispose
+
+    expect(getPtyIdForPaneKey(pane.paneKey)).toBe(pane.reattachedPtyId)
+  })
+
+  // The lease's tabId is frozen at write time, but `detachTerminalPaneToTab` moves a live pane
+  // into a new tab without killing its PTY. A producer that forwarded `lease.tabId` would key the
+  // fence to the tab the pane LEFT — and every other clause here uses one tab on both sides, so
+  // nothing else in this file would notice.
+  it('keys the pane to the tab the leaf is in now, not the one its lease was written in', async () => {
+    const leafId = '44444444-4444-4444-8444-444444444444'
+    const pane = await spawnThenReattachPane(leafId, 'tab-moved-to')
+    cleanup = pane.dispose
+
+    expect(pane.paneKey).toBe(makePaneKey('tab-moved-to', leafId))
+    expect(getPtyIdForPaneKey(pane.paneKey)).toBe(pane.reattachedPtyId)
+    expect(getPtyIdForPaneKey(makePaneKey(TAB_ID, leafId))).not.toBe(pane.reattachedPtyId)
+    // The runtime graph must land on the SAME tab as the record and the fence. Registering under
+    // the lease's frozen tabId would split the pane across two tabs and ensure a mobile surface
+    // for the one it left.
+    expect(pane.runtime.registerPty).toHaveBeenCalledWith(
+      pane.reattachedPtyId,
+      'worktree-1',
+      TARGET,
+      expect.objectContaining({ tabId: 'tab-moved-to', leafId })
+    )
+  })
+
+  // Guards the clause above from a fence that simply refuses everything.
+  it('still delivers a write to the reattached PTY', async () => {
+    const pane = await spawnThenReattachPane('33333333-3333-4333-8333-333333333333')
+    cleanup = pane.dispose
+    pane.provider.write.mockClear()
+
+    pane.write(pane.reattachedPtyId)
+    await Promise.resolve()
+
+    expect(pane.provider.write).toHaveBeenCalledWith(pane.reattachedPtyId, 'x')
+  })
+})
diff --git a/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts b/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
index 3eebb3574b3..b958c26db1b 100644
--- a/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
+++ b/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
@@ -101,6 +101,9 @@ vi.mock('../providers/ssh-git-provider', () => ({
   SshGitProvider: class MockSshGitProvider {}
 }))
 vi.mock('../ipc/pty', () => ({
+  resolvePaneShellTabId: vi.fn(() => undefined),
+  // Step F: the single pane->shell bind producer the relay now calls.
+  bindPaneShell: vi.fn(() => true),
   registerSshPtyProvider: vi.fn(),
   unregisterSshPtyProvider: vi.fn(),
   getSshPtyProvider: vi.fn(),
@@ -124,6 +127,7 @@ vi.mock('../providers/ssh-git-dispatch', () => ({
 }))
 
 const {
+  bindPaneShell,
   registerSshPtyProvider,
   getSshPtyProvider,
   getPtyIdsForConnection,
@@ -435,18 +439,43 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
       incarnationId
     })
     expect(runtime.onPtySpawned).not.toHaveBeenCalled()
-    expect(mockStore.persistPtyBinding).toHaveBeenCalledWith({
+    // Step F moved the observation point to the one bind producer; the intent is
+    // unchanged — exact incarnation proof, and mayCreate:false so reattach binds
+    // an existing pane and never grafts one back.
+    expect(bindPaneShell).toHaveBeenCalledWith({
+      store: expect.anything(),
       worktreeId: 'worktree-1',
       tabId: 'tab-1',
       leafId: INCARNATION_LEAF_ID,
       ptyId: APP_PTY_ID,
-      incarnationId
+      incarnationId,
+      mayCreate: false
     })
-    expect(vi.mocked(mockStore.persistPtyBinding).mock.invocationCallOrder[0]).toBeLessThan(
+    expect(vi.mocked(bindPaneShell).mock.invocationCallOrder[0]).toBeLessThan(
       vi.mocked(mockStore.markSshRemotePtyLeasesAttachedAsync).mock.invocationCallOrder[0]!
     )
   })
 
+  it('sends pane identity beside incarnation for relays that only understand the legacy fence', async () => {
+    const { mockConn, mockStore, mockPortForward, getMainWindow } = createMockDeps()
+    const attachForReconnect = vi.fn().mockResolvedValue({ incarnationId: 'incarnation-lease' })
+    vi.mocked(getSshPtyProvider).mockReturnValue({
+      attachForReconnect,
+      dispose: vi.fn()
+    } as unknown as ReturnType<typeof getSshPtyProvider>)
+    vi.mocked(mockStore.getSshRemotePtyLeases).mockReturnValue([
+      { ...detachedLease(), incarnationId: 'incarnation-lease' }
+    ] as ReturnType<typeof mockStore.getSshRemotePtyLeases>)
+    const session = new SshRelaySession('target-1', getMainWindow, mockStore, mockPortForward)
+
+    await session.establish(mockConn)
+
+    expect(attachForReconnect).toHaveBeenCalledWith('pty-live', undefined, 'incarnation-lease', {
+      paneKey: `tab-1:${INCARNATION_LEAF_ID}`,
+      tabId: 'tab-1'
+    })
+  })
+
   it('does not restore a PTY whose matching exit shares the attach reply batch', async () => {
     const { mockConn, mockStore, mockPortForward, getMainWindow, mockWindow } = createMockDeps()
     const incarnationId = 'incarnation-exited-during-attach'
@@ -489,7 +518,8 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
     expect(runtime.registerPty).not.toHaveBeenCalled()
     expect(restorePtyIncarnation).toHaveBeenCalledWith(APP_PTY_ID, incarnationId)
     expect(setPtyOwnership).not.toHaveBeenCalled()
-    expect(mockStore.persistPtyBinding).not.toHaveBeenCalled()
+    // Step F: observed at the one bind producer, else this negative is vacuous.
+    expect(bindPaneShell).not.toHaveBeenCalled()
     expect(sourceActivationLease.rollback).toHaveBeenCalledOnce()
     expect(sourceActivationLease.commit).not.toHaveBeenCalled()
     expect(mockStore.markSshRemotePtyLease).toHaveBeenCalledWith(
@@ -548,8 +578,14 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
       incarnationId: currentIncarnationId
     })
     expect(setPtyOwnership).toHaveBeenCalledWith(APP_PTY_ID, 'target-1')
-    expect(mockStore.persistPtyBinding).toHaveBeenCalledWith(
-      expect.objectContaining({ ptyId: APP_PTY_ID, incarnationId: currentIncarnationId })
+    // Step F moved the observation point to the one bind producer; the asserted
+    // intent — exact incarnation proof, mayCreate:false — is unchanged.
+    expect(bindPaneShell).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ptyId: APP_PTY_ID,
+        incarnationId: currentIncarnationId,
+        mayCreate: false
+      })
     )
     expect(mockWindow.webContents.send).toHaveBeenCalledWith('pty:replay', {
       id: APP_PTY_ID,
@@ -567,7 +603,9 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
     vi.mocked(mockStore.getSshRemotePtyLeases).mockReturnValue([detachedLease()] as ReturnType<
       typeof mockStore.getSshRemotePtyLeases
     >)
-    vi.mocked(mockStore.persistPtyBinding).mockImplementationOnce(() => {
+    // Step F: the durable write now happens inside the bind producer, so that is
+    // where the failure has to be injected.
+    vi.mocked(bindPaneShell).mockImplementationOnce(() => {
       throw new Error('disk full')
     })
     const runtime = { onPtySpawned: vi.fn(), registerPty: vi.fn() }
diff --git a/src/main/ssh/ssh-relay-session-recovery-races.test.ts b/src/main/ssh/ssh-relay-session-recovery-races.test.ts
index 26dd798ac5a..f8853832ed1 100644
--- a/src/main/ssh/ssh-relay-session-recovery-races.test.ts
+++ b/src/main/ssh/ssh-relay-session-recovery-races.test.ts
@@ -705,7 +705,7 @@ describe('SshRelaySession recovery race fencing', () => {
     await session.reconnect(deps.mockConn)
 
     expect(attachForReconnectMock).toHaveBeenCalledTimes(2)
-    expect(attachForReconnectMock.mock.calls.at(-1)?.[2]).toMatchObject({
+    expect(attachForReconnectMock.mock.calls.at(-1)?.[1]).toMatchObject({
       status: 'checkpoint',
       deliveryToken: 'new-token',
       acceptedSourceEndSu: 8
@@ -763,7 +763,7 @@ describe('SshRelaySession recovery race fencing', () => {
     const replacementReconnect = session.reconnect(deps.mockConn)
     await Promise.all([staleReconnect, replacementReconnect])
 
-    const recoveryRequests = attachForReconnectMock.mock.calls.map((call) => call[2])
+    const recoveryRequests = attachForReconnectMock.mock.calls.map((call) => call[1])
     expect(recoveryRequests).toHaveLength(2)
     expect(recoveryRequests[1]).toMatchObject({
       status: 'checkpoint',
diff --git a/src/main/ssh/ssh-relay-session-rejected-delivery.test.ts b/src/main/ssh/ssh-relay-session-rejected-delivery.test.ts
index e0f1572d4d3..9e83768ca42 100644
--- a/src/main/ssh/ssh-relay-session-rejected-delivery.test.ts
+++ b/src/main/ssh/ssh-relay-session-rejected-delivery.test.ts
@@ -54,6 +54,7 @@ type RejectedDeliverySession = {
   >
   rejectedPtyRecoveryAttempts: Map<string, unknown>
   sourceIdentityByRelayPtyId: Map<string, unknown>
+  watchMuxForRelayLoss: (mux: SshChannelMultiplexer) => void
   retireExitedPty: (payload: {
     id: string
     code: number
@@ -89,9 +90,18 @@ function rejectedPayload(overrides: Partial<SshPtyDataPayload> = {}): SshPtyData
 
 function prepareSession() {
   const deps = createMockDeps()
+  const disposeHandlers: ((reason: 'shutdown' | 'connection_lost') => void)[] = []
   const mux = {
     isDisposed: vi.fn(() => false),
-    dispose: vi.fn()
+    onDispose: vi.fn((handler: (reason: 'shutdown' | 'connection_lost') => void) => {
+      disposeHandlers.push(handler)
+      return () => {}
+    }),
+    dispose: vi.fn((reason: 'shutdown' | 'connection_lost' = 'shutdown') => {
+      for (const handler of disposeHandlers) {
+        handler(reason)
+      }
+    })
   } as unknown as SshChannelMultiplexer
   const session = new SshRelaySession(
     'target-1',
@@ -101,6 +111,11 @@ function prepareSession() {
   )
   const internals = session as unknown as RejectedDeliverySession
   internals.mux = mux
+  // Why wired: disposing this mux is what fires the host-wide relay-lost reconnect, so a test can
+  // observe the blast radius of a per-PTY escalation instead of only the local dispose call.
+  const relayLost = vi.fn()
+  session.setOnRelayLost(relayLost)
+  internals.watchMuxForRelayLoss(mux)
   internals.activePtyProviderGeneration = 23
   internals.ptyConsumerSessionState = {
     mode: 'negotiated',
@@ -110,7 +125,7 @@ function prepareSession() {
     ownerLease: 'owner-lease',
     outputFlowControl: { version: 1, windowSu: 64 }
   }
-  return { deps, internals, mux, session }
+  return { deps, internals, mux, relayLost, session }
 }
 
 describe('SshRelaySession rejected PTY delivery recovery', () => {
@@ -231,7 +246,8 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
     const recovery = reattachKnownPty.mock.calls[0]?.[0]
     expect(recovery?.ptyId).toBe('pty-bad')
     expect(Array.from(recovery?.activeLeaseByPtyId.keys() ?? [])).toEqual(['pty-bad'])
-    expect(Array.from(recovery?.expectedIdentityByPtyId.keys() ?? [])).toEqual([])
+    // The sibling `expectedIdentityByPtyId` clause is gone with the map itself (STA-3077 step A):
+    // reattach no longer carries pane identity at all, which subsumes "carries none for this pty".
     expect(recovery?.targetedDeliveryRecovery).toBe('fresh-activation')
     expect(deps.mockStore.markSshRemotePtyLeasesAttachedAsync).toHaveBeenCalledWith('target-1', [
       'pty-bad'
@@ -243,8 +259,10 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
     expect(mux.dispose).not.toHaveBeenCalled()
   })
 
+  // Why this one still drops the channel: the relay refused to confirm the delivery was canceled, so
+  // no per-PTY fence is available — it is an unprovable state, not an exhausted retry count.
   it('reconnects instead of canceling an unprovable malformed delivery', async () => {
-    const { internals, mux } = prepareSession()
+    const { internals, mux, relayLost } = prepareSession()
     const reattach = vi.fn().mockResolvedValue(true)
     internals.reattachRejectedPty = reattach
     vi.spyOn(console, 'warn').mockImplementation(() => {})
@@ -259,6 +277,7 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
     )
 
     expect(mux.dispose).toHaveBeenCalledWith('connection_lost')
+    expect(relayLost).toHaveBeenCalledWith('target-1')
     expect(reattach).not.toHaveBeenCalled()
   })
 
@@ -338,7 +357,8 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
       internals.reattachRejectedPty('pty-bad', mux, 23, 'confirm-existing')
     ).resolves.toBe(true)
 
-    expect(attachForReconnect).toHaveBeenCalledWith('pty-bad', undefined, checkpoint)
+    // Two args since step A dropped the expected-identity parameter from the attach call.
+    expect(attachForReconnect).toHaveBeenCalledWith('pty-bad', checkpoint)
     expect(commit).toHaveBeenCalledOnce()
     expect(mux.dispose).not.toHaveBeenCalled()
   })
@@ -357,11 +377,11 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
     expect(internals.rejectedPtyRecoveryAttempts).toHaveLength(0)
   })
 
-  // Why a channel drop rather than a terminal relay error: a terminal error clears the reconnect
-  // backoff and rotates provider authority, aborting every fs and git request on the target, so one
-  // PTY's undeliverable output would strand the whole connection in manual recovery.
-  it('bounds failed targeted recovery and escalates to a recoverable relay reconnect', async () => {
-    const { internals, mux, session } = prepareSession()
+  // Why this is the oracle: an exhausted retry budget is not proof of anything, and the relay channel
+  // is shared — dropping it rotates provider authority, aborts every in-flight fs and git request on
+  // the target and stalls every sibling PTY over one PTY's undeliverable output.
+  it('parks one PTY after its recovery budget runs out and leaves the shared channel and a sibling alone', async () => {
+    const { internals, mux, relayLost, session } = prepareSession()
     const reattach = vi.fn().mockResolvedValue(false)
     internals.reattachRejectedPty = reattach
     getSshPtyProviderMock.mockReturnValue({ hasPty: () => true } as unknown as SshPtyProvider)
@@ -370,19 +390,90 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
 
     await internals.acceptPtyData(rejectedPayload())
-    await vi.waitFor(() => expect(mux.dispose).toHaveBeenCalledOnce(), { timeout: 2000 })
-
-    expect(reattach).toHaveBeenCalledTimes(2)
-    expect(reattach.mock.calls).toEqual([
-      ['pty-bad', mux, 23, 'confirm-existing'],
-      ['pty-bad', mux, 23, 'confirm-existing']
-    ])
-    expect(mux.dispose).toHaveBeenCalledWith('connection_lost')
-    expect(warn).toHaveBeenCalledWith(
-      expect.stringContaining('PTY pty-bad delivery recovery exhausted')
+    await vi.waitFor(
+      () =>
+        expect(warn).toHaveBeenCalledWith(
+          expect.stringContaining('PTY pty-bad delivery recovery exhausted')
+        ),
+      { timeout: 10_000 }
     )
+    // Why the extra wait: a dispose would be scheduled off the same recovery pass as the warning.
+    await new Promise((resolve) => setTimeout(resolve, 400))
+
+    expect(mux.dispose).not.toHaveBeenCalled()
+    expect(relayLost).not.toHaveBeenCalled()
     expect(onTerminalError).not.toHaveBeenCalled()
+    expect(reattach).toHaveBeenCalledTimes(12)
     expect(acceptOutputDataMock).not.toHaveBeenCalled()
+
+    await internals.acceptPtyData(
+      rejectedPayload({
+        id: 'ssh:target-1@@pty-healthy',
+        data: 'healthy',
+        ptyIncarnation: 'incarnation-healthy',
+        source: source({
+          relayPtyId: 'pty-healthy',
+          spanId: 'token-healthy:0:7',
+          deliveryToken: 'token-healthy',
+          sourceEndSu: 7
+        }),
+        sourceRejected: undefined
+      })
+    )
+
+    expect(acceptOutputDataMock).toHaveBeenCalledOnce()
+    expect(acceptOutputDataMock).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 'ssh:target-1@@pty-healthy', data: 'healthy' })
+    )
+  })
+
+  // The clause above pins the containment; this one pins that containment is not abandonment. The
+  // park's only stated escape is the next relay open, and a shared channel that stays healthy never
+  // gives it one — so a pane could sit with no output and no way back, which is the exact state
+  // this change exists to prevent. The park has to expire.
+  it('re-arms a parked PTY once its cooldown has passed rather than leaving it dark', async () => {
+    const { internals } = prepareSession()
+    const reattach = vi.fn().mockResolvedValue(false)
+    internals.reattachRejectedPty = reattach
+    getSshPtyProviderMock.mockReturnValue({ hasPty: () => true } as unknown as SshPtyProvider)
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await internals.acceptPtyData(rejectedPayload())
+    await vi.waitFor(
+      () =>
+        expect(warn).toHaveBeenCalledWith(
+          expect.stringContaining('PTY pty-bad delivery recovery exhausted')
+        ),
+      { timeout: 10_000 }
+    )
+    expect(reattach).toHaveBeenCalledTimes(12)
+
+    // Let the exhaustion loop go quiet first: its last retries are timer-driven and would
+    // otherwise land after the clear below and satisfy the final clause on their own.
+    await new Promise((resolve) => setTimeout(resolve, 1500))
+    reattach.mockClear()
+
+    // Every frame below reuses the ORIGINAL delivery token, because that is what actually happens:
+    // retirement is ours, not the host's, and a stalled source keeps publishing the token we
+    // retired. It also matters that they are identical — retirement holds ONE key per relay PTY,
+    // so slipping a different token in here would overwrite that key, un-retire the original and
+    // let the final clause pass with the wake-up path still broken.
+
+    // Before the cooldown: parked, so nothing retries.
+    await internals.acceptPtyData(rejectedPayload())
+    await new Promise((resolve) => setTimeout(resolve, 600))
+    expect(reattach).not.toHaveBeenCalled()
+
+    // Backdate the park instead of burning a minute of real time — the property under test is
+    // elapsed time, not which timer implementation measures it.
+    const parked = internals.rejectedPtyRecoveryAttempts.get('ssh:target-1@@pty-bad') as {
+      parkedAt: number
+    }
+    parked.parkedAt -= 60_000
+
+    await internals.acceptPtyData(rejectedPayload())
+
+    await vi.waitFor(() => expect(reattach).toHaveBeenCalled(), { timeout: 10_000 })
   })
 
   it('stops without an error when the rejected PTY exited during recovery', async () => {
@@ -404,6 +495,30 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
     expect(mux.dispose).not.toHaveBeenCalled()
   })
 
+  // The counterpart to the clause above, and the distinction the whole design rests on. hasPty is
+  // three-state: null means the provider has not listed the host yet, which is precisely the state
+  // a fresh provider is in right after the reconnect that produces rejected frames. Reading that
+  // as death drops the attempt and schedules nothing, and the delivery token is already retired,
+  // so nothing can revive it — the pane stays dark. Only an explicit false is proof.
+  it('keeps retrying while the PTY liveness is merely unknown', async () => {
+    const { internals, mux, session } = prepareSession()
+    const reattach = vi.fn().mockResolvedValue(false)
+    internals.reattachRejectedPty = reattach
+    getSshPtyProviderMock.mockReturnValue({ hasPty: () => null } as unknown as SshPtyProvider)
+    const onTerminalError = vi.fn()
+    session.setOnTerminalRelayError(onTerminalError)
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await internals.acceptPtyData(rejectedPayload())
+
+    // More than one attempt is the whole point: unknown liveness must not end recovery.
+    await vi.waitFor(() => expect(reattach.mock.calls.length).toBeGreaterThan(1), {
+      timeout: 10_000
+    })
+    expect(onTerminalError).not.toHaveBeenCalled()
+    expect(mux.dispose).not.toHaveBeenCalled()
+  })
+
   // Why bounded: the bulk reconnect path caps the identical attach work at 8, and a relay that
   // starts rejecting across every PTY at once would otherwise open one attach round trip per PTY.
   it('caps concurrent targeted reattaches and coalesces repeats for one PTY', async () => {
@@ -452,18 +567,18 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
   })
 
   it('does not let accepted frames refill the recovery budget indefinitely', async () => {
-    const { internals, mux, session } = prepareSession()
+    const { internals, mux, relayLost, session } = prepareSession()
     const reattach = vi.fn().mockResolvedValue(true)
     internals.reattachRejectedPty = reattach
     getSshPtyProviderMock.mockReturnValue({ hasPty: () => true } as unknown as SshPtyProvider)
     const onTerminalError = vi.fn()
     session.setOnTerminalRelayError(onTerminalError)
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
 
     // Why alternating, with a fresh bad token each round: every rejection retires its own delivery,
     // so a flapping PTY only keeps asking for recovery by moving onto new ones, and the accepted
-    // frame in between is what used to clear the budget outright. Each reattach here succeeds, so
-    // the consecutive budget is cleared legitimately too — only the per-generation ceiling can stop
-    // it.
+    // frame in between is what used to clear the budget outright — only the per-generation ceiling
+    // can stop it.
     for (let round = 0; round < 40; round++) {
       await internals.acceptPtyData(
         rejectedPayload({
@@ -487,9 +602,17 @@ describe('SshRelaySession rejected PTY delivery recovery', () => {
       )
       await Promise.resolve()
     }
-    await vi.waitFor(() => expect(mux.dispose).toHaveBeenCalledOnce(), { timeout: 2000 })
+    await vi.waitFor(
+      () =>
+        expect(warn).toHaveBeenCalledWith(
+          expect.stringContaining('PTY pty-bad delivery recovery exhausted')
+        ),
+      { timeout: 2000 }
+    )
 
     expect(onTerminalError).not.toHaveBeenCalled()
+    expect(mux.dispose).not.toHaveBeenCalled()
+    expect(relayLost).not.toHaveBeenCalled()
     expect(acceptOutputDataMock).toHaveBeenCalledTimes(40)
     expect(reattach.mock.calls.length).toBeLessThanOrEqual(12)
   })
diff --git a/src/main/ssh/ssh-relay-session-terminal-error.test.ts b/src/main/ssh/ssh-relay-session-terminal-error.test.ts
index a0f855543ef..026f64aafeb 100644
--- a/src/main/ssh/ssh-relay-session-terminal-error.test.ts
+++ b/src/main/ssh/ssh-relay-session-terminal-error.test.ts
@@ -104,6 +104,7 @@ function createMockDeps(): {
     upsertSshPtyConsumerRecovery: vi.fn(),
     removeSshPtyConsumerRecovery: vi.fn(),
     getSshRemotePtyLeases: vi.fn().mockReturnValue([]),
+    supersedeDuplicatePaneLeases: vi.fn().mockReturnValue(0),
     markSshRemotePtyLease: vi.fn(),
     markSshRemotePtyLeases: vi.fn(),
     markSshRemotePtyLeasesAsync: vi.fn(),
diff --git a/src/main/ssh/ssh-relay-session-test-fixtures.ts b/src/main/ssh/ssh-relay-session-test-fixtures.ts
index c5f084a8785..6fd72afd5a5 100644
--- a/src/main/ssh/ssh-relay-session-test-fixtures.ts
+++ b/src/main/ssh/ssh-relay-session-test-fixtures.ts
@@ -21,12 +21,14 @@ export function createMockDeps(): SshRelaySessionTestDeps {
     upsertSshPtyConsumerRecovery: vi.fn(),
     removeSshPtyConsumerRecovery: vi.fn(),
     getSshRemotePtyLeases: vi.fn().mockReturnValue([]),
+    supersedeDuplicatePaneLeases: vi.fn().mockReturnValue(0),
     markSshRemotePtyLease: vi.fn(),
     markSshRemotePtyLeases: vi.fn(),
     markSshRemotePtyLeasesAsync: vi.fn(),
     markSshRemotePtyLeasesForShutdown: vi.fn(),
     markSshRemotePtyLeasesAttachedAsync: vi.fn(),
-    persistPtyBinding: vi.fn()
+    markSshRemotePtyLeasesTerminatedAsync: vi.fn(),
+    persistPtyBinding: vi.fn().mockReturnValue(true)
   } as unknown as Store
   const mockPortForward = {
     removeAllForwards: vi.fn()
diff --git a/src/main/ssh/ssh-relay-session-two-host-delivery-isolation.integration.test.ts b/src/main/ssh/ssh-relay-session-two-host-delivery-isolation.integration.test.ts
new file mode 100644
index 00000000000..6ff4cf9f18d
--- /dev/null
+++ b/src/main/ssh/ssh-relay-session-two-host-delivery-isolation.integration.test.ts
@@ -0,0 +1,402 @@
+/**
+ * Journey 4 — two distinct final-host connections live at the same time, and one
+ * host's delivery failure may not reach the other host or a sibling PTY.
+ *
+ * Everything below SSH is real: two `SshRelaySession`s, two real
+ * `SshChannelMultiplexer`s, two real `SshPtyProvider`s, and two real
+ * `RelayDispatcher`s speaking the relay wire over an in-process pipe. The fault
+ * is injected the way a desynced relay actually produces it — a `pty.data`
+ * frame whose source header does not parse, with a delivery identity the host
+ * cannot cancel — so the whole rejection/recovery machinery runs for real.
+ *
+ * The oracle is the blast radius of exhausting ONE PTY's delivery-recovery
+ * budget: the shared relay channel, the sibling PTY on the same host, and the
+ * entire second host must be untouched.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import type { Store } from '../persistence'
+import type { SshPortForwardManager } from './ssh-port-forward'
+import type { SshConnection } from './ssh-connection'
+import type { MultiplexerTransport } from './ssh-channel-multiplexer'
+import { RelayDispatcher } from '../../relay/dispatcher'
+import { getSshPtyProvider, unregisterSshPtyProvider } from '../ipc/pty'
+import type { SshPtyProvider } from '../providers/ssh-pty-provider'
+import { toAppSshPtyId } from '../providers/ssh-pty-id'
+import { DEFAULT_PTY_SOURCE_WINDOW_SU } from '../../shared/pty-source-credit-contract'
+import {
+  installSshPtyOutputIntake,
+  type acceptSshPtyOutputData
+} from '../ipc/ssh-pty-output-intake-registry'
+import type { SshPtyOutputIntake } from '../ipc/ssh-pty-output-intake'
+
+vi.mock('./ssh-relay-deploy', () => ({
+  deployAndLaunchRelay: vi.fn()
+}))
+
+const { deployAndLaunchRelay } = await import('./ssh-relay-deploy')
+const { SshRelaySession } = await import('./ssh-relay-session')
+
+type DeliveredFrame = Parameters<typeof acceptSshPtyOutputData>[0]
+
+/** The relay-side half of one host: a real dispatcher plus wire-level controls. */
+type FakeRelayHost = {
+  transport: MultiplexerTransport
+  dispatcher: RelayDispatcher
+  /** Publishes output on the PTY's live delivery, advancing its source cursor. */
+  publish: (relayPtyId: string, data: string) => void
+  /**
+   * Publishes a frame whose source header does not parse (`sourceLengthSu`
+   * disagrees with the payload) but which still carries a complete delivery
+   * identity this client never installed. That combination is what routes the
+   * rejection into the bounded per-PTY recovery budget rather than an immediate
+   * channel reconnect.
+   */
+  publishMalformed: (relayPtyId: string, data: string) => void
+  requestCounts: Map<string, number>
+  /** When true, `pty.attach` is refused — the relay cannot re-prove the delivery. */
+  refuseAttach: { value: boolean }
+  dispose: () => void
+}
+
+function createFakeRelayHost(): FakeRelayHost {
+  const clientDataCallbacks: ((data: Buffer) => void)[] = []
+  const clientCloseCallbacks: (() => void)[] = []
+  const requestCounts = new Map<string, number>()
+  const refuseAttach = { value: false }
+  const deliveries = new Map<
+    string,
+    { deliveryToken: string; ptyIncarnation: string; sentSu: number }
+  >()
+  let spawnCount = 0
+
+  const transport: MultiplexerTransport = {
+    write: (data) => {
+      setImmediate(() => dispatcher.feed(data))
+    },
+    onData: (cb) => {
+      clientDataCallbacks.push(cb)
+    },
+    onClose: (cb) => {
+      clientCloseCallbacks.push(cb)
+    },
+    close: () => {
+      for (const cb of clientCloseCallbacks) {
+        cb()
+      }
+    }
+  }
+
+  const dispatcher = new RelayDispatcher((data) => {
+    setImmediate(() => {
+      for (const cb of clientDataCallbacks) {
+        cb(data)
+      }
+    })
+  })
+
+  const count = (method: string): void => {
+    requestCounts.set(method, (requestCounts.get(method) ?? 0) + 1)
+  }
+
+  dispatcher.onRequest('pty.openClient', async (params) => {
+    count('pty.openClient')
+    return {
+      protocolVersion: 1,
+      serverBuildId: 'test-relay-build',
+      clientGeneration: 1,
+      role: 'session-owner',
+      ownerGeneration: 1,
+      ownerLease: 'test-owner-lease',
+      resumed: params.resume !== undefined,
+      capabilities: {
+        outputFlowControl: { version: 1, windowSu: DEFAULT_PTY_SOURCE_WINDOW_SU }
+      }
+    }
+  })
+  dispatcher.onRequest('session.resolveHome', async (params) => ({
+    resolvedPath: params.path === '~' ? '/home/orca' : params.path
+  }))
+  dispatcher.onRequest('git.listWorktrees', async () => [])
+  dispatcher.onRequest('ports.detect', async () => ({ ports: [], platform: 'linux' }))
+  dispatcher.onRequest('pty.spawn', async () => {
+    count('pty.spawn')
+    spawnCount += 1
+    const id = `remote-pty-${spawnCount}`
+    const ptyIncarnation = `incarnation-${id}`
+    const deliveryToken = `delivery-${id}`
+    deliveries.set(id, { deliveryToken, ptyIncarnation, sentSu: 0 })
+    return {
+      id,
+      incarnationId: ptyIncarnation,
+      sourceActivation: {
+        status: 'pending',
+        clientGeneration: 1,
+        ownerGeneration: 1,
+        ptyIncarnation,
+        deliveryToken,
+        checkpointSourceEndSu: 0,
+        recoveryEndSu: 0
+      }
+    }
+  })
+  dispatcher.onRequest('pty.getCwd', async () => {
+    count('pty.getCwd')
+    return '/home/orca/project'
+  })
+  // Why `canceled: false`: the host cannot retire a delivery identity it never
+  // issued. That is the branch that asks the client to confirm the existing
+  // delivery rather than to drop the channel, so recovery enters the bounded
+  // retry budget this test is about.
+  dispatcher.onRequest('pty.cancelDelivery', async () => {
+    count('pty.cancelDelivery')
+    return { canceled: false }
+  })
+  dispatcher.onRequest('pty.attach', async () => {
+    count('pty.attach')
+    if (refuseAttach.value) {
+      // Why not a not-found error: not-found is positive proof the PTY is gone
+      // and takes the destructive path. A refusal is the "unknown" case, which
+      // is what keeps the recovery budget burning down.
+      throw new Error('relay_attach_refused')
+    }
+    return { id: 'unused' }
+  })
+
+  const delivery = (relayPtyId: string) => {
+    const state = deliveries.get(relayPtyId)
+    if (!state) {
+      throw new Error(`relay has no delivery for ${relayPtyId}`)
+    }
+    return state
+  }
+
+  return {
+    transport,
+    dispatcher,
+    publish: (relayPtyId, data) => {
+      const state = delivery(relayPtyId)
+      state.sentSu += data.length
+      dispatcher.notify('pty.data', {
+        id: relayPtyId,
+        data,
+        deliveryToken: state.deliveryToken,
+        ptyIncarnation: state.ptyIncarnation,
+        clientGeneration: 1,
+        ownerGeneration: 1,
+        sourceEndSu: state.sentSu,
+        sourceLengthSu: data.length
+      })
+    },
+    publishMalformed: (relayPtyId, data) => {
+      dispatcher.notify('pty.data', {
+        id: relayPtyId,
+        data,
+        deliveryToken: 'delivery-this-client-never-installed',
+        ptyIncarnation: 'incarnation-unknown',
+        clientGeneration: 1,
+        ownerGeneration: 1,
+        sourceEndSu: data.length + 1,
+        sourceLengthSu: data.length + 1
+      })
+    },
+    requestCounts,
+    refuseAttach,
+    dispose: () => dispatcher.dispose()
+  }
+}
+
+function createStore(): Store {
+  return {
+    getRepos: vi.fn().mockReturnValue([]),
+    getSshPtyConsumerRecovery: vi.fn().mockReturnValue(null),
+    upsertSshPtyConsumerRecovery: vi.fn(),
+    removeSshPtyConsumerRecovery: vi.fn(),
+    getSshRemotePtyLeases: vi.fn().mockReturnValue([]),
+    supersedeDuplicatePaneLeases: vi.fn().mockReturnValue(0),
+    markSshRemotePtyLease: vi.fn(),
+    markSshRemotePtyLeases: vi.fn(),
+    markSshRemotePtyLeasesAsync: vi.fn(),
+    markSshRemotePtyLeasesForShutdown: vi.fn(),
+    markSshRemotePtyLeasesAttachedAsync: vi.fn(),
+    persistPtyBinding: vi.fn().mockReturnValue(true)
+  } as unknown as Store
+}
+
+type LiveHost = {
+  targetId: string
+  relay: FakeRelayHost
+  session: InstanceType<typeof SshRelaySession>
+  provider: SshPtyProvider
+  relayLost: ReturnType<typeof vi.fn>
+  terminalError: ReturnType<typeof vi.fn>
+}
+
+async function openHost(targetId: string): Promise<LiveHost> {
+  const relay = createFakeRelayHost()
+  vi.mocked(deployAndLaunchRelay).mockResolvedValue({
+    transport: relay.transport,
+    serverBuildId: 'test-relay-build',
+    platform: 'linux-x64'
+  })
+  const session = new SshRelaySession(
+    targetId,
+    vi.fn().mockReturnValue({
+      isDestroyed: () => false,
+      isVisible: () => true,
+      isMinimized: () => false,
+      webContents: { send: vi.fn() }
+    }),
+    createStore(),
+    { removeAllForwards: vi.fn().mockResolvedValue(undefined) } as unknown as SshPortForwardManager
+  )
+  const relayLost = vi.fn()
+  const terminalError = vi.fn()
+  session.setOnRelayLost(relayLost)
+  session.setOnTerminalRelayError(terminalError)
+  await session.establish({} as SshConnection)
+  const provider = getSshPtyProvider(targetId) as SshPtyProvider | undefined
+  if (!provider) {
+    throw new Error(`no PTY provider registered for ${targetId}`)
+  }
+  return { targetId, relay, session, provider, relayLost, terminalError }
+}
+
+describe('two live SSH hosts over real relay dispatchers', () => {
+  const hosts: LiveHost[] = []
+  let delivered: DeliveredFrame[] = []
+  let uninstallIntake: (() => void) | null = null
+  let warnSpy: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    delivered = []
+    warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    // Why the real registration seam: the session publishes accepted output
+    // through `acceptSshPtyOutputData`, so installing a recording intake
+    // observes the production delivery boundary without stubbing the module.
+    uninstallIntake = installSshPtyOutputIntake({
+      acceptData: async (event) => {
+        delivered.push(event)
+        return { status: 'accepted' } as never
+      },
+      acceptExit: async () => {},
+      closeGeneration: () => {},
+      dispose: () => {}
+    } as unknown as SshPtyOutputIntake)
+  })
+
+  afterEach(() => {
+    for (const host of hosts.splice(0)) {
+      host.session.dispose()
+      host.relay.dispose()
+      unregisterSshPtyProvider(host.targetId)
+    }
+    uninstallIntake?.()
+    uninstallIntake = null
+    warnSpy.mockRestore()
+  })
+
+  /**
+   * Brings both hosts up, gives host A two PTYs and host B one, proves all three
+   * deliver, then burns host A's PTY-1 delivery-recovery budget to exhaustion.
+   *
+   * The two clauses are separate tests on purpose: a mutation that only breaks
+   * same-host containment must be seen to leave the cross-host clause green,
+   * which proves the clauses independently rather than jointly.
+   */
+  async function exhaustOnePtyOnHostA(): Promise<{
+    hostA: LiveHost
+    hostB: LiveHost
+    a2: { id: string }
+    b1: { id: string }
+  }> {
+    const hostA = await openHost('host-a')
+    const hostB = await openHost('host-b')
+    hosts.push(hostA, hostB)
+
+    const a1 = await hostA.provider.spawn({ cols: 80, rows: 24, cwd: '/home/orca' })
+    const a2 = await hostA.provider.spawn({ cols: 80, rows: 24, cwd: '/home/orca' })
+    const b1 = await hostB.provider.spawn({ cols: 80, rows: 24, cwd: '/home/orca' })
+    expect(a1.id).toBe(toAppSshPtyId('host-a', 'remote-pty-1'))
+    expect(a2.id).toBe(toAppSshPtyId('host-a', 'remote-pty-2'))
+    expect(b1.id).toBe(toAppSshPtyId('host-b', 'remote-pty-1'))
+    // Two distinct final-host connections, each with its own provider identity.
+    expect(hostA.provider).not.toBe(hostB.provider)
+
+    hostA.relay.publish('remote-pty-1', 'a1-before')
+    hostA.relay.publish('remote-pty-2', 'a2-before')
+    hostB.relay.publish('remote-pty-1', 'b1-before')
+    await vi.waitFor(() => expect(delivered).toHaveLength(3), { timeout: 5_000 })
+    delivered = []
+
+    // The fault: one PTY on host A can never re-prove its delivery.
+    hostA.relay.refuseAttach.value = true
+    hostA.relay.publishMalformed('remote-pty-1', 'a1-poisoned')
+    await vi.waitFor(
+      () =>
+        expect(warnSpy).toHaveBeenCalledWith(
+          expect.stringContaining('remote-pty-1 delivery recovery exhausted')
+        ),
+      { timeout: 60_000 }
+    )
+    // Why the extra settle: a channel drop is scheduled off the same recovery
+    // pass that logs the exhaustion, not before it.
+    await new Promise((resolve) => setTimeout(resolve, 500))
+
+    // The budget was really spent on relay round trips, so the fault is live.
+    expect(hostA.relay.requestCounts.get('pty.attach') ?? 0).toBeGreaterThanOrEqual(12)
+    expect(hostA.relay.requestCounts.get('pty.cancelDelivery') ?? 0).toBeGreaterThan(0)
+    // The undeliverable frame itself never reached a consumer.
+    expect(delivered.some((frame) => frame.data === 'a1-poisoned')).toBe(false)
+
+    return { hostA, hostB, a2, b1 }
+  }
+
+  it('leaves the sibling PTY and the shared channel on the same host working', async () => {
+    const { hostA, a2 } = await exhaustOnePtyOnHostA()
+
+    hostA.relay.publish('remote-pty-2', 'a2-after')
+    await vi.waitFor(
+      () =>
+        expect(
+          delivered.filter((frame) => frame.id === a2.id && frame.data === 'a2-after'),
+          'the sibling PTY stopped receiving output after its neighbour was parked'
+        ).toHaveLength(1),
+      { timeout: 10_000 }
+    )
+    // A live request round trip: the shared channel still carries the fs/git
+    // control plane that dropping it would have aborted.
+    await expect(hostA.provider.getCwd(a2.id)).resolves.toBe('/home/orca/project')
+    expect(hostA.relayLost, 'host A lost its relay channel over one PTY').not.toHaveBeenCalled()
+    expect(hostA.terminalError, 'host A was parked in manual recovery').not.toHaveBeenCalled()
+  }, 120_000)
+
+  it('leaves the second host entirely untouched', async () => {
+    const { hostB, b1 } = await exhaustOnePtyOnHostA()
+
+    expect(hostB.relayLost, 'host B lost its relay channel').not.toHaveBeenCalled()
+    expect(hostB.terminalError, 'host B was parked in manual recovery').not.toHaveBeenCalled()
+    expect(
+      hostB.relay.requestCounts.get('pty.attach') ?? 0,
+      "host A's recovery reached host B's relay"
+    ).toBe(0)
+    expect(
+      hostB.relay.requestCounts.get('pty.cancelDelivery') ?? 0,
+      "host A's delivery cancellation reached host B's relay"
+    ).toBe(0)
+    expect(
+      hostB.relay.requestCounts.get('pty.openClient') ?? 0,
+      'host B renegotiated its consumer session'
+    ).toBe(1)
+    await expect(hostB.provider.getCwd(b1.id)).resolves.toBe('/home/orca/project')
+    hostB.relay.publish('remote-pty-1', 'b1-after')
+    await vi.waitFor(
+      () =>
+        expect(
+          delivered.filter((frame) => frame.id === b1.id && frame.data === 'b1-after')
+        ).toHaveLength(1),
+      { timeout: 10_000 }
+    )
+  }, 120_000)
+})
diff --git a/src/main/ssh/ssh-relay-session.test.ts b/src/main/ssh/ssh-relay-session.test.ts
index 570fca21fd4..8563c552aaf 100644
--- a/src/main/ssh/ssh-relay-session.test.ts
+++ b/src/main/ssh/ssh-relay-session.test.ts
@@ -531,26 +531,8 @@ describe('SshRelaySession', () => {
     )
   })
 
-  it('forwards a lease tab identity to reattach so a reset relay cannot cross-wire it', async () => {
-    const { mockConn, mockStore, mockPortForward, getMainWindow } = createMockDeps()
-    const { getSshPtyProvider } = await import('../ipc/pty')
-    const mockAttach = vi.fn().mockResolvedValue(undefined)
-    vi.mocked(getSshPtyProvider).mockReturnValue({
-      attachForReconnect: mockAttach,
-      dispose: vi.fn()
-    } as unknown as ReturnType<typeof getSshPtyProvider>)
-    vi.mocked(getPtyIdsForConnection).mockReturnValue([])
-    vi.mocked(mockStore.getSshRemotePtyLeases).mockReturnValue([
-      { targetId: 'target-1', ptyId: 'pty-1', state: 'detached', tabId: 'tab-a' }
-    ] as ReturnType<typeof mockStore.getSshRemotePtyLeases>)
-
-    const session = new SshRelaySession('target-1', getMainWindow, mockStore, mockPortForward)
-    await session.establish(mockConn)
-
-    expect(mockAttach).toHaveBeenCalledWith('pty-1', { tabId: 'tab-a' })
-  })
-
-  it('forwards a lease pane identity when leaf identity is available', async () => {
+  // New relays prioritize incarnation; old relays ignore that additive field and need this fence.
+  it('preserves pane identity for relays that predate incarnation fencing', async () => {
     const { mockConn, mockStore, mockPortForward, getMainWindow } = createMockDeps()
     const { getSshPtyProvider } = await import('../ipc/pty')
     const mockAttach = vi.fn().mockResolvedValue(undefined)
@@ -567,7 +549,40 @@ describe('SshRelaySession', () => {
     const session = new SshRelaySession('target-1', getMainWindow, mockStore, mockPortForward)
     await session.establish(mockConn)
 
-    expect(mockAttach).toHaveBeenCalledWith('pty-1', {
+    expect(mockAttach).toHaveBeenCalledWith('pty-1', undefined, undefined, {
+      paneKey: `tab-a:${leafId}`,
+      tabId: 'tab-a'
+    })
+  })
+
+  // This is the path that reattaches every known pty when a relay comes back — precisely when ids
+  // have been reissued from pty-1 — so it is the one that most needs to say which shell it means.
+  // The shell's own identity is authoritative; pane identity remains the fallback for old relays.
+  it('forwards the shell identity its lease recorded when reattaching', async () => {
+    const { mockConn, mockStore, mockPortForward, getMainWindow } = createMockDeps()
+    const { getSshPtyProvider } = await import('../ipc/pty')
+    const mockAttach = vi.fn().mockResolvedValue(undefined)
+    vi.mocked(getSshPtyProvider).mockReturnValue({
+      attachForReconnect: mockAttach,
+      dispose: vi.fn()
+    } as unknown as ReturnType<typeof getSshPtyProvider>)
+    vi.mocked(getPtyIdsForConnection).mockReturnValue([])
+    const leafId = '11111111-1111-4111-8111-111111111111'
+    vi.mocked(mockStore.getSshRemotePtyLeases).mockReturnValue([
+      {
+        targetId: 'target-1',
+        ptyId: 'pty-1',
+        state: 'detached',
+        tabId: 'tab-a',
+        leafId,
+        incarnationId: 'inc-host-1'
+      }
+    ] as ReturnType<typeof mockStore.getSshRemotePtyLeases>)
+
+    const session = new SshRelaySession('target-1', getMainWindow, mockStore, mockPortForward)
+    await session.establish(mockConn)
+
+    expect(mockAttach).toHaveBeenCalledWith('pty-1', undefined, 'inc-host-1', {
       paneKey: `tab-a:${leafId}`,
       tabId: 'tab-a'
     })
@@ -602,13 +617,10 @@ describe('SshRelaySession', () => {
 
     await session.reconnect(mockConn)
 
-    expect(mockAttach).toHaveBeenCalledWith('pty-1', {
-      paneKey: `tab-old:${staleLeafId}`,
-      tabId: 'tab-old'
-    })
     expect(clearProviderPtyState).not.toHaveBeenCalledWith('ssh:target-1@@pty-1')
     expect(deletePtyOwnership).not.toHaveBeenCalledWith('ssh:target-1@@pty-1')
     expect(mockStore.markSshRemotePtyLease).not.toHaveBeenCalledWith('target-1', 'pty-1', 'expired')
+    expect(mockAttach).toHaveBeenCalledOnce()
     expect(mockWindow.webContents.send).not.toHaveBeenCalledWith('pty:exit', {
       id: 'ssh:target-1@@pty-1',
       code: -1
@@ -671,7 +683,11 @@ describe('SshRelaySession', () => {
     expect(mockStore.markSshRemotePtyLeasesAttachedAsync).not.toHaveBeenCalled()
   })
 
-  it('invalidates and broadcasts remote PTYs that cannot reattach after relay reconnect', async () => {
+  // INVERTED for STA-3077 step E-0. This case previously asserted that a PTY the relay reports as
+  // not-found is invalidated and broadcast as an exit. A not-found is not proof of death, so the
+  // broadcast was a fabricated one; what must still hold is that the healthy sibling reattaches and
+  // the unproven one is left alone rather than written off.
+  it('leaves an unreattachable remote PTY alone while its sibling reattaches', async () => {
     const { mockConn, mockStore, mockPortForward, getMainWindow, mockWindow } = createMockDeps()
     const session = new SshRelaySession('target-1', getMainWindow, mockStore, mockPortForward)
     await session.establish(mockConn)
@@ -693,12 +709,9 @@ describe('SshRelaySession', () => {
 
     expect(mockAttach).toHaveBeenCalledWith('pty-stale')
     expect(mockAttach).toHaveBeenCalledWith('pty-live')
-    expect(clearProviderPtyState).toHaveBeenCalledWith('ssh:target-1@@pty-stale')
-    expect(deletePtyOwnership).toHaveBeenCalledWith('ssh:target-1@@pty-stale')
-    expect(mockWindow.webContents.send).toHaveBeenCalledWith('pty:exit', {
-      id: 'ssh:target-1@@pty-stale',
-      code: -1
-    })
+    expect(clearProviderPtyState).not.toHaveBeenCalledWith('ssh:target-1@@pty-stale')
+    expect(deletePtyOwnership).not.toHaveBeenCalledWith('ssh:target-1@@pty-stale')
+    expect(mockWindow.webContents.send).not.toHaveBeenCalledWith('pty:exit', expect.anything())
   })
 
   it('retries transient reattach failure without tearing down provider registration', async () => {
diff --git a/src/main/ssh/ssh-relay-session.ts b/src/main/ssh/ssh-relay-session.ts
index e002c334aad..ea56dd88786 100644
--- a/src/main/ssh/ssh-relay-session.ts
+++ b/src/main/ssh/ssh-relay-session.ts
@@ -12,6 +12,7 @@ import type { SshPtyAttachResult } from '../providers/ssh-pty-session-reattach'
 import type { SshPtyDataCallback, SshPtyExitCallback } from '../providers/ssh-pty-provider-contract'
 import type { SshPtyRecoveryActivationLease } from '../providers/ssh-pty-notification-routing'
 import { isSshPtyIdentityMismatchError, isSshPtyNotFoundError } from '../providers/ssh-pty-errors'
+import { parseMatchingPtyExitedError } from '../../shared/ssh-pty-failure-tokens'
 import { toAppSshPtyId, toRelaySshPtyId } from '../providers/ssh-pty-id'
 import { SshFilesystemProvider } from '../providers/ssh-filesystem-provider'
 import { isMethodNotFoundError } from './ssh-filesystem-stream-reader'
@@ -32,6 +33,8 @@ import {
 import { _internals as openCodeInternals } from '../opencode/hook-service'
 import { getPiAgentStatusExtensionSource } from '../pi/agent-status-extension-source'
 import {
+  bindPaneShell,
+  resolvePaneShellTabId,
   registerSshPtyProvider,
   unregisterSshPtyProvider,
   getSshPtyProvider,
@@ -95,6 +98,8 @@ import {
   parseRemoteOrcaCliPostOutput
 } from './ssh-remote-orchestration-post-output'
 import { toSshExecutionHostId, type ExecutionHostId } from '../../shared/execution-host'
+import { isTerminalLeafId, makePaneKey } from '../../shared/stable-pane-id'
+import { isValidTerminalTabId } from '../../shared/terminal-tab-id'
 import {
   SSH_AI_VAULT_LIST_SESSIONS_METHOD,
   SSH_AI_VAULT_LIST_SESSIONS_TIMEOUT_MS,
@@ -103,8 +108,6 @@ import {
   type SshAiVaultRelayListParams,
   type SshAiVaultRelayTitleParams
 } from '../../shared/ssh-ai-vault-relay'
-import { isTerminalLeafId, makePaneKey } from '../../shared/stable-pane-id'
-import { isValidTerminalTabId } from '../../shared/terminal-tab-id'
 import {
   openSshPtyConsumerSession,
   type OpenSshPtyConsumerSessionOptions,
@@ -138,11 +141,15 @@ const SSH_PTY_REATTACH_MAX_CONCURRENCY = 8
 const SSH_PTY_REATTACH_ATTEMPT_TIMEOUT_MS = 10_000
 const SSH_PTY_REATTACH_RETRY_MIN_DELAY_MS = 50
 const SSH_PTY_REATTACH_RETRY_JITTER_MS = 200
-const SSH_REJECTED_PTY_RECOVERY_MAX_ATTEMPTS = 2
-// Why a second ceiling: the consecutive budget resets whenever a reattach succeeds, so a PTY that
-// alternates recovered and rejected frames would otherwise reattach forever — each one costs a
-// store read, an attach round trip and a store write.
+// Why a ceiling at all: a PTY that alternates recovered and rejected frames would otherwise reattach
+// forever — each one costs a store read, an attach round trip and a store write. Exhausting it parks
+// this PTY's delivery; it never authorizes tearing anything down.
 const SSH_REJECTED_PTY_RECOVERY_MAX_GENERATION_ATTEMPTS = 12
+// Why a park expires: exhaustion parks one PTY's delivery instead of dropping the shared channel,
+// and the escape it names — the next relay open — may never come while that channel stays healthy.
+// A pane with no output and no way back is the state this change exists to prevent, so the park is
+// a cooldown rather than a verdict: recovery is rate-limited, never abandoned.
+const SSH_REJECTED_PTY_RECOVERY_PARK_MS = 60_000
 const SSH_REJECTED_PTY_RECOVERY_RETRY_DELAY_MS = 150
 const SSH_SOURCE_RECOVERY_CANCELLATION_FAILED = 'ssh_source_recovery_cancellation_failed'
 
@@ -191,15 +198,15 @@ type RemoteCliBridgeEnv = {
   pathDelimiter?: ':' | ';'
 }
 
-type ExpectedPtyIdentity = { paneKey?: string; tabId?: string }
+type LegacyExpectedPtyIdentity = { paneKey?: string; tabId?: string }
 type TargetedDeliveryRecovery = 'confirm-existing' | 'fresh-activation'
 
-function expectedIdentityForLease(lease: {
+function legacyExpectedIdentityForLease(lease: {
   tabId?: string
   leafId?: string
-}): ExpectedPtyIdentity | null {
+}): LegacyExpectedPtyIdentity | undefined {
   if (typeof lease.tabId !== 'string' || lease.tabId.length === 0) {
-    return null
+    return undefined
   }
   const paneKey =
     isValidTerminalTabId(lease.tabId) &&
@@ -207,10 +214,7 @@ function expectedIdentityForLease(lease: {
     isTerminalLeafId(lease.leafId)
       ? makePaneKey(lease.tabId, lease.leafId)
       : undefined
-  return {
-    ...(paneKey ? { paneKey } : {}),
-    tabId: lease.tabId
-  }
+  return { ...(paneKey ? { paneKey } : {}), tabId: lease.tabId }
 }
 
 function parseRecoveryComplete(params: Record<string, unknown>): PtySourceRecoveryComplete | null {
@@ -343,9 +347,10 @@ export class SshRelaySession {
     string,
     {
       providerGeneration: number
-      attempts: number
       generationAttempts: number
       reported: boolean
+      /** When the budget ran out; 0 while it has not. Drives the park cooldown. */
+      parkedAt: number
     }
   >()
   private readonly rejectedPtyRecoveryRetries = new Set<ReturnType<typeof setTimeout>>()
@@ -438,7 +443,7 @@ export class SshRelaySession {
   async requestAiVaultSessionList(
     params: SshAiVaultRelayListParams,
     options: { signal?: AbortSignal; timeoutMs?: number } = {}
-  ): Promise<unknown | null> {
+  ): Promise<unknown> {
     if (this.aiVaultListMethodSupported === false) {
       return null
     }
@@ -465,7 +470,7 @@ export class SshRelaySession {
   async requestAiVaultSessionTitles(
     params: SshAiVaultRelayTitleParams,
     options: { signal?: AbortSignal; timeoutMs?: number } = {}
-  ): Promise<unknown | null> {
+  ): Promise<unknown> {
     if (this.aiVaultTitleMethodSupported === false) {
       return null
     }
@@ -1436,7 +1441,7 @@ export class SshRelaySession {
     })
   }
 
-  // Why: ship plugin/extension source from Orca so agent-event changes don't force a relay redeploy (agent-status-over-ssh.md §4/§8). Best-effort.
+  // Why: ship plugin/extension source from Orca so agent-event changes don't force a relay redeploy — the relay is versioned independently. Best-effort: failure only costs agent status on this host.
   private async installPluginsOnRelay(mux: SshChannelMultiplexer): Promise<void> {
     if (!isRemoteAgentHooksEnabled() || !this.areAgentStatusHooksEnabled()) {
       return
@@ -1513,7 +1518,7 @@ export class SshRelaySession {
       if (typeof envelope.paneKey !== 'string') {
         return
       }
-      // Why: forward env/version verbatim so cross-build warn-once diagnostics fire on remote events too (agent-status-over-ssh.md §3).
+      // Why: forward the agent CLI's env/version verbatim (not the relay's) so warn-once protocol-mismatch diagnostics fire for remote events too.
       agentHookServer.ingestRemote(
         {
           paneKey: envelope.paneKey,
@@ -1789,7 +1794,8 @@ export class SshRelaySession {
     const offeredSource = payload.source
     if (
       offeredSource &&
-      this.retiredSourceDeliveries.has(payload.providerGeneration, offeredSource)
+      this.retiredSourceDeliveries.has(payload.providerGeneration, offeredSource) &&
+      !this.isParkedRecoveryDue(payload.id)
     ) {
       return Promise.resolve()
     }
@@ -1846,6 +1852,19 @@ export class SshRelaySession {
     })
   }
 
+  /**
+   * A parked PTY whose cooldown has elapsed must be let back past the retired-delivery filter.
+   * Retirement is ours, not the host's: a stalled source keeps publishing the very token we
+   * retired, so that filter would swallow every frame that could re-arm the park and the pane
+   * would stay dark for good — the failure the cooldown exists to rule out. Letting one through
+   * costs nothing: it is re-classified as rejected and re-retired, so no output reaches the
+   * terminal; it only regains the ability to ask for recovery.
+   */
+  private isParkedRecoveryDue(appPtyId: string): boolean {
+    const attempt = this.rejectedPtyRecoveryAttempts.get(appPtyId)
+    return !!attempt?.parkedAt && Date.now() - attempt.parkedAt >= SSH_REJECTED_PTY_RECOVERY_PARK_MS
+  }
+
   private recoverRejectedPtyDelivery(
     payload: SshPtyDataPayload,
     source: SshPtyDataPayload['source']
@@ -1880,26 +1899,28 @@ export class SshRelaySession {
     const attempt =
       previous?.providerGeneration === providerGeneration
         ? previous
-        : { providerGeneration, attempts: 0, generationAttempts: 0, reported: false }
-    if (
-      attempt.attempts >= SSH_REJECTED_PTY_RECOVERY_MAX_ATTEMPTS ||
-      attempt.generationAttempts >= SSH_REJECTED_PTY_RECOVERY_MAX_GENERATION_ATTEMPTS
-    ) {
-      if (!attempt.reported) {
-        attempt.reported = true
-        console.warn(
-          `[ssh-relay-session] PTY ${relayPtyId} delivery recovery exhausted for ${this.targetId}; dropping the relay channel to reconnect`
-        )
-        // Why a channel drop and not a terminal relay error: a terminal error clears the reconnect
-        // backoff, rotates provider authority (aborting every in-flight fs and git request on the
-        // target) and parks the target in a manual-recovery state — over one PTY's delivery. Losing
-        // the channel is the recoverable escalation, and it is what this path did before targeted
-        // recovery existed.
-        mux.dispose('connection_lost')
+        : { providerGeneration, generationAttempts: 0, reported: false, parkedAt: 0 }
+    if (attempt.generationAttempts >= SSH_REJECTED_PTY_RECOVERY_MAX_GENERATION_ATTEMPTS) {
+      // Why park instead of dropping the relay channel: a retry count is not proof of anything, and
+      // the channel is shared — dropping it rotates provider authority, aborts every in-flight fs
+      // and git request on the target and stalls every sibling PTY over one PTY's delivery. The
+      // remote shell keeps running and its lease stands.
+      if (attempt.parkedAt && Date.now() - attempt.parkedAt >= SSH_REJECTED_PTY_RECOVERY_PARK_MS) {
+        // The park has served its cooldown. Re-arm rather than leave the pane dark for good.
+        attempt.generationAttempts = 0
+        attempt.reported = false
+        attempt.parkedAt = 0
+      } else {
+        if (!attempt.reported) {
+          attempt.reported = true
+          attempt.parkedAt = Date.now()
+          console.warn(
+            `[ssh-relay-session] PTY ${relayPtyId} delivery recovery exhausted for ${this.targetId}; parking its delivery for ${SSH_REJECTED_PTY_RECOVERY_PARK_MS}ms or until the next relay open`
+          )
+        }
+        return
       }
-      return
     }
-    attempt.attempts++
     attempt.generationAttempts++
     this.rejectedPtyRecoveryAttempts.set(appPtyId, attempt)
     void this.rejectedPtyReattaches
@@ -1915,13 +1936,9 @@ export class SshRelaySession {
       )
       .then(
         (recovered) => {
-          if (recovered) {
-            // Why only a completed reattach clears this: an accepted frame proves nothing about the
-            // delivery that was rejected, and resetting on one lets a flapping PTY reattach forever.
-            attempt.attempts = 0
-            return
+          if (!recovered) {
+            this.retryRejectedPtyDelivery(payload, source, appPtyId)
           }
-          this.retryRejectedPtyDelivery(payload, source, appPtyId)
         },
         (error: unknown) => {
           console.warn(`[ssh-relay-session] PTY ${relayPtyId} targeted delivery recovery failed`, {
@@ -1935,14 +1952,23 @@ export class SshRelaySession {
 
   // Why liveness is checked before retrying: reattachKnownPty resolves without claiming the lease
   // when the PTY exited mid-attach, which is indistinguishable from a failed reattach at the call
-  // site. Retrying that race twice would drop the relay channel over an ordinary PTY exit.
+  // site, so an ordinary exit would otherwise burn the whole recovery budget on attach round trips.
   private retryRejectedPtyDelivery(
     payload: SshPtyDataPayload,
     source: SshPtyDataPayload['source'],
     appPtyId: string
   ): void {
     const ptyProvider = getSshPtyProvider(this.targetId) as SshPtyProvider | undefined
-    if (!ptyProvider || typeof ptyProvider.hasPty !== 'function' || !ptyProvider.hasPty(appPtyId)) {
+    // Why `=== false` and not `!`: hasPty is three-state, and null means the provider has not
+    // listed the host yet — ignorance, not death, which is exactly the state a fresh provider is
+    // in right after the reconnect that produces these rejected frames. Treating it as death
+    // dropped the recovery attempt and scheduled nothing, and since the delivery token is already
+    // retired, no later frame could revive it: the pane stayed dark. Only proof stops us.
+    if (
+      !ptyProvider ||
+      typeof ptyProvider.hasPty !== 'function' ||
+      ptyProvider.hasPty(appPtyId) === false
+    ) {
       this.rejectedPtyRecoveryAttempts.delete(appPtyId)
       return
     }
@@ -1979,21 +2005,25 @@ export class SshRelaySession {
     const activeLeaseByPtyId = activeLease
       ? new Map<string, SshPtyLease>([[relayPtyId, activeLease]])
       : new Map<string, SshPtyLease>()
-    const expectedIdentity = activeLease ? expectedIdentityForLease(activeLease) : undefined
     const attachedLeaseIds = new Set<string>()
+    const terminatedLeaseIds = new Set<string>()
     await this.reattachKnownPty({
       ptyProvider,
       ptyId: relayPtyId,
       activeLeaseByPtyId,
-      expectedIdentityByPtyId: expectedIdentity
-        ? new Map([[relayPtyId, expectedIdentity]])
-        : new Map(),
       attachedLeaseIds,
+      terminatedLeaseIds,
       mux,
       providerGeneration,
       shouldContinue,
       targetedDeliveryRecovery
     })
+    if (terminatedLeaseIds.size > 0) {
+      await this.store.markSshRemotePtyLeasesTerminatedAsync(
+        this.targetId,
+        Array.from(terminatedLeaseIds)
+      )
+    }
     if (attachedLeaseIds.size > 0 && shouldContinue()) {
       await this.store.markSshRemotePtyLeasesAttachedAsync(
         this.targetId,
@@ -2245,21 +2275,21 @@ export class SshRelaySession {
     mux: SshChannelMultiplexer,
     shouldContinue: () => boolean
   ): Promise<void> {
+    // Why: installs predating pane-keyed supersession carry duplicate live leases;
+    // fanning out over them is what grafted panes the user never opened (STA-3077).
+    const retired = await this.store.supersedeDuplicatePaneLeases(this.targetId)
+    if (retired > 0) {
+      console.info(
+        `[ssh-relay-session] Retired ${retired} duplicate pane lease(s) for ${this.targetId}; their remote shells are left running.`
+      )
+    }
     const activeLeases = this.store
       .getSshRemotePtyLeases(this.targetId)
       .filter((lease) => lease.state !== 'terminated' && lease.state !== 'expired')
     const activeLeaseByPtyId = new Map(activeLeases.map((lease) => [lease.ptyId, lease]))
     const leasedPtyIds = activeLeases.map((lease) => lease.ptyId)
-    // Why: pass pane identity so the relay can reject cross-generation id collisions; tabId falls back for pre-leafId leases.
-    const expectedIdentityByPtyId = new Map(
-      activeLeases
-        .map((lease): [string, ExpectedPtyIdentity] | null => {
-          const expected = expectedIdentityForLease(lease)
-          return expected ? [lease.ptyId, expected] : null
-        })
-        .filter((entry): entry is [string, ExpectedPtyIdentity] => entry !== null)
-    )
     const attachedLeaseIds = new Set<string>()
+    const terminatedLeaseIds = new Set<string>()
     // Why: after app restart ptyOwnership is empty, but durable SSH leases still describe grace-window survivors.
     const ptyIds = Array.from(
       new Set([
@@ -2286,8 +2316,8 @@ export class SshRelaySession {
             ptyProvider,
             ptyId,
             activeLeaseByPtyId,
-            expectedIdentityByPtyId,
             attachedLeaseIds,
+            terminatedLeaseIds,
             mux,
             providerGeneration,
             shouldContinue
@@ -2307,6 +2337,12 @@ export class SshRelaySession {
     await Promise.all(
       Array.from({ length: Math.min(SSH_PTY_REATTACH_MAX_CONCURRENCY, ptyIds.length) }, worker)
     )
+    if (terminatedLeaseIds.size > 0) {
+      await this.store.markSshRemotePtyLeasesTerminatedAsync(
+        this.targetId,
+        Array.from(terminatedLeaseIds)
+      )
+    }
     if (attachedLeaseIds.size > 0 && shouldContinue()) {
       await this.store.markSshRemotePtyLeasesAttachedAsync(
         this.targetId,
@@ -2319,8 +2355,8 @@ export class SshRelaySession {
     ptyProvider: SshPtyProvider
     ptyId: string
     activeLeaseByPtyId: Map<string, SshPtyLease>
-    expectedIdentityByPtyId: Map<string, ExpectedPtyIdentity>
     attachedLeaseIds: Set<string>
+    terminatedLeaseIds: Set<string>
     mux: SshChannelMultiplexer
     providerGeneration: number
     shouldContinue: () => boolean
@@ -2330,8 +2366,8 @@ export class SshRelaySession {
       ptyProvider,
       ptyId,
       activeLeaseByPtyId,
-      expectedIdentityByPtyId,
       attachedLeaseIds,
+      terminatedLeaseIds,
       mux,
       providerGeneration,
       shouldContinue,
@@ -2358,12 +2394,17 @@ export class SshRelaySession {
         targetedDeliveryRecovery === 'fresh-activation'
           ? undefined
           : await this.sourceRecoveryRequest(appPtyId)
+      // The shell this lease names, as the host attested it. Without it the main reconnect path
+      // attaches by id alone, and a replaced relay reissues ids from pty-1.
       const attachResult = await this.attachPtyWithRetry(
         ptyProvider,
         ptyId,
-        expectedIdentityByPtyId.get(ptyId),
         recoveryRequest,
-        shouldContinue
+        shouldContinue,
+        activeLeaseByPtyId.get(ptyId)?.incarnationId,
+        activeLeaseByPtyId.get(ptyId)
+          ? legacyExpectedIdentityForLease(activeLeaseByPtyId.get(ptyId)!)
+          : undefined
       )
       sourceActivationLease = attachResult.sourceActivationLease
       if (!shouldContinue()) {
@@ -2509,7 +2550,13 @@ export class SshRelaySession {
       if (!shouldContinue()) {
         return
       }
-      this.handlePtyReattachFailure(ptyId, appPtyId, pendingReattach, error)
+      this.handlePtyReattachFailure(
+        ptyId,
+        pendingReattach,
+        error,
+        activeLeaseByPtyId.get(ptyId)?.incarnationId,
+        terminatedLeaseIds
+      )
     } finally {
       recoveryActivationLease?.retire()
       sourceActivationLease?.rollback()
@@ -2548,22 +2595,42 @@ export class SshRelaySession {
     lease: SshPtyLease | undefined
   ): void {
     if (lease?.worktreeId && lease.tabId && lease.leafId) {
-      this.runtime?.registerPty(appPtyId, lease.worktreeId, this.targetId, {
-        tabId: lease.tabId,
-        leafId: lease.leafId,
-        incarnationId
-      })
+      // Why bind before registering: `mayCreate: false` refuses when the pane is
+      // gone, and registering first would surface a pane the user never opened.
+      // A thrown write is unknown, not a refusal, so it must not detach anything.
+      // The lease's tabId was frozen when it was written and the pane may have moved since, so the
+      // live layout outranks it. Resolved before the write, so a throw cannot lose it and leave the
+      // graph registered under the tab the pane left.
+      const tabId = resolvePaneShellTabId(this.store, lease.leafId) ?? lease.tabId
+      let bind: { bound: boolean; tabId: string } | null = null
       try {
-        this.store.persistPtyBinding({
+        bind = bindPaneShell({
+          store: this.store,
           worktreeId: lease.worktreeId,
-          tabId: lease.tabId,
+          tabId,
           leafId: lease.leafId,
           ptyId: appPtyId,
-          incarnationId
+          incarnationId,
+          mayCreate: false
         })
       } catch (error) {
         console.error('[ssh-relay-session] Failed to persist reconnect incarnation:', error)
       }
+      if (bind?.bound === false) {
+        // Unresolved, not dead: the remote shell keeps running and stays
+        // reattachable once a durable pane names it again.
+        console.info(
+          `[ssh-relay-session] No durable pane owns ${appPtyId} on ${this.targetId}; left running unbound.`
+        )
+        return
+      }
+      // The tab the bind resolved, not the lease's frozen one — a moved pane must not be recorded
+      // in the graph under the tab it left while its record and fence name the tab it is in.
+      this.runtime?.registerPty(appPtyId, lease.worktreeId, this.targetId, {
+        tabId,
+        leafId: lease.leafId,
+        incarnationId
+      })
       return
     }
     this.runtime?.onPtySpawned(appPtyId, incarnationId, { awaitsRegistration: false })
@@ -2572,9 +2639,10 @@ export class SshRelaySession {
   private async attachPtyWithRetry(
     ptyProvider: SshPtyProvider,
     ptyId: string,
-    expectedIdentity: ExpectedPtyIdentity | undefined,
     recoveryRequest: PtySourceRecoveryRequest | undefined,
-    shouldContinue: () => boolean
+    shouldContinue: () => boolean,
+    expectedIncarnationId: string | undefined,
+    legacyExpectedIdentity: LegacyExpectedPtyIdentity | undefined
   ): Promise<SshPtyAttachResult> {
     let lastError: unknown
     for (let attempt = 0; attempt < 2; attempt++) {
@@ -2585,12 +2653,26 @@ export class SshRelaySession {
         return await this.attachPtyWithDeadline(
           ptyProvider,
           ptyId,
-          expectedIdentity,
-          recoveryRequest
+          recoveryRequest,
+          expectedIncarnationId,
+          legacyExpectedIdentity
         )
       } catch (error) {
         lastError = error
-        if (!shouldContinue() || isSshPtyNotFoundError(error) || attempt === 1) {
+        // A proven exit is as final as an unknown id: retrying either only burns the wait before
+        // the same answer. Without this the liveness-probe reap, which now answers with proof
+        // rather than "not found", would no longer match and would cost a needless retry.
+        if (
+          !shouldContinue() ||
+          isSshPtyNotFoundError(error) ||
+          isSshPtyIdentityMismatchError(error) ||
+          parseMatchingPtyExitedError(
+            error instanceof Error ? error.message : String(error),
+            ptyId,
+            expectedIncarnationId
+          ) !== null ||
+          attempt === 1
+        ) {
           throw error
         }
         await this.waitForPtyReattachRetry()
@@ -2602,8 +2684,9 @@ export class SshRelaySession {
   private async attachPtyWithDeadline(
     ptyProvider: SshPtyProvider,
     ptyId: string,
-    expectedIdentity: ExpectedPtyIdentity | undefined,
-    recoveryRequest: PtySourceRecoveryRequest | undefined
+    recoveryRequest: PtySourceRecoveryRequest | undefined,
+    expectedIncarnationId: string | undefined,
+    legacyExpectedIdentity: LegacyExpectedPtyIdentity | undefined
   ): Promise<SshPtyAttachResult> {
     let timer: ReturnType<typeof setTimeout> | undefined
     let timedOut = false
@@ -2617,13 +2700,17 @@ export class SshRelaySession {
       timer.unref?.()
     })
     try {
-      const attach = expectedIdentity
-        ? recoveryRequest
-          ? ptyProvider.attachForReconnect(ptyId, expectedIdentity, recoveryRequest)
-          : ptyProvider.attachForReconnect(ptyId, expectedIdentity)
-        : recoveryRequest
-          ? ptyProvider.attachForReconnect(ptyId, undefined, recoveryRequest)
-          : ptyProvider.attachForReconnect(ptyId)
+      const attach =
+        expectedIncarnationId !== undefined || legacyExpectedIdentity !== undefined
+          ? ptyProvider.attachForReconnect(
+              ptyId,
+              recoveryRequest,
+              expectedIncarnationId,
+              legacyExpectedIdentity
+            )
+          : recoveryRequest !== undefined
+            ? ptyProvider.attachForReconnect(ptyId, recoveryRequest)
+            : ptyProvider.attachForReconnect(ptyId)
       const guardedAttach = attach.then((result) => {
         if (timedOut) {
           result.sourceActivationLease?.rollback()
@@ -2650,40 +2737,31 @@ export class SshRelaySession {
 
   private handlePtyReattachFailure(
     ptyId: string,
-    appPtyId: string,
     pending: PendingPtyReattach,
-    error: unknown
+    error: unknown,
+    expectedIncarnationId: string | undefined,
+    terminatedLeaseIds: Set<string>
   ): void {
-    if (!isSshPtyNotFoundError(error)) {
-      pending.restoreRequired = 'reattachAttemptsExhausted'
-      this.wakeRecovery(pending)
-      console.warn(
-        `[ssh-relay-session] Leaving PTY ${ptyId} detached for ${this.targetId} after bounded reattach attempts failed: ${
-          error instanceof Error ? error.message : String(error)
-        }`
-      )
-      return
-    }
-    if (isSshPtyIdentityMismatchError(error)) {
-      console.warn(
-        `[ssh-relay-session] Ignoring stale PTY ${ptyId} for ${this.targetId} after relay identity mismatch: ${
-          error instanceof Error ? error.message : String(error)
-        }`
-      )
-      return
+    // An exact exit proof settles the lease; queue it for one post-worker durable retirement batch.
+    // `terminated` is not the recovery-grant state, so this cannot authorize a replacement.
+
+    const exitProof = parseMatchingPtyExitedError(
+      error instanceof Error ? error.message : String(error),
+      ptyId,
+      expectedIncarnationId
+    )
+    if (exitProof) {
+      terminatedLeaseIds.add(ptyId)
     }
+    // Nothing else proves it — not even a not-found, which the relay also returns when it merely
+    // cannot hand this id back — so every other failure leaves the pane detached and recoverable.
+    pending.restoreRequired = 'reattachAttemptsExhausted'
+    this.wakeRecovery(pending)
     console.warn(
-      `[ssh-relay-session] Dropping stale PTY ${ptyId} for ${this.targetId} after relay reattach failed: ${
+      `[ssh-relay-session] Leaving PTY ${ptyId} detached for ${this.targetId} after reattach failed: ${
         error instanceof Error ? error.message : String(error)
       }`
     )
-    clearProviderPtyState(appPtyId)
-    deletePtyOwnership(appPtyId)
-    this.store.markSshRemotePtyLease(this.targetId, ptyId, 'expired')
-    const win = this.getMainWindow()
-    if (win && !win.isDestroyed()) {
-      win.webContents.send('pty:exit', { id: appPtyId, code: -1 })
-    }
   }
 
   private async sourceRecoveryRequest(
diff --git a/src/main/ssh/ssh-remote-node-toolchain-probe.ts b/src/main/ssh/ssh-remote-node-toolchain-probe.ts
index b1e0b8d544a..d6d7f1d7a06 100644
--- a/src/main/ssh/ssh-remote-node-toolchain-probe.ts
+++ b/src/main/ssh/ssh-remote-node-toolchain-probe.ts
@@ -50,7 +50,7 @@ export function nodeToolchainVersionsMeetRequirements(versionOutput: string): bo
 function markedVersionMajor(output: string, marker: string): number | null {
   const lines = output.split(/\r?\n/)
   const markerIndex = lines.indexOf(marker)
-  if (markerIndex < 0) {
+  if (markerIndex === -1) {
     return null
   }
   for (const line of lines.slice(markerIndex + 1)) {
diff --git a/src/main/startup/configure-process.test.ts b/src/main/startup/configure-process.test.ts
index eaf9f42aeec..54ecdc61424 100644
--- a/src/main/startup/configure-process.test.ts
+++ b/src/main/startup/configure-process.test.ts
@@ -396,6 +396,46 @@ describe('configureElectronNetworkCompatibility', () => {
   })
 })
 
+describe('disableUnsupportedChromiumFeatures', () => {
+  it('disables FedCM before Chromium sessions are created', async () => {
+    const { app } = await import('electron')
+    const { disableUnsupportedChromiumFeatures } = await import('./configure-process')
+
+    vi.mocked(app.commandLine.appendSwitch).mockClear()
+    disableUnsupportedChromiumFeatures()
+
+    expect(app.commandLine.appendSwitch).toHaveBeenCalledWith('disable-features', 'FedCm')
+  })
+
+  it('preserves existing disabled Chromium features', async () => {
+    const { app } = await import('electron')
+    const { disableUnsupportedChromiumFeatures } = await import('./configure-process')
+
+    vi.mocked(app.commandLine.getSwitchValue).mockReturnValueOnce('ExistingFeature')
+    vi.mocked(app.commandLine.appendSwitch).mockClear()
+    disableUnsupportedChromiumFeatures()
+
+    expect(app.commandLine.appendSwitch).toHaveBeenCalledWith(
+      'disable-features',
+      'FedCm,ExistingFeature'
+    )
+  })
+
+  it('does not duplicate FedCM when disable-features already includes it', async () => {
+    const { app } = await import('electron')
+    const { disableUnsupportedChromiumFeatures } = await import('./configure-process')
+
+    vi.mocked(app.commandLine.getSwitchValue).mockReturnValueOnce('FedCm,ExistingFeature')
+    vi.mocked(app.commandLine.appendSwitch).mockClear()
+    disableUnsupportedChromiumFeatures()
+
+    expect(app.commandLine.appendSwitch).toHaveBeenCalledWith(
+      'disable-features',
+      'FedCm,ExistingFeature'
+    )
+  })
+})
+
 describe('enableMainProcessGpuFeatures', () => {
   const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
   const originalE2EUserDataDir = process.env.ORCA_E2E_USER_DATA_DIR
diff --git a/src/main/startup/configure-process.ts b/src/main/startup/configure-process.ts
index e545d89da9c..e39963bc9f2 100644
--- a/src/main/startup/configure-process.ts
+++ b/src/main/startup/configure-process.ts
@@ -66,6 +66,20 @@ export function configureElectronNetworkCompatibility(
   app.commandLine.appendSwitch('disable-http2')
 }
 
+export function disableUnsupportedChromiumFeatures(): void {
+  appendDisabledChromiumFeatures(['FedCm'])
+}
+
+function appendDisabledChromiumFeatures(features: string[]): void {
+  const existingFeatures = app.commandLine
+    .getSwitchValue('disable-features')
+    .split(',')
+    .map((feature) => feature.trim())
+    .filter(Boolean)
+  const disabledFeatures = Array.from(new Set([...features, ...existingFeatures])).join(',')
+  app.commandLine.appendSwitch('disable-features', disabledFeatures)
+}
+
 function getProcessPathDelimiter(): string {
   return process.platform === 'win32' ? ';' : ':'
 }
@@ -300,11 +314,7 @@ export function enableMainProcessGpuFeatures(): void {
     app.commandLine.appendSwitch('enable-features', features)
   }
 
-  const existingDisabledFeatures = app.commandLine.getSwitchValue('disable-features')
   // Why: IntensiveWakeUpThrottling clamps hidden-page timers to 1/min after 5min, delaying agent-done/bell notifications ~60s.
   // This opt-out is skipped under GPU fallback (win32-only today); if throttling ever reaches Windows it must move out of this path.
-  const disabledFeatures = ['IntensiveWakeUpThrottling', existingDisabledFeatures]
-    .filter(Boolean)
-    .join(',')
-  app.commandLine.appendSwitch('disable-features', disabledFeatures)
+  appendDisabledChromiumFeatures(['IntensiveWakeUpThrottling'])
 }
diff --git a/src/main/startup/hydrate-shell-path.ts b/src/main/startup/hydrate-shell-path.ts
index 9cf7dc75608..38a16816507 100644
--- a/src/main/startup/hydrate-shell-path.ts
+++ b/src/main/startup/hydrate-shell-path.ts
@@ -71,11 +71,11 @@ function pickShell(): string | null {
 function parseCapturedPath(stdout: string, pathDelimiter: string = delimiter): string[] {
   const cleaned = stdout.replace(ANSI_RE, '')
   const first = cleaned.indexOf(DELIMITER)
-  if (first < 0) {
+  if (first === -1) {
     return []
   }
   const second = cleaned.indexOf(DELIMITER, first + DELIMITER.length)
-  if (second < 0) {
+  if (second === -1) {
     return []
   }
   const value = cleaned.slice(first + DELIMITER.length, second).trim()
diff --git a/src/main/text-generation/commit-message-text-generation.test.ts b/src/main/text-generation/commit-message-text-generation.test.ts
index 885f24d1667..1163f54bb42 100644
--- a/src/main/text-generation/commit-message-text-generation.test.ts
+++ b/src/main/text-generation/commit-message-text-generation.test.ts
@@ -89,7 +89,6 @@ beforeEach(() => {
 describe('resolveCommitMessageSettings', () => {
   it('falls back when a dynamic persisted model was not discovered', () => {
     const settings = getDefaultSettings('/tmp')
-    settings.enableGitHubAttribution = true
     settings.commitMessageAi = {
       enabled: true,
       agentId: 'codex',
diff --git a/src/main/warp-themes/discovery.ts b/src/main/warp-themes/discovery.ts
index 6f3f80b51da..fd29419c12c 100644
--- a/src/main/warp-themes/discovery.ts
+++ b/src/main/warp-themes/discovery.ts
@@ -142,7 +142,7 @@ export function getWarpThemeDirectories(): string[] {
 export function warpThemeSourceLabelForDirectory(directoryPath: string): string {
   const parts = directoryPath.split(/[\\/]+/).filter(Boolean)
   const themesIndex = parts.findLastIndex((part) => part.toLowerCase() === 'themes')
-  if (themesIndex < 0) {
+  if (themesIndex === -1) {
     return parts.at(-1) || 'Warp themes'
   }
 
diff --git a/src/main/window/createMainWindow.ts b/src/main/window/createMainWindow.ts
index d34ef495965..0661b6c3d06 100644
--- a/src/main/window/createMainWindow.ts
+++ b/src/main/window/createMainWindow.ts
@@ -336,7 +336,7 @@ export function createMainWindow(
     mainWindow.webContents.setZoomLevel(level)
     // Why: native traffic lights don't scale with CSS zoom; reposition on startup to stay aligned with the zoomed titlebar.
     if (process.platform === 'darwin') {
-      syncTrafficLightPosition(mainWindow, Math.pow(1.2, level))
+      syncTrafficLightPosition(mainWindow, 1.2 ** level)
     }
   })
 
diff --git a/src/preload/api-types.ts b/src/preload/api-types.ts
index cf59c18719c..54e03a81f58 100644
--- a/src/preload/api-types.ts
+++ b/src/preload/api-types.ts
@@ -1196,6 +1196,7 @@ export type PreloadApi = {
           | 'externalWorktreeVisibilityPromptDismissedAt'
           | 'externalWorktreeInboxBaselinePaths'
           | 'importedExternalWorktreePaths'
+          | 'agentWorktreeVisibility'
           | 'projectGroupId'
           | 'projectGroupOrder'
           | 'forkSyncMode'
@@ -1332,6 +1333,7 @@ export type PreloadApi = {
           | 'pendingFirstAgentMessageRename'
           | 'firstAgentMessageRenameError'
           | 'lastActivityAt'
+          | 'diffComments'
         >
       >
     }) => Promise<FolderWorkspace | null>
@@ -1467,9 +1469,12 @@ export type PreloadApi = {
       rows: number
       cwd?: string
       cwdFallback?: 'worktree'
+      /** Create a shell for this pane instead of adopting the one it records; see pty.ts. */
+      createFreshShellForUnreachablePane?: boolean
       env?: Record<string, string>
       envToDelete?: string[]
       command?: string
+      commandDelivery?: 'renderer' | 'provider'
       launchConfig?: SleepingAgentLaunchConfig
       resumeProviderSession?: AgentProviderSessionMetadata
       launchToken?: string
@@ -1499,6 +1504,8 @@ export type PreloadApi = {
       snapshotPrefixAnsi?: string
       snapshotFrameAnsi?: string
       snapshotFrameRestoreAnsi?: string
+      snapshotKittyKeyboardFlags?: number
+      snapshotSeq?: number
       isReattach?: boolean
       isAlternateScreen?: boolean
       replay?: string
@@ -1581,6 +1588,9 @@ export type PreloadApi = {
       /** Trailing incomplete escape the emulator ingested; the restorer must
        *  write it after its post-replay resets, last before live chunks. */
       pendingEscapeTailAnsi?: string
+      /** Effective kitty flags the snapshot owner proved at `seq`. Absent means
+       *  unknown; consumers must not turn that into a known `0`. */
+      kittyKeyboardFlags?: number
     } | null>
     getRendererDeliveryDebugSnapshot: () => Promise<{
       pendingPtyCount: number
@@ -1651,6 +1661,7 @@ export type PreloadApi = {
         rows: number
         seq?: number
         lastTitle?: string
+        kittyKeyboardFlags?: number
       } | null
     ) => void
     declarePendingPaneSerializer: (paneKey: string) => Promise<number>
@@ -3404,6 +3415,7 @@ export type PreloadApi = {
       params?: unknown
       timeoutMs?: number
       expectedEnvironmentPairingRevision?: number
+      expectedRuntimeId?: string
     }) => Promise<RuntimeRpcResponse<unknown>>
     subscribe: (
       args: {
@@ -3412,6 +3424,7 @@ export type PreloadApi = {
         params?: unknown
         timeoutMs?: number
         expectedEnvironmentPairingRevision?: number
+        expectedRuntimeId?: string
       },
       callbacks: {
         onResponse: (response: RuntimeRpcResponse<unknown>) => void
diff --git a/src/preload/index.ts b/src/preload/index.ts
index 70ce60249b1..4808dd3b979 100644
--- a/src/preload/index.ts
+++ b/src/preload/index.ts
@@ -943,9 +943,11 @@ const api = {
       rows: number
       cwd?: string
       cwdFallback?: 'worktree'
+      createFreshShellForUnreachablePane?: boolean
       env?: Record<string, string>
       envToDelete?: string[]
       command?: string
+      commandDelivery?: 'renderer' | 'provider'
       launchConfig?: SleepingAgentLaunchConfig
       resumeProviderSession?: AgentProviderSessionMetadata
       launchToken?: string
@@ -973,6 +975,8 @@ const api = {
       snapshotPrefixAnsi?: string
       snapshotFrameAnsi?: string
       snapshotFrameRestoreAnsi?: string
+      snapshotKittyKeyboardFlags?: number
+      snapshotSeq?: number
       isReattach?: boolean
       isAlternateScreen?: boolean
       replay?: string
@@ -1093,6 +1097,7 @@ const api = {
       alternateScreen?: boolean
       scrollbackAnsi?: string
       pendingEscapeTailAnsi?: string
+      kittyKeyboardFlags?: number
     } | null> => ipcRenderer.invoke('pty:getMainBufferSnapshot', { id, opts }),
 
     getRendererDeliveryDebugSnapshot: (): Promise<{
@@ -1255,6 +1260,7 @@ const api = {
         rows: number
         seq?: number
         lastTitle?: string
+        kittyKeyboardFlags?: number
       } | null
     ): void => {
       ipcRenderer.send('pty:serializeBuffer:response', { requestId, snapshot })
@@ -1461,7 +1467,7 @@ const api = {
       checkName?: string
       url?: string | null
       prRepo?: GitHubOwnerRepo | null
-    }): Promise<unknown | null> => ipcRenderer.invoke('gh:prCheckDetails', args),
+    }): Promise<unknown> => ipcRenderer.invoke('gh:prCheckDetails', args),
 
     rerunPRChecks: (args: {
       repoPath: string
@@ -4423,6 +4429,7 @@ const api = {
       params?: unknown
       timeoutMs?: number
       expectedEnvironmentPairingRevision?: number
+      expectedRuntimeId?: string
     }): Promise<RuntimeRpcResponse<unknown>> =>
       ipcRenderer.invoke('runtimeEnvironments:call', args),
     subscribe: async (
@@ -4432,6 +4439,7 @@ const api = {
         params?: unknown
         timeoutMs?: number
         expectedEnvironmentPairingRevision?: number
+        expectedRuntimeId?: string
       },
       callbacks: {
         onResponse: (response: RuntimeRpcResponse<unknown>) => void
@@ -4933,8 +4941,7 @@ if (process.contextIsolated) {
     console.error(error)
   }
 } else {
-  // @ts-ignore (define in dts)
   window.electron = electronAPI
-  // @ts-ignore (define in dts)
+  // @ts-expect-error (define in dts)
   window.api = api
 }
diff --git a/src/preload/runtime-environment-subscriptions.test.ts b/src/preload/runtime-environment-subscriptions.test.ts
index 585b0f75fa9..a77614e1196 100644
--- a/src/preload/runtime-environment-subscriptions.test.ts
+++ b/src/preload/runtime-environment-subscriptions.test.ts
@@ -68,7 +68,12 @@ describe('subscribeRuntimeEnvironmentFromPreload', () => {
 
     const cleanupPromise = subscribeRuntimeEnvironmentFromPreload(
       ipc,
-      { selector: 'desk', method: 'terminal.subscribe' },
+      {
+        selector: 'desk',
+        method: 'terminal.subscribe',
+        expectedEnvironmentPairingRevision: 7,
+        expectedRuntimeId: 'runtime-1'
+      },
       { onResponse, onBinary },
       () => 'sub-1'
     )
@@ -80,6 +85,8 @@ describe('subscribeRuntimeEnvironmentFromPreload', () => {
     expect(ipc.invoke).toHaveBeenCalledWith('runtimeEnvironments:subscribe', {
       selector: 'desk',
       method: 'terminal.subscribe',
+      expectedEnvironmentPairingRevision: 7,
+      expectedRuntimeId: 'runtime-1',
       subscriptionId: 'sub-1'
     })
 
diff --git a/src/preload/runtime-environment-subscriptions.ts b/src/preload/runtime-environment-subscriptions.ts
index f9d46b467aa..c804c651f73 100644
--- a/src/preload/runtime-environment-subscriptions.ts
+++ b/src/preload/runtime-environment-subscriptions.ts
@@ -5,6 +5,8 @@ type RuntimeEnvironmentSubscribeArgs = {
   method: string
   params?: unknown
   timeoutMs?: number
+  expectedEnvironmentPairingRevision?: number
+  expectedRuntimeId?: string
 }
 
 type RuntimeEnvironmentSubscriptionCallbacks = {
diff --git a/src/relay/agent-hook-server.ts b/src/relay/agent-hook-server.ts
index 3166c70a2f5..6a281a7ed83 100644
--- a/src/relay/agent-hook-server.ts
+++ b/src/relay/agent-hook-server.ts
@@ -1,8 +1,9 @@
 /* eslint-disable max-lines -- Why: parsing, replay cache, endpoint writing, and retry state are one lifecycle unit; splitting obscures cleanup ordering across reconnects. */
 // Relay-side adapter for the shared agent-hook listener: hosts a loopback HTTP server and
 // forwards each parsed payload via a callback so `relay.ts` re-emits it as an `agent.hook`
-// JSON-RPC notification over the SSH channel. Replay cache is bounded one-entry-per-paneKey —
-// see docs/design/agent-status-over-ssh.md §5 (Path 3, request-driven replay) for the rationale.
+// JSON-RPC notification over the SSH channel. Replay cache is bounded one-entry-per-paneKey: a
+// reattaching Orca only needs each pane's current status, never its history, and the bound keeps a
+// long-lived relay from growing with every event.
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
 import { randomUUID } from 'node:crypto'
 import { basename, dirname, join } from 'node:path'
@@ -99,10 +100,10 @@ export class RelayAgentHookServer {
   private state: HookListenerState = createHookListenerState()
   // Why: retain envelope metadata so replays match live POSTs.
   // Invariant: keys mirror state.lastStatusByPaneKey, populated/cleared in lockstep.
-  private lastEnvelopeMetaByPaneKey: Map<
+  private lastEnvelopeMetaByPaneKey = new Map<
     string,
     { source: AgentHookSource; env?: string; version?: string }
-  > = new Map()
+  >()
   private assistantMessageRetryTimers = new Map<string, ReturnType<typeof setTimeout>>()
   private codexSubagentPollTimers = new Map<string, ReturnType<typeof setTimeout>>()
   private forward: RelayHookForward
diff --git a/src/relay/ai-vault-service-client.ts b/src/relay/ai-vault-service-client.ts
index 87c0d6e4c84..c873c380506 100644
--- a/src/relay/ai-vault-service-client.ts
+++ b/src/relay/ai-vault-service-client.ts
@@ -123,7 +123,7 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
         continue
       }
       const index = this.queue.findIndex((call) => call.lane === lane)
-      if (index < 0) {
+      if (index === -1) {
         continue
       }
       const call = this.queue.splice(index, 1)[0]!
@@ -241,7 +241,7 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
 
   private cancel(call: RelayAiVaultServiceCall): void {
     const index = this.queue.indexOf(call)
-    if (index >= 0) {
+    if (index !== -1) {
       this.queue.splice(index, 1)
       settleRelayAiVaultServiceCall(call, relayAiVaultAbortError())
       this.pump()
diff --git a/src/relay/dispatcher-client-writer.test.ts b/src/relay/dispatcher-client-writer.test.ts
index 13e49b59e8e..83b5e7960b7 100644
--- a/src/relay/dispatcher-client-writer.test.ts
+++ b/src/relay/dispatcher-client-writer.test.ts
@@ -51,7 +51,7 @@ function createWriter(
         sink.drainWaiters.push(callback)
         return () => {
           const index = sink.drainWaiters.indexOf(callback)
-          if (index >= 0) {
+          if (index !== -1) {
             sink.drainWaiters.splice(index, 1)
           }
         }
diff --git a/src/relay/external-automations-handler.ts b/src/relay/external-automations-handler.ts
index baaaa99481e..03bb0b9beba 100644
--- a/src/relay/external-automations-handler.ts
+++ b/src/relay/external-automations-handler.ts
@@ -382,7 +382,7 @@ export class ExternalAutomationsHandler {
       (sessionRun, index) =>
         !usedSessionRunIndexes.has(index) && this.getRunKey(sessionRun) === outputRunKey
     )
-    if (exactMatchIndex >= 0) {
+    if (exactMatchIndex !== -1) {
       return exactMatchIndex
     }
 
@@ -755,7 +755,7 @@ export class ExternalAutomationsHandler {
     }
   }
 
-  private readHermesSessionDbRunById(jobId: string, runId: string): unknown | null {
+  private readHermesSessionDbRunById(jobId: string, runId: string): unknown {
     if (!existsSync(HERMES_STATE_DB)) {
       return null
     }
diff --git a/src/relay/git-handler-utils.ts b/src/relay/git-handler-utils.ts
index ab3bb61faba..25885cfe4dc 100644
--- a/src/relay/git-handler-utils.ts
+++ b/src/relay/git-handler-utils.ts
@@ -106,7 +106,7 @@ export function parseUnmergedEntry(
  */
 export function parseBranchDiff(
   stdout: string,
-  statsByPath: Map<string, GitLineStats> = new Map()
+  statsByPath = new Map<string, GitLineStats>()
 ): Record<string, unknown>[] {
   const entries: Record<string, unknown>[] = []
   for (const line of stdout.split(/\r?\n/)) {
diff --git a/src/relay/plugin-overlay-env.test.ts b/src/relay/plugin-overlay-env.test.ts
index 78e08918297..7746307cf47 100644
--- a/src/relay/plugin-overlay-env.test.ts
+++ b/src/relay/plugin-overlay-env.test.ts
@@ -104,4 +104,31 @@ describe('plugin overlay env source resolution', () => {
       )
     ).toBe('/remote/original-prime')
   })
+
+  // Why: the session env is the only place a fish user's XDG_CONFIG_HOME shows up
+  // (config.fish exports it, so no GUI-launched process inherits it). Dropping it
+  // here would scan ~/.config and disagree with the same lookup on the main side.
+  it.skipIf(process.platform === 'win32')(
+    'reads fish config under the session XDG_CONFIG_HOME',
+    () => {
+      const configHome = join(homeDir, 'xdg')
+      mkdirSync(join(configHome, 'fish'), { recursive: true })
+      writeFileSync(
+        join(configHome, 'fish', 'config.fish'),
+        'set -gx OPENCODE_CONFIG_DIR "$HOME/company-opencode"\n'
+      )
+      mkdirSync(join(homeDir, '.config', 'fish'), { recursive: true })
+      writeFileSync(
+        join(homeDir, '.config', 'fish', 'config.fish'),
+        'set -gx OPENCODE_CONFIG_DIR /wrong-default-config-home\n'
+      )
+
+      expect(
+        resolveOpenCodeSourceConfigDir(
+          { HOME: homeDir, XDG_CONFIG_HOME: configHome },
+          '/opt/homebrew/bin/fish'
+        )
+      ).toBe(join(homeDir, 'company-opencode'))
+    }
+  )
 })
diff --git a/src/relay/plugin-overlay-env.ts b/src/relay/plugin-overlay-env.ts
index 4b91da8ff62..1db43f4717e 100644
--- a/src/relay/plugin-overlay-env.ts
+++ b/src/relay/plugin-overlay-env.ts
@@ -1,4 +1,4 @@
-import { readShellStartupEnvVar } from '../main/pty/shell-startup-env'
+import { readSessionShellStartupEnvVar } from '../main/pty/shell-startup-env'
 import {
   PRIMARY_AGENT_DIR_ENV_BY_KIND,
   SOURCE_AGENT_DIR_ENV_BY_KIND,
@@ -14,7 +14,9 @@ function readStartupEnv(
   env: Record<string, string>,
   shell: string | undefined
 ): string | undefined {
-  return readShellStartupEnvVar(name, env.HOME ?? process.env.HOME, shell ?? env.SHELL)
+  // Why the session env first: it is closer to the user's shell than the relay
+  // process env, and fish config lives under its XDG_CONFIG_HOME.
+  return readSessionShellStartupEnvVar(name, env, shell)
 }
 
 export function resolveOpenCodeSourceConfigDir(
diff --git a/src/relay/plugin-overlay.ts b/src/relay/plugin-overlay.ts
index 6ff480ef91a..ffb9116beae 100644
--- a/src/relay/plugin-overlay.ts
+++ b/src/relay/plugin-overlay.ts
@@ -4,11 +4,11 @@
 // renderer are meaningless on SSH targets, so the relay performs the remote
 // filesystem work itself.
 //
-// Plugin source strings ship over the JSON-RPC channel at session-ready
-// (commit #7) — they are NOT bundled with the relay binary because the
-// relay is versioned independently from Orca and the plugin source changes
-// frequently as new agent events get added (see docs/design/agent-status-
-// over-ssh.md §4 "Why ship the plugin source over the wire").
+// Plugin source strings ship over the JSON-RPC channel at session-ready —
+// they are NOT bundled with the relay binary because the relay is versioned
+// independently from Orca and the plugin source changes frequently as new
+// agent events get added; bundling would make every such change a relay
+// redeploy, and an old relay would silently serve stale plugin code.
 //
 // We deliberately do not reuse OpenCodeHookService / PiTitlebarExtensionService
 // directly: those modules import `electron` and ride on Orca's userData
diff --git a/src/relay/pty-handler.test.ts b/src/relay/pty-handler.test.ts
index 35d11461c53..f45727c19db 100644
--- a/src/relay/pty-handler.test.ts
+++ b/src/relay/pty-handler.test.ts
@@ -11,9 +11,11 @@ import {
   SETUP_AGENT_SEQUENCE_STARTUP_COMMAND_ENV
 } from '../shared/setup-agent-sequencing'
 import { PTY_STARTUP_INGRESS_VERSION } from '../shared/pty-startup-ingress'
+import { stripLegacyTerminalShimEnv } from '../main/pty/legacy-terminal-shim-dir'
 
-const { mockPtySpawn, mockPtyInstance } = vi.hoisted(() => ({
+const { mockPtySpawn, mockPtyInstance, mockCreateShellPromptReadinessProbe } = vi.hoisted(() => ({
   mockPtySpawn: vi.fn(),
+  mockCreateShellPromptReadinessProbe: vi.fn(),
   mockPtyInstance: {
     // Why: attach now proves the backing pid is alive before replaying, so the
     // default managed PTY must report a live pid. Reuse the test runner's own
@@ -38,11 +40,14 @@ vi.mock('../main/pty/posix-pty-process-groups', () => ({
   forceKillPosixPtyProcessGroups: vi.fn((_pid: number, fallback: () => void) => fallback())
 }))
 
+vi.mock('../main/shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: mockCreateShellPromptReadinessProbe
+}))
+
 import {
   IMMEDIATE_PTY_EXIT_TIMEOUT_MS,
   MAX_RELAY_PTY_SESSIONS,
   PtyHandler,
-  attachIdentityMismatches,
   formatNodePtyUnavailableMessage
 } from './pty-handler'
 import { RelayDispatcher } from './dispatcher'
@@ -139,6 +144,11 @@ describe('PtyHandler', () => {
     mockPtyInstance.clear.mockReset()
     mockPtyInstance.pause.mockReset()
     mockPtyInstance.resume.mockReset()
+    mockCreateShellPromptReadinessProbe.mockReset()
+    mockCreateShellPromptReadinessProbe.mockReturnValue({
+      notifyOutput: vi.fn(),
+      dispose: vi.fn()
+    })
     vi.spyOn(ptyShellUtils, 'processHasChildren').mockResolvedValue(false)
 
     mockPtySpawn.mockReturnValue({ ...mockPtyInstance })
@@ -298,7 +308,56 @@ describe('PtyHandler', () => {
 
     const spawnOptions = mockPtySpawn.mock.calls[0][2] as { env: Record<string, string> }
     expect(spawnOptions.env.NODE_ENV).toBeUndefined()
-    expect(spawnOptions.env.PATH).toBe(process.env.PATH)
+    const expectedEnv = { PATH: process.env.PATH ?? '' }
+    stripLegacyTerminalShimEnv(expectedEnv, process.platform)
+    expect(spawnOptions.env.PATH).toBe(expectedEnv.PATH)
+  })
+
+  it('does not inherit legacy attribution state from the relay process', async () => {
+    const keys = ['ORCA_ENABLE_GIT_ATTRIBUTION', 'ORCA_ATTRIBUTION_SHIM_DIR', 'PATH'] as const
+    const saved = Object.fromEntries(keys.map((key) => [key, process.env[key]]))
+    process.env.ORCA_ENABLE_GIT_ATTRIBUTION = '1'
+    process.env.ORCA_ATTRIBUTION_SHIM_DIR = '/tmp/orca-terminal-attribution/posix'
+    process.env.PATH = '/tmp/orca-terminal-attribution/posix:/usr/bin'
+
+    try {
+      await dispatcher.callRequest('pty.spawn', { cols: 80, rows: 24 })
+      const spawnedEnv = mockPtySpawn.mock.calls.at(-1)?.[2] as {
+        env: Record<string, string>
+      }
+      expect(spawnedEnv.env.PATH).toBe('/usr/bin')
+      expect(spawnedEnv.env.ORCA_ENABLE_GIT_ATTRIBUTION).toBeUndefined()
+      expect(spawnedEnv.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
+
+      const state = (await dispatcher.callRequest('pty.serialize', {
+        ids: ['pty-1']
+      })) as string
+      await handler.dispose({ waitForPhysicalExit: false })
+      mockPtySpawn.mockClear()
+      dispatcher = createMockDispatcher()
+      handler = new PtyHandler(dispatcher as unknown as RelayDispatcher)
+      const killSpy = vi.spyOn(process, 'kill').mockImplementation(() => true)
+      try {
+        await dispatcher.callRequest('pty.revive', { state })
+      } finally {
+        killSpy.mockRestore()
+      }
+
+      const revivedEnv = mockPtySpawn.mock.calls.at(-1)?.[2] as {
+        env: Record<string, string>
+      }
+      expect(revivedEnv.env.PATH).toBe('/usr/bin')
+      expect(revivedEnv.env.ORCA_ENABLE_GIT_ATTRIBUTION).toBeUndefined()
+      expect(revivedEnv.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
+    } finally {
+      for (const [key, value] of Object.entries(saved)) {
+        if (value === undefined) {
+          delete process.env[key]
+        } else {
+          process.env[key] = value
+        }
+      }
+    }
   })
 
   it('keeps a renderer-supplied NODE_ENV for the spawned shell', async () => {
@@ -829,6 +888,7 @@ describe('PtyHandler', () => {
     vi.advanceTimersByTime(49)
     const term = mockPtySpawn.mock.results[0]?.value
     expect(handler.retainedStartupCommandCount).toBe(1)
+    expect(handler.retainedStartupCommandBytes).toBe('echo provider-owned'.length)
     expect(term.write).not.toHaveBeenCalled()
 
     vi.advanceTimersByTime(1)
@@ -870,6 +930,9 @@ describe('PtyHandler', () => {
         | { env?: Record<string, string> }
         | undefined
       expect(spawnOptions?.env?.ORCA_SHELL_READY_MARKER).toBe('1')
+      expect(handler.retainedStartupCommandCount).toBe(1)
+      expect(handler.retainedStartupCommandBytes).toBe(0)
+      vi.advanceTimersByTime(15_000)
       expect(handler.retainedStartupCommandCount).toBe(0)
     }
   )
@@ -906,7 +969,7 @@ describe('PtyHandler', () => {
         | { env?: Record<string, string> }
         | undefined
       expect(spawnOptions?.env?.ORCA_SHELL_READY_MARKER).toBe('1')
-      expect(handler.retainedStartupCommandCount).toBe(0)
+      expect(handler.retainedStartupCommandCount).toBe(1)
     }
   )
 
@@ -1043,6 +1106,224 @@ describe('PtyHandler', () => {
     }
   )
 
+  it.skipIf(process.platform === 'win32')(
+    'recovers provider delivery when startup exec replaces the relay wrapper',
+    async () => {
+      let dataCallback: ((data: string) => void) | undefined
+      const term = {
+        ...mockPtyInstance,
+        onData: vi.fn((cb: (data: string) => void) => {
+          dataCallback = cb
+        }),
+        onExit: vi.fn()
+      }
+      mockPtySpawn.mockReturnValue(term)
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-provider-exec-spawn-'))
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/bash'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'echo after-exec',
+          commandDelivery: 'provider',
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      dataCallback?.(`\x1b]777;orca-shell-start:${process.pid}\x07\x1b[?2004hremote $ `)
+      await vi.advanceTimersByTimeAsync(8)
+
+      const promptOptions = mockCreateShellPromptReadinessProbe.mock.calls[0]?.[0] as {
+        onPromptReady: () => void
+      }
+      expect(
+        mockCreateShellPromptReadinessProbe.mock.results[0]?.value.notifyOutput
+      ).toHaveBeenCalledWith('\x1b[?2004hremote $ ')
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b[?2004hremote $ '
+      })
+      promptOptions.onPromptReady()
+      await vi.advanceTimersByTimeAsync(50)
+
+      expect(term.write).toHaveBeenCalledWith('echo after-exec\n')
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'signals renderer delivery when startup exec replaces the relay wrapper',
+    async () => {
+      let dataCallback: ((data: string) => void) | undefined
+      const term = {
+        ...mockPtyInstance,
+        onData: vi.fn((cb: (data: string) => void) => {
+          dataCallback = cb
+        }),
+        onExit: vi.fn()
+      }
+      mockPtySpawn.mockReturnValue(term)
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-renderer-exec-spawn-'))
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/bash'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'echo after-exec',
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      dataCallback?.(`\x1b]777;orca-shell-start:${process.pid}\x07\x1b[?2004hremote $ `)
+      await vi.advanceTimersByTimeAsync(8)
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b[?2004hremote $ '
+      })
+
+      const promptOptions = mockCreateShellPromptReadinessProbe.mock.calls[0]?.[0] as {
+        onPromptReady: () => void
+      }
+      promptOptions.onPromptReady()
+      await vi.advanceTimersByTimeAsync(8)
+
+      expect(term.write).not.toHaveBeenCalled()
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b]777;orca-shell-ready\x07'
+      })
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'forwards the supported ready marker to renderer delivery',
+    async () => {
+      let dataCallback: ((data: string) => void) | undefined
+      const term = {
+        ...mockPtyInstance,
+        onData: vi.fn((cb: (data: string) => void) => {
+          dataCallback = cb
+        }),
+        onExit: vi.fn()
+      }
+      mockPtySpawn.mockReturnValue(term)
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-renderer-ready-spawn-'))
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/bash'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'echo after-ready',
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      dataCallback?.(
+        `\x1b]777;orca-shell-start:${process.pid}\x07\x1b]777;orca-shell-ready\x07remote $ `
+      )
+      await vi.advanceTimersByTimeAsync(8)
+
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b]777;orca-shell-ready\x07remote $ '
+      })
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'releases split renderer readiness through one completed path',
+    async () => {
+      let dataCallback: ((data: string) => void) | undefined
+      const term = {
+        ...mockPtyInstance,
+        onData: vi.fn((cb: (data: string) => void) => {
+          dataCallback = cb
+        }),
+        onExit: vi.fn()
+      }
+      mockPtySpawn.mockReturnValue(term)
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-renderer-split-ready-spawn-'))
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/bash'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'echo after-ready',
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      dataCallback?.(`\x1b]777;orca-shell-start:${process.pid}\x07\x1b]777;orca-shell-ready`)
+      dataCallback?.('\x07remote $ ')
+      await vi.advanceTimersByTimeAsync(8)
+
+      const probe = mockCreateShellPromptReadinessProbe.mock.results[0]?.value
+      expect(probe.notifyOutput).not.toHaveBeenCalled()
+      expect(probe.dispose).toHaveBeenCalledOnce()
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b]777;orca-shell-ready\x07remote $ '
+      })
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'does not retain renderer readiness state for unsupported shells',
+    async () => {
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/sh'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          command: 'x'.repeat(256 * 1024),
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+      }
+
+      const spawnOptions = mockPtySpawn.mock.calls[0]?.[2] as
+        | { env?: Record<string, string> }
+        | undefined
+      expect(spawnOptions?.env?.ORCA_SHELL_READY_MARKER).toBe('0')
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
   it.skipIf(process.platform === 'win32')(
     'flushes held shell-ready marker bytes when provider delivery falls back',
     async () => {
@@ -1104,10 +1385,10 @@ describe('PtyHandler', () => {
     }
   )
 
-  it('reports not-found and reaps a reattach whose backing shell is dead', async () => {
+  it('proves the exit and reaps a reattach whose backing shell is dead', async () => {
     // Why: a lingering managed entry whose child died without an onExit would
     // otherwise attach-succeed with an empty replay and strand the pane on a
-    // black shell. A provably-dead pid must surface as not-found so the SSH
+    // black shell. A provably-dead pid must surface as a PROVEN exit so the SSH
     // provider maps it to SSH_SESSION_EXPIRED and the pane respawns fresh.
     let onExitCb: ((evt: { exitCode: number }) => void) | undefined
     mockPtySpawn.mockReturnValue({
@@ -1120,15 +1401,25 @@ describe('PtyHandler', () => {
     const exits: { id: string; paneKey?: string }[] = []
     handler.setExitListener((evt) => exits.push(evt))
 
-    await dispatcher.callRequest('pty.spawn', { env: { ORCA_PANE_KEY: 'tab-dead:0' } })
+    const spawned = (await dispatcher.callRequest('pty.spawn', {
+      env: { ORCA_PANE_KEY: 'tab-dead:0' }
+    })) as { id: string; incarnationId: string }
     expect(handler.activePtyCount).toBe(1)
     expect(onExitCb).toBeDefined()
 
     const aliveSpy = vi.spyOn(ptyShellUtils, 'isProcessAlive').mockReturnValue(false)
     try {
+      // INVERTED: the reap is unchanged, but its answer is no longer the ordinary unknown. The
+      // relay held this shell and found its pid gone, which is first-hand proof of death — the
+      // one observation that separates a dead shell from one a replacement relay never knew.
       await expect(
-        dispatcher.callRequest('pty.attach', { id: 'pty-1', suppressReplayNotification: true })
-      ).rejects.toThrow('PTY "pty-1" not found')
+        dispatcher.callRequest('pty.attach', {
+          id: 'pty-1',
+          suppressReplayNotification: true,
+          exitProofSupported: true,
+          expectedIncarnationId: spawned.incarnationId
+        })
+      ).rejects.toThrow(/SSH_PTY_EXITED/)
     } finally {
       aliveSpy.mockRestore()
     }
@@ -1137,11 +1428,62 @@ describe('PtyHandler', () => {
     // is freed so a later attach also cleanly reports not-found.
     expect(exits).toEqual([{ id: 'pty-1', paneKey: 'tab-dead:0' }])
     expect(handler.activePtyCount).toBe(0)
+    // INVERTED: a LATER attach still answers, and now answers with what this process observed —
+    // the remembered exit outlives the reap, which is the whole point of remembering it.
     await expect(
-      dispatcher.callRequest('pty.attach', { id: 'pty-1', suppressReplayNotification: true })
-    ).rejects.toThrow('PTY "pty-1" not found')
+      dispatcher.callRequest('pty.attach', {
+        id: 'pty-1',
+        suppressReplayNotification: true,
+        exitProofSupported: true,
+        expectedIncarnationId: spawned.incarnationId
+      })
+    ).rejects.toThrow(/SSH_PTY_EXITED/)
   })
 
+  it.skipIf(process.platform === 'win32')(
+    'releases renderer readiness state when attach reaps a dead shell',
+    async () => {
+      const oldShell = process.env.SHELL
+      const oldHome = process.env.HOME
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-dead-shell-ready-spawn-'))
+      process.env.SHELL = '/bin/bash'
+      process.env.HOME = homeDir
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'x'.repeat(256 * 1024),
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        if (oldHome === undefined) {
+          delete process.env.HOME
+        } else {
+          process.env.HOME = oldHome
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+      expect(handler.retainedStartupCommandCount).toBe(1)
+
+      const aliveSpy = vi.spyOn(ptyShellUtils, 'isProcessAlive').mockReturnValue(false)
+      try {
+        await expect(dispatcher.callRequest('pty.attach', { id: 'pty-1' })).rejects.toThrow(
+          'PTY "pty-1" not found'
+        )
+      } finally {
+        aliveSpy.mockRestore()
+      }
+
+      expect(handler.retainedStartupCommandCount).toBe(0)
+      vi.advanceTimersByTime(15_000)
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
   it('settles concurrent immediate shutdown when attach proves the shell exited', async () => {
     const mockKill = vi.fn()
     mockPtySpawn.mockReturnValue({
@@ -1150,7 +1492,10 @@ describe('PtyHandler', () => {
       onData: vi.fn(),
       onExit: vi.fn()
     })
-    await dispatcher.callRequest('pty.spawn', {})
+    const spawned = (await dispatcher.callRequest('pty.spawn', {})) as {
+      id: string
+      incarnationId: string
+    }
 
     let shutdown: Promise<unknown> | undefined
     const aliveSpy = vi.spyOn(ptyShellUtils, 'isProcessAlive').mockImplementation(() => {
@@ -1158,9 +1503,14 @@ describe('PtyHandler', () => {
       return false
     })
     try {
-      await expect(dispatcher.callRequest('pty.attach', { id: 'pty-1' })).rejects.toThrow(
-        'PTY "pty-1" not found'
-      )
+      // INVERTED with the reap above: proof of exit, not an unknown id.
+      await expect(
+        dispatcher.callRequest('pty.attach', {
+          id: 'pty-1',
+          exitProofSupported: true,
+          expectedIncarnationId: spawned.incarnationId
+        })
+      ).rejects.toThrow(/SSH_PTY_EXITED/)
       await expect(shutdown).resolves.toBeUndefined()
     } finally {
       aliveSpy.mockRestore()
@@ -1168,6 +1518,173 @@ describe('PtyHandler', () => {
 
     expect(mockKill).toHaveBeenCalledWith('SIGKILL')
     expect(handler.activePtyCount).toBe(0)
+  })
+
+  // A relay that never knew an id may be a replacement whose predecessor's shells are still
+  // running, so "not found" proves nothing. A relay that WATCHED the shell exit knows first-hand.
+  // Keeping that observation is what lets the client tell a dead shell from an unknown one, and
+  // therefore what lets it respawn without risking a second agent on a live transcript.
+  // What the host answers reaches clients that predate the reply, and one of those reads an
+  // unrecognized attach error as neither death nor recovery — a stranded pane. So the proof is
+  // offered only to a client that says it can act on it.
+  /** `toThrow(expect.not.stringMatching(...))` passes whenever ANYTHING throws, so a negative
+   *  claim about the wording has to read the message itself. */
+  async function attachRejectionMessage(params: Record<string, unknown>): Promise<string> {
+    const error = await dispatcher.callRequest('pty.attach', params).then(
+      () => null,
+      (thrown: unknown) => thrown as Error
+    )
+    expect(error, 'attach unexpectedly succeeded').toBeInstanceOf(Error)
+    return (error as Error).message
+  }
+
+  it('keeps the older wording for a client that has not declared it understands exit proof', async () => {
+    const spawned = await spawnPty({})
+    const onExitCb = mockPtyInstance.onExit.mock.calls.at(-1)?.[0] as
+      | ((evt: { exitCode: number }) => void)
+      | undefined
+    onExitCb?.({ exitCode: 3 })
+
+    await expect(dispatcher.callRequest('pty.attach', { id: spawned.id })).rejects.toThrow(
+      `PTY "${'pty-1'}" not found`
+    )
+  })
+
+  // The sharpest edge in the whole change. A caller that names no shell is not asking about this
+  // one, so a remembered exit is not an answer to it: relay A is killed leaving pty-1 alive and
+  // orphaned, relay B mints its own pty-1 and THAT one exits. A pane carrying no recorded identity
+  // must not be told its shell is gone, because the reply authorizes replacing a process that is
+  // still running — the double agent resume this whole change exists to prevent.
+  it('does not prove an exit to a caller that names no shell', async () => {
+    const spawned = await spawnPty({})
+    const onExitCb = mockPtyInstance.onExit.mock.calls.at(-1)?.[0] as
+      | ((evt: { exitCode: number }) => void)
+      | undefined
+    onExitCb?.({ exitCode: 3 })
+
+    expect(await attachRejectionMessage({ id: spawned.id, exitProofSupported: true })).not.toMatch(
+      /SSH_PTY_EXITED/
+    )
+  })
+
+  // The same rule on the other proof route. A replacement relay can hold a DIFFERENT shell under
+  // this id; if that one dies, its death is not evidence about the caller's, which may be running
+  // orphaned under the relay this one replaced. The reap still happens — a dead shell should be
+  // cleared whoever asked — but the answer must not authorize replacing a live process.
+  it('does not prove a reaped shell to a caller that named a different one', async () => {
+    const spawned = await spawnPty({})
+    const aliveSpy = vi.spyOn(ptyShellUtils, 'isProcessAlive').mockReturnValue(false)
+    try {
+      const message = await attachRejectionMessage({
+        id: spawned.id,
+        exitProofSupported: true,
+        expectedIncarnationId: 'a-shell-from-a-previous-relay'
+      })
+      expect(message).not.toMatch(/SSH_PTY_EXITED/)
+      expect(message).toMatch(/identity mismatch/i)
+    } finally {
+      aliveSpy.mockRestore()
+    }
+    // The reap still ran: the dead entry is gone regardless of who asked.
+    expect(handler.activePtyCount).toBe(0)
+  })
+
+  it('answers a later attach with the exit it observed, not an unknown id', async () => {
+    const spawned = await spawnPty({})
+    let onExitCb: ((evt: { exitCode: number }) => void) | undefined
+    // The exit listener was captured at spawn by the shared mock; drive a real exit through it.
+    onExitCb = mockPtyInstance.onExit.mock.calls.at(-1)?.[0] as typeof onExitCb
+    expect(onExitCb).toBeDefined()
+    onExitCb!({ exitCode: 3 })
+
+    const asking = {
+      id: spawned.id,
+      exitProofSupported: true,
+      expectedIncarnationId: spawned.incarnationId
+    }
+    await expect(attachPty(asking)).rejects.toThrow(/SSH_PTY_EXITED/)
+    await expect(attachPty(asking)).rejects.toThrow(/code=3/)
+  })
+
+  // The dangerous shape: a replaced relay hands pty-1 to a new shell, that one exits, and the
+  // pane still bound to the ORIGINAL pty-1 asks about its own. Reporting the stranger's death as
+  // proof would authorize a respawn onto a shell that may still be running.
+  it('does not report a remembered exit for a shell the caller did not ask about', async () => {
+    const spawned = await spawnPty({})
+    const onExitCb = mockPtyInstance.onExit.mock.calls.at(-1)?.[0] as
+      | ((evt: { exitCode: number }) => void)
+      | undefined
+    onExitCb?.({ exitCode: 3 })
+
+    expect(
+      await attachRejectionMessage({
+        id: spawned.id,
+        exitProofSupported: true,
+        expectedIncarnationId: 'a-different-shell'
+      })
+    ).not.toMatch(/SSH_PTY_EXITED/)
+  })
+
+  // INVERTED from the deleted `attachIdentityMismatches` suite. That guard compared the paneKey and
+  // tabId frozen at spawn; it caught a recycled id, but it also refused a pane that had merely moved
+  // to another tab — and refused as "not found", which the client read as death and answered by
+  // resuming the agent a second time. The property worth keeping is "a recycled id must not attach";
+  // the property that had to go is "identity is where the pane lives". Both are pinned below, now
+  // against the shell's own incarnation.
+  it('refuses an attach whose expected incarnation names a different shell', async () => {
+    const first = await spawnPty({})
+
+    await expect(
+      dispatcher.callRequest('pty.attach', {
+        id: first.id,
+        expectedIncarnationId: 'incarnation-from-a-previous-relay'
+      })
+    ).rejects.toThrow(/identity mismatch/i)
+  })
+
+  // The wording matters as much as the refusal: "not found" is what the client maps to an expired
+  // session, and expiry authorizes a respawn onto the very shell this branch proved is alive.
+  it('does not word an incarnation refusal as not-found', async () => {
+    const first = await spawnPty({})
+
+    expect(
+      await attachRejectionMessage({
+        id: first.id,
+        expectedIncarnationId: 'incarnation-from-a-previous-relay'
+      })
+    ).not.toMatch(/not found/i)
+  })
+
+  it('attaches when the expected incarnation is the shell it names', async () => {
+    const first = await spawnPty({})
+
+    await expect(
+      attachPty({ id: first.id, expectedIncarnationId: first.incarnationId })
+    ).resolves.toMatchObject({ incarnationId: first.incarnationId })
+  })
+
+  // An older client sends no expectation. Refusing there would strand every pane it owns.
+  it('stays permissive when the caller supplies no expected incarnation', async () => {
+    const first = await spawnPty({})
+
+    await expect(attachPty({ id: first.id })).resolves.toMatchObject({
+      incarnationId: first.incarnationId
+    })
+  })
+
+  // The regression the old tab-keyed guard caused. A pane carries its shell to a new tab; the
+  // relay still holds the paneKey/tabId frozen at spawn. That must not refuse the attach.
+  it('attaches a pane that has moved to another tab', async () => {
+    const first = await spawnPty({ paneKey: 'tab-a:0', tabId: 'tab-a' })
+
+    await expect(
+      attachPty({
+        id: first.id,
+        expectedIncarnationId: first.incarnationId,
+        expectedPaneKey: 'tab-b:0',
+        expectedTabId: 'tab-b'
+      })
+    ).resolves.toMatchObject({ incarnationId: first.incarnationId })
     expect(vi.getTimerCount()).toBe(0)
   })
 
@@ -1876,13 +2393,17 @@ describe('PtyHandler', () => {
     expect(spawnOptions.env.ORCA_PANE_KEY).toBeUndefined()
     expect(spawnOptions.env.ORCA_TAB_ID).toBeUndefined()
 
+    // A caller that names no incarnation is an older client, and pane identity is the only fence
+    // it can be given — so it still applies, and still refuses. A caller that CAN name the shell is
+    // fenced on that instead and attaches regardless of which tab it now lives in; that is pinned
+    // by "attaches a pane that has moved to another tab".
     await expect(
       attachPty({
         id: 'pty-1',
         expectedPaneKey: 'tab-b:leaf-b',
         expectedTabId: 'tab-b'
       })
-    ).rejects.toThrow('PTY "pty-1" not found')
+    ).rejects.toThrow(/identity mismatch/i)
 
     await expect(
       attachPty({
@@ -2523,16 +3044,16 @@ describe('PtyHandler', () => {
     handler.addEnvAugmenter(() => ({
       TERM: 'augmenter-term',
       TERM_PROGRAM: 'augmenter-terminal',
-      ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/augmenter-attribution'
+      ORCA_STALE_TEST_ENV: '/tmp/augmenter-stale'
     }))
 
     await dispatcher.callRequest('pty.spawn', {
       env: {
         TERM: 'screen-256color',
         TERM_PROGRAM: 'renderer-terminal',
-        ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/renderer-attribution'
+        ORCA_STALE_TEST_ENV: '/tmp/renderer-stale'
       },
-      envToDelete: ['TERM_PROGRAM', 'ORCA_ATTRIBUTION_SHIM_DIR']
+      envToDelete: ['TERM_PROGRAM', 'ORCA_STALE_TEST_ENV']
     })
 
     const spawnEnv = mockPtySpawn.mock.calls[0][2] as {
@@ -2544,7 +3065,7 @@ describe('PtyHandler', () => {
     expect(spawnEnv.env.COLORTERM).toBe('truecolor')
     expect(spawnEnv.env.FORCE_HYPERLINK).toBe('1')
     expect(spawnEnv.env.TERM_PROGRAM).toBeUndefined()
-    expect(spawnEnv.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
+    expect(spawnEnv.env.ORCA_STALE_TEST_ENV).toBeUndefined()
   })
 
   it('replaces an ambient TERM=dumb when no explicit TERM is supplied', async () => {
@@ -2734,9 +3255,16 @@ describe('PtyHandler', () => {
       ORCA_AGENT_HOOK_TOKEN: 'abc-uuid'
     }))
     const killSpy = vi.spyOn(process, 'kill').mockImplementation(() => true)
+    const oldStartupIdentity = process.env.ORCA_SHELL_STARTUP_IDENTITY
+    process.env.ORCA_SHELL_STARTUP_IDENTITY = '1'
     try {
       await dispatcher.callRequest('pty.revive', { state })
     } finally {
+      if (oldStartupIdentity === undefined) {
+        delete process.env.ORCA_SHELL_STARTUP_IDENTITY
+      } else {
+        process.env.ORCA_SHELL_STARTUP_IDENTITY = oldStartupIdentity
+      }
       killSpy.mockRestore()
     }
 
@@ -2749,6 +3277,8 @@ describe('PtyHandler', () => {
     expect(callArgs.env.ORCA_AGENT_HOOK_TOKEN).toBe('abc-uuid')
     expect(callArgs.env.TERM).toBe('xterm-256color')
     expect(callArgs.env.TERM_PROGRAM).toBe('Orca')
+    expect(callArgs.env.ORCA_SHELL_READY_MARKER).toBe('0')
+    expect(callArgs.env.ORCA_SHELL_STARTUP_IDENTITY).toBe('0')
   })
 
   it('fences both revived worktree identity and cwd with rollback', async () => {
@@ -2900,7 +3430,7 @@ describe('PtyHandler', () => {
   it('normalizes an explicit empty TERM and preserves sanitized env deletions on revive', async () => {
     await dispatcher.callRequest('pty.spawn', {
       env: { TERM: '' },
-      envToDelete: ['ORCA_ATTRIBUTION_SHIM_DIR', '', 42]
+      envToDelete: ['ORCA_STALE_TEST_ENV', '', 42]
     })
 
     const initialEnv = mockPtySpawn.mock.calls[0][2] as {
@@ -2916,14 +3446,14 @@ describe('PtyHandler', () => {
       envToDelete?: string[]
     }[]
     expect(serialized.explicitTerm).toBeUndefined()
-    expect(serialized.envToDelete).toEqual(['ORCA_ATTRIBUTION_SHIM_DIR'])
+    expect(serialized.envToDelete).toEqual(['ORCA_STALE_TEST_ENV'])
 
     await handler.dispose({ waitForPhysicalExit: false })
     mockPtySpawn.mockClear()
     dispatcher = createMockDispatcher()
     handler = new PtyHandler(dispatcher as unknown as RelayDispatcher)
     handler.addEnvAugmenter(() => ({
-      ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/revived-attribution'
+      ORCA_STALE_TEST_ENV: '/tmp/revived-stale'
     }))
     const killSpy = vi.spyOn(process, 'kill').mockImplementation(() => true)
     try {
@@ -2938,7 +3468,7 @@ describe('PtyHandler', () => {
     }
     expect(revivedEnv.name).toBe('xterm-256color')
     expect(revivedEnv.env.TERM).toBe('xterm-256color')
-    expect(revivedEnv.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
+    expect(revivedEnv.env.ORCA_STALE_TEST_ENV).toBeUndefined()
   })
 
   it('drops legacy empty explicit TERM metadata after revive', async () => {
@@ -2950,11 +3480,11 @@ describe('PtyHandler', () => {
         rows: 24,
         cwd: process.cwd(),
         explicitTerm: '',
-        envToDelete: ['ORCA_ATTRIBUTION_SHIM_DIR']
+        envToDelete: ['ORCA_STALE_TEST_ENV']
       }
     ])
     handler.addEnvAugmenter(() => ({
-      ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/legacy-empty-attribution'
+      ORCA_STALE_TEST_ENV: '/tmp/legacy-empty-stale'
     }))
     const killSpy = vi.spyOn(process, 'kill').mockImplementation(() => true)
     try {
@@ -2969,7 +3499,7 @@ describe('PtyHandler', () => {
     }
     expect(revivedEnv.name).toBe('xterm-256color')
     expect(revivedEnv.env.TERM).toBe('xterm-256color')
-    expect(revivedEnv.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
+    expect(revivedEnv.env.ORCA_STALE_TEST_ENV).toBeUndefined()
 
     const serializedState = (await dispatcher.callRequest('pty.serialize', {
       ids: ['pty-8']
@@ -2979,13 +3509,13 @@ describe('PtyHandler', () => {
       envToDelete?: string[]
     }[]
     expect(serialized.explicitTerm).toBeUndefined()
-    expect(serialized.envToDelete).toEqual(['ORCA_ATTRIBUTION_SHIM_DIR'])
+    expect(serialized.envToDelete).toEqual(['ORCA_STALE_TEST_ENV'])
   })
 
   it('preserves explicit TERM and env deletions through repeated revive cycles', async () => {
     await dispatcher.callRequest('pty.spawn', {
       env: { TERM: 'screen-256color' },
-      envToDelete: ['ORCA_ATTRIBUTION_SHIM_DIR']
+      envToDelete: ['ORCA_STALE_TEST_ENV']
     })
     let state = (await dispatcher.callRequest('pty.serialize', { ids: ['pty-1'] })) as string
 
@@ -2996,7 +3526,7 @@ describe('PtyHandler', () => {
       dispatcher = createMockDispatcher()
       handler = new PtyHandler(dispatcher as unknown as RelayDispatcher)
       handler.addEnvAugmenter(() => ({
-        ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/first-revive'
+        ORCA_STALE_TEST_ENV: '/tmp/first-revive'
       }))
       await dispatcher.callRequest('pty.revive', { state })
 
@@ -3006,12 +3536,12 @@ describe('PtyHandler', () => {
       }
       expect(firstRevivedEnv.name).toBe('screen-256color')
       expect(firstRevivedEnv.env.TERM).toBe('screen-256color')
-      expect(firstRevivedEnv.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
+      expect(firstRevivedEnv.env.ORCA_STALE_TEST_ENV).toBeUndefined()
       state = (await dispatcher.callRequest('pty.serialize', { ids: ['pty-1'] })) as string
       expect(JSON.parse(state)).toMatchObject([
         {
           explicitTerm: 'screen-256color',
-          envToDelete: ['ORCA_ATTRIBUTION_SHIM_DIR']
+          envToDelete: ['ORCA_STALE_TEST_ENV']
         }
       ])
 
@@ -3020,7 +3550,7 @@ describe('PtyHandler', () => {
       dispatcher = createMockDispatcher()
       handler = new PtyHandler(dispatcher as unknown as RelayDispatcher)
       handler.addEnvAugmenter(() => ({
-        ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/second-revive'
+        ORCA_STALE_TEST_ENV: '/tmp/second-revive'
       }))
       await dispatcher.callRequest('pty.revive', { state })
     } finally {
@@ -3033,12 +3563,12 @@ describe('PtyHandler', () => {
     }
     expect(secondRevivedEnv.name).toBe('screen-256color')
     expect(secondRevivedEnv.env.TERM).toBe('screen-256color')
-    expect(secondRevivedEnv.env.ORCA_ATTRIBUTION_SHIM_DIR).toBeUndefined()
+    expect(secondRevivedEnv.env.ORCA_STALE_TEST_ENV).toBeUndefined()
   })
 
   it('revives legacy serialized entries with default TERM and no env deletions', async () => {
     handler.addEnvAugmenter(() => ({
-      ORCA_ATTRIBUTION_SHIM_DIR: '/tmp/legacy-attribution'
+      ORCA_STALE_TEST_ENV: '/tmp/legacy-stale'
     }))
     const state = JSON.stringify([
       {
@@ -3058,7 +3588,7 @@ describe('PtyHandler', () => {
 
     const revivedEnv = mockPtySpawn.mock.calls[0][2] as { env: Record<string, string> }
     expect(revivedEnv.env.TERM).toBe('xterm-256color')
-    expect(revivedEnv.env.ORCA_ATTRIBUTION_SHIM_DIR).toBe('/tmp/legacy-attribution')
+    expect(revivedEnv.env.ORCA_STALE_TEST_ENV).toBe('/tmp/legacy-stale')
   })
 
   it('revive preserves attach identity metadata without exporting hook identity env', async () => {
@@ -3116,13 +3646,15 @@ describe('PtyHandler', () => {
     expect(callArgs.env.ORCA_PANE_KEY).toBeUndefined()
     expect(callArgs.env.ORCA_TAB_ID).toBeUndefined()
 
+    // Revive preserves the serialized pane identity, and for a caller that names no incarnation
+    // that identity is still the fence.
     await expect(
       dispatcher.callRequest('pty.attach', {
         id: 'pty-1',
         expectedPaneKey: 'tab-other:leaf',
         expectedTabId: 'tab-other'
       })
-    ).rejects.toThrow('PTY "pty-1" not found')
+    ).rejects.toThrow(/identity mismatch/i)
   })
 
   it('invokes the exit listener with the spawn-time paneKey', async () => {
@@ -3434,13 +3966,19 @@ describe('PtyHandler', () => {
       mockPtySpawn.mockReturnValue({ ...mockPtyInstance, onData: vi.fn(), onExit: vi.fn() })
       const poolEmpty = vi.fn()
       handler.onPtyPoolEmpty(poolEmpty)
-      await spawnPty()
+      const spawned = await spawnPty()
 
       const aliveSpy = vi.spyOn(ptyShellUtils, 'isProcessAlive').mockReturnValue(false)
       try {
-        await expect(attachPty({ id: 'pty-1', suppressReplayNotification: true })).rejects.toThrow(
-          'PTY "pty-1" not found'
-        )
+        // INVERTED with the reap above: proof of exit, not an unknown id.
+        await expect(
+          attachPty({
+            id: 'pty-1',
+            suppressReplayNotification: true,
+            exitProofSupported: true,
+            expectedIncarnationId: spawned.incarnationId
+          })
+        ).rejects.toThrow(/SSH_PTY_EXITED/)
       } finally {
         aliveSpy.mockRestore()
       }
@@ -3593,39 +4131,3 @@ describe('PtyHandler', () => {
     expect(handler.pendingPtyCreationCount).toBe(0)
   })
 })
-
-describe('attachIdentityMismatches', () => {
-  it('rejects a paneKey collision across relay generations', () => {
-    // Old lease expects tab-a's pane; the reset relay's pty-1 belongs to tab-b.
-    expect(
-      attachIdentityMismatches({ paneKey: 'tab-a:0' }, { paneKey: 'tab-b:0', tabId: 'tab-b' })
-    ).toBe(true)
-  })
-
-  it('rejects a tabId collision when only tab identity is known', () => {
-    expect(attachIdentityMismatches({ tabId: 'tab-a' }, { tabId: 'tab-b' })).toBe(true)
-  })
-
-  it('accepts a matching identity', () => {
-    expect(
-      attachIdentityMismatches(
-        { paneKey: 'tab-a:0', tabId: 'tab-a' },
-        { paneKey: 'tab-a:0', tabId: 'tab-a' }
-      )
-    ).toBe(false)
-  })
-
-  it('stays permissive when the caller supplies no identity', () => {
-    expect(attachIdentityMismatches({}, { paneKey: 'tab-a:0', tabId: 'tab-a' })).toBe(false)
-  })
-
-  it('stays permissive when the managed PTY predates identity capture', () => {
-    expect(attachIdentityMismatches({ paneKey: 'tab-a:0', tabId: 'tab-a' }, {})).toBe(false)
-  })
-
-  it('does not reject on tabId when paneKey matches (split panes share a tab)', () => {
-    expect(
-      attachIdentityMismatches({ paneKey: 'tab-a:1' }, { paneKey: 'tab-a:1', tabId: 'tab-a' })
-    ).toBe(false)
-  })
-})
diff --git a/src/relay/pty-handler.ts b/src/relay/pty-handler.ts
index 9471b2a3b9f..b63b1cb631c 100644
--- a/src/relay/pty-handler.ts
+++ b/src/relay/pty-handler.ts
@@ -26,13 +26,19 @@ import {
   normalizeRuntimePathForComparison
 } from '../shared/cross-platform-path'
 import { splitWorktreeId } from '../shared/worktree-id'
+import { formatPtyExitedError } from '../shared/ssh-pty-failure-tokens'
 import { PhysicalExitTracker } from '../shared/physical-exit-tracker'
+import { SHELL_READY_MARKER_PREFIX } from '../main/shell-ready-marker-scanner'
 import {
-  createShellReadyScanState,
-  drainShellReadyHeldBytes,
-  scanForShellReady,
-  type ShellReadyScanState
-} from '../main/shell-ready-marker-scanner'
+  createShellStartupOutputScanState,
+  drainShellStartupOutputScanState,
+  scanShellStartupOutput,
+  type ShellStartupOutputScanState
+} from '../main/shell-startup-output-scanner'
+import {
+  createShellPromptReadinessProbe,
+  type ShellPromptReadinessProbe
+} from '../main/shell-prompt-readiness-probe'
 import { applyTerminalGitCredentialPromptGuard } from '../shared/terminal-git-credential-guard'
 import {
   gitCredentialPromptGuardEnv,
@@ -42,6 +48,7 @@ import { isTuiAgent } from '../shared/tui-agent-config'
 import type { TuiAgent } from '../shared/types'
 import { forceKillPosixPtyProcessGroups } from '../main/pty/posix-pty-process-groups'
 import { stripInheritedBuildModeEnv } from '../main/pty/build-mode-env'
+import { stripLegacyTerminalShimEnv } from '../main/pty/legacy-terminal-shim-dir'
 import {
   PTY_STARTUP_INGRESS_VERSION,
   PtyStartupIngress,
@@ -147,6 +154,9 @@ type ManagedPty = {
   worktreeId?: string
   terminalHandle?: string
   explicitTerm?: string
+  shellPath?: string
+  shellCwd?: string
+  shellPathEnv?: string
   envToDelete: string[]
   gitCredentialPromptGuarded: boolean
   startupCommand?: ManagedStartupCommand
@@ -167,6 +177,12 @@ type RelayAgentSessionCreateResult = {
   sourceActivation?: PtySourceReceivingActivation
 }
 
+/** Enough to cover every pane a host could plausibly have lost since the client last looked. */
+const MAX_REMEMBERED_PTY_EXITS = 256
+
+/** No exit status to report: the relay found the pid gone rather than watching it go. */
+const PTY_EXIT_CODE_OBSERVED_GONE = -1
+
 const AGENT_SESSION_CREATE_OPERATION_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/
 const AGENT_SESSION_CREATE_OPERATION_RETENTION_MS = 24 * 60 * 60 * 1000
 const AGENT_SESSION_CREATE_OPERATION_LIMIT = 4_096
@@ -178,10 +194,13 @@ type PendingPtyOutput = RelayPtySourceOutput & {
 }
 
 type ManagedStartupCommand = {
-  command: string
+  command: string | null
+  providerDelivery: boolean
   delivered: boolean
   waitForShellReady: boolean
-  scanState: ShellReadyScanState | null
+  outputScanState: ShellStartupOutputScanState | null
+  shellPid: number | null
+  promptProbe: ShellPromptReadinessProbe | null
   timer: ReturnType<typeof setTimeout> | null
 }
 
@@ -245,6 +264,7 @@ const INTERACTIVE_REDRAW_MAX_CHARS = PTY_OUTPUT_FLUSH_CHUNK_CHARS
 const INTERACTIVE_OUTPUT_BUDGET_CHARS = 32 * 1024
 const STARTUP_COMMAND_WRITE_DELAY_MS = 50
 const STARTUP_COMMAND_SHELL_READY_FALLBACK_MS = 1500
+const RENDERER_SHELL_READY_RETENTION_MS = 15_000
 const PTY_FORCE_KILL_RETRY_DELAY_MS = 250
 const PTY_FORCE_KILL_MAX_ATTEMPTS = 2
 const ALLOWED_SIGNALS = new Set([
@@ -329,12 +349,11 @@ export type PtyExitListener = (event: { id: string; paneKey?: string }) => void
 
 type PtyIdentity = { paneKey?: string; tabId?: string }
 
-/**
- * True when a reattach's expected pane identity contradicts the target PTY's own.
- * Rejects cross-relay-generation id collisions (a reset relay reuses `pty-N`).
- * Only compares fields present on both sides; absent identity stays permissive.
- */
-export function attachIdentityMismatches(expected: PtyIdentity, managed: PtyIdentity): boolean {
+/** Fallback fence for a client too old to name a shell by incarnation. It froze paneKey/tabId at
+ *  spawn, so it refuses a pane that merely moved tabs — which is why a client that CAN name the
+ *  shell is fenced on that instead. Not deleted, because the relay is shared: an upgraded host
+ *  would otherwise leave every not-yet-updated client attaching a recycled id unchecked. */
+function attachIdentityMismatches(expected: PtyIdentity, managed: PtyIdentity): boolean {
   return Boolean(
     (expected.paneKey && managed.paneKey && expected.paneKey !== managed.paneKey) ||
     (expected.tabId && managed.tabId && expected.tabId !== managed.tabId)
@@ -364,6 +383,10 @@ export class PtyHandler {
   private outputFlushTimer: ReturnType<typeof setTimeout> | null = null
   private pendingOutputByPty = new Map<string, PendingPtyOutput[]>()
   private pendingExitByPty = new Map<string, { id: string; code: number; incarnationId: string }>()
+  /** Exits this process WATCHED, kept past publication so attach can prove death rather than report
+   *  an unknown id. Bounded and oldest-evicted; losing one costs a user-asked respawn, never a
+   *  wrong one, and a crash losing all of them correctly reads as no knowledge. */
+  private exitedPtys = new Map<string, { code: number; incarnationId: string }>()
   private pausedOutputPtys = new Set<string>()
   private consumerPausedOutputPtys = new Set<string>()
   private removeLegacyCapacityListener: (() => void) | null = null
@@ -557,7 +580,7 @@ export class PtyHandler {
   }
 
   /** Register an env augmenter merged into every spawn env *after* process.env and renderer env.
-   *  Used by the relay-hook server to inject ORCA_AGENT_HOOK_* coords. See docs/design/agent-status-over-ssh.md §3. */
+   *  Used by the relay-hook server to inject ORCA_AGENT_HOOK_* coords: evaluated per spawn (not captured once), so a late or restarted hook-server bind still reaches the next PTY. */
   addEnvAugmenter(augmenter: PtyEnvAugmenter): () => void {
     this.envAugmenters.push(augmenter)
     return () => {
@@ -603,15 +626,13 @@ export class PtyHandler {
       }
     }
     const result = mergeGitConfigEnvProtocol(baseEnv, augmented) as Record<string, string>
+    // Why: an older client may not ask a newly upgraded relay to delete inherited shim state.
+    stripLegacyTerminalShimEnv(result, process.platform)
     // Why: match local/daemon precedence so defaults/augmenters can't resurrect explicitly-removed values.
     for (const key of envToDelete) {
       delete result[key]
     }
-    if (
-      !envToDelete.includes('TERM') &&
-      rendererEnv &&
-      Object.prototype.hasOwnProperty.call(rendererEnv, 'TERM')
-    ) {
+    if (!envToDelete.includes('TERM') && rendererEnv && Object.hasOwn(rendererEnv, 'TERM')) {
       result.TERM = rendererEnv.TERM
     }
     // Why: node-pty defaults missing/empty TERM per-platform; normalize so POSIX and Windows children agree.
@@ -638,10 +659,20 @@ export class PtyHandler {
 
   private releaseStartupCommand(managed: ManagedPty): void {
     this.clearStartupCommandTimer(managed)
+    managed.startupCommand?.promptProbe?.dispose()
     managed.startupCommand = undefined
   }
 
-  private scheduleStartupCommandDelivery(managed: ManagedPty, delayMs: number): void {
+  private drainStartupScanBytes(startup: ManagedStartupCommand): string {
+    if (!startup.outputScanState) {
+      return ''
+    }
+    const heldBytes = drainShellStartupOutputScanState(startup.outputScanState)
+    startup.outputScanState = null
+    return heldBytes
+  }
+
+  private scheduleStartupCommandResolution(managed: ManagedPty, delayMs: number): void {
     const startup = managed.startupCommand
     if (!startup || startup.delivered || managed.disposed) {
       return
@@ -649,22 +680,25 @@ export class PtyHandler {
     this.clearStartupCommandTimer(managed)
     startup.timer = setTimeout(() => {
       startup.timer = null
-      this.deliverStartupCommand(managed)
+      if (startup.providerDelivery) {
+        this.deliverStartupCommand(managed)
+      } else {
+        this.signalRendererShellReady(managed)
+      }
     }, delayMs)
   }
 
   private deliverStartupCommand(managed: ManagedPty): void {
     const startup = managed.startupCommand
-    if (!startup || startup.delivered || managed.disposed) {
+    if (!startup?.providerDelivery || !startup.command || startup.delivered || managed.disposed) {
       return
     }
     startup.delivered = true
     this.clearStartupCommandTimer(managed)
-    if (startup.scanState) {
-      const heldBytes = drainShellReadyHeldBytes(startup.scanState)
-      if (heldBytes) {
-        managed.startupIngress?.accept(heldBytes)
-      }
+    startup.promptProbe?.dispose()
+    const heldBytes = this.drainStartupScanBytes(startup)
+    if (heldBytes) {
+      managed.startupIngress?.accept(heldBytes)
     }
     const submit = process.platform === 'win32' ? '\r' : '\n'
     // Why: only the shell-ready wrapper arms bracketed-paste; other shells use raw submit so ESC[200~ markers aren't echoed.
@@ -676,6 +710,19 @@ export class PtyHandler {
     managed.pty.write(payload)
   }
 
+  private signalRendererShellReady(managed: ManagedPty): void {
+    const startup = managed.startupCommand
+    if (!startup || startup.providerDelivery || startup.delivered || managed.disposed) {
+      return
+    }
+    startup.delivered = true
+    this.clearStartupCommandTimer(managed)
+    startup.promptProbe?.dispose()
+    managed.startupIngress?.accept(this.drainStartupScanBytes(startup))
+    managed.startupIngress?.accept(`${SHELL_READY_MARKER_PREFIX}\x07`)
+    managed.startupCommand = undefined
+  }
+
   /** Wire onData/onExit listeners for a managed PTY and store it. */
   private wireAndStore(managed: ManagedPty): void {
     managed.physicalExit = new PhysicalExitTracker()
@@ -701,16 +748,43 @@ export class PtyHandler {
       onEmission: emitIngressData,
       ...(echoProbe ? { echoProbe } : {})
     })
+    const startup = managed.startupCommand
+    if (startup?.waitForShellReady) {
+      startup.promptProbe = createShellPromptReadinessProbe({
+        slavePath: readPtySlavePath(managed.pty),
+        shellPath: managed.shellPath,
+        shellCwd: managed.shellCwd,
+        shellPathEnv: managed.shellPathEnv,
+        getShellPid: () => startup.shellPid,
+        onPromptReady: () => {
+          if (startup.providerDelivery) {
+            this.scheduleStartupCommandResolution(managed, STARTUP_COMMAND_WRITE_DELAY_MS)
+          } else {
+            this.signalRendererShellReady(managed)
+          }
+        }
+      })
+    }
     managed.pty.onData((data: string) => {
       const startup = managed.startupCommand
-      if (startup?.waitForShellReady && startup.scanState && !startup.delivered) {
-        const scanned = scanForShellReady(startup.scanState, data)
+      if (startup?.waitForShellReady && startup.outputScanState && !startup.delivered) {
+        const scanned = scanShellStartupOutput(startup.outputScanState, data)
         data = scanned.output
-        if (scanned.matched) {
-          this.scheduleStartupCommandDelivery(managed, STARTUP_COMMAND_WRITE_DELAY_MS)
+        if (scanned.shellPid) {
+          startup.shellPid = scanned.shellPid
+        }
+        if (scanned.ready) {
+          if (startup.providerDelivery) {
+            this.scheduleStartupCommandResolution(managed, STARTUP_COMMAND_WRITE_DELAY_MS)
+          } else {
+            this.signalRendererShellReady(managed)
+          }
         }
       }
       managed.startupIngress?.accept(data)
+      if (startup && !startup.delivered && data.length > 0) {
+        startup.promptProbe?.notifyOutput(data)
+      }
     })
     managed.pty.onExit(({ exitCode }: { exitCode: number }) => {
       managed.physicalExit?.markExited()
@@ -736,6 +810,7 @@ export class PtyHandler {
         code: exitCode,
         incarnationId: managed.incarnationId
       })
+      this.rememberPtyExit(managed.id, exitCode, managed.incarnationId)
       this.publishPendingExit(managed.id)
       this.notifyExitListener(managed)
       this.agentSessionOwners.release(managed.id)
@@ -746,13 +821,36 @@ export class PtyHandler {
     })
   }
 
+  /** Proof must name the caller's own shell: present and matching. Both gone-paths ask this, so a
+   *  change to the rule cannot reach one and miss the other. */
+  private exitProofAnswersCaller(
+    expectedIncarnationId: string | undefined,
+    exitedIncarnationId: string,
+    clientUnderstandsExitProof: boolean
+  ): boolean {
+    return clientUnderstandsExitProof && expectedIncarnationId === exitedIncarnationId
+  }
+
+  /** Oldest-evicted: a Map iterates in insertion order, so the first key is the oldest. */
+  private rememberPtyExit(id: string, code: number, incarnationId: string): void {
+    this.exitedPtys.delete(id)
+    this.exitedPtys.set(id, { code, incarnationId })
+    while (this.exitedPtys.size > MAX_REMEMBERED_PTY_EXITS) {
+      const oldest = this.exitedPtys.keys().next()
+      if (oldest.done) {
+        break
+      }
+      this.exitedPtys.delete(oldest.value)
+    }
+  }
+
   private releaseRelayIngress(managed: ManagedPty): void {
     const startupCommand = managed.startupCommand
-    const scanState = startupCommand?.scanState
-    if (scanState) {
-      const held = drainShellReadyHeldBytes(scanState)
-      startupCommand.scanState = null
-      managed.startupIngress?.accept(held)
+    if (startupCommand) {
+      this.clearStartupCommandTimer(managed)
+      startupCommand.promptProbe?.dispose()
+      managed.startupIngress?.accept(this.drainStartupScanBytes(startupCommand))
+      managed.startupCommand = undefined
     }
     managed.startupIngress?.drainAndClose()
   }
@@ -1431,7 +1529,7 @@ export class PtyHandler {
     const explicitTerm =
       !envToDelete.includes('TERM') &&
       env &&
-      Object.prototype.hasOwnProperty.call(env, 'TERM') &&
+      Object.hasOwn(env, 'TERM') &&
       typeof env.TERM === 'string' &&
       env.TERM.length > 0
         ? env.TERM
@@ -1475,11 +1573,15 @@ export class PtyHandler {
         startupCommandDelivery:
           params.startupCommandDelivery === 'shell-ready' ? 'shell-ready' : undefined
       })
+    const managedStartupCommand = shouldProviderDeliverCommand ? command : launchCommandHint
     // Why: both renderer- and provider-delivered startup commands use this marker; the delivering side strips it from output.
     const shellLaunch = getRelayShellLaunchConfig(shell, spawnEnv, process.platform, {
       terminalWindowsWslDistro,
-      emitReadyMarker: shouldEmitShellReadyMarker
+      emitReadyMarker: shouldEmitShellReadyMarker,
+      emitStartupIdentity: shouldEmitShellReadyMarker
     })
+    const rendererShellReadySupported =
+      !shouldProviderDeliverCommand && shellLaunch.env.ORCA_SHELL_READY_MARKER === '1'
 
     if (context?.signal?.aborted || context?.isStale()) {
       // Why: cancellation remains side-effect-free until the exact native spawn seam.
@@ -1500,7 +1602,12 @@ export class PtyHandler {
         rows,
         cwd,
         // Why: relay shells inherit process.env; don't let an ambient Orca marker enable shell-ready unless requested.
-        env: { ...spawnEnv, ORCA_SHELL_READY_MARKER: '0', ...shellLaunch.env }
+        env: {
+          ...spawnEnv,
+          ORCA_SHELL_READY_MARKER: '0',
+          ORCA_SHELL_STARTUP_IDENTITY: '0',
+          ...shellLaunch.env
+        }
       })
     } catch (error) {
       // Why: Windows loads conpty.node only on first spawn, so handle that late binding failure here.
@@ -1539,6 +1646,9 @@ export class PtyHandler {
       ...(explicitTerm !== undefined ? { explicitTerm } : {}),
       envToDelete,
       gitCredentialPromptGuarded,
+      shellPath: shell,
+      shellCwd: cwd,
+      shellPathEnv: spawnEnv.PATH,
       ownerBackend: resolvePtyOwnerBackend({
         platform: process.platform,
         shellPath: shell,
@@ -1546,16 +1656,19 @@ export class PtyHandler {
       }),
       ...(startupIngressIntent ? { startupIngressIntent } : {}),
       ...(terminalHandle ? { terminalHandle } : {}),
-      ...(shouldProviderDeliverCommand
+      ...(managedStartupCommand && (shouldProviderDeliverCommand || rendererShellReadySupported)
         ? {
             startupCommand: {
-              command,
+              command: shouldProviderDeliverCommand ? managedStartupCommand : null,
+              providerDelivery: shouldProviderDeliverCommand,
               delivered: false,
               waitForShellReady: shellLaunch.env.ORCA_SHELL_READY_MARKER === '1',
-              scanState:
+              outputScanState:
                 shellLaunch.env.ORCA_SHELL_READY_MARKER === '1'
-                  ? createShellReadyScanState()
+                  ? createShellStartupOutputScanState()
                   : null,
+              shellPid: null,
+              promptProbe: null,
               timer: null
             }
           }
@@ -1572,11 +1685,13 @@ export class PtyHandler {
       this.releaseStartupCommand(managed)
       this.requestGracefulKill(managed, 'terminate stale')
     } else if (managed.startupCommand) {
-      this.scheduleStartupCommandDelivery(
+      this.scheduleStartupCommandResolution(
         managed,
-        managed.startupCommand.waitForShellReady
-          ? STARTUP_COMMAND_SHELL_READY_FALLBACK_MS
-          : STARTUP_COMMAND_WRITE_DELAY_MS
+        managed.startupCommand.providerDelivery
+          ? managed.startupCommand.waitForShellReady
+            ? STARTUP_COMMAND_SHELL_READY_FALLBACK_MS
+            : STARTUP_COMMAND_WRITE_DELAY_MS
+          : RENDERER_SHELL_READY_RETENTION_MS
       )
     }
     return {
@@ -1596,9 +1711,29 @@ export class PtyHandler {
     sourceActivation?: PtySourceReceivingActivation
   }> {
     const id = params.id as string
+    const expectedIncarnationId =
+      typeof params.expectedIncarnationId === 'string' ? params.expectedIncarnationId : undefined
+    // Gated because the host's answer reaches clients predating it, which read an unrecognized
+    // attach error as neither death nor recovery and strand the pane.
+    const clientUnderstandsExitProof = params.exitProofSupported === true
     const managed = this.ptys.get(id)
     // Why: after dispose, pty.kill is a POSIX no-op; treat disposed as not-found so failures aren't silent.
     if (!managed || managed.disposed) {
+      // `disposed` is teardown, not an observed exit, so only a genuinely absent pty may be
+      // answered from what this process watched exit.
+      if (!managed) {
+        const exited = this.exitedPtys.get(id)
+        if (
+          exited &&
+          this.exitProofAnswersCaller(
+            expectedIncarnationId,
+            exited.incarnationId,
+            clientUnderstandsExitProof
+          )
+        ) {
+          throw new Error(formatPtyExitedError(id, exited.code, exited.incarnationId))
+        }
+      }
       throw new Error(`PTY "${id}" not found`)
     }
 
@@ -1612,19 +1747,43 @@ export class PtyHandler {
       disposeManagedPty(managed)
       this.removePty(id)
       this.clearPtyFlowState(id)
-      throw new Error(`PTY "${id}" not found`)
+      // The reap runs whoever asked, but the ANSWER depends on whose shell died: under this id a
+      // replacement relay may hold a different one entirely, and the caller's may be orphaned and
+      // alive under the relay this one replaced.
+      this.rememberPtyExit(id, PTY_EXIT_CODE_OBSERVED_GONE, managed.incarnationId)
+      if (expectedIncarnationId && expectedIncarnationId !== managed.incarnationId) {
+        throw new Error(`PTY "${id}" identity mismatch`)
+      }
+      throw new Error(
+        this.exitProofAnswersCaller(
+          expectedIncarnationId,
+          managed.incarnationId,
+          clientUnderstandsExitProof
+        )
+          ? formatPtyExitedError(id, PTY_EXIT_CODE_OBSERVED_GONE, managed.incarnationId)
+          : `PTY "${id}" not found`
+      )
     }
 
-    // Why: generation resets can reuse PTY IDs; reject conflicting identities.
-    const mismatch = attachIdentityMismatches(
-      {
-        paneKey: typeof params.expectedPaneKey === 'string' ? params.expectedPaneKey : undefined,
-        tabId: typeof params.expectedTabId === 'string' ? params.expectedTabId : undefined
-      },
-      managed.attachIdentity ?? { paneKey: managed.paneKey, tabId: managed.tabId }
-    )
-    if (mismatch) {
-      throw new Error(`PTY "${id}" not found (identity mismatch)`)
+    // A reset relay restarts ids at pty-1, so an id alone can name somebody else's shell. The
+    // incarnation is the shell's own identity, so it catches that without caring where the pane
+    // lives — unlike the pane identity below, which froze the tab at spawn and refused moved panes.
+    if (
+      !expectedIncarnationId &&
+      attachIdentityMismatches(
+        {
+          paneKey: typeof params.expectedPaneKey === 'string' ? params.expectedPaneKey : undefined,
+          tabId: typeof params.expectedTabId === 'string' ? params.expectedTabId : undefined
+        },
+        managed.attachIdentity ?? { paneKey: managed.paneKey, tabId: managed.tabId }
+      )
+    ) {
+      throw new Error(`PTY "${id}" identity mismatch`)
+    }
+    if (expectedIncarnationId && expectedIncarnationId !== managed.incarnationId) {
+      // Deliberately NOT worded "not found": that phrasing is what the client maps to an expired
+      // session, and expiry authorizes a respawn onto a shell this branch just proved is alive.
+      throw new Error(`PTY "${id}" identity mismatch`)
     }
 
     managed.startupIngress?.snapshotBarrier()
@@ -2033,7 +2192,12 @@ export class PtyHandler {
       rows: entry.rows,
       cwd: entry.cwd,
       // Why: no provider-delivered command is waiting for a ready marker.
-      env: { ...spawnEnv, ORCA_SHELL_READY_MARKER: '0', ...shellLaunch.env }
+      env: {
+        ...spawnEnv,
+        ORCA_SHELL_READY_MARKER: '0',
+        ORCA_SHELL_STARTUP_IDENTITY: '0',
+        ...shellLaunch.env
+      }
     })
     this.wireAndStore({
       id: entry.id,
@@ -2212,6 +2376,14 @@ export class PtyHandler {
     return count
   }
 
+  get retainedStartupCommandBytes(): number {
+    let bytes = 0
+    for (const managed of this.ptys.values()) {
+      bytes += managed.startupCommand?.command?.length ?? 0
+    }
+    return bytes
+  }
+
   get graceTimerActive(): boolean {
     return this.graceTimer !== null
   }
diff --git a/src/relay/pty-shell-launch.test.ts b/src/relay/pty-shell-launch.test.ts
index c4c5b5f11ad..04f7a261583 100644
--- a/src/relay/pty-shell-launch.test.ts
+++ b/src/relay/pty-shell-launch.test.ts
@@ -181,6 +181,12 @@ describe('getRelayShellLaunchConfig', () => {
       expect(config.args).toEqual(['-l'])
       expect(config.env.ZDOTDIR).toBe(zshRoot)
       expect(config.env.ORCA_SHELL_READY_MARKER).toBe('1')
+      expect(readFileSync(join(zshRoot, '.zshenv'), 'utf8')).toContain(
+        'printf "\\033]777;orca-shell-start:%s\\007" "$$"'
+      )
+      expect(readFileSync(join(zshRoot, '.zshenv'), 'utf8')).toContain(
+        'unset ORCA_SHELL_STARTUP_IDENTITY'
+      )
       expect(zlogin).toContain('zle -N zle-line-init __orca_prompt_mark')
       expect(zlogin).toContain('printf "\\033]777;orca-shell-ready\\007"')
     }
@@ -195,11 +201,26 @@ describe('getRelayShellLaunchConfig', () => {
       const bashRc = readFileSync(config.args[1] as string, 'utf8')
 
       expect(config.env.ORCA_SHELL_READY_MARKER).toBe('1')
+      expect(bashRc).toContain('printf "\\033]777;orca-shell-start:%s\\007" "$$"')
+      expect(bashRc).toContain('unset ORCA_SHELL_STARTUP_IDENTITY')
       expect(bashRc).toContain('__orca_append_prompt_command "__orca_prompt_mark"')
       expect(bashRc).toContain('printf "\\033]777;orca-shell-ready\\007"')
     }
   )
 
+  it.skipIf(process.platform === 'win32')(
+    'wraps zsh when only startup identity emission is requested',
+    () => {
+      const config = getRelayShellLaunchConfig('/bin/zsh', { HOME: homeDir }, 'linux', {
+        emitStartupIdentity: true
+      })
+
+      expect(config.env.ZDOTDIR).toBe(join(homeDir, '.orca-relay', 'shell-ready', 'zsh'))
+      expect(config.env.ORCA_SHELL_STARTUP_IDENTITY).toBe('1')
+      expect(config.env.ORCA_SHELL_READY_MARKER).toBeUndefined()
+    }
+  )
+
   itWithBash('runs the relay bash wrapper without fake C/D markers before the first prompt', () => {
     const config = getRelayShellLaunchConfig('/bin/bash', { HOME: homeDir })
     const output = runInteractiveBashRcfile(config.args[1] as string, homeDir)
diff --git a/src/relay/pty-shell-launch.ts b/src/relay/pty-shell-launch.ts
index 5f58b89702c..7a6d7d7a097 100644
--- a/src/relay/pty-shell-launch.ts
+++ b/src/relay/pty-shell-launch.ts
@@ -5,6 +5,7 @@ import { getPosixOmpShellWrapper } from '../main/pty/omp-shell-wrapper'
 import {
   getZshFinalZdotdirRestoreBlock,
   getZshShellReadyMarkerRegistrationBlock,
+  SHELL_STARTUP_IDENTITY_MARKER_BLOCK,
   getZshStartupFileSourceBlock
 } from '../main/shell-templates'
 
@@ -84,6 +85,7 @@ function ensureOverlayRestoreWrappers(root: string): void {
   const bashDir = join(root, 'bash')
 
   const zshEnv = `# Orca relay zsh overlay wrapper
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 export ORCA_ORIG_ZDOTDIR="\${ORCA_ORIG_ZDOTDIR:-$HOME}"
 case "\${ORCA_ORIG_ZDOTDIR%/}" in
   */shell-ready/zsh) export ORCA_ORIG_ZDOTDIR="$HOME" ;;
@@ -133,6 +135,7 @@ ${getZshFinalZdotdirRestoreBlock('"${ORCA_USER_ZDOTDIR:-${ORCA_ORIG_ZDOTDIR:-$HO
 ${getZshShellReadyMarkerRegistrationBlock(SHELL_READY_MARKER_ESCAPED)}
 `
   const bashRc = `# Orca relay bash overlay wrapper
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 [[ -f /etc/profile ]] && source /etc/profile
 if [[ -f "$HOME/.bash_profile" ]]; then
   source "$HOME/.bash_profile"
@@ -264,10 +267,15 @@ export function getRelayShellLaunchConfig(
   shellPath: string,
   env: Record<string, string>,
   platform: NodeJS.Platform = process.platform,
-  options: { emitReadyMarker?: boolean; terminalWindowsWslDistro?: string | null } = {}
+  options: {
+    emitReadyMarker?: boolean
+    emitStartupIdentity?: boolean
+    terminalWindowsWslDistro?: string | null
+  } = {}
 ): RelayShellLaunchConfig {
   const shellName = shellBasename(shellPath)
   const emitReadyMarker = options.emitReadyMarker === true
+  const emitStartupIdentity = options.emitStartupIdentity === true
   if (platform === 'win32') {
     // Why: pwsh also exists on POSIX remotes; Windows-specific shell args must
     // only apply when the relay itself is running on native Windows.
@@ -283,9 +291,9 @@ export function getRelayShellLaunchConfig(
   if (shellName !== 'zsh' && shellName !== 'bash') {
     return { args: POSIX_LOGIN_ARGS, env: {} }
   }
-  // Why: preserve plain zsh startup fast path; only force wrappers when
-  // shell-ready or overlay env restoration is requested.
-  if (shellName === 'zsh' && !hasOverlayRestoreEnv(env) && !emitReadyMarker) {
+  // Why: preserve plain zsh startup fast path unless markers or overlay restoration are requested.
+  const requiresZshWrapper = hasOverlayRestoreEnv(env) || emitReadyMarker || emitStartupIdentity
+  if (shellName === 'zsh' && !requiresZshWrapper) {
     return { args: POSIX_LOGIN_ARGS, env: {} }
   }
 
@@ -298,13 +306,17 @@ export function getRelayShellLaunchConfig(
       env: {
         ORCA_ORIG_ZDOTDIR: resolveOriginalZdotdir(env),
         ZDOTDIR: join(root, 'zsh'),
-        ...(emitReadyMarker ? { ORCA_SHELL_READY_MARKER: '1' } : {})
+        ...(emitReadyMarker ? { ORCA_SHELL_READY_MARKER: '1' } : {}),
+        ...(emitStartupIdentity ? { ORCA_SHELL_STARTUP_IDENTITY: '1' } : {})
       }
     }
   }
 
   return {
     args: ['--rcfile', join(root, 'bash', 'rcfile')],
-    env: emitReadyMarker ? { ORCA_SHELL_READY_MARKER: '1' } : {}
+    env: {
+      ...(emitReadyMarker ? { ORCA_SHELL_READY_MARKER: '1' } : {}),
+      ...(emitStartupIdentity ? { ORCA_SHELL_STARTUP_IDENTITY: '1' } : {})
+    }
   }
 }
diff --git a/src/relay/relay-watcher-event-emitter.test.ts b/src/relay/relay-watcher-event-emitter.test.ts
index acf734acd71..0f0991e5c01 100644
--- a/src/relay/relay-watcher-event-emitter.test.ts
+++ b/src/relay/relay-watcher-event-emitter.test.ts
@@ -61,7 +61,7 @@ function createRecordingSink(highWaterMark?: number): {
       drainWaiters.push(callback)
       return () => {
         const index = drainWaiters.indexOf(callback)
-        if (index >= 0) {
+        if (index !== -1) {
           drainWaiters.splice(index, 1)
         }
       }
diff --git a/src/relay/relay.ts b/src/relay/relay.ts
index cf4b4808668..afd7ef9a02b 100644
--- a/src/relay/relay.ts
+++ b/src/relay/relay.ts
@@ -549,7 +549,7 @@ async function main(): Promise<void> {
     const marker = process.argv.indexOf('--orca-cli')
     await runOrcaCliMode(
       sockPath,
-      marker >= 0 ? process.argv.slice(marker + 1) : [],
+      marker !== -1 ? process.argv.slice(marker + 1) : [],
       endpointCredential
     )
     return
@@ -780,7 +780,7 @@ async function main(): Promise<void> {
   )
 
   // ── Agent-hook server ─────────────────────────────────────────────
-  // Why: loopback HTTP receiver so remote-PTY agent CLIs post hook events locally, forwarded to Orca as agent.hook notifications. See docs/design/agent-status-over-ssh.md §2-§5.
+  // Why: loopback HTTP receiver so remote-PTY agent CLIs post hook events to a local port (they can't reach Orca's host); the relay forwards them as agent.hook notifications.
   const hookServer = new RelayAgentHookServer({
     // Why: scope endpoint.env/cmd by socket path so multiple relay daemons on one account can't overwrite each other's hook tokens.
     endpointDir: endpointDir ?? endpointDirForRelaySocket(sockPath),
@@ -870,7 +870,7 @@ async function main(): Promise<void> {
     return env
   })
 
-  // Why: evict pane status cache + overlay dirs on PTY exit so panes don't ghost after reconnect (§5 Path 3) or leak dirs.
+  // Why: evict pane status cache + overlay dirs on PTY exit, else the next reconnect replays a dead pane's last status (ghost row) and overlay dirs leak.
   ptyHandler.setExitListener(({ paneKey, id }) => {
     if (paneKey) {
       hookServer.clearPaneState(paneKey)
@@ -878,7 +878,7 @@ async function main(): Promise<void> {
     pluginOverlay.clearOverlay(paneKey ?? id)
   })
 
-  // Why: forward cached entries as notifications before returning so the response trails all replays, closing a reconnect race. See docs/design/agent-status-over-ssh.md §5 Path 3.
+  // Why: forward cached entries as notifications before returning, so the response trails every replay and Orca can't treat replay as done while frames are still in flight.
   dispatcher.onRequest(AGENT_HOOK_REQUEST_REPLAY_METHOD, async () => {
     const replayed = hookServer.replayCachedPayloadsForPanes()
     return { replayed }
@@ -887,7 +887,7 @@ async function main(): Promise<void> {
   // Why: relay-local installers collapse hundreds of SFTP request/response RTTs to one RPC.
   registerManagedHookInstaller(dispatcher)
 
-  // Why: plugin sources ship over the wire so an Orca update doesn't force a relay redeploy; cache them per spawn. See docs/design/agent-status-over-ssh.md §4.
+  // Why: plugin sources ship over the wire — the relay is versioned independently of Orca, so bundling them would make every agent-event change a relay redeploy.
   // Why: bound per-source size so a buggy/hostile Orca can't OOM the relay by pushing a giant string.
   dispatcher.onRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, async (params) => {
     const opencode = params.opencodePluginSource
diff --git a/src/renderer/src/App.tsx b/src/renderer/src/App.tsx
index 84b6bb9e155..0795d6221a3 100644
--- a/src/renderer/src/App.tsx
+++ b/src/renderer/src/App.tsx
@@ -1416,7 +1416,9 @@ function App(): React.JSX.Element {
         hideWorkspacesFromOtherDevices,
         alwaysShowDefaultBranchWorkspace,
         showDotfilesByWorktree,
-        filterRepoIds,
+        // Why: the store keeps this readonly for identity stability, but PersistedUI crosses to
+        // main, which owns a mutable array — copy at the boundary rather than widening the wire type.
+        filterRepoIds: [...filterRepoIds],
         // Why (#9002): activeView is deliberately NOT included here. It used to
         // ride this same 150ms writer (#8265), which meant every top-level view
         // switch scheduled a full durable-state save. The narrow preference
@@ -1476,18 +1478,17 @@ function App(): React.JSX.Element {
     } else if (settings.theme === 'light') {
       applyDocumentTheme('light')
       return undefined
-    } else {
-      // system
-      const mq = window.matchMedia('(prefers-color-scheme: dark)')
-      applyDocumentTheme('system')
-      const handler = (): void => {
-        applyDocumentTheme('system')
-        // System theme changes don't mutate the store, so mobile terminal colors need an explicit graph republish.
-        scheduleRuntimeGraphSync()
-      }
-      mq.addEventListener('change', handler)
-      return () => mq.removeEventListener('change', handler)
     }
+    // system
+    const mq = window.matchMedia('(prefers-color-scheme: dark)')
+    applyDocumentTheme('system')
+    const handler = (): void => {
+      applyDocumentTheme('system')
+      // System theme changes don't mutate the store, so mobile terminal colors need an explicit graph republish.
+      scheduleRuntimeGraphSync()
+    }
+    mq.addEventListener('change', handler)
+    return () => mq.removeEventListener('change', handler)
   }, [settings])
 
   useEffect(() => {
diff --git a/src/renderer/src/components/AgentWorkingSpinner.test.tsx b/src/renderer/src/components/AgentWorkingSpinner.test.tsx
index 25c04f39783..f887dab132c 100644
--- a/src/renderer/src/components/AgentWorkingSpinner.test.tsx
+++ b/src/renderer/src/components/AgentWorkingSpinner.test.tsx
@@ -50,7 +50,99 @@ describe('AgentWorkingSpinner', () => {
     }
   })
 
-  it('anchors mount and restart animations to the shared document epoch', async () => {
+  // Why: animationstart fires on the first start and on every restart (class
+  // re-add, display:none reveal), so it alone keeps every ring phase-locked.
+  // A negative animation-delay cannot — it is static, so a restart replays the
+  // stale mount-time offset and the rings fan out across steps.
+  it('anchors every animation start to the shared document epoch', async () => {
+    const animation = {
+      animationName: 'agent-spinner-rotate',
+      startTime: 321
+    } as unknown as Animation
+    const getAnimations = vi.fn(() => [animation])
+    const originalGetAnimations = Object.getOwnPropertyDescriptor(
+      HTMLElement.prototype,
+      'getAnimations'
+    )
+    Object.defineProperty(HTMLElement.prototype, 'getAnimations', {
+      configurable: true,
+      value: getAnimations
+    })
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    const fireAnimationStart = async (): Promise<void> => {
+      const event = new Event('animationstart', { bubbles: true })
+      Object.defineProperty(event, 'animationName', { value: 'agent-spinner-rotate' })
+      await act(async () => {
+        container.querySelector('[data-agent-spinner]')!.dispatchEvent(event)
+      })
+    }
+
+    try {
+      await act(async () => {
+        root.render(<AgentWorkingSpinner />)
+      })
+      // Why: mount must not query animations — that forces a synchronous style
+      // recalc per ring for a phase the first animationstart sets anyway.
+      expect(getAnimations).not.toHaveBeenCalled()
+
+      await fireAnimationStart()
+      expect(animation.startTime).toBe(0)
+
+      animation.startTime = 654
+      await fireAnimationStart()
+      expect(animation.startTime).toBe(0)
+      expect(getAnimations).toHaveBeenCalledTimes(2)
+    } finally {
+      act(() => root.unmount())
+      container.remove()
+      if (originalGetAnimations === undefined) {
+        Reflect.deleteProperty(HTMLElement.prototype, 'getAnimations')
+      } else {
+        Object.defineProperty(HTMLElement.prototype, 'getAnimations', originalGetAnimations)
+      }
+    }
+  })
+
+  // Why: reduced motion resolves the rule to `animation: none`, so no animation
+  // exists to start and none to anchor. Pins that dropping the ref-time anchor
+  // adds no exposure here — both paths were already no-ops.
+  it('anchors nothing when reduced motion leaves no animation to start', async () => {
+    const getAnimations = vi.fn(() => [] as Animation[])
+    const originalGetAnimations = Object.getOwnPropertyDescriptor(
+      HTMLElement.prototype,
+      'getAnimations'
+    )
+    Object.defineProperty(HTMLElement.prototype, 'getAnimations', {
+      configurable: true,
+      value: getAnimations
+    })
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+
+    try {
+      await act(async () => {
+        root.render(<AgentWorkingSpinner />)
+      })
+      const el = container.querySelector('[data-agent-spinner]')
+
+      expect(el).not.toBeNull()
+      expect(getAnimations).not.toHaveBeenCalled()
+      expect(el!.className).toContain('motion-reduce:border-t-yellow-500')
+    } finally {
+      act(() => root.unmount())
+      container.remove()
+      if (originalGetAnimations === undefined) {
+        Reflect.deleteProperty(HTMLElement.prototype, 'getAnimations')
+      } else {
+        Object.defineProperty(HTMLElement.prototype, 'getAnimations', originalGetAnimations)
+      }
+    }
+  })
+
+  it('ignores animation starts from other animations on the same element', async () => {
     const animation = {
       animationName: 'agent-spinner-rotate',
       startTime: 321
@@ -72,16 +164,14 @@ describe('AgentWorkingSpinner', () => {
       await act(async () => {
         root.render(<AgentWorkingSpinner />)
       })
-      expect(animation.startTime).toBe(0)
-
-      animation.startTime = 654
-      const restart = new Event('animationstart', { bubbles: true })
-      Object.defineProperty(restart, 'animationName', { value: 'agent-spinner-rotate' })
+      const unrelated = new Event('animationstart', { bubbles: true })
+      Object.defineProperty(unrelated, 'animationName', { value: 'compact-agent-expansion-reveal' })
       await act(async () => {
-        container.querySelector('[data-agent-spinner]')!.dispatchEvent(restart)
+        container.querySelector('[data-agent-spinner]')!.dispatchEvent(unrelated)
       })
-      expect(animation.startTime).toBe(0)
-      expect(getAnimations).toHaveBeenCalledTimes(2)
+
+      expect(getAnimations).not.toHaveBeenCalled()
+      expect(animation.startTime).toBe(321)
     } finally {
       act(() => root.unmount())
       container.remove()
diff --git a/src/renderer/src/components/AgentWorkingSpinner.tsx b/src/renderer/src/components/AgentWorkingSpinner.tsx
index 9b20a862b09..7d2ab0a0b5a 100644
--- a/src/renderer/src/components/AgentWorkingSpinner.tsx
+++ b/src/renderer/src/components/AgentWorkingSpinner.tsx
@@ -3,8 +3,10 @@ import { cn } from '@/lib/utils'
 
 const SPINNER_ANIMATION_NAME = 'agent-spinner-rotate'
 
-// Why: CSS assigns per-element start times after refs run; anchoring the Web
-// Animation timeline gives late mounts exact phase sync without recurring JS.
+// Why: anchoring the Web Animation timeline gives late mounts exact phase sync
+// without recurring JS. Driven only by animationstart — a ref-time call would
+// force a synchronous style recalc per mount for a phase animationstart fixes
+// one frame later anyway (measured: 24ms of blocking work per 200 mounts).
 function syncSpinnerPhase(el: HTMLSpanElement | null): void {
   if (el === null || typeof el.getAnimations !== 'function') {
     return
@@ -33,7 +35,6 @@ function handleSpinnerAnimationStart(event: React.AnimationEvent<HTMLSpanElement
 export function AgentWorkingSpinner({ className }: { className?: string }): React.JSX.Element {
   return (
     <span
-      ref={syncSpinnerPhase}
       onAnimationStart={handleSpinnerAnimationStart}
       data-agent-spinner=""
       className={cn(
diff --git a/src/renderer/src/components/BrowserCookieImportDisclosure.tsx b/src/renderer/src/components/BrowserCookieImportDisclosure.tsx
new file mode 100644
index 00000000000..9e7c203675d
--- /dev/null
+++ b/src/renderer/src/components/BrowserCookieImportDisclosure.tsx
@@ -0,0 +1,28 @@
+import { Info } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+import { DropdownMenuLabel, DropdownMenuSeparator } from '@/components/ui/dropdown-menu'
+
+export function BrowserCookieImportDisclosure(): React.JSX.Element {
+  return (
+    <>
+      <DropdownMenuSeparator />
+      <DropdownMenuLabel className="flex max-w-64 items-start gap-2 whitespace-normal py-2 font-normal">
+        <Info aria-hidden className="mt-0.5 size-3.5 shrink-0" />
+        <span className="min-w-0">
+          <span className="block font-medium leading-4 text-foreground">
+            {translate(
+              'auto.components.BrowserCookieImportDisclosure.title',
+              "Google logins aren't imported"
+            )}
+          </span>
+          <span className="block leading-4 text-muted-foreground">
+            {translate(
+              'auto.components.BrowserCookieImportDisclosure.description',
+              'Sign in to Google directly in Orca.'
+            )}
+          </span>
+        </span>
+      </DropdownMenuLabel>
+    </>
+  )
+}
diff --git a/src/renderer/src/components/GitHubItemDialog.tsx b/src/renderer/src/components/GitHubItemDialog.tsx
index eee4a5a106c..5f73fb31bea 100644
--- a/src/renderer/src/components/GitHubItemDialog.tsx
+++ b/src/renderer/src/components/GitHubItemDialog.tsx
@@ -1240,7 +1240,7 @@ if (typeof window !== 'undefined' && window.api?.gh?.onWorkItemMutated) {
     invalidateWorkItemDetailsCacheByMatch(payload)
   })
 }
-if (typeof import.meta !== 'undefined' && import.meta.hot) {
+if (import.meta !== undefined && import.meta.hot) {
   import.meta.hot.dispose(() => {
     workItemMutatedUnsub?.()
     workItemDetailsCacheEventUnsub?.()
diff --git a/src/renderer/src/components/PullRequestPage.tsx b/src/renderer/src/components/PullRequestPage.tsx
index 69969b5f3bd..aedc7bdd5e0 100644
--- a/src/renderer/src/components/PullRequestPage.tsx
+++ b/src/renderer/src/components/PullRequestPage.tsx
@@ -1286,7 +1286,7 @@ if (typeof window !== 'undefined' && window.api?.gh?.onWorkItemMutated) {
     invalidateWorkItemDetailsCacheByMatch(payload)
   })
 }
-if (typeof import.meta !== 'undefined' && import.meta.hot) {
+if (import.meta !== undefined && import.meta.hot) {
   import.meta.hot.dispose(() => {
     workItemMutatedUnsub?.()
     workItemDetailsCacheEventUnsub?.()
diff --git a/src/renderer/src/components/TaskPage.tsx b/src/renderer/src/components/TaskPage.tsx
index 520f2debbdd..29bc0bc4587 100644
--- a/src/renderer/src/components/TaskPage.tsx
+++ b/src/renderer/src/components/TaskPage.tsx
@@ -6960,7 +6960,7 @@ export default function TaskPage(): React.JSX.Element {
     const authorityPage = pages.findIndex((page) =>
       page?.some((item) => authorityItemKeys.has(taskPageGitHubItemKey(item.repoId, item.id)))
     )
-    const quietPage = authorityPage >= 0 ? authorityPage : currentPage
+    const quietPage = authorityPage !== -1 ? authorityPage : currentPage
     const visiblePage = currentPage > quietPage ? currentPage : undefined
     const pageItemKeys = (page: number): Set<string> =>
       new Set((pages[page] ?? []).map((item) => taskPageGitHubItemKey(item.repoId, item.id)))
diff --git a/src/renderer/src/components/Terminal.tsx b/src/renderer/src/components/Terminal.tsx
index a8938a4e507..d555a92d22c 100644
--- a/src/renderer/src/components/Terminal.tsx
+++ b/src/renderer/src/components/Terminal.tsx
@@ -12,6 +12,7 @@ import {
 } from '@/constants/terminal'
 import { useAppStore } from '../store'
 import { folderWorkspaceKey } from '../../../shared/workspace-scope'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 import { useAllWorktrees } from '../store/selectors'
 import { getConnectionId } from '../lib/connection-context'
 import { basename } from '../lib/path'
@@ -181,6 +182,7 @@ import {
   useManualTerminalWorktreeParking
 } from './terminal-pane/use-manual-terminal-worktree-parking'
 import { EDITOR_TAB_CONTENT_TYPES, getEditorCmdSaveFileId } from './editor/editor-cmd-save-target'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 const EditorPanel = lazy(() => import('./editor/EditorPanel'))
 
@@ -188,6 +190,10 @@ const EditorPanel = lazy(() => import('./editor/EditorPanel'))
 const CLOSE_DIALOG_DEBOUNCE_MS = 200
 type TerminalStoreSnapshot = ReturnType<typeof useAppStore.getState>
 
+function showClientCreationActionError(error: unknown): void {
+  toast.error(error instanceof Error ? error.message : String(error))
+}
+
 function haveSameIdSet(left: ReadonlySet<string>, right: ReadonlySet<string>): boolean {
   if (left.size !== right.size) {
     return false
@@ -1597,7 +1603,7 @@ function Terminal(): React.JSX.Element | null {
     void openMobileEmulatorTab(activeWorktreeId, {
       placement: 'rightSplit',
       targetGroupId: targetGroupId ?? undefined
-    })
+    }).catch(showClientCreationActionError)
   }, [activeWorktreeId])
 
   const handleNewBrowserTab = useCallback(() => {
@@ -1608,22 +1614,31 @@ function Terminal(): React.JSX.Element | null {
       useAppStore.getState().activeGroupIdByWorktree[activeWorktreeId] ??
       useAppStore.getState().groupsByWorktree[activeWorktreeId]?.[0]?.id
     if (targetGroupId) {
-      void openNewBrowserTabInActiveWorkspace(targetGroupId)
+      void openNewBrowserTabInActiveWorkspace(targetGroupId).catch(showClientCreationActionError)
       return
     }
-    const defaultUrl = useAppStore.getState().browserDefaultUrl ?? 'about:blank'
+    const state = useAppStore.getState()
+    const browserAvailability = getClientCreationActionPolicy(state, activeWorktreeId)[
+      'managed-browser'
+    ]
+    if (browserAvailability.state !== 'enabled') {
+      toast.error(browserAvailability.reason)
+      return
+    }
+    const defaultUrl = state.browserDefaultUrl ?? 'about:blank'
     const runtimeEnvironmentId = getActiveWorktreeRuntimeEnvironmentId(activeWorktreeId)
-    if (isWebRuntimeSessionActive(runtimeEnvironmentId)) {
+    if (browserAvailability.provider === 'paired-runtime' && runtimeEnvironmentId) {
       void createWebRuntimeSessionBrowserTab({
         worktreeId: activeWorktreeId,
         environmentId: runtimeEnvironmentId,
         url: defaultUrl
-      })
+      }).catch(showClientCreationActionError)
       return
     }
     createBrowserTab(activeWorktreeId, defaultUrl, {
       title: translate('auto.components.Terminal.37da0d736f', 'New Browser Tab'),
-      focusAddressBar: true
+      focusAddressBar: true,
+      ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {})
     })
   }, [activeWorktreeId, createBrowserTab, openNewBrowserTabInActiveWorkspace])
 
@@ -1643,8 +1658,16 @@ function Terminal(): React.JSX.Element | null {
         return
       }
       const runtimeEnvironmentId = getActiveWorktreeRuntimeEnvironmentId(activeWorktreeId)
+      const browserAvailability = getClientCreationActionPolicy(state, activeWorktreeId)[
+        'managed-browser'
+      ]
+      if (browserAvailability.state !== 'enabled') {
+        toast.error(browserAvailability.reason)
+        return
+      }
       if (
-        isWebRuntimeSessionActive(runtimeEnvironmentId) &&
+        browserAvailability.provider === 'paired-runtime' &&
+        runtimeEnvironmentId &&
         browserWorkspaceHasRemoteOwner(state, source.id, runtimeEnvironmentId)
       ) {
         void createWebRuntimeSessionBrowserTab({
@@ -1652,12 +1675,17 @@ function Terminal(): React.JSX.Element | null {
           environmentId: runtimeEnvironmentId,
           url: source.url,
           profileId: source.sessionProfileId
-        })
+        }).catch(showClientCreationActionError)
         return
       }
-      createBrowserTab(activeWorktreeId, source.url, {
-        ...buildDuplicatedBrowserTabOptions(source)
-      })
+      try {
+        createBrowserTab(activeWorktreeId, source.url, {
+          ...buildDuplicatedBrowserTabOptions(source),
+          ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {})
+        })
+      } catch (error) {
+        showClientCreationActionError(error)
+      }
     },
     [activeWorktreeId, createBrowserTab]
   )
@@ -2032,7 +2060,11 @@ function Terminal(): React.JSX.Element | null {
       if (!e.repeat && matchShortcut('tab.reopenClosed')) {
         e.preventDefault()
         notifyTerminalCapture('tab.reopenClosed')
-        useAppStore.getState().reopenClosedTab(activeWorktreeId)
+        try {
+          useAppStore.getState().reopenClosedTab(activeWorktreeId)
+        } catch (error) {
+          showClientCreationActionError(error)
+        }
         return
       }
 
@@ -2040,8 +2072,18 @@ function Terminal(): React.JSX.Element | null {
       if (!e.repeat && matchShortcut('tab.newBrowser')) {
         e.preventDefault()
         notifyTerminalCapture('tab.newBrowser')
+        const browserAvailability = getClientCreationActionPolicy(
+          useAppStore.getState(),
+          floatingWorkspaceFocused ? FLOATING_TERMINAL_WORKTREE_ID : activeWorktreeId
+        )['managed-browser']
+        if (browserAvailability.state !== 'enabled') {
+          toast.error(browserAvailability.reason)
+          return
+        }
         if (floatingWorkspaceFocused) {
-          void createFloatingWorkspaceBrowserTab(useAppStore.getState())
+          void createFloatingWorkspaceBrowserTab(useAppStore.getState()).catch(
+            showClientCreationActionError
+          )
           return
         }
         handleNewBrowserTab()
@@ -2052,6 +2094,14 @@ function Terminal(): React.JSX.Element | null {
       if (!e.repeat && mobileEmulatorEnabled && matchShortcut('tab.newSimulator')) {
         e.preventDefault()
         notifyTerminalCapture('tab.newSimulator')
+        const simulatorAvailability = getClientCreationActionPolicy(
+          useAppStore.getState(),
+          activeWorktreeId
+        )['mobile-emulator']
+        if (simulatorAvailability.state !== 'enabled') {
+          toast.error(simulatorAvailability.reason)
+          return
+        }
         if (!floatingWorkspaceFocused) {
           handleNewSimulatorTab()
         }
diff --git a/src/renderer/src/components/WorktreeJumpPalette.linear-url.test.tsx b/src/renderer/src/components/WorktreeJumpPalette.linear-url.test.tsx
new file mode 100644
index 00000000000..709d57777c7
--- /dev/null
+++ b/src/renderer/src/components/WorktreeJumpPalette.linear-url.test.tsx
@@ -0,0 +1,741 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { flushSync } from 'react-dom'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as ReactI18Next from 'react-i18next'
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import type { GitHubWorkItem, LinearIssue, Repo } from '../../../shared/types'
+import { projectHostSetupProjectionFromRepos } from '../../../shared/project-host-setup-projection'
+import { resolveWorkspaceCreationTarget } from '@/lib/project-host-workspace-target'
+import { WORKTREE_PALETTE_QUERY_MAX_BYTES } from '@/lib/worktree-palette-query-bounds'
+import WorktreeJumpPalette from './WorktreeJumpPalette'
+import { makeRecentTabState, makeRepo, makeWorktree } from './worktree-jump-palette-test-fixtures'
+
+const { lookupCmdJGitHubUrlWorkItem } = vi.hoisted(() => ({
+  lookupCmdJGitHubUrlWorkItem: vi.fn()
+}))
+
+vi.mock('@/lib/cmd-j-github-url-lookup', () => ({
+  lookupCmdJGitHubUrlWorkItem
+}))
+
+vi.mock('react-i18next', async (importOriginal) => {
+  const actual = await importOriginal<typeof ReactI18Next>()
+  return {
+    ...actual,
+    useTranslation: () => ({
+      t: (_key: string, fallback?: string) => fallback ?? _key
+    })
+  }
+})
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: vi.fn(),
+    error: vi.fn(),
+    info: vi.fn(),
+    warning: vi.fn(),
+    message: vi.fn()
+  }
+}))
+
+vi.mock('@/hooks/useSettingsNavigationMetadata', () => ({
+  useSettingsNavigationMetadata: () => []
+}))
+
+vi.mock('@/components/sidebar/StatusIndicator', () => ({
+  default: () => <span data-status-indicator="true" />
+}))
+
+vi.mock('@/components/repo/RepoBadgeLabel', () => ({
+  RepoBadgeMark: () => <span data-repo-badge-mark="true" />
+}))
+
+vi.mock('@/components/cmd-j/palette-host-badge', () => ({
+  getPaletteHostBadge: () => null
+}))
+
+vi.mock('@/components/ui/command', async () => {
+  const React = await import('react')
+  return {
+    Command: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+    CommandGroup: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+    CommandDialog: ({
+      children,
+      open,
+      commandProps,
+      onOpenChange
+    }: {
+      children: React.ReactNode
+      open?: boolean
+      commandProps?: { value?: string; onValueChange?: (next: string) => void }
+      onOpenChange?: (open: boolean) => void
+    }) => {
+      requestCommandDialogClose = () => onOpenChange?.(false)
+      return open ? (
+        <div data-command-dialog="true" data-command-value={commandProps?.value ?? ''}>
+          {children}
+        </div>
+      ) : null
+    },
+    CommandInput: ({
+      value,
+      onValueChange
+    }: {
+      value?: string
+      onValueChange?: (next: string) => void
+    }) => {
+      setCommandQuery = onValueChange ?? null
+      return (
+        <input
+          data-command-input="true"
+          value={value}
+          onChange={(event) => onValueChange?.(event.currentTarget.value)}
+        />
+      )
+    },
+    CommandList: React.forwardRef(function CommandList(
+      { children }: { children: React.ReactNode },
+      ref: React.ForwardedRef<HTMLDivElement>
+    ) {
+      return (
+        <div ref={ref} data-command-list="true">
+          {children}
+        </div>
+      )
+    }),
+    CommandEmpty: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+    CommandItem: ({
+      children,
+      onSelect,
+      value,
+      ...props
+    }: {
+      children: React.ReactNode
+      onSelect?: (value: string) => void
+      value?: string
+    } & Omit<React.ButtonHTMLAttributes<HTMLButtonElement>, 'onSelect' | 'value'>) => (
+      <button
+        {...props}
+        data-command-item={value ?? ''}
+        onClick={() => onSelect?.(value ?? '')}
+        type="button"
+      >
+        {children}
+      </button>
+    )
+  }
+})
+
+const LINEAR_URL = 'https://linear.app/stably/issue/STA-4084/restore-osc-133-shell-integration'
+const initialAppState = useAppStore.getInitialState()
+let testRoot: Root
+let testContainer: HTMLDivElement
+let setCommandQuery: ((next: string) => void) | null = null
+let requestCommandDialogClose: (() => void) | null = null
+
+function makeLinearIssue(patch: Partial<LinearIssue> = {}): LinearIssue {
+  return {
+    id: 'issue-sta-4084',
+    workspaceId: 'linear-workspace-1',
+    workspaceName: 'Stably',
+    identifier: 'STA-4084',
+    title: 'Restore OSC 133 shell integration',
+    branchName: 'sta-4084-restore-osc-133-shell-integration',
+    url: LINEAR_URL,
+    state: { name: 'Todo', type: 'unstarted', color: '#999999' },
+    team: { id: 'team-sta', name: 'Stably', key: 'STA' },
+    labels: [],
+    labelIds: [],
+    estimate: null,
+    priority: 2,
+    updatedAt: '2026-08-12T12:00:00.000Z',
+    ...patch
+  }
+}
+
+function deferredValue<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+  let resolve!: (value: T) => void
+  return {
+    promise: new Promise<T>((next) => {
+      resolve = next
+    }),
+    resolve
+  }
+}
+
+async function flushEffects(): Promise<void> {
+  await act(async () => {
+    await Promise.resolve()
+    await Promise.resolve()
+  })
+}
+
+async function renderPalette(overrides: Partial<AppState>): Promise<void> {
+  useAppStore.setState({
+    activeModal: 'worktree-palette',
+    activeWorktreeId: null,
+    repos: [makeRepo()],
+    tabsByWorktree: {},
+    browserTabsByWorktree: {},
+    browserPagesByWorkspace: {},
+    unifiedTabsByWorktree: {},
+    hideDefaultBranchWorkspace: false,
+    hideAutomationGeneratedWorkspaces: false,
+    alwaysShowDefaultBranchWorkspace: true,
+    lastVisitedAtByWorktreeId: {},
+    linearStatus: {
+      connected: true,
+      viewer: null,
+      workspaces: [
+        {
+          id: 'linear-workspace-1',
+          displayName: 'Linear User',
+          email: null,
+          organizationId: 'linear-organization-1',
+          organizationName: 'Stably',
+          organizationUrlKey: 'stably'
+        }
+      ],
+      selectedWorkspaceId: 'all'
+    },
+    ...makeRecentTabState(),
+    ...overrides
+  } as Partial<AppState>)
+
+  await act(async () => {
+    testRoot.render(<WorktreeJumpPalette />)
+  })
+  await flushEffects()
+}
+
+function getRenderedRowIds(): string[] {
+  return [...testContainer.querySelectorAll<HTMLElement>('[data-command-item]')].map(
+    (node) => node.dataset.commandItem ?? ''
+  )
+}
+
+function getCommandValue(): string {
+  return (
+    testContainer.querySelector<HTMLElement>('[data-command-dialog]')?.dataset.commandValue ?? ''
+  )
+}
+
+describe('WorktreeJumpPalette Linear URL intent', () => {
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    setCommandQuery = null
+    requestCommandDialogClose = null
+    lookupCmdJGitHubUrlWorkItem.mockReset()
+    lookupCmdJGitHubUrlWorkItem.mockResolvedValue(null)
+    useAppStore.setState(initialAppState, true)
+    testContainer = document.createElement('div')
+    document.body.appendChild(testContainer)
+    testRoot = createRoot(testContainer)
+  })
+
+  afterEach(async () => {
+    await act(async () => {
+      testRoot.unmount()
+    })
+    vi.useRealTimers()
+    document.body.replaceChildren()
+    useAppStore.setState(initialAppState, true)
+  })
+
+  it('delays loading feedback before replacing the pending row with an issue preview', async () => {
+    const issueLookup = deferredValue<LinearIssue | null>()
+    const fetchLinearIssue = vi.fn(() => issueLookup.promise)
+    await renderPalette({
+      fetchLinearIssue,
+      linearStatus: {
+        connected: true,
+        viewer: null,
+        workspaces: [
+          {
+            id: 'linear-workspace-1',
+            displayName: 'Linear User',
+            email: null,
+            organizationId: 'linear-organization-1',
+            organizationName: 'Stably',
+            organizationUrlKey: 'stably'
+          }
+        ],
+        selectedWorkspaceId: 'all'
+      }
+    })
+
+    vi.useFakeTimers()
+    await act(async () => setCommandQuery?.(LINEAR_URL))
+    await flushEffects()
+
+    const pendingRow = testContainer.querySelector<HTMLElement>(
+      '[data-cmd-j-linear-issue-preview="true"]'
+    )
+    expect(getRenderedRowIds().find(Boolean)).toBe('__create_worktree__')
+    expect(getCommandValue()).toBe('__create_worktree__')
+    expect(pendingRow?.dataset.cmdJLinearIssueState).toBe('loading')
+    expect(pendingRow?.getAttribute('aria-busy')).toBe('true')
+    expect(pendingRow?.getAttribute('aria-label')).toBe(
+      'Create worktree from Linear issue STA-4084'
+    )
+    expect(pendingRow?.textContent).toContain('Create worktree from Linear issue')
+    expect(pendingRow?.textContent).not.toContain('Loading Linear issue…')
+    expect(fetchLinearIssue).toHaveBeenCalledWith(
+      'STA-4084',
+      'linear-workspace-1',
+      expect.objectContaining({
+        sourceContext: expect.objectContaining({
+          provider: 'linear',
+          projectId: 'repo:repo-1',
+          projectHostSetupId: 'repo-1',
+          repoId: 'repo-1',
+          hostId: 'local'
+        })
+      })
+    )
+
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(199)
+    })
+    expect(pendingRow?.textContent).not.toContain('Loading Linear issue…')
+
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(1)
+    })
+    expect(pendingRow?.getAttribute('aria-label')).toBe('Loading Linear issue STA-4084')
+    expect(pendingRow?.textContent).toContain('Loading Linear issue…')
+
+    await act(async () => {
+      issueLookup.resolve(makeLinearIssue())
+      await issueLookup.promise
+    })
+    await flushEffects()
+
+    const resolvedRow = testContainer.querySelector<HTMLElement>(
+      '[data-cmd-j-linear-issue-preview="true"]'
+    )
+    expect(resolvedRow?.dataset.cmdJLinearIssueState).toBe('resolved')
+    expect(resolvedRow?.textContent).toContain('STA-4084')
+    expect(resolvedRow?.textContent).toContain('Restore OSC 133 shell integration')
+    expect(getRenderedRowIds().find(Boolean)).toBe('__create_worktree__')
+    expect(getCommandValue()).toBe('__create_worktree__')
+  })
+
+  it('rejects oversized Linear URLs before lookup or create-row rendering', async () => {
+    const fetchLinearIssue = vi.fn(async () => makeLinearIssue())
+    await renderPalette({ fetchLinearIssue })
+
+    await act(async () =>
+      setCommandQuery?.(`${LINEAR_URL}/${'a'.repeat(WORKTREE_PALETTE_QUERY_MAX_BYTES)}`)
+    )
+    await flushEffects()
+
+    expect(fetchLinearIssue).not.toHaveBeenCalled()
+    expect(getRenderedRowIds()).not.toContain('__create_worktree__')
+    expect(testContainer.querySelector('[data-cmd-j-linear-issue-preview="true"]')).toBeNull()
+  })
+
+  it('opens the composer with the resolved issue and generated workspace name', async () => {
+    await renderPalette({
+      fetchLinearIssue: vi.fn(async () => makeLinearIssue()),
+      prefetchWorktreeCreateBase: vi.fn(async () => {})
+    })
+    await act(async () => setCommandQuery?.(LINEAR_URL))
+    await flushEffects()
+
+    await act(async () => {
+      testContainer.querySelector<HTMLElement>('[data-command-item="__create_worktree__"]')?.click()
+      await Promise.resolve()
+    })
+    await flushEffects()
+
+    expect(useAppStore.getState().activeModal).toBe('new-workspace-composer')
+    expect(useAppStore.getState().modalData).toMatchObject({
+      prefilledName: 'sta-4084-restore-osc-133-shell-integration',
+      initialRepoId: 'repo-1',
+      telemetrySource: 'command_palette',
+      linkedWorkItem: {
+        provider: 'linear',
+        type: 'issue',
+        linearIdentifier: 'STA-4084',
+        linearWorkspaceId: 'linear-workspace-1',
+        title: 'Restore OSC 133 shell integration'
+      },
+      taskSourceContext: {
+        provider: 'linear',
+        projectId: 'repo:repo-1',
+        projectHostSetupId: 'repo-1',
+        repoId: 'repo-1',
+        hostId: 'local',
+        providerIdentity: {
+          provider: 'linear',
+          workspaceId: 'linear-workspace-1',
+          workspaceName: 'Stably',
+          teamId: 'team-sta',
+          teamKey: 'STA'
+        }
+      }
+    })
+  })
+
+  it('keeps runtime folder projects as the Linear lookup and composer owner', async () => {
+    const folderRepo: Repo = {
+      ...makeRepo(),
+      id: 'folder-repo',
+      kind: 'folder' as const,
+      executionHostId: 'runtime:folder-env'
+    }
+    const fetchLinearIssue = vi.fn(async () => makeLinearIssue())
+    const prefetchWorktreeCreateBase = vi.fn(async () => {})
+    await renderPalette({
+      activeRepoId: folderRepo.id,
+      repos: [folderRepo],
+      fetchLinearIssue,
+      prefetchWorktreeCreateBase
+    })
+    await act(async () => setCommandQuery?.(LINEAR_URL))
+    await flushEffects()
+
+    expect(fetchLinearIssue).toHaveBeenCalledWith(
+      'STA-4084',
+      'linear-workspace-1',
+      expect.objectContaining({
+        sourceContext: expect.objectContaining({
+          provider: 'linear',
+          projectId: 'repo:folder-repo',
+          projectHostSetupId: 'folder-repo',
+          repoId: 'folder-repo',
+          hostId: 'runtime:folder-env'
+        })
+      })
+    )
+
+    await act(async () => {
+      testContainer.querySelector<HTMLElement>('[data-command-item="__create_worktree__"]')?.click()
+      await Promise.resolve()
+    })
+    await flushEffects()
+
+    expect(useAppStore.getState().modalData).toMatchObject({
+      initialRepoId: 'folder-repo',
+      taskSourceContext: {
+        provider: 'linear',
+        projectId: 'repo:folder-repo',
+        projectHostSetupId: 'folder-repo',
+        repoId: 'folder-repo',
+        hostId: 'runtime:folder-env'
+      }
+    })
+    const projection = projectHostSetupProjectionFromRepos([folderRepo])
+    expect(
+      resolveWorkspaceCreationTarget({
+        eligibleRepos: [folderRepo],
+        projects: projection.projects,
+        projectHostSetups: projection.setups,
+        initialRepoId: 'folder-repo',
+        projectId: 'repo:folder-repo',
+        hostId: 'runtime:folder-env',
+        projectHostSetupId: 'folder-repo'
+      })
+    ).toMatchObject({ status: 'ready', target: { repoId: 'folder-repo' } })
+    expect(prefetchWorktreeCreateBase).not.toHaveBeenCalled()
+  })
+
+  it('maps a runtime-owned active repo to its eligible project sibling', async () => {
+    const unrelatedRepo = { ...makeRepo(), id: 'unrelated-repo' }
+    const localSibling = {
+      ...makeRepo(),
+      id: 'local-sibling',
+      upstream: { owner: 'stablyai', repo: 'orca' }
+    }
+    const runtimeOwnedRepo = {
+      ...makeRepo(),
+      id: 'runtime-owned',
+      connectionId: 'runtime-ssh-workspace-1',
+      upstream: { owner: 'stablyai', repo: 'orca' }
+    }
+    const fetchLinearIssue = vi.fn(async () => makeLinearIssue())
+    await renderPalette({
+      activeRepoId: runtimeOwnedRepo.id,
+      repos: [unrelatedRepo, localSibling, runtimeOwnedRepo],
+      fetchLinearIssue
+    })
+    await act(async () => setCommandQuery?.(LINEAR_URL))
+    await flushEffects()
+
+    expect(fetchLinearIssue).toHaveBeenCalledWith(
+      'STA-4084',
+      'linear-workspace-1',
+      expect.objectContaining({
+        sourceContext: expect.objectContaining({
+          projectId: 'github:stablyai/orca',
+          repoId: 'local-sibling'
+        })
+      })
+    )
+  })
+
+  it('does not open the composer after the palette closes during lookup', async () => {
+    const issueLookup = deferredValue<LinearIssue | null>()
+    await renderPalette({ fetchLinearIssue: vi.fn(() => issueLookup.promise) })
+    await act(async () => setCommandQuery?.(LINEAR_URL))
+    await flushEffects()
+
+    await act(async () => {
+      testContainer.querySelector<HTMLElement>('[data-command-item="__create_worktree__"]')?.click()
+      useAppStore.getState().closeModal()
+    })
+    await act(async () => {
+      issueLookup.resolve(makeLinearIssue())
+      await issueLookup.promise
+    })
+    await flushEffects()
+
+    expect(useAppStore.getState().activeModal).toBe('none')
+  })
+
+  it('restores focus when a loading selection is abandoned', async () => {
+    const focusTarget = document.createElement('button')
+    document.body.appendChild(focusTarget)
+    focusTarget.focus()
+    const issueLookup = deferredValue<LinearIssue | null>()
+    await renderPalette({
+      activeWorktreeId: 'wt-alpha',
+      fetchLinearIssue: vi.fn(() => issueLookup.promise)
+    })
+    await act(async () => setCommandQuery?.(LINEAR_URL))
+    await flushEffects()
+    await act(async () => {
+      testContainer.querySelector<HTMLElement>('[data-command-item="__create_worktree__"]')?.click()
+    })
+    await act(async () => setCommandQuery?.('ordinary name'))
+    testContainer.querySelector<HTMLElement>('[data-command-input="true"]')?.focus()
+
+    await act(async () => requestCommandDialogClose?.())
+    await act(async () => {
+      issueLookup.resolve(makeLinearIssue())
+      await issueLookup.promise
+      await new Promise((resolve) => window.setTimeout(resolve, 50))
+    })
+
+    expect(document.activeElement).toBe(focusTarget)
+    expect(useAppStore.getState().activeModal).toBe('none')
+  })
+
+  it('awaits the live URL after replacing an already resolved URL', async () => {
+    const secondLookup = deferredValue<LinearIssue | null>()
+    await renderPalette({
+      fetchLinearIssue: vi.fn((identifier: string) =>
+        identifier === 'STA-4084' ? Promise.resolve(makeLinearIssue()) : secondLookup.promise
+      )
+    })
+    await act(async () => setCommandQuery?.(LINEAR_URL))
+    await flushEffects()
+    await act(async () =>
+      setCommandQuery?.('https://linear.app/stably/issue/STA-4099/current-second-issue')
+    )
+    await flushEffects()
+
+    await act(async () => {
+      testContainer.querySelector<HTMLElement>('[data-command-item="__create_worktree__"]')?.click()
+    })
+    expect(useAppStore.getState().activeModal).toBe('worktree-palette')
+
+    await act(async () => {
+      secondLookup.resolve(
+        makeLinearIssue({
+          id: 'issue-sta-4099',
+          identifier: 'STA-4099',
+          title: 'Current second issue',
+          url: 'https://linear.app/stably/issue/STA-4099/current-second-issue'
+        })
+      )
+      await secondLookup.promise
+    })
+    await flushEffects()
+
+    expect(useAppStore.getState().modalData).toMatchObject({
+      linkedWorkItem: { linearIdentifier: 'STA-4099', title: 'Current second issue' }
+    })
+  })
+
+  it('does not let a stale lookup replace a newer URL preview', async () => {
+    const firstLookup = deferredValue<LinearIssue | null>()
+    const secondLookup = deferredValue<LinearIssue | null>()
+    await renderPalette({
+      fetchLinearIssue: vi.fn((identifier: string) =>
+        identifier === 'STA-4084' ? firstLookup.promise : secondLookup.promise
+      )
+    })
+
+    vi.useFakeTimers()
+    await act(async () => setCommandQuery?.('https://linear.app/stably/issue/STA-4084/first'))
+    await flushEffects()
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(200)
+    })
+    expect(testContainer.textContent).toContain('Loading Linear issue…')
+
+    await act(async () => {
+      flushSync(() => setCommandQuery?.('https://linear.app/stably/issue/STA-4099/second'))
+      const currentPendingRow = testContainer.querySelector<HTMLElement>(
+        '[data-cmd-j-linear-issue-preview="true"]'
+      )
+      expect(currentPendingRow?.getAttribute('aria-label')).toBe(
+        'Create worktree from Linear issue STA-4099'
+      )
+      expect(currentPendingRow?.textContent).toContain('Create worktree from Linear issue')
+      expect(currentPendingRow?.textContent).not.toContain('Loading Linear issue…')
+    })
+    await flushEffects()
+
+    await act(async () => {
+      firstLookup.resolve(makeLinearIssue({ title: 'Stale first issue' }))
+      await firstLookup.promise
+    })
+    await flushEffects()
+
+    expect(testContainer.textContent).toContain('STA-4099')
+    expect(testContainer.textContent).not.toContain('Stale first issue')
+
+    await act(async () => {
+      secondLookup.resolve(
+        makeLinearIssue({
+          id: 'issue-sta-4099',
+          identifier: 'STA-4099',
+          title: 'Current second issue',
+          url: 'https://linear.app/stably/issue/STA-4099/current-second-issue'
+        })
+      )
+      await secondLookup.promise
+    })
+    await flushEffects()
+
+    expect(testContainer.textContent).toContain('Current second issue')
+    expect(testContainer.textContent).not.toContain('Stale first issue')
+    expect(getCommandValue()).toBe('__create_worktree__')
+  })
+
+  it('selects an existing Linear-linked worktree and keeps create underneath', async () => {
+    const linked = makeWorktree('wt-linked', 'Linked Linear workspace', {
+      linkedLinearIssue: 'STA-4084',
+      linkedLinearIssueOrganizationUrlKey: 'stably'
+    })
+    const other = makeWorktree('wt-other', 'Unrelated workspace')
+    await renderPalette({
+      fetchLinearIssue: vi.fn(async () => makeLinearIssue()),
+      worktreesByRepo: { 'repo-1': [other, linked] }
+    })
+
+    await act(async () => setCommandQuery?.(LINEAR_URL))
+    await flushEffects()
+
+    expect(getRenderedRowIds().filter(Boolean)).toEqual([
+      'worktree:wt-linked',
+      '__create_worktree__'
+    ])
+    expect(getCommandValue()).toBe('worktree:wt-linked')
+    expect(testContainer.querySelector('[data-cmd-j-linear-issue-preview="true"]')).not.toBeNull()
+  })
+
+  it('resolves a pasted GitHub issue URL and opens create with the linked issue', async () => {
+    const githubIssueUrl = 'https://github.com/stablyai/orca/issues/14198'
+    const githubIssue = {
+      id: 'issue-14198',
+      type: 'issue',
+      number: 14198,
+      title: 'Agent terminals disappearing randomly',
+      state: 'open',
+      url: githubIssueUrl,
+      labels: [],
+      updatedAt: '2026-08-12T12:00:00.000Z',
+      author: 'nwparker',
+      repoId: 'repo-1'
+    } satisfies GitHubWorkItem
+    lookupCmdJGitHubUrlWorkItem.mockResolvedValue(githubIssue)
+    await renderPalette({
+      prefetchWorktreeCreateBase: vi.fn(async () => {})
+    })
+
+    await act(async () => setCommandQuery?.(githubIssueUrl))
+    await flushEffects()
+
+    const preview = testContainer.querySelector<HTMLElement>('[data-cmd-j-task-url-preview="true"]')
+    expect(getRenderedRowIds().find(Boolean)).toBe('__create_worktree__')
+    expect(getCommandValue()).toBe('__create_worktree__')
+    expect(preview?.dataset.cmdJTaskUrlProvider).toBe('github')
+    expect(preview?.dataset.cmdJTaskUrlState).toBe('resolved')
+    expect(preview?.getAttribute('aria-label')).toBe(
+      'Create worktree from GitHub issue stablyai/orca#14198: Agent terminals disappearing randomly'
+    )
+    expect(preview?.textContent).toContain('#14198')
+    expect(preview?.textContent).toContain('Agent terminals disappearing randomly')
+    expect(lookupCmdJGitHubUrlWorkItem).toHaveBeenCalledWith(
+      expect.objectContaining({
+        link: expect.objectContaining({ type: 'issue', number: 14198 }),
+        repo: expect.objectContaining({ id: 'repo-1' })
+      })
+    )
+
+    await act(async () => {
+      preview?.click()
+      await Promise.resolve()
+    })
+    await flushEffects()
+
+    expect(useAppStore.getState().activeModal).toBe('new-workspace-composer')
+    expect(useAppStore.getState().modalData).toMatchObject({
+      prefilledName: 'agent-terminals-disappearing-randomly',
+      initialRepoId: 'repo-1',
+      telemetrySource: 'command_palette',
+      linkedWorkItem: {
+        provider: 'github',
+        type: 'issue',
+        number: 14198,
+        title: 'Agent terminals disappearing randomly',
+        url: githubIssueUrl,
+        repoId: 'repo-1'
+      },
+      initialGitHubWorkItem: githubIssue
+    })
+  })
+
+  it('previews a pasted GitHub pull URL', async () => {
+    await renderPalette({})
+    await act(async () => setCommandQuery?.('https://github.com/stablyai/orca/pull/12789'))
+    await flushEffects()
+
+    const preview = testContainer.querySelector<HTMLElement>('[data-cmd-j-task-url-preview="true"]')
+    expect(preview?.dataset.cmdJTaskUrlProvider).toBe('github')
+    expect(preview?.getAttribute('aria-label')).toBe(
+      'Create worktree from GitHub pull request stablyai/orca#12789'
+    )
+    expect(preview?.textContent).toContain('#12789')
+  })
+
+  it('selects an existing GitHub-linked worktree and keeps create underneath', async () => {
+    const linked = makeWorktree('wt-linked', 'Linked GitHub workspace', { linkedIssue: 14198 })
+    const other = makeWorktree('wt-other', 'Unrelated workspace', { linkedIssue: 7 })
+    await renderPalette({
+      repos: [{ ...makeRepo(), displayName: 'stablyai/orca' }],
+      worktreesByRepo: { 'repo-1': [other, linked] }
+    })
+
+    await act(async () => setCommandQuery?.('https://github.com/stablyai/orca/issues/14198'))
+    await flushEffects()
+
+    expect(getRenderedRowIds().filter(Boolean)).toEqual([
+      'worktree:wt-linked',
+      '__create_worktree__'
+    ])
+    expect(getCommandValue()).toBe('worktree:wt-linked')
+    expect(
+      testContainer.querySelector<HTMLElement>('[data-cmd-j-task-url-preview="true"]')?.dataset
+        .cmdJTaskUrlProvider
+    ).toBe('github')
+  })
+})
diff --git a/src/renderer/src/components/WorktreeJumpPalette.tsx b/src/renderer/src/components/WorktreeJumpPalette.tsx
index aaccdda3da7..f95bc25de5b 100644
--- a/src/renderer/src/components/WorktreeJumpPalette.tsx
+++ b/src/renderer/src/components/WorktreeJumpPalette.tsx
@@ -15,7 +15,6 @@ import {
   FileText,
   FolderTree,
   Globe,
-  Plus,
   Server,
   ServerOff,
   Smartphone,
@@ -175,23 +174,39 @@ import { resolvePaletteFocusRestoreTarget } from '@/components/cmd-j/palette-foc
 import { selectWorktreePaletteCacheInputs } from '@/components/cmd-j/worktree-palette-cache-inputs'
 import { getRepoHostIdentity } from '@/store/slices/repo-host-identity'
 import { buildPluginQuickActions } from '@/components/cmd-j/plugin-quick-actions'
+import { PaletteCreateWorktreeRow } from '@/components/cmd-j/PaletteCreateWorktreeRow'
 import { WorkspaceEmojiSuggestionPopover } from '@/components/workspace-emoji/WorkspaceEmojiSuggestionPopover'
 import { useWorkspaceEmojiShortcodeInput } from '@/components/workspace-emoji/useWorkspaceEmojiShortcodeInput'
 import { usePluginCommands } from '@/store/plugin-panels'
 import {
   getComposerEligibleRepos,
+  resolveComposerActiveRepoId,
   resolveComposerGitRepoId
 } from '@/lib/new-workspace-composer-repo'
+import { resolveWorkspaceCreationTarget } from '@/lib/project-host-workspace-target'
 import { lookupGitHubWorkItemForSource } from '@/lib/github-work-item-source-lookup'
+import { lookupCmdJGitHubUrlWorkItem } from '@/lib/cmd-j-github-url-lookup'
+import { buildLinearIssueLinkedWorkItem } from '@/lib/linear-linked-work-item'
+import { lookupLinearIssueUrl } from '@/lib/linear-issue-url-lookup'
+import {
+  getCmdJTaskUrlCreatePreview,
+  parseCmdJTaskSourceUrl,
+  withResolvedCmdJGitHubPreview
+} from '@/lib/worktree-palette-task-url-match'
 import type { SettingsNavTarget } from '@/lib/settings-navigation-types'
 import { getHostDisplayLabelOverrides } from '../../../shared/host-setting-overrides'
 import {
   getSettingsFocusedExecutionHostId,
   isRuntimeOwnedSshTargetId
 } from '../../../shared/execution-host'
-import type { TerminalTab, Worktree } from '../../../shared/types'
+import type { GitHubWorkItem, LinearIssue, TerminalTab, Worktree } from '../../../shared/types'
 import { isGitRepoKind } from '../../../shared/repo-kind'
-import { buildTaskSourceContextFromRepo } from '../../../shared/task-source-context'
+import {
+  buildTaskSourceContextFromRepo,
+  normalizeTaskSourceContext,
+  type TaskSourceContext
+} from '../../../shared/task-source-context'
+import { getLinearIssueWorkspaceName } from '../../../shared/workspace-name'
 import { translate } from '@/i18n/i18n'
 
 type WorktreePaletteItem = {
@@ -254,6 +269,22 @@ type CreateWorktreePaletteItem = {
   type: 'create-worktree'
 }
 
+type CmdJLinearIssuePreview = {
+  query: string
+  issue: LinearIssue | null
+  loading: boolean
+  initialRepoId: string | null
+  sourceContext: TaskSourceContext | null
+}
+
+type CmdJGitHubWorkItemPreview = {
+  query: string
+  item: GitHubWorkItem | null
+  loading: boolean
+  initialRepoId: string | null
+  sourceContext: TaskSourceContext | null
+}
+
 // Why: keep quick actions curated — Cmd+J is a fast intent surface, not a dump of every setup button.
 type PaletteItem =
   | WorktreePaletteItem
@@ -321,8 +352,8 @@ function shouldIncludeOpenTabInRecentSection({
   worktree: Worktree
   row: RecentWorkspaceTabRow
   paneSources: TabPaneInputSources
-  unreadTerminalTabs: Record<string, true | boolean | undefined>
-  unreadAgentCompletionPanes: Record<string, true | boolean | undefined>
+  unreadTerminalTabs: Record<string, boolean | undefined>
+  unreadAgentCompletionPanes: Record<string, boolean | undefined>
   now: number
 }): boolean {
   if (worktree.isArchived) {
@@ -374,14 +405,28 @@ function getComposerPrefetchRepoId(
   state: ReturnType<typeof useAppStore.getState>,
   initialRepoId?: string
 ): string | null {
+  const eligibleRepos = getComposerEligibleRepos(state.repos)
   return resolveComposerGitRepoId({
-    eligibleRepos: getComposerEligibleRepos(state.repos),
+    eligibleRepos,
     initialRepoId,
-    activeRepoId: state.activeRepoId,
+    activeRepoId: resolveComposerActiveRepoId(state.repos, eligibleRepos, state.activeRepoId),
     focusedHostScope: state.workspaceHostScope
   })
 }
 
+function getComposerDefaultWorkspaceTarget(state: ReturnType<typeof useAppStore.getState>) {
+  const eligibleRepos = getComposerEligibleRepos(state.repos)
+  const activeRepoId = resolveComposerActiveRepoId(state.repos, eligibleRepos, state.activeRepoId)
+  const resolution = resolveWorkspaceCreationTarget({
+    eligibleRepos,
+    projects: state.projects,
+    projectHostSetups: state.projectHostSetups,
+    activeRepoId,
+    focusedHostScope: state.workspaceHostScope
+  })
+  return resolution.status === 'ready' ? resolution.target : null
+}
+
 function appendPaletteListEntries(
   target: PaletteListEntry[],
   source: readonly PaletteItem[]
@@ -639,7 +684,29 @@ function WorktreeJumpPaletteContent({
 
   const [query, setQuery] = useState('')
   const deferredQuery = useDeferredValue(query)
+  const liveQueryRef = useRef(query)
+  liveQueryRef.current = query
+  const taskSourceUrl = useMemo(() => parseCmdJTaskSourceUrl(query), [query])
+  const linearIssueUrlIntent = taskSourceUrl?.provider === 'linear' ? taskSourceUrl.intent : null
+  const githubUrlLink = taskSourceUrl?.provider === 'github' ? taskSourceUrl.link : null
+  const parsedTaskUrlCreatePreview = useMemo(
+    () => (taskSourceUrl ? getCmdJTaskUrlCreatePreview(taskSourceUrl) : null),
+    [taskSourceUrl]
+  )
   const [selectedItemId, setSelectedItemId] = useState('')
+  const [linearIssuePreview, setLinearIssuePreview] = useState<CmdJLinearIssuePreview | null>(null)
+  const [githubWorkItemPreview, setGithubWorkItemPreview] =
+    useState<CmdJGitHubWorkItemPreview | null>(null)
+  const githubLookupGenerationRef = useRef(0)
+  const githubLookupRef = useRef<{
+    query: string
+    promise: Promise<CmdJGitHubWorkItemPreview>
+  } | null>(null)
+  const linearIssueLookupGenerationRef = useRef(0)
+  const linearIssueLookupRef = useRef<{
+    query: string
+    promise: Promise<CmdJLinearIssuePreview>
+  } | null>(null)
   // Why: the id cmdk auto-selected for the last committed list, so a late recent-order snapshot can
   // tell "nobody has moved the highlight yet" from "the user arrowed somewhere deliberately".
   const autoSelectedItemIdRef = useRef<string | null>(null)
@@ -743,7 +810,8 @@ function WorktreeJumpPaletteContent({
     [defaultHostId, projectGroups]
   )
 
-  const hasQuery = deferredQuery.trim().length > 0
+  const paletteSearchQuery = taskSourceUrl ? query.trim() : deferredQuery.trim()
+  const hasQuery = paletteSearchQuery.length > 0
   const isLoading = repos.length > 0 && Object.keys(worktreesByRepo).length === 0
 
   // Why: keep running-agent workspaces visible under "Hide sleeping" even when the live PTY is momentarily absent, matching sidebar. #7197
@@ -920,7 +988,7 @@ function WorktreeJumpPaletteContent({
     () =>
       searchWorktrees(
         sortedWorktrees,
-        deferredQuery.trim(),
+        paletteSearchQuery,
         repoMap,
         prCache,
         issueCache,
@@ -929,7 +997,7 @@ function WorktreeJumpPaletteContent({
       ),
     [
       sortedWorktrees,
-      deferredQuery,
+      paletteSearchQuery,
       repoMap,
       prCache,
       issueCache,
@@ -1480,23 +1548,37 @@ function WorktreeJumpPaletteContent({
   // Why: filtering via buildQuickActionContext() inside a memo with stable primitive deps
   // instead of calling it inline every render — a fresh context object as a useMemo dep
   // defeated the middleItems memo (new identity every keystroke).
+  const quickActionAvailabilityInputs = useMemo(
+    () => ({
+      activeView,
+      activeWorktreeId,
+      worktreesByRepo,
+      repos,
+      sshConnectionStates,
+      activeGroupIdByWorktree,
+      groupsByWorktree,
+      isLoading,
+      activeRuntimeEnvironmentId: settings?.activeRuntimeEnvironmentId,
+      runtimeStatusByEnvironmentId
+    }),
+    [
+      activeView,
+      activeWorktreeId,
+      worktreesByRepo,
+      repos,
+      sshConnectionStates,
+      activeGroupIdByWorktree,
+      groupsByWorktree,
+      isLoading,
+      settings?.activeRuntimeEnvironmentId,
+      runtimeStatusByEnvironmentId
+    ]
+  )
   const availableActionResults = useMemo(() => {
+    void quickActionAvailabilityInputs
     const ctx = buildQuickActionContext()
     return actionResults.filter((action) => action.isAvailable(ctx).available)
-  }, [
-    actionResults,
-    buildQuickActionContext,
-    // oxlint-disable-next-line react-hooks/exhaustive-deps -- these are the availability-determining primitives buildQuickActionContext reads from the store; listing them ensures the memo recomputes when availability actually changes, not on every render.
-    activeView,
-    activeWorktreeId,
-    worktreesByRepo,
-    repos,
-    sshConnectionStates,
-    activeGroupIdByWorktree,
-    groupsByWorktree,
-    isLoading,
-    settings?.activeRuntimeEnvironmentId
-  ])
+  }, [actionResults, buildQuickActionContext, quickActionAvailabilityInputs])
 
   const middleItems = useMemo<(SettingsPaletteItem | QuickActionPaletteItem)[]>(
     () =>
@@ -1599,7 +1681,10 @@ function WorktreeJumpPaletteContent({
   const digitShortcutModifiers =
     useShortcutKeyComboDetails(DIGIT_INDEX_ACTION_ID)[0]?.keys.slice(0, -1) ?? []
 
-  const { createWorktreeName, showCreateAction } = useMemo(
+  const {
+    createWorktreeName: deferredCreateWorktreeName,
+    showCreateAction: deferredShowCreateAction
+  } = useMemo(
     () =>
       getWorktreePaletteCreateActionState({
         canCreateWorktree,
@@ -1607,6 +1692,154 @@ function WorktreeJumpPaletteContent({
       }),
     [canCreateWorktree, deferredQuery]
   )
+  const createWorktreeName = taskSourceUrl ? query.trim() : deferredCreateWorktreeName
+  const showCreateAction = deferredShowCreateAction || taskSourceUrl !== null
+
+  // Why: arm the lookup before Enter can target the newly rendered Linear row.
+  useLayoutEffect(() => {
+    const generation = ++linearIssueLookupGenerationRef.current
+    linearIssueLookupRef.current = null
+    if (!visible || !linearIssueUrlIntent) {
+      setLinearIssuePreview(null)
+      return
+    }
+
+    const state = useAppStore.getState()
+    const workspaceTarget = getComposerDefaultWorkspaceTarget(state)
+    const initialRepoId = workspaceTarget?.repoId ?? null
+    const sourceContext = workspaceTarget
+      ? buildTaskSourceContextFromRepo({
+          provider: 'linear',
+          projectId: workspaceTarget.projectId,
+          repo: workspaceTarget.repo,
+          projectHostSetupId: workspaceTarget.projectHostSetupId
+        })
+      : null
+    const pendingPreview: CmdJLinearIssuePreview = {
+      query: createWorktreeName,
+      issue: null,
+      loading: true,
+      initialRepoId,
+      sourceContext
+    }
+    setLinearIssuePreview(pendingPreview)
+
+    const promise = lookupLinearIssueUrl({
+      intent: linearIssueUrlIntent,
+      knownStatus: state.linearStatus,
+      sourceContext,
+      fetchLinearIssue: state.fetchLinearIssue
+    })
+      .catch(() => null)
+      .then(
+        (issue): CmdJLinearIssuePreview => ({
+          ...pendingPreview,
+          issue,
+          loading: false
+        })
+      )
+    linearIssueLookupRef.current = { query: createWorktreeName, promise }
+    void promise.then((preview) => {
+      if (linearIssueLookupGenerationRef.current === generation) {
+        setLinearIssuePreview(preview)
+      }
+    })
+
+    return () => {
+      if (linearIssueLookupGenerationRef.current === generation) {
+        linearIssueLookupGenerationRef.current += 1
+      }
+    }
+  }, [createWorktreeName, linearIssueUrlIntent, visible])
+
+  useLayoutEffect(() => {
+    const generation = ++githubLookupGenerationRef.current
+    githubLookupRef.current = null
+    if (!visible || !githubUrlLink) {
+      setGithubWorkItemPreview(null)
+      return
+    }
+
+    const state = useAppStore.getState()
+    const workspaceTarget = getComposerDefaultWorkspaceTarget(state)
+    const initialRepoId = workspaceTarget?.repoId ?? null
+    const sourceContext = workspaceTarget
+      ? buildTaskSourceContextFromRepo({
+          provider: 'github',
+          projectId: workspaceTarget.projectId,
+          repo: workspaceTarget.repo,
+          projectHostSetupId: workspaceTarget.projectHostSetupId
+        })
+      : null
+    const pendingPreview: CmdJGitHubWorkItemPreview = {
+      query: createWorktreeName,
+      item: null,
+      loading: true,
+      initialRepoId,
+      sourceContext
+    }
+    setGithubWorkItemPreview(pendingPreview)
+
+    const promise = lookupCmdJGitHubUrlWorkItem({
+      link: githubUrlLink,
+      repo: workspaceTarget?.repo ?? null,
+      sourceContext
+    })
+      .catch(() => null)
+      .then(
+        (item): CmdJGitHubWorkItemPreview => ({
+          ...pendingPreview,
+          item: item ?? null,
+          loading: false
+        })
+      )
+    githubLookupRef.current = { query: createWorktreeName, promise }
+    void promise.then((preview) => {
+      if (githubLookupGenerationRef.current === generation) {
+        setGithubWorkItemPreview(preview)
+      }
+    })
+
+    return () => {
+      if (githubLookupGenerationRef.current === generation) {
+        githubLookupGenerationRef.current += 1
+      }
+    }
+  }, [createWorktreeName, githubUrlLink, visible])
+
+  const taskUrlCreatePreview = useMemo(() => {
+    if (!parsedTaskUrlCreatePreview) {
+      return null
+    }
+    const preview =
+      githubWorkItemPreview?.query === createWorktreeName ? githubWorkItemPreview : null
+    return withResolvedCmdJGitHubPreview(
+      parsedTaskUrlCreatePreview,
+      preview?.item?.title ?? null,
+      preview?.loading === true
+    )
+  }, [createWorktreeName, githubWorkItemPreview, parsedTaskUrlCreatePreview])
+
+  const currentGitHubWorkItemPreview =
+    githubWorkItemPreview?.query === createWorktreeName ? githubWorkItemPreview : null
+  const currentLinearIssuePreview =
+    linearIssuePreview?.query === createWorktreeName ? linearIssuePreview : null
+  const [linearLoadingFeedbackQuery, setLinearLoadingFeedbackQuery] = useState<string | null>(null)
+  useEffect(() => {
+    if (!currentLinearIssuePreview?.loading) {
+      setLinearLoadingFeedbackQuery(null)
+      return
+    }
+    setLinearLoadingFeedbackQuery(null)
+    const timer = window.setTimeout(
+      () => setLinearLoadingFeedbackQuery(currentLinearIssuePreview.query),
+      200
+    )
+    return () => window.clearTimeout(timer)
+  }, [currentLinearIssuePreview?.loading, currentLinearIssuePreview?.query])
+  const showLinearLoadingFeedback =
+    currentLinearIssuePreview?.loading === true &&
+    linearLoadingFeedbackQuery === currentLinearIssuePreview.query
 
   const listEntries = useMemo<PaletteListEntry[]>(() => {
     const entries: PaletteListEntry[] = []
@@ -1733,6 +1966,18 @@ function WorktreeJumpPaletteContent({
       }
     }
 
+    // Why: a pasted issue/PR URL is decisive. Show linked worktrees first so
+    // Enter jumps; keep create available underneath when the user wants a new one.
+    if (taskSourceUrl) {
+      if (visibleWorktreeItems.length > 0) {
+        pushWorktreeSection()
+      }
+      if (showCreateAction) {
+        entries.push({ id: CREATE_WORKTREE_ITEM_ID, type: 'create-worktree' })
+      }
+      return entries
+    }
+
     if (!hasQuery) {
       // Why: the recent section leads the empty-query view; nothing else in this branch is populated.
       pushOpenTabSection()
@@ -1809,7 +2054,14 @@ function WorktreeJumpPaletteContent({
       entries.push({ id: CREATE_WORKTREE_ITEM_ID, type: 'create-worktree' })
     }
     return entries
-  }, [hasQuery, openTabsLeadSections, paletteSections, showCreateAction, worktreeItems.length])
+  }, [
+    hasQuery,
+    openTabsLeadSections,
+    paletteSections,
+    showCreateAction,
+    taskSourceUrl,
+    worktreeItems.length
+  ])
 
   // Why derive from listEntries: multi-primary interleave must stay identical for
   // empty-state counts and keyboard selection — dual-path builders drifted before.
@@ -2248,12 +2500,15 @@ function WorktreeJumpPaletteContent({
   }, [handleSelectItem, hasQuery, query.length, visible])
 
   const handleCreateWorktree = useCallback(() => {
-    skipRestoreFocusRef.current = true
     const trimmed = createWorktreeName.trim()
+    if (liveQueryRef.current.trim() !== trimmed) {
+      return
+    }
     const ghLink = parseGitHubIssueOrPRLink(trimmed)
     const ghNumber = parseGitHubIssueOrPRNumber(trimmed)
 
     const openComposer = (data: Record<string, unknown>): void => {
+      skipRestoreFocusRef.current = true
       prefetchCreateWorkspaceBaseForComposer(
         typeof data.initialRepoId === 'string' ? data.initialRepoId : undefined
       )
@@ -2265,28 +2520,107 @@ function WorktreeJumpPaletteContent({
       )
     }
 
-    // Case 1: user pasted a GH issue/PR URL.
-    if (ghLink) {
-      const { number } = ghLink
-      const state = useAppStore.getState()
-
-      // Why: the existing-worktree check only needs the issue/PR number (repo-agnostic in worktree meta).
-      const matches = allWorktrees.filter(
-        (w) => !w.isArchived && (w.linkedIssue === number || w.linkedPR === number)
-      )
-      const activeMatch = matches.find((w) => w.repoId === state.activeRepoId) ?? matches[0]
-      if (activeMatch) {
-        closeModal()
-        // Why: #9939 — jumping to an already-open workspace must focus its own terminal.
-        const activation = activateAndRevealWorktree(activeMatch.id)
-        if (!queueWorkspaceActivationTerminalFocus(activeMatch.id, activation)) {
-          focusFallbackSurface()
+    if (linearIssueUrlIntent) {
+      const openLinearIssueComposer = async (): Promise<void> => {
+        const lookup = linearIssueLookupRef.current
+        const preview = currentLinearIssuePreview?.loading
+          ? await lookup?.promise
+          : (currentLinearIssuePreview ?? (await lookup?.promise))
+        if (
+          lookup?.query !== trimmed ||
+          linearIssueLookupRef.current !== lookup ||
+          liveQueryRef.current.trim() !== trimmed
+        ) {
+          return
         }
-        recordFeatureInteraction('cmd-j-workspace-open')
-        return
-      }
+        const composerData = preview?.issue
+          ? (() => {
+              const taskSourceContext = preview.sourceContext
+                ? normalizeTaskSourceContext({
+                    ...preview.sourceContext,
+                    providerIdentity: {
+                      provider: 'linear',
+                      workspaceId: preview.issue.workspaceId ?? null,
+                      workspaceName: preview.issue.workspaceName ?? null,
+                      teamId: preview.issue.team.id,
+                      teamKey: preview.issue.team.key
+                    },
+                    accountLabel: preview.issue.workspaceName ?? null
+                  })
+                : null
+              return {
+                prefilledName: getLinearIssueWorkspaceName(preview.issue),
+                linkedWorkItem: buildLinearIssueLinkedWorkItem(preview.issue),
+                ...(preview.initialRepoId ? { initialRepoId: preview.initialRepoId } : {}),
+                ...(taskSourceContext ? { taskSourceContext } : {})
+              }
+            })()
+          : preview?.initialRepoId
+            ? { prefilledName: trimmed, initialRepoId: preview.initialRepoId }
+            : { prefilledName: trimmed }
 
-      // Why: hand the raw URL to the composer so it runs Cmd+N cross-project detection; pre-resolving here silently linked to the wrong project.
+        if (useAppStore.getState().activeModal !== 'worktree-palette') {
+          return
+        }
+        openComposer(composerData)
+      }
+      void openLinearIssueComposer()
+      return
+    }
+
+    // Case 1: user pasted a GH/GitLab/Jira URL.
+    // Why: GitHub uses the in-flight Cmd+J preview so Enter attaches the issue/PR
+    // entity. GitLab/Jira still hand the raw URL to the composer. Linked worktrees
+    // are listed above this row — selecting one jumps there.
+    if (ghLink) {
+      const openGitHubUrlComposer = async (): Promise<void> => {
+        const lookup = githubLookupRef.current
+        const preview = currentGitHubWorkItemPreview?.loading
+          ? await lookup?.promise
+          : (currentGitHubWorkItemPreview ?? (await lookup?.promise))
+        if (
+          lookup?.query !== trimmed ||
+          githubLookupRef.current !== lookup ||
+          liveQueryRef.current.trim() !== trimmed
+        ) {
+          return
+        }
+        const item = preview?.item ?? null
+        const composerData = item
+          ? (() => {
+              const linkedWorkItem: LinkedWorkItemSummary = {
+                provider: 'github',
+                type: item.type,
+                number: item.number,
+                title: item.title,
+                url: item.url,
+                ...(item.repoId ? { repoId: item.repoId } : {})
+              }
+              return {
+                prefilledName:
+                  getLinkedWorkItemWorkspaceName(linkedWorkItem)?.seedName ??
+                  getLinkedWorkItemSuggestedName({ title: item.title }),
+                linkedWorkItem,
+                initialGitHubWorkItem: item,
+                ...(preview?.initialRepoId ? { initialRepoId: preview.initialRepoId } : {}),
+                ...(preview?.sourceContext ? { taskSourceContext: preview.sourceContext } : {})
+              }
+            })()
+          : preview?.initialRepoId
+            ? { prefilledName: trimmed, initialRepoId: preview.initialRepoId }
+            : { prefilledName: trimmed }
+
+        if (useAppStore.getState().activeModal !== 'worktree-palette') {
+          return
+        }
+        openComposer(composerData)
+      }
+      void openGitHubUrlComposer()
+      return
+    }
+
+    if (taskUrlCreatePreview) {
+      const state = useAppStore.getState()
       const eligibleRepos = state.repos.filter((r) => isGitRepoKind(r))
       const repoForLookup =
         (state.activeRepoId && eligibleRepos.find((r) => r.id === state.activeRepoId)) ||
@@ -2307,6 +2641,7 @@ function WorktreeJumpPaletteContent({
       )
       const activeMatch = matches.find((w) => w.repoId === state.activeRepoId) ?? matches[0]
       if (activeMatch) {
+        skipRestoreFocusRef.current = true
         closeModal()
         // Why: #9939 — jumping to an already-open workspace must focus its own terminal.
         const activation = activateAndRevealWorktree(activeMatch.id)
@@ -2333,6 +2668,7 @@ function WorktreeJumpPaletteContent({
       })
       const lookupToken = createLookupGuard.start()
       preserveCreateLookupOnCloseRef.current = true
+      skipRestoreFocusRef.current = true
       recordFeatureInteraction('cmd-j-create-workspace')
       closeModal()
       void lookupGitHubWorkItemForSource({
@@ -2386,8 +2722,12 @@ function WorktreeJumpPaletteContent({
     closeModal,
     createLookupGuard,
     createWorktreeName,
+    currentGitHubWorkItemPreview,
+    currentLinearIssuePreview,
     focusFallbackSurface,
+    linearIssueUrlIntent,
     openModal,
+    taskUrlCreatePreview,
     prefetchCreateWorkspaceBaseForComposer,
     recordFeatureInteraction,
     repoMap
@@ -2589,26 +2929,21 @@ function WorktreeJumpPaletteContent({
               }
 
               if (entry.type === 'create-worktree') {
+                const linearPreviewIssue = currentLinearIssuePreview?.issue ?? null
+                const linearPreviewLoading =
+                  linearIssueUrlIntent !== null && currentLinearIssuePreview?.loading !== false
                 return (
-                  <CommandItem
+                  <PaletteCreateWorktreeRow
                     key={entry.id}
-                    value={CREATE_WORKTREE_ITEM_ID}
-                    onSelect={handleCreateWorktree}
                     className={cn(JUMP_PALETTE_ITEM_CLASSNAME, 'mt-1 py-1.5')}
-                  >
-                    <div className="flex h-5 w-5 shrink-0 items-center justify-center rounded-full border border-dashed border-border/60 bg-muted/25 text-muted-foreground/70">
-                      <Plus size={13} aria-hidden="true" />
-                    </div>
-                    <div className="min-w-0 flex-1">
-                      <div className="text-[14px] font-semibold tracking-[-0.01em] text-foreground">
-                        {translate(
-                          'auto.components.WorktreeJumpPalette.95be6587d3',
-                          'Create worktree "{{value0}}"',
-                          { value0: createWorktreeName }
-                        )}
-                      </div>
-                    </div>
-                  </CommandItem>
+                    createWorktreeName={createWorktreeName}
+                    linearIdentifier={linearIssueUrlIntent?.identifier ?? null}
+                    linearIssue={linearPreviewIssue}
+                    linearPending={linearPreviewLoading}
+                    showLinearLoadingFeedback={showLinearLoadingFeedback}
+                    taskUrlPreview={taskUrlCreatePreview}
+                    onSelect={handleCreateWorktree}
+                  />
                 )
               }
 
diff --git a/src/renderer/src/components/automations/AutomationEditorDialog.tsx b/src/renderer/src/components/automations/AutomationEditorDialog.tsx
index 90eb5a9df47..6ac0c7bc66c 100644
--- a/src/renderer/src/components/automations/AutomationEditorDialog.tsx
+++ b/src/renderer/src/components/automations/AutomationEditorDialog.tsx
@@ -62,7 +62,7 @@ type AutomationEditorDialogProps = {
   canSave: boolean
   createTarget: AutomationCreateTarget
   repos: readonly Repo[]
-  projectHostSetups: ProjectHostSetup[]
+  projectHostSetups: readonly ProjectHostSetup[]
   automationYamlHooksByRepoKey: Record<string, OrcaHooks | null>
   getAutomationHooksCacheKey: (repoId: string) => string
   repoMap: Map<string, Repo>
diff --git a/src/renderer/src/components/automations/AutomationEditorDialogFooter.tsx b/src/renderer/src/components/automations/AutomationEditorDialogFooter.tsx
index ff5a67cc41b..160dac72d8b 100644
--- a/src/renderer/src/components/automations/AutomationEditorDialogFooter.tsx
+++ b/src/renderer/src/components/automations/AutomationEditorDialogFooter.tsx
@@ -32,7 +32,7 @@ type AutomationEditorDialogFooterProps = {
   isSaving: boolean
   canSave: boolean
   repos: readonly Repo[]
-  projectHostSetups: ProjectHostSetup[]
+  projectHostSetups: readonly ProjectHostSetup[]
   automationYamlHooksByRepoKey: Record<string, OrcaHooks | null>
   getAutomationHooksCacheKey: (repoId: string) => string
   repoMap: Map<string, Repo>
diff --git a/src/renderer/src/components/automations/AutomationListExternalRows.tsx b/src/renderer/src/components/automations/AutomationListExternalRows.tsx
index 25a9f137397..8cd712b09c2 100644
--- a/src/renderer/src/components/automations/AutomationListExternalRows.tsx
+++ b/src/renderer/src/components/automations/AutomationListExternalRows.tsx
@@ -36,6 +36,8 @@ import {
   AUTOMATIONS_TABLE_ROW_SELECTED_CLASS
 } from './automations-table-layout'
 import { isPortaledRowMenuClick, isRowActivationKey } from './automation-list-row-interaction'
+import { getExternalAutomationLastRunSnapshot } from './automation-list-last-run'
+import { AutomationListLastRunCell } from './AutomationListLastRunCell'
 import { AutomationListStatusCell } from './AutomationListStatusCell'
 import { translate } from '@/i18n/i18n'
 
@@ -85,6 +87,7 @@ export function AutomationListExternalRows({
         const nextRunLabel = entry.job.enabled
           ? formatExternalDate(entry.job.nextRunAt, relativeNow)
           : translate('auto.components.automations.AutomationsPage.paused', 'Paused')
+        const lastRunSnapshot = getExternalAutomationLastRunSnapshot(entry.job)
 
         return (
           <ContextMenu key={entry.key}>
@@ -124,6 +127,7 @@ export function AutomationListExternalRows({
                 <span className="min-w-0 truncate text-muted-foreground" title={nextRunLabel}>
                   {nextRunLabel}
                 </span>
+                <AutomationListLastRunCell snapshot={lastRunSnapshot} now={relativeNow} />
                 <AutomationListStatusCell enabled={entry.job.enabled} />
                 <span className="truncate text-center text-xs text-muted-foreground">
                   {providerLabel}
diff --git a/src/renderer/src/components/automations/AutomationListFilterMenu.tsx b/src/renderer/src/components/automations/AutomationListFilterMenu.tsx
new file mode 100644
index 00000000000..54efbc819a0
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListFilterMenu.tsx
@@ -0,0 +1,192 @@
+import React from 'react'
+import { ListFilter, X } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
+import { translate } from '@/i18n/i18n'
+import {
+  countAutomationListFilters,
+  EMPTY_AUTOMATION_LIST_FILTER,
+  type AutomationListFilter,
+  type AutomationListLastRunFilter,
+  type AutomationListStatusFilter
+} from './automation-list-view'
+
+function FilterPill({
+  label,
+  value,
+  onClear
+}: {
+  label: string
+  value: string
+  onClear: () => void
+}): React.JSX.Element {
+  return (
+    <span className="inline-flex h-6 items-center gap-1 rounded-full border border-border/60 bg-muted/50 pl-2 pr-1 text-[11px] text-foreground">
+      <span className="text-muted-foreground">{label}:</span>
+      <span className="max-w-[140px] truncate font-medium">{value}</span>
+      <button
+        type="button"
+        aria-label={translate(
+          'auto.components.automations.AutomationListFilterMenu.removeFilter',
+          'Remove {{value0}} filter',
+          { value0: label }
+        )}
+        onClick={onClear}
+        className="rounded-full p-0.5 text-muted-foreground transition hover:bg-muted hover:text-foreground"
+      >
+        <X className="size-3" />
+      </button>
+    </span>
+  )
+}
+
+export function AutomationListFilterPills({
+  filter,
+  onChange
+}: {
+  filter: AutomationListFilter
+  onChange: (next: AutomationListFilter) => void
+}): React.JSX.Element | null {
+  const statusLabel = translate('auto.components.automations.AutomationsPage.tableStatus', 'Status')
+  const lastRunLabel = translate(
+    'auto.components.automations.AutomationsPage.tableLastRun',
+    'Last run'
+  )
+  const statusValueLabel =
+    filter.status === 'enabled'
+      ? translate('auto.components.automations.AutomationDetail.eaa02014f8', 'Enabled')
+      : filter.status === 'paused'
+        ? translate('auto.components.automations.AutomationDetail.b09b2384fd', 'Paused')
+        : null
+  const lastRunValueLabel =
+    filter.lastRun === 'failed'
+      ? translate('auto.components.automations.AutomationListFilterMenu.failed', 'Failed')
+      : filter.lastRun === 'succeeded'
+        ? translate('auto.components.automations.AutomationListFilterMenu.succeeded', 'Succeeded')
+        : filter.lastRun === 'never'
+          ? translate('auto.components.automations.AutomationListFilterMenu.neverRan', 'Never ran')
+          : null
+  if (!statusValueLabel && !lastRunValueLabel) {
+    return null
+  }
+  return (
+    <>
+      {statusValueLabel ? (
+        <FilterPill
+          label={statusLabel}
+          value={statusValueLabel}
+          onClear={() => onChange({ ...filter, status: 'all' })}
+        />
+      ) : null}
+      {lastRunValueLabel ? (
+        <FilterPill
+          label={lastRunLabel}
+          value={lastRunValueLabel}
+          onClear={() => onChange({ ...filter, lastRun: 'all' })}
+        />
+      ) : null}
+    </>
+  )
+}
+
+export function AutomationListFilterMenu({
+  filter,
+  onChange
+}: {
+  filter: AutomationListFilter
+  onChange: (next: AutomationListFilter) => void
+}): React.JSX.Element {
+  const activeCount = countAutomationListFilters(filter)
+  const statusLabel = translate('auto.components.automations.AutomationsPage.tableStatus', 'Status')
+  const lastRunLabel = translate(
+    'auto.components.automations.AutomationsPage.tableLastRun',
+    'Last run'
+  )
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button
+          type="button"
+          variant="ghost"
+          size="sm"
+          className="h-8 shrink-0 gap-1.5 border border-border bg-background px-2.5 text-xs shadow-none hover:bg-muted/50 focus-visible:border-ring/70 focus-visible:ring-0"
+        >
+          <ListFilter className="size-3.5" />
+          {translate('auto.components.automations.AutomationListFilterMenu.filters', 'Filters')}
+          {activeCount > 0 ? (
+            <span className="rounded-full bg-foreground px-1.5 text-[10px] font-semibold leading-4 text-background">
+              {activeCount}
+            </span>
+          ) : null}
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="w-48">
+        <DropdownMenuLabel>{statusLabel}</DropdownMenuLabel>
+        <DropdownMenuRadioGroup
+          value={filter.status}
+          onValueChange={(value) =>
+            onChange({ ...filter, status: value as AutomationListStatusFilter })
+          }
+        >
+          <DropdownMenuRadioItem value="all">
+            {translate('auto.components.automations.AutomationListFilterMenu.all', 'All')}
+          </DropdownMenuRadioItem>
+          <DropdownMenuRadioItem value="enabled">
+            {translate('auto.components.automations.AutomationDetail.eaa02014f8', 'Enabled')}
+          </DropdownMenuRadioItem>
+          <DropdownMenuRadioItem value="paused">
+            {translate('auto.components.automations.AutomationDetail.b09b2384fd', 'Paused')}
+          </DropdownMenuRadioItem>
+        </DropdownMenuRadioGroup>
+        <DropdownMenuSeparator />
+        <DropdownMenuLabel>{lastRunLabel}</DropdownMenuLabel>
+        <DropdownMenuRadioGroup
+          value={filter.lastRun}
+          onValueChange={(value) =>
+            onChange({ ...filter, lastRun: value as AutomationListLastRunFilter })
+          }
+        >
+          <DropdownMenuRadioItem value="all">
+            {translate('auto.components.automations.AutomationListFilterMenu.all', 'All')}
+          </DropdownMenuRadioItem>
+          <DropdownMenuRadioItem value="failed">
+            {translate('auto.components.automations.AutomationListFilterMenu.failed', 'Failed')}
+          </DropdownMenuRadioItem>
+          <DropdownMenuRadioItem value="succeeded">
+            {translate(
+              'auto.components.automations.AutomationListFilterMenu.succeeded',
+              'Succeeded'
+            )}
+          </DropdownMenuRadioItem>
+          <DropdownMenuRadioItem value="never">
+            {translate(
+              'auto.components.automations.AutomationListFilterMenu.neverRan',
+              'Never ran'
+            )}
+          </DropdownMenuRadioItem>
+        </DropdownMenuRadioGroup>
+        {activeCount > 0 ? (
+          <>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem onSelect={() => onChange(EMPTY_AUTOMATION_LIST_FILTER)}>
+              {translate(
+                'auto.components.automations.AutomationListFilterMenu.clear',
+                'Clear filters'
+              )}
+            </DropdownMenuItem>
+          </>
+        ) : null}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationListLastRunCell.tsx b/src/renderer/src/components/automations/AutomationListLastRunCell.tsx
new file mode 100644
index 00000000000..6b5ddf42d9c
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListLastRunCell.tsx
@@ -0,0 +1,37 @@
+import React from 'react'
+import { cn } from '@/lib/utils'
+import {
+  formatAutomationLastRunCell,
+  type AutomationLastRunSnapshot
+} from './automation-list-last-run'
+
+export function AutomationListLastRunCell({
+  snapshot,
+  now
+}: {
+  snapshot: AutomationLastRunSnapshot
+  now: number
+}): React.JSX.Element {
+  const cell = formatAutomationLastRunCell(snapshot, now)
+  const failed = cell.tone === 'failed'
+  return (
+    <span
+      className={cn(
+        'inline-flex min-w-0 items-center gap-1.5 truncate',
+        failed ? 'text-destructive' : 'text-muted-foreground'
+      )}
+      title={cell.title}
+    >
+      {cell.tone !== 'never' ? (
+        <span
+          className={cn(
+            'size-1.5 shrink-0 rounded-full',
+            failed ? 'bg-destructive' : 'bg-muted-foreground/70'
+          )}
+          aria-hidden="true"
+        />
+      ) : null}
+      <span className="truncate">{cell.text}</span>
+    </span>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationListLocalRows.test.tsx b/src/renderer/src/components/automations/AutomationListLocalRows.test.tsx
index b6c41db55af..221e0e45142 100644
--- a/src/renderer/src/components/automations/AutomationListLocalRows.test.tsx
+++ b/src/renderer/src/components/automations/AutomationListLocalRows.test.tsx
@@ -6,11 +6,13 @@ import userEvent from '@testing-library/user-event'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type {
   Automation,
+  AutomationRun,
   ExternalAutomationJob,
   ExternalAutomationManager
 } from '../../../../shared/automations-types'
 import { AutomationListLocalRows } from './AutomationListLocalRows'
 import { AutomationListExternalRows } from './AutomationListExternalRows'
+import { indexLatestAutomationRuns } from './automation-list-last-run'
 
 // Why: Tooltip needs a provider in the app; stub so rows render standalone.
 vi.mock('@/components/ui/tooltip', () => ({
@@ -84,16 +86,42 @@ function makeExternalManager(): ExternalAutomationManager {
   }
 }
 
+function makeRun(overrides: Partial<AutomationRun> = {}): AutomationRun {
+  return {
+    id: 'run-1',
+    automationId: 'automation-1',
+    title: 'test',
+    scheduledFor: 1,
+    status: 'dispatch_failed',
+    trigger: 'scheduled',
+    workspaceId: 'worktree-1',
+    sessionKind: 'terminal',
+    chatSessionId: null,
+    terminalSessionId: null,
+    terminalPaneKey: null,
+    terminalPtyId: null,
+    outputSnapshot: null,
+    precheckResult: null,
+    usage: null,
+    error: 'boom',
+    startedAt: Date.now() - 8 * 60 * 60 * 1000,
+    dispatchedAt: Date.now() - 8 * 60 * 60 * 1000,
+    createdAt: Date.now() - 8 * 60 * 60 * 1000,
+    ...overrides
+  }
+}
+
 function renderLocalRows(handlers: {
   onSelect: (automationId: string) => void
   onDelete?: (automation: Automation) => void
+  runs?: AutomationRun[]
 }) {
   return render(
     <AutomationListLocalRows
       automations={[makeAutomation()]}
       selectedId={null}
       isSelectedLocal={true}
-      runs={[]}
+      lastRunByAutomationId={indexLatestAutomationRuns(handlers.runs ?? [])}
       relativeNow={Date.now()}
       repoMap={new Map()}
       worktreeMap={new Map()}
@@ -162,6 +190,11 @@ describe('Automation list row selection', () => {
     expect(onSelect).not.toHaveBeenCalled()
   })
 
+  it('shows last-run status and relative time', () => {
+    renderLocalRows({ onSelect: vi.fn(), runs: [makeRun()] })
+    expect(screen.getByText('Failed 8h ago')).toBeTruthy()
+  })
+
   it('still selects when the local row itself is clicked', async () => {
     const onSelect = vi.fn()
     const { container } = renderLocalRows({ onSelect })
diff --git a/src/renderer/src/components/automations/AutomationListLocalRows.tsx b/src/renderer/src/components/automations/AutomationListLocalRows.tsx
index 97ec2c7bb5f..93019241d63 100644
--- a/src/renderer/src/components/automations/AutomationListLocalRows.tsx
+++ b/src/renderer/src/components/automations/AutomationListLocalRows.tsx
@@ -31,6 +31,8 @@ import type { ProjectHostSetup, Repo, Worktree } from '../../../../shared/types'
 import type { RuntimeStatus } from '../../../../shared/runtime-types'
 import type { TaskSourceHostAvailability } from '../task-source-context-summary'
 import type { AutomationHostTarget } from './automation-host-client'
+import { getLocalAutomationLastRunSnapshot } from './automation-list-last-run'
+import { AutomationListLastRunCell } from './AutomationListLastRunCell'
 import { formatAutomationDateTimeWithRelative } from './automation-page-parts'
 import { getAutomationTargetAvailability } from './automation-target-availability'
 import { getAgentLabel } from './automation-draft-model'
@@ -48,7 +50,7 @@ export function AutomationListLocalRows({
   automations,
   selectedId,
   isSelectedLocal,
-  runs,
+  lastRunByAutomationId,
   relativeNow,
   repoMap,
   worktreeMap,
@@ -67,7 +69,7 @@ export function AutomationListLocalRows({
   automations: readonly Automation[]
   selectedId: string | null | undefined
   isSelectedLocal: boolean
-  runs: readonly AutomationRun[]
+  lastRunByAutomationId: ReadonlyMap<string, AutomationRun>
   relativeNow: number
   repoMap: ReadonlyMap<string, Repo>
   worktreeMap: ReadonlyMap<string, Worktree>
@@ -86,19 +88,6 @@ export function AutomationListLocalRows({
   onToggle: (automation: Automation) => void
   onDelete: (automation: Automation) => void
 }): React.JSX.Element {
-  // Why: one pass over runs instead of a full scan per rendered automation —
-  // this list re-renders on the relativeNow timer.
-  const lastRunByAutomationId = React.useMemo(() => {
-    const latest = new Map<string, AutomationRun>()
-    for (const run of runs) {
-      const existing = latest.get(run.automationId)
-      if (!existing || run.createdAt > existing.createdAt) {
-        latest.set(run.automationId, run)
-      }
-    }
-    return latest
-  }, [runs])
-
   return (
     <>
       {automations.map((automation) => {
@@ -132,6 +121,7 @@ export function AutomationListLocalRows({
           ? (hostLabelById.get(hostId) ?? getExecutionHostLabel(hostId))
           : getLocalExecutionHostLabel()
         const lastRun = lastRunByAutomationId.get(automation.id)
+        const lastRunSnapshot = getLocalAutomationLastRunSnapshot(automation, lastRun)
         const lastRunCost =
           lastRun?.usage?.status === 'known'
             ? formatAutomationCost(lastRun.usage.estimatedCostUsd)
@@ -213,6 +203,7 @@ export function AutomationListLocalRows({
                 <span className="min-w-0 truncate text-muted-foreground" title={nextRunLabel}>
                   {nextRunLabel}
                 </span>
+                <AutomationListLastRunCell snapshot={lastRunSnapshot} now={relativeNow} />
                 <AutomationListStatusCell enabled={automation.enabled} />
                 <Tooltip>
                   <TooltipTrigger asChild>
diff --git a/src/renderer/src/components/automations/AutomationListSortHeader.tsx b/src/renderer/src/components/automations/AutomationListSortHeader.tsx
new file mode 100644
index 00000000000..2c24a344328
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListSortHeader.tsx
@@ -0,0 +1,51 @@
+import React from 'react'
+import { ArrowDown, ArrowUp } from 'lucide-react'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import type { AutomationListSort, AutomationListSortField } from './automation-list-view'
+
+export function AutomationListSortHeader({
+  field,
+  label,
+  sort,
+  onSort
+}: {
+  field: AutomationListSortField
+  label: string
+  sort: AutomationListSort | null
+  onSort: (field: AutomationListSortField) => void
+}): React.JSX.Element {
+  const active = sort?.field === field
+  const direction = active ? sort.direction : null
+  // Why: one interpolated key per direction — word order and punctuation around
+  // the column name differ per language.
+  const sortedLabel =
+    direction === 'asc'
+      ? translate(
+          'auto.components.automations.AutomationListSortHeader.sortedAscending',
+          '{{value0}}, sorted ascending',
+          { value0: label }
+        )
+      : direction === 'desc'
+        ? translate(
+            'auto.components.automations.AutomationListSortHeader.sortedDescending',
+            '{{value0}}, sorted descending',
+            { value0: label }
+          )
+        : null
+  return (
+    <button
+      type="button"
+      onClick={() => onSort(field)}
+      aria-label={sortedLabel ?? label}
+      className={cn(
+        'flex min-w-0 items-center gap-1 rounded-sm text-left text-[11px] font-medium tracking-[0.08em] uppercase select-none hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring/50 focus-visible:outline-none',
+        active && 'text-foreground'
+      )}
+    >
+      <span className="truncate">{label}</span>
+      {direction === 'asc' ? <ArrowUp aria-hidden="true" className="size-3 shrink-0" /> : null}
+      {direction === 'desc' ? <ArrowDown aria-hidden="true" className="size-3 shrink-0" /> : null}
+    </button>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationListTableHeader.tsx b/src/renderer/src/components/automations/AutomationListTableHeader.tsx
new file mode 100644
index 00000000000..8adbd127727
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListTableHeader.tsx
@@ -0,0 +1,50 @@
+import React from 'react'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import {
+  AUTOMATIONS_TABLE_GRID_CLASS,
+  AUTOMATIONS_TABLE_HEADER_CLASS
+} from './automations-table-layout'
+import { AutomationListSortHeader } from './AutomationListSortHeader'
+import type { AutomationListSort, AutomationListSortField } from './automation-list-view'
+
+export function AutomationListTableHeader({
+  sort,
+  onSort
+}: {
+  sort: AutomationListSort | null
+  onSort: (field: AutomationListSortField) => void
+}): React.JSX.Element {
+  return (
+    <div className={cn(AUTOMATIONS_TABLE_GRID_CLASS, AUTOMATIONS_TABLE_HEADER_CLASS)}>
+      <AutomationListSortHeader
+        field="name"
+        label={translate('auto.components.automations.AutomationsPage.tableName', 'Name')}
+        sort={sort}
+        onSort={onSort}
+      />
+      <span>
+        {translate('auto.components.automations.AutomationDetail.18763ded26', 'Schedule')}
+      </span>
+      <span>
+        {translate('auto.components.automations.AutomationsPage.tableProject', 'Project')}
+      </span>
+      <span>
+        {translate('auto.components.automations.AutomationDetail.578ff46987', 'Next run')}
+      </span>
+      <AutomationListSortHeader
+        field="lastRun"
+        label={translate('auto.components.automations.AutomationsPage.tableLastRun', 'Last run')}
+        sort={sort}
+        onSort={onSort}
+      />
+      <span>{translate('auto.components.automations.AutomationsPage.tableStatus', 'Status')}</span>
+      <span className="text-center">
+        {translate('auto.components.automations.AutomationDetail.2df8970cd5', 'Agent')}
+      </span>
+      <span className="sr-only">
+        {translate('auto.components.automations.AutomationsPage.tableActions', 'Actions')}
+      </span>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationListToolbar.tsx b/src/renderer/src/components/automations/AutomationListToolbar.tsx
new file mode 100644
index 00000000000..31e55df9e04
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListToolbar.tsx
@@ -0,0 +1,86 @@
+import React from 'react'
+import { Plus, RefreshCw } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import { clampAutomationListSearchQueryInput } from './automation-list-search'
+import type { AutomationListFilter } from './automation-list-view'
+import { AutomationListFilterMenu, AutomationListFilterPills } from './AutomationListFilterMenu'
+import { AutomationListSearchField } from './AutomationListSearchField'
+import type { AutomationTemplate } from './automation-templates'
+
+export function AutomationListToolbar({
+  listSearchQuery,
+  isListSearchQueryTooLarge,
+  onListSearchQueryChange,
+  filter,
+  onFilterChange,
+  onRefresh,
+  isRefreshing,
+  openCreateDialog
+}: {
+  listSearchQuery: string
+  isListSearchQueryTooLarge: boolean
+  onListSearchQueryChange: (query: string) => void
+  filter: AutomationListFilter
+  onFilterChange: (filter: AutomationListFilter) => void
+  onRefresh: () => void
+  isRefreshing: boolean
+  openCreateDialog: (template?: AutomationTemplate) => void
+}): React.JSX.Element {
+  return (
+    <div className="flex shrink-0 items-start justify-between gap-3">
+      <div className="flex min-w-0 flex-wrap items-center gap-2">
+        <div className="flex shrink-0 items-center gap-2">
+          <AutomationListSearchField
+            query={listSearchQuery}
+            isTooLarge={isListSearchQueryTooLarge}
+            className="w-56"
+            onQueryChange={(query) =>
+              onListSearchQueryChange(clampAutomationListSearchQueryInput(query))
+            }
+            onClear={() => onListSearchQueryChange('')}
+          />
+          <AutomationListFilterMenu filter={filter} onChange={onFilterChange} />
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon-sm"
+                aria-label={translate(
+                  'auto.components.automations.AutomationsPage.19a6e30eae',
+                  'Refresh automations'
+                )}
+                onClick={onRefresh}
+                disabled={isRefreshing}
+                className="shrink-0 border border-border bg-background shadow-none hover:bg-muted/50"
+              >
+                <RefreshCw className={cn('size-4', isRefreshing && 'animate-spin')} />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent side="bottom" sideOffset={6}>
+              {translate(
+                'auto.components.automations.AutomationsPage.19a6e30eae',
+                'Refresh automations'
+              )}
+            </TooltipContent>
+          </Tooltip>
+        </div>
+        <AutomationListFilterPills filter={filter} onChange={onFilterChange} />
+      </div>
+      <Button
+        type="button"
+        variant="default"
+        size="sm"
+        className="shrink-0"
+        onClick={() => openCreateDialog()}
+        data-contextual-tour-target="automations-create"
+      >
+        <Plus className="size-4" />
+        {translate('auto.components.automations.AutomationsPage.newAutomation', 'New Automation')}
+      </Button>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationSchedulePicker.tsx b/src/renderer/src/components/automations/AutomationSchedulePicker.tsx
index 1f6f6d96ebf..b1dde548163 100644
--- a/src/renderer/src/components/automations/AutomationSchedulePicker.tsx
+++ b/src/renderer/src/components/automations/AutomationSchedulePicker.tsx
@@ -19,6 +19,7 @@ import {
 } from '../../../../shared/automation-schedules'
 import type { AutomationDraft } from './AutomationEditorDialog'
 import { AutomationCustomCronPanel } from './AutomationCustomCronPanel'
+import { AutomationTimeField, parseAutomationTime } from './AutomationTimeField'
 import { Field } from './automation-page-parts'
 import { translate } from '@/i18n/i18n'
 
@@ -49,49 +50,6 @@ const DAY_OPTIONS = [
   ['5', 'Friday'],
   ['6', 'Saturday']
 ] as const
-const HOUR_OPTIONS = Array.from({ length: 12 }, (_, index) => String(index + 1))
-const MINUTE_OPTIONS = Array.from({ length: 60 }, (_, index) => String(index))
-const PERIOD_OPTIONS = ['AM', 'PM'] as const
-
-function parseTime(value: string): { hour: number; minute: number } {
-  const [hour, minute] = value.split(':').map((part) => Number(part))
-  return {
-    hour: Number.isInteger(hour) && hour >= 0 && hour <= 23 ? hour : 9,
-    minute: Number.isInteger(minute) && minute >= 0 && minute <= 59 ? minute : 0
-  }
-}
-
-function formatTimeInput(hour: number, minute: number): string {
-  return `${String(hour).padStart(2, '0')}:${String(minute).padStart(2, '0')}`
-}
-
-function getClockParts(time: string): { hour12: number; minute: number; period: 'AM' | 'PM' } {
-  const { hour, minute } = parseTime(time)
-  return {
-    hour12: hour % 12 === 0 ? 12 : hour % 12,
-    minute,
-    period: hour >= 12 ? 'PM' : 'AM'
-  }
-}
-
-function updateTimePart(
-  time: string,
-  patch: { hour12?: number; minute?: number; period?: 'AM' | 'PM' }
-): string {
-  const current = getClockParts(time)
-  const nextHour12 = patch.hour12 ?? current.hour12
-  const nextPeriod = patch.period ?? current.period
-  const nextMinute = patch.minute ?? current.minute
-  const hour24 =
-    nextPeriod === 'AM'
-      ? nextHour12 === 12
-        ? 0
-        : nextHour12
-      : nextHour12 === 12
-        ? 12
-        : nextHour12 + 12
-  return formatTimeInput(hour24, nextMinute)
-}
 
 function getDraftScheduleLabel(draft: AutomationDraft): string {
   if (draft.preset === 'custom') {
@@ -99,7 +57,7 @@ function getDraftScheduleLabel(draft: AutomationDraft): string {
       ? formatAutomationSchedule(draft.customSchedule)
       : 'Advanced schedule'
   }
-  const { hour, minute } = parseTime(draft.time)
+  const { hour, minute } = parseAutomationTime(draft.time)
   return formatAutomationSchedule(
     buildAutomationRrule({
       preset: draft.preset,
@@ -118,7 +76,7 @@ function buildCustomScheduleSeed(draft: AutomationDraft): string {
   if (draft.preset === 'custom') {
     return ''
   }
-  const { hour, minute } = parseTime(draft.time)
+  const { hour, minute } = parseAutomationTime(draft.time)
   return buildAutomationCronSchedule({
     preset: draft.preset,
     hour,
@@ -151,13 +109,20 @@ export function AutomationSchedulePicker({
 }): React.JSX.Element {
   const [open, setOpen] = React.useState(false)
   const label = getDraftScheduleLabel(draft)
-  const clockParts = getClockParts(draft.time)
   const customSchedule = draft.customSchedule.trim()
   const customScheduleInvalid =
     draft.preset === 'custom' &&
     customSchedule.length > 0 &&
     !validateAdvancedSchedule(customSchedule)
 
+  const setTime = (time: string): void => {
+    onDraftChange((current) => ({
+      ...current,
+      time,
+      scheduleWarning: null
+    }))
+  }
+
   return (
     <Popover open={open} onOpenChange={setOpen}>
       <PopoverTrigger asChild>
@@ -198,7 +163,7 @@ export function AutomationSchedulePicker({
               <SelectTrigger className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}>
                 <SelectValue />
               </SelectTrigger>
-              <SelectContent>
+              <SelectContent position="popper">
                 {AUTOMATION_SCHEDULE_PRESET_OPTIONS.map(([value, fallbackLabel, labelKey]) => (
                   <SelectItem key={value} value={value}>
                     {getAutomationSchedulePresetLabel([value, fallbackLabel, labelKey])}
@@ -232,7 +197,7 @@ export function AutomationSchedulePicker({
                     <SelectTrigger className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}>
                       <SelectValue />
                     </SelectTrigger>
-                    <SelectContent>
+                    <SelectContent position="popper">
                       {DAY_OPTIONS.map(([value, dayLabel]) => (
                         <SelectItem key={value} value={value}>
                           {dayLabel}
@@ -249,27 +214,7 @@ export function AutomationSchedulePicker({
                     'Minute'
                   )}
                 >
-                  <Select
-                    value={String(clockParts.minute)}
-                    onValueChange={(minute) =>
-                      onDraftChange((current) => ({
-                        ...current,
-                        time: updateTimePart(current.time, { minute: Number(minute) }),
-                        scheduleWarning: null
-                      }))
-                    }
-                  >
-                    <SelectTrigger className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}>
-                      <SelectValue />
-                    </SelectTrigger>
-                    <SelectContent>
-                      {MINUTE_OPTIONS.map((minute) => (
-                        <SelectItem key={minute} value={minute}>
-                          :{minute.padStart(2, '0')}
-                        </SelectItem>
-                      ))}
-                    </SelectContent>
-                  </Select>
+                  <AutomationTimeField time={draft.time} mode="minute" onTimeChange={setTime} />
                 </Field>
               ) : (
                 <Field
@@ -278,89 +223,7 @@ export function AutomationSchedulePicker({
                     'Time'
                   )}
                 >
-                  <div className="grid grid-cols-[minmax(0,1fr)_minmax(0,1fr)_minmax(0,0.8fr)] gap-2">
-                    <Select
-                      value={String(clockParts.hour12)}
-                      onValueChange={(hour12) =>
-                        onDraftChange((current) => ({
-                          ...current,
-                          time: updateTimePart(current.time, { hour12: Number(hour12) }),
-                          scheduleWarning: null
-                        }))
-                      }
-                    >
-                      <SelectTrigger
-                        aria-label={translate(
-                          'auto.components.automations.AutomationSchedulePicker.6b802ecc99',
-                          'Hour'
-                        )}
-                        className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}
-                      >
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        {HOUR_OPTIONS.map((hour) => (
-                          <SelectItem key={hour} value={hour}>
-                            {hour}
-                          </SelectItem>
-                        ))}
-                      </SelectContent>
-                    </Select>
-                    <Select
-                      value={String(clockParts.minute)}
-                      onValueChange={(minute) =>
-                        onDraftChange((current) => ({
-                          ...current,
-                          time: updateTimePart(current.time, { minute: Number(minute) }),
-                          scheduleWarning: null
-                        }))
-                      }
-                    >
-                      <SelectTrigger
-                        aria-label={translate(
-                          'auto.components.automations.AutomationSchedulePicker.9e677335b0',
-                          'Minute'
-                        )}
-                        className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}
-                      >
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        {MINUTE_OPTIONS.map((minute) => (
-                          <SelectItem key={minute} value={minute}>
-                            {minute.padStart(2, '0')}
-                          </SelectItem>
-                        ))}
-                      </SelectContent>
-                    </Select>
-                    <Select
-                      value={clockParts.period}
-                      onValueChange={(period) =>
-                        onDraftChange((current) => ({
-                          ...current,
-                          time: updateTimePart(current.time, { period: period as 'AM' | 'PM' }),
-                          scheduleWarning: null
-                        }))
-                      }
-                    >
-                      <SelectTrigger
-                        aria-label={translate(
-                          'auto.components.automations.AutomationSchedulePicker.22359b186a',
-                          'AM or PM'
-                        )}
-                        className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}
-                      >
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        {PERIOD_OPTIONS.map((period) => (
-                          <SelectItem key={period} value={period}>
-                            {period}
-                          </SelectItem>
-                        ))}
-                      </SelectContent>
-                    </Select>
-                  </div>
+                  <AutomationTimeField time={draft.time} mode="time" onTimeChange={setTime} />
                 </Field>
               )}
             </>
diff --git a/src/renderer/src/components/automations/AutomationTimeField.test.tsx b/src/renderer/src/components/automations/AutomationTimeField.test.tsx
new file mode 100644
index 00000000000..d085d41385d
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationTimeField.test.tsx
@@ -0,0 +1,177 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+import React from 'react'
+import { cleanup, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  AutomationTimeField,
+  formatAutomationTimeFromClockParts,
+  formatAutomationTimeInput,
+  getAutomationClockParts,
+  parseAutomationTime,
+  resolveDigitCommit,
+  resolveDigitStep
+} from './AutomationTimeField'
+
+afterEach(() => {
+  cleanup()
+})
+
+describe('AutomationTimeField helpers', () => {
+  it('parses and formats 24h time values', () => {
+    expect(parseAutomationTime('09:15')).toEqual({ hour: 9, minute: 15 })
+    expect(parseAutomationTime('23:59')).toEqual({ hour: 23, minute: 59 })
+    expect(parseAutomationTime('bad')).toEqual({ hour: 9, minute: 0 })
+    expect(formatAutomationTimeInput(9, 5)).toBe('09:05')
+    expect(formatAutomationTimeInput(0, 0)).toBe('00:00')
+  })
+
+  it('converts between 12h clock parts and 24h storage', () => {
+    expect(getAutomationClockParts('00:05')).toEqual({ hour12: 12, minute: 5, period: 'AM' })
+    expect(getAutomationClockParts('13:30')).toEqual({ hour12: 1, minute: 30, period: 'PM' })
+    expect(getAutomationClockParts('12:00')).toEqual({ hour12: 12, minute: 0, period: 'PM' })
+    expect(formatAutomationTimeFromClockParts({ hour12: 12, minute: 5, period: 'AM' })).toBe(
+      '00:05'
+    )
+    expect(formatAutomationTimeFromClockParts({ hour12: 1, minute: 30, period: 'PM' })).toBe(
+      '13:30'
+    )
+    expect(formatAutomationTimeFromClockParts({ hour12: 12, minute: 0, period: 'PM' })).toBe(
+      '12:00'
+    )
+  })
+
+  it('resolves digit commits with empty → min and range clamp', () => {
+    expect(resolveDigitCommit('', 9, 1, 12)).toBe(1)
+    expect(resolveDigitCommit('', 15, 0, 59)).toBe(0)
+    expect(resolveDigitCommit('9', 1, 1, 12)).toBe(9)
+    expect(resolveDigitCommit('00', 9, 1, 12)).toBe(1)
+    expect(resolveDigitCommit('24', 9, 0, 23)).toBe(23)
+    expect(resolveDigitCommit('99', 15, 0, 59)).toBe(59)
+    expect(resolveDigitCommit('abc', 15, 0, 59)).toBe(15)
+  })
+
+  it('steps from in-progress text rather than only the committed value', () => {
+    expect(resolveDigitStep('1', 9, 1, 12, 1)).toBe(2)
+    // At the min bound, down wraps to max.
+    expect(resolveDigitStep('1', 9, 1, 12, -1)).toBe(12)
+    expect(resolveDigitStep('', 9, 1, 12, 1)).toBe(10)
+    expect(resolveDigitStep('12', 12, 1, 12, 1)).toBe(1)
+    expect(resolveDigitStep('0', 0, 0, 59, -1)).toBe(59)
+  })
+})
+
+function ControlledTimeField({
+  initialTime = '09:15',
+  mode = 'time',
+  onTimeChange
+}: {
+  initialTime?: string
+  mode?: 'time' | 'minute'
+  onTimeChange?: (time: string) => void
+}): React.JSX.Element {
+  const [time, setTime] = React.useState(initialTime)
+  return (
+    <AutomationTimeField
+      time={time}
+      mode={mode}
+      onTimeChange={(next) => {
+        setTime(next)
+        onTimeChange?.(next)
+      }}
+    />
+  )
+}
+
+describe('AutomationTimeField interactions', () => {
+  it('renders a unified 12h field with AM/PM instead of nested selects', () => {
+    render(<ControlledTimeField initialTime="13:15" />)
+
+    expect(screen.getByLabelText('Hour')).toHaveValue('1')
+    expect(screen.getByLabelText('Minute')).toHaveValue('15')
+    expect(screen.getByRole('button', { name: /^AM or PM:/ })).toHaveTextContent('PM')
+    expect(document.querySelector('[data-slot="select"]')).toBeNull()
+  })
+
+  it('names the selected period for assistive technology', async () => {
+    const user = userEvent.setup()
+    render(<ControlledTimeField initialTime="01:15" />)
+
+    const period = screen.getByRole('button', { name: 'AM or PM: AM' })
+    expect(period).toHaveAttribute('aria-pressed', 'false')
+
+    await user.click(period)
+
+    expect(screen.getByRole('button', { name: 'AM or PM: PM' })).toHaveAttribute(
+      'aria-pressed',
+      'true'
+    )
+  })
+
+  it('renders minute-only mode for hourly cadence', () => {
+    render(<ControlledTimeField mode="minute" />)
+
+    expect(screen.getByLabelText('Minute')).toHaveValue('15')
+    expect(screen.queryByLabelText('Hour')).toBeNull()
+    expect(screen.queryByRole('button', { name: /^AM or PM:/ })).toBeNull()
+  })
+
+  it('commits typed hour/minute and toggles AM/PM into 24h storage', async () => {
+    const user = userEvent.setup()
+    const onTimeChange = vi.fn()
+    render(<ControlledTimeField onTimeChange={onTimeChange} />)
+
+    const hour = screen.getByLabelText('Hour')
+    await user.clear(hour)
+    await user.type(hour, '11')
+    expect(onTimeChange).toHaveBeenLastCalledWith('11:15')
+
+    onTimeChange.mockClear()
+    const minute = screen.getByLabelText('Minute')
+    await user.clear(minute)
+    await user.type(minute, '05')
+    expect(onTimeChange).toHaveBeenLastCalledWith('11:05')
+
+    onTimeChange.mockClear()
+    await user.click(screen.getByRole('button', { name: /^AM or PM:/ }))
+    expect(onTimeChange).toHaveBeenLastCalledWith('23:05')
+    expect(screen.getByRole('button', { name: /^AM or PM:/ })).toHaveTextContent('PM')
+  })
+
+  it('treats empty blur as min and does not re-fire after 2-digit auto-commit', async () => {
+    const user = userEvent.setup()
+    const onTimeChange = vi.fn()
+    render(<ControlledTimeField onTimeChange={onTimeChange} />)
+
+    const minute = screen.getByLabelText('Minute')
+    await user.clear(minute)
+    await user.tab()
+    expect(onTimeChange).toHaveBeenLastCalledWith('09:00')
+    expect(minute).toHaveValue('00')
+
+    onTimeChange.mockClear()
+    await user.click(minute)
+    await user.clear(minute)
+    await user.type(minute, '30')
+    // 2-digit entry auto-commits once; blur must not emit a second identical update.
+    const callsAfterType = onTimeChange.mock.calls.length
+    expect(onTimeChange).toHaveBeenLastCalledWith('09:30')
+    await user.tab()
+    expect(onTimeChange.mock.calls.length).toBe(callsAfterType)
+  })
+
+  it('arrow-steps from the in-progress digit, not only the last commit', async () => {
+    const user = userEvent.setup()
+    const onTimeChange = vi.fn()
+    render(<ControlledTimeField onTimeChange={onTimeChange} />)
+
+    const hour = screen.getByLabelText('Hour')
+    await user.clear(hour)
+    await user.type(hour, '1')
+    onTimeChange.mockClear()
+    await user.keyboard('{ArrowUp}')
+    expect(onTimeChange).toHaveBeenLastCalledWith('02:15')
+  })
+})
diff --git a/src/renderer/src/components/automations/AutomationTimeField.tsx b/src/renderer/src/components/automations/AutomationTimeField.tsx
new file mode 100644
index 00000000000..9eb842c170a
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationTimeField.tsx
@@ -0,0 +1,261 @@
+import React from 'react'
+import { Clock } from 'lucide-react'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+
+const TIME_SHELL_CLASS =
+  'flex h-9 w-full items-center gap-2 rounded-md border border-input bg-input/30 px-3 shadow-xs transition-[color,box-shadow] focus-within:border-ring focus-within:ring-[3px] focus-within:ring-ring/50 dark:bg-input/30'
+
+export type AutomationClockParts = {
+  hour12: number
+  minute: number
+  period: 'AM' | 'PM'
+}
+
+export function parseAutomationTime(value: string): { hour: number; minute: number } {
+  const [hour, minute] = value.split(':').map((part) => Number(part))
+  return {
+    hour: Number.isInteger(hour) && hour >= 0 && hour <= 23 ? hour : 9,
+    minute: Number.isInteger(minute) && minute >= 0 && minute <= 59 ? minute : 0
+  }
+}
+
+export function formatAutomationTimeInput(hour: number, minute: number): string {
+  return `${String(hour).padStart(2, '0')}:${String(minute).padStart(2, '0')}`
+}
+
+export function getAutomationClockParts(time: string): AutomationClockParts {
+  const { hour, minute } = parseAutomationTime(time)
+  return {
+    hour12: hour % 12 === 0 ? 12 : hour % 12,
+    minute,
+    period: hour >= 12 ? 'PM' : 'AM'
+  }
+}
+
+export function formatAutomationTimeFromClockParts(parts: AutomationClockParts): string {
+  const hour24 =
+    parts.period === 'AM'
+      ? parts.hour12 === 12
+        ? 0
+        : parts.hour12
+      : parts.hour12 === 12
+        ? 12
+        : parts.hour12 + 12
+  return formatAutomationTimeInput(hour24, parts.minute)
+}
+
+export function clampInt(value: number, min: number, max: number): number {
+  if (!Number.isFinite(value)) {
+    return min
+  }
+  return Math.min(max, Math.max(min, Math.trunc(value)))
+}
+
+/** Resolve typed digits on commit. Empty → min (0 minutes / 1 hour). */
+export function resolveDigitCommit(raw: string, value: number, min: number, max: number): number {
+  const trimmed = raw.trim()
+  if (trimmed === '') {
+    return min
+  }
+  const parsed = Number(trimmed)
+  if (!Number.isFinite(parsed)) {
+    return value
+  }
+  return clampInt(parsed, min, max)
+}
+
+/** Step from in-progress text when present, otherwise the committed value. */
+export function resolveDigitStep(
+  raw: string,
+  value: number,
+  min: number,
+  max: number,
+  delta: 1 | -1
+): number {
+  const trimmed = raw.trim()
+  const parsed = trimmed === '' ? Number.NaN : Number(trimmed)
+  const base = Number.isFinite(parsed) ? clampInt(parsed, min, max) : value
+  if (delta === 1) {
+    return base >= max ? min : base + 1
+  }
+  return base <= min ? max : base - 1
+}
+
+function pad2(value: number): string {
+  return String(value).padStart(2, '0')
+}
+
+function TimeDigitInput({
+  value,
+  min,
+  max,
+  pad = true,
+  ariaLabel,
+  onCommit
+}: {
+  value: number
+  min: number
+  max: number
+  pad?: boolean
+  ariaLabel: string
+  onCommit: (value: number) => void
+}): React.JSX.Element {
+  const [text, setText] = React.useState(pad ? pad2(value) : String(value))
+  const [focused, setFocused] = React.useState(false)
+  // Track last emitted commit so blur after 2-digit auto-commit does not re-fire.
+  const lastCommittedRef = React.useRef(value)
+
+  // Keep the visible digits in sync while the field is not being edited.
+  React.useEffect(() => {
+    lastCommittedRef.current = value
+    if (!focused) {
+      setText(pad ? pad2(value) : String(value))
+    }
+  }, [focused, pad, value])
+
+  const commit = (raw: string): void => {
+    const next = resolveDigitCommit(raw, value, min, max)
+    setText(pad ? pad2(next) : String(next))
+    if (next === lastCommittedRef.current) {
+      return
+    }
+    lastCommittedRef.current = next
+    onCommit(next)
+  }
+
+  return (
+    <input
+      type="text"
+      inputMode="numeric"
+      autoComplete="off"
+      spellCheck={false}
+      aria-label={ariaLabel}
+      value={text}
+      onFocus={(event) => {
+        setFocused(true)
+        event.currentTarget.select()
+      }}
+      onBlur={() => {
+        setFocused(false)
+        commit(text)
+      }}
+      onChange={(event) => {
+        const next = event.target.value.replace(/\D/g, '').slice(0, 2)
+        setText(next)
+        if (next.length === 2) {
+          commit(next)
+        }
+      }}
+      onKeyDown={(event) => {
+        if (event.key === 'ArrowUp' || event.key === 'ArrowDown') {
+          event.preventDefault()
+          const next = resolveDigitStep(text, value, min, max, event.key === 'ArrowUp' ? 1 : -1)
+          setText(pad ? pad2(next) : String(next))
+          if (next !== lastCommittedRef.current) {
+            lastCommittedRef.current = next
+            onCommit(next)
+          }
+          return
+        }
+        if (event.key === 'Enter') {
+          event.currentTarget.blur()
+        }
+      }}
+      className="h-7 w-9 rounded-sm border-0 bg-transparent p-0 text-center text-sm tabular-nums tracking-wide text-foreground outline-none selection:bg-primary/20 focus-visible:bg-accent/50"
+    />
+  )
+}
+
+export function AutomationTimeField({
+  time,
+  mode = 'time',
+  onTimeChange,
+  className
+}: {
+  time: string
+  mode?: 'time' | 'minute'
+  onTimeChange: (time: string) => void
+  className?: string
+}): React.JSX.Element {
+  const clock = getAutomationClockParts(time)
+  // Why: digit commits close over the latest clock parts without stale hour/minute.
+  // Sync in an effect so render stays pure (React Doctor: no ref writes during render).
+  const clockRef = React.useRef(clock)
+  React.useEffect(() => {
+    clockRef.current = getAutomationClockParts(time)
+  }, [time])
+
+  const patchTime = (patch: Partial<AutomationClockParts>): void => {
+    // Why: apply the patch to the ref immediately so a second digit field commit
+    // in the same tick (or before the parent re-renders) cannot clobber the first.
+    const next = { ...clockRef.current, ...patch }
+    clockRef.current = next
+    onTimeChange(formatAutomationTimeFromClockParts(next))
+  }
+
+  return (
+    <div className={cn(TIME_SHELL_CLASS, className)}>
+      <Clock className="size-4 shrink-0 text-muted-foreground" aria-hidden />
+      <div className="flex min-w-0 flex-1 items-center gap-1.5">
+        {mode === 'time' ? (
+          <>
+            <TimeDigitInput
+              value={clock.hour12}
+              min={1}
+              max={12}
+              pad={false}
+              ariaLabel={translate(
+                'auto.components.automations.AutomationTimeField.aa593eb5e2',
+                'Hour'
+              )}
+              onCommit={(hour12) => patchTime({ hour12 })}
+            />
+            <span className="select-none text-sm text-muted-foreground" aria-hidden>
+              :
+            </span>
+            <TimeDigitInput
+              value={clock.minute}
+              min={0}
+              max={59}
+              ariaLabel={translate(
+                'auto.components.automations.AutomationTimeField.32a5e4e35e',
+                'Minute'
+              )}
+              onCommit={(minute) => patchTime({ minute })}
+            />
+            <button
+              type="button"
+              // The label overrides the visible text, so name the current period explicitly.
+              aria-label={`${translate(
+                'auto.components.automations.AutomationTimeField.39ec1383f6',
+                'AM or PM'
+              )}: ${clock.period}`}
+              aria-pressed={clock.period === 'PM'}
+              onClick={() => patchTime({ period: clock.period === 'AM' ? 'PM' : 'AM' })}
+              className="ml-auto h-7 shrink-0 rounded-sm px-2 text-sm font-medium text-muted-foreground outline-none transition-colors hover:bg-accent/60 hover:text-foreground focus-visible:bg-accent/60 focus-visible:text-foreground"
+            >
+              {clock.period}
+            </button>
+          </>
+        ) : (
+          <>
+            <span className="select-none text-sm text-muted-foreground" aria-hidden>
+              :
+            </span>
+            <TimeDigitInput
+              value={clock.minute}
+              min={0}
+              max={59}
+              ariaLabel={translate(
+                'auto.components.automations.AutomationTimeField.32a5e4e35e',
+                'Minute'
+              )}
+              onCommit={(minute) => patchTime({ minute })}
+            />
+          </>
+        )}
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationsListPanel.tsx b/src/renderer/src/components/automations/AutomationsListPanel.tsx
index e3dd2b3c090..a792839885c 100644
--- a/src/renderer/src/components/automations/AutomationsListPanel.tsx
+++ b/src/renderer/src/components/automations/AutomationsListPanel.tsx
@@ -1,7 +1,6 @@
 import React from 'react'
-import { Plus, RefreshCw } from 'lucide-react'
+import { Plus } from 'lucide-react'
 import { Button } from '@/components/ui/button'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { cn } from '@/lib/utils'
 import type {
   Automation,
@@ -15,29 +14,35 @@ import type { ProjectHostSetup, Repo, Worktree } from '../../../../shared/types'
 import type { RuntimeStatus } from '../../../../shared/runtime-types'
 import type { TaskSourceHostAvailability } from '../task-source-context-summary'
 import type { AutomationHostTarget } from './automation-host-client'
-import { clampAutomationListSearchQueryInput } from './automation-list-search'
 import type { AutomationPaneTab } from './automation-page-state'
-import { AutomationListSearchField } from './AutomationListSearchField'
 import { getAutomationTemplates, type AutomationTemplate } from './automation-templates'
-import type { ExternalAutomationListEntry } from './external-automation-list-entries'
 import { AutomationListLocalRows } from './AutomationListLocalRows'
 import { AutomationListExternalRows } from './AutomationListExternalRows'
-import {
-  AUTOMATIONS_TABLE_CONTAINER_CLASS,
-  AUTOMATIONS_TABLE_GRID_CLASS,
-  AUTOMATIONS_TABLE_HEADER_CLASS
-} from './automations-table-layout'
+import { AUTOMATIONS_TABLE_CONTAINER_CLASS } from './automations-table-layout'
 import { translate } from '@/i18n/i18n'
+import type {
+  AutomationListFilter,
+  AutomationListSort,
+  AutomationListSortField,
+  AutomationListViewItem
+} from './automation-list-view'
+import { AutomationListTableHeader } from './AutomationListTableHeader'
+import { AutomationListToolbar } from './AutomationListToolbar'
+import { indexLatestAutomationRuns } from './automation-list-last-run'
 
 type AutomationsListPanelProps = {
   hasListItems: boolean
   hasFilteredListItems: boolean
   isListSearchActive: boolean
+  isListFilterActive: boolean
   listSearchQuery: string
   isListSearchQueryTooLarge: boolean
   onListSearchQueryChange: (query: string) => void
-  filteredAutomations: readonly Automation[]
-  filteredExternalAutomationEntries: readonly ExternalAutomationListEntry[]
+  visibleItems: readonly AutomationListViewItem[]
+  listFilter: AutomationListFilter
+  onListFilterChange: (filter: AutomationListFilter) => void
+  listSort: AutomationListSort | null
+  onListSort: (field: AutomationListSortField) => void
   // Why: use explicit ids, not resolved detail selection (which falls back to the
   // first row) — list highlight should only mark a user-chosen row.
   selectedId: string | null
@@ -79,11 +84,15 @@ export function AutomationsListPanel({
   hasListItems,
   hasFilteredListItems,
   isListSearchActive,
+  isListFilterActive,
   listSearchQuery,
   isListSearchQueryTooLarge,
   onListSearchQueryChange,
-  filteredAutomations,
-  filteredExternalAutomationEntries,
+  visibleItems,
+  listFilter,
+  onListFilterChange,
+  listSort,
+  onListSort,
   selectedId,
   selectedExternalKey,
   runs,
@@ -111,6 +120,10 @@ export function AutomationsListPanel({
   onRefresh,
   isRefreshing
 }: AutomationsListPanelProps): React.JSX.Element {
+  // Why: one pass over runs for the whole list — each row renders its own
+  // component, so indexing per row would be O(rows × runs) on every re-render.
+  const lastRunByAutomationId = React.useMemo(() => indexLatestAutomationRuns(runs), [runs])
+
   return (
     <section
       className="flex min-h-0 flex-1 flex-col overflow-hidden px-3 pb-4 md:px-5"
@@ -154,57 +167,16 @@ export function AutomationsListPanel({
         </div>
       ) : (
         <div className="flex min-h-0 flex-1 flex-col gap-4">
-          <div className="flex shrink-0 items-center justify-between gap-3">
-            <div className="flex min-w-0 items-center gap-2">
-              <AutomationListSearchField
-                query={listSearchQuery}
-                isTooLarge={isListSearchQueryTooLarge}
-                className="w-full max-w-xs"
-                onQueryChange={(query) =>
-                  onListSearchQueryChange(clampAutomationListSearchQueryInput(query))
-                }
-                onClear={() => onListSearchQueryChange('')}
-              />
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <Button
-                    type="button"
-                    variant="ghost"
-                    size="icon-sm"
-                    aria-label={translate(
-                      'auto.components.automations.AutomationsPage.19a6e30eae',
-                      'Refresh automations'
-                    )}
-                    onClick={onRefresh}
-                    disabled={isRefreshing}
-                    className="shrink-0 border border-border bg-background shadow-none hover:bg-muted/50"
-                  >
-                    <RefreshCw className={cn('size-4', isRefreshing && 'animate-spin')} />
-                  </Button>
-                </TooltipTrigger>
-                <TooltipContent side="bottom" sideOffset={6}>
-                  {translate(
-                    'auto.components.automations.AutomationsPage.19a6e30eae',
-                    'Refresh automations'
-                  )}
-                </TooltipContent>
-              </Tooltip>
-            </div>
-            <Button
-              type="button"
-              variant="default"
-              size="sm"
-              className="shrink-0"
-              onClick={() => openCreateDialog()}
-              data-contextual-tour-target="automations-create"
-            >
-              <Plus className="size-4" />
-              {translate(
-                'auto.components.automations.AutomationsPage.newAutomation',
-                'New Automation'
-              )}
-            </Button>
-          </div>
+          <AutomationListToolbar
+            listSearchQuery={listSearchQuery}
+            isListSearchQueryTooLarge={isListSearchQueryTooLarge}
+            onListSearchQueryChange={onListSearchQueryChange}
+            filter={listFilter}
+            onFilterChange={onListFilterChange}
+            onRefresh={onRefresh}
+            isRefreshing={isRefreshing}
+            openCreateDialog={openCreateDialog}
+          />
 
           <div
             className={cn(
@@ -214,88 +186,61 @@ export function AutomationsListPanel({
           >
             {hasFilteredListItems ? (
               <>
-                <div className={cn(AUTOMATIONS_TABLE_GRID_CLASS, AUTOMATIONS_TABLE_HEADER_CLASS)}>
-                  <span>
-                    {translate('auto.components.automations.AutomationsPage.tableName', 'Name')}
-                  </span>
-                  <span>
-                    {translate(
-                      'auto.components.automations.AutomationDetail.18763ded26',
-                      'Schedule'
-                    )}
-                  </span>
-                  <span>
-                    {translate(
-                      'auto.components.automations.AutomationsPage.tableProject',
-                      'Project'
-                    )}
-                  </span>
-                  <span>
-                    {translate(
-                      'auto.components.automations.AutomationDetail.578ff46987',
-                      'Next run'
-                    )}
-                  </span>
-                  <span>
-                    {translate('auto.components.automations.AutomationsPage.tableStatus', 'Status')}
-                  </span>
-                  <span className="text-center">
-                    {translate('auto.components.automations.AutomationDetail.2df8970cd5', 'Agent')}
-                  </span>
-                  <span className="sr-only">
-                    {translate(
-                      'auto.components.automations.AutomationsPage.tableActions',
-                      'Actions'
-                    )}
-                  </span>
-                </div>
+                <AutomationListTableHeader sort={listSort} onSort={onListSort} />
                 <div className="divide-y divide-border/50">
-                  <AutomationListLocalRows
-                    automations={filteredAutomations}
-                    selectedId={selectedId}
-                    isSelectedLocal={selectedExternalKey === null}
-                    runs={runs}
-                    relativeNow={relativeNow}
-                    repoMap={repoMap}
-                    worktreeMap={worktreeMap}
-                    projectHostSetups={projectHostSetups}
-                    sshConnectionStates={sshConnectionStates}
-                    runtimeStatusByEnvironmentId={runtimeStatusByEnvironmentId}
-                    automationHostTarget={automationHostTarget}
-                    automationSourceHostAvailabilityById={automationSourceHostAvailabilityById}
-                    hostLabelById={hostLabelById}
-                    onSelect={(automationId) => {
-                      selectExternalKey(null)
-                      selectAutomationId(automationId)
-                      onOpenDetail()
-                    }}
-                    onRunNow={runNow}
-                    onEdit={openEditDialog}
-                    onToggle={toggleAutomation}
-                    onDelete={requestDeleteAutomation}
-                  />
-                  <AutomationListExternalRows
-                    entries={filteredExternalAutomationEntries}
-                    selectedExternalKey={selectedExternalKey}
-                    relativeNow={relativeNow}
-                    sshConnectionStates={sshConnectionStates}
-                    externalActionKey={externalActionKey}
-                    onSelect={(entryKey) => {
-                      selectAutomationId(null)
-                      selectExternalKey(entryKey)
-                      setActivePaneTab('overview')
-                      onOpenDetail()
-                    }}
-                    onRequestAction={requestExternalAction}
-                    onEdit={openEditExternalDialog}
-                  />
+                  {visibleItems.map((item) =>
+                    item.kind === 'local' ? (
+                      <AutomationListLocalRows
+                        key={item.id}
+                        automations={[item.automation]}
+                        selectedId={selectedId}
+                        isSelectedLocal={selectedExternalKey === null}
+                        lastRunByAutomationId={lastRunByAutomationId}
+                        relativeNow={relativeNow}
+                        repoMap={repoMap}
+                        worktreeMap={worktreeMap}
+                        projectHostSetups={projectHostSetups}
+                        sshConnectionStates={sshConnectionStates}
+                        runtimeStatusByEnvironmentId={runtimeStatusByEnvironmentId}
+                        automationHostTarget={automationHostTarget}
+                        automationSourceHostAvailabilityById={automationSourceHostAvailabilityById}
+                        hostLabelById={hostLabelById}
+                        onSelect={(automationId) => {
+                          selectExternalKey(null)
+                          selectAutomationId(automationId)
+                          onOpenDetail()
+                        }}
+                        onRunNow={runNow}
+                        onEdit={openEditDialog}
+                        onToggle={toggleAutomation}
+                        onDelete={requestDeleteAutomation}
+                      />
+                    ) : (
+                      <AutomationListExternalRows
+                        key={item.id}
+                        entries={[item.entry]}
+                        selectedExternalKey={selectedExternalKey}
+                        relativeNow={relativeNow}
+                        sshConnectionStates={sshConnectionStates}
+                        externalActionKey={externalActionKey}
+                        onSelect={(entryKey) => {
+                          selectAutomationId(null)
+                          selectExternalKey(entryKey)
+                          setActivePaneTab('overview')
+                          onOpenDetail()
+                        }}
+                        onRequestAction={requestExternalAction}
+                        onEdit={openEditExternalDialog}
+                      />
+                    )
+                  )}
                 </div>
               </>
-            ) : isListSearchActive ? (
+            ) : isListSearchActive || isListFilterActive ? (
               <div className="px-3 py-6 text-center text-sm text-muted-foreground">
                 {translate(
-                  'auto.components.automations.AutomationsPage.noSearchMatches',
-                  'No automations match your search.'
+                  'auto.components.automations.AutomationsPage.noListMatches',
+                  'No automations match.'
                 )}
               </div>
             ) : null}
diff --git a/src/renderer/src/components/automations/AutomationsPage.tsx b/src/renderer/src/components/automations/AutomationsPage.tsx
index 996f474a7c9..b1fe9c4988b 100644
--- a/src/renderer/src/components/automations/AutomationsPage.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.tsx
@@ -106,6 +106,13 @@ import {
 import { buildExternalAutomationListEntries } from './external-automation-list-entries'
 import { shouldCloseDetailForLostSelection } from './automation-detail-selection'
 import { useAutomationListSearch } from './use-automation-list-search'
+import { useAutomationListView } from './use-automation-list-view'
+import {
+  EMPTY_AUTOMATION_LIST_FILTER,
+  nextAutomationListSort,
+  type AutomationListFilter,
+  type AutomationListSort
+} from './automation-list-view'
 import { AutomationDeleteDialog, ExternalAutomationDeleteDialog } from './AutomationDeleteDialogs'
 import { AutomationsListPanel } from './AutomationsListPanel'
 import { AutomationsDetailPane } from './AutomationsDetailPane'
@@ -173,6 +180,8 @@ export default function AutomationsPage(): React.JSX.Element {
   const [isLoading, setIsLoading] = useState(true)
   const [isSaving, setIsSaving] = useState(false)
   const [listSearchQuery, setListSearchQuery] = useState('')
+  const [listFilter, setListFilter] = useState<AutomationListFilter>(EMPTY_AUTOMATION_LIST_FILTER)
+  const [listSort, setListSort] = useState<AutomationListSort | null>(null)
   const [createOpen, setCreateOpen] = useState(false)
   const [createTarget, setCreateTarget] = useState<AutomationCreateTarget>('orca')
   const [editingAutomationId, setEditingAutomationId] = useState<string | null>(null)
@@ -273,8 +282,7 @@ export default function AutomationsPage(): React.JSX.Element {
     isListSearchActive,
     filteredAutomations,
     filteredExternalAutomationEntries,
-    hasListItems,
-    hasFilteredListItems
+    hasListItems
   } = useAutomationListSearch({
     listSearchQuery,
     automations,
@@ -285,6 +293,21 @@ export default function AutomationsPage(): React.JSX.Element {
     selectAutomationId,
     selectExternalKey
   })
+  const {
+    visibleItems,
+    isListFilterActive,
+    hasVisibleListItems: hasFilteredListItems
+  } = useAutomationListView({
+    automations: filteredAutomations,
+    externalEntries: filteredExternalAutomationEntries,
+    runs,
+    filter: listFilter,
+    sort: listSort,
+    selectedId,
+    selectedExternalKey,
+    selectAutomationId,
+    selectExternalKey
+  })
 
   const selectedExternal =
     externalAutomationEntries.find((entry) => entry.key === selectedExternalKey) ??
@@ -355,7 +378,7 @@ export default function AutomationsPage(): React.JSX.Element {
   const loadAutomationYamlHooksForRepo = useCallback(
     async (repoId: string): Promise<OrcaHooks | null> => {
       const key = getAutomationHooksCacheKey(repoId)
-      if (Object.prototype.hasOwnProperty.call(automationYamlHooksByRepoKey, key)) {
+      if (Object.hasOwn(automationYamlHooksByRepoKey, key)) {
         return automationYamlHooksByRepoKey[key] ?? null
       }
       const existingPromise = automationHookCheckPromisesRef.current.get(key)
@@ -376,7 +399,7 @@ export default function AutomationsPage(): React.JSX.Element {
         return hooks
       }
       setAutomationYamlHooksByRepoKey((current) =>
-        Object.prototype.hasOwnProperty.call(current, key) ? current : { ...current, [key]: hooks }
+        Object.hasOwn(current, key) ? current : { ...current, [key]: hooks }
       )
       return hooks
     },
@@ -2015,11 +2038,15 @@ export default function AutomationsPage(): React.JSX.Element {
           hasListItems={hasListItems}
           hasFilteredListItems={hasFilteredListItems}
           isListSearchActive={isListSearchActive}
+          isListFilterActive={isListFilterActive}
           listSearchQuery={listSearchQuery}
           isListSearchQueryTooLarge={isListSearchQueryTooLarge}
           onListSearchQueryChange={setListSearchQuery}
-          filteredAutomations={filteredAutomations}
-          filteredExternalAutomationEntries={filteredExternalAutomationEntries}
+          visibleItems={visibleItems}
+          listFilter={listFilter}
+          onListFilterChange={setListFilter}
+          listSort={listSort}
+          onListSort={(field) => setListSort((current) => nextAutomationListSort(current, field))}
           selectedId={selectedId}
           selectedExternalKey={selectedExternalKey}
           runs={runs}
diff --git a/src/renderer/src/components/automations/AutomationsPageSkeleton.tsx b/src/renderer/src/components/automations/AutomationsPageSkeleton.tsx
index b8de919f1cc..172502b29a1 100644
--- a/src/renderer/src/components/automations/AutomationsPageSkeleton.tsx
+++ b/src/renderer/src/components/automations/AutomationsPageSkeleton.tsx
@@ -16,12 +16,14 @@ function TableRowSkeleton({
   scheduleWidthClass,
   projectWidthClass,
   nextWidthClass,
+  lastRunWidthClass,
   statusWidthClass
 }: {
   nameWidthClass: string
   scheduleWidthClass: string
   projectWidthClass: string
   nextWidthClass: string
+  lastRunWidthClass: string
   statusWidthClass: string
 }): React.JSX.Element {
   return (
@@ -30,6 +32,7 @@ function TableRowSkeleton({
       <SkeletonBar className={cn('h-3.5', scheduleWidthClass)} />
       <SkeletonBar className={cn('h-3.5', projectWidthClass)} />
       <SkeletonBar className={cn('h-3.5', nextWidthClass)} />
+      <SkeletonBar className={cn('h-3.5', lastRunWidthClass)} />
       <SkeletonBar className={cn('h-3.5', statusWidthClass)} />
       <SkeletonBar className="mx-auto size-4 rounded" />
       <SkeletonBar className="size-6 rounded-md" />
@@ -44,6 +47,7 @@ const TABLE_ROW_SKELETONS = [
     scheduleWidthClass: 'w-36',
     projectWidthClass: 'w-28',
     nextWidthClass: 'w-24',
+    lastRunWidthClass: 'w-20',
     statusWidthClass: 'w-16'
   },
   {
@@ -52,6 +56,7 @@ const TABLE_ROW_SKELETONS = [
     scheduleWidthClass: 'w-28',
     projectWidthClass: 'w-32',
     nextWidthClass: 'w-20',
+    lastRunWidthClass: 'w-24',
     statusWidthClass: 'w-14'
   },
   {
@@ -60,6 +65,7 @@ const TABLE_ROW_SKELETONS = [
     scheduleWidthClass: 'w-40',
     projectWidthClass: 'w-24',
     nextWidthClass: 'w-28',
+    lastRunWidthClass: 'w-16',
     statusWidthClass: 'w-16'
   },
   {
@@ -68,6 +74,7 @@ const TABLE_ROW_SKELETONS = [
     scheduleWidthClass: 'w-32',
     projectWidthClass: 'w-36',
     nextWidthClass: 'w-24',
+    lastRunWidthClass: 'w-20',
     statusWidthClass: 'w-14'
   },
   {
@@ -76,6 +83,7 @@ const TABLE_ROW_SKELETONS = [
     scheduleWidthClass: 'w-24',
     projectWidthClass: 'w-28',
     nextWidthClass: 'w-20',
+    lastRunWidthClass: 'w-24',
     statusWidthClass: 'w-16'
   },
   {
@@ -84,6 +92,7 @@ const TABLE_ROW_SKELETONS = [
     scheduleWidthClass: 'w-36',
     projectWidthClass: 'w-20',
     nextWidthClass: 'w-24',
+    lastRunWidthClass: 'w-16',
     statusWidthClass: 'w-14'
   }
 ] as const
@@ -100,7 +109,8 @@ export function AutomationsPageSkeleton(): React.JSX.Element {
     >
       <div className="flex shrink-0 items-center justify-between gap-3">
         <div className="flex min-w-0 items-center gap-2">
-          <SkeletonBar className="h-8 w-full max-w-xs rounded-md" />
+          <SkeletonBar className="h-8 w-56 shrink-0 rounded-md" />
+          <SkeletonBar className="h-8 w-20 shrink-0 rounded-md" />
           <SkeletonBar className="size-8 shrink-0 rounded-md" />
         </div>
         <SkeletonBar className="h-8 w-32 shrink-0 rounded-md" />
@@ -114,6 +124,7 @@ export function AutomationsPageSkeleton(): React.JSX.Element {
           <SkeletonBar className="h-2.5 w-14" />
           <SkeletonBar className="h-2.5 w-14" />
           <SkeletonBar className="h-2.5 w-16" />
+          <SkeletonBar className="h-2.5 w-16" />
           <SkeletonBar className="h-2.5 w-12" />
           <SkeletonBar className="mx-auto h-2.5 w-10" />
           <span />
diff --git a/src/renderer/src/components/automations/automation-draft-model.ts b/src/renderer/src/components/automations/automation-draft-model.ts
index 747bc615782..2abf4511388 100644
--- a/src/renderer/src/components/automations/automation-draft-model.ts
+++ b/src/renderer/src/components/automations/automation-draft-model.ts
@@ -17,8 +17,8 @@ export function formatTimeInput(hour: number, minute: number): string {
 export function parseDraftTime(time: string): { hour: number; minute: number } {
   const [rawHour, rawMinute] = time.split(':').map((part) => Number(part))
   return {
-    hour: Number.isFinite(rawHour) ? rawHour : 9,
-    minute: Number.isFinite(rawMinute) ? rawMinute : 0
+    hour: Number.isInteger(rawHour) && rawHour >= 0 && rawHour <= 23 ? rawHour : 9,
+    minute: Number.isInteger(rawMinute) && rawMinute >= 0 && rawMinute <= 59 ? rawMinute : 0
   }
 }
 
diff --git a/src/renderer/src/components/automations/automation-list-last-run.test.ts b/src/renderer/src/components/automations/automation-list-last-run.test.ts
new file mode 100644
index 00000000000..7eb54e123a5
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-list-last-run.test.ts
@@ -0,0 +1,168 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  Automation,
+  AutomationRun,
+  ExternalAutomationJob
+} from '../../../../shared/automations-types'
+import {
+  formatAutomationLastRunCell,
+  getExternalAutomationLastRunSnapshot,
+  getLocalAutomationLastRunSnapshot,
+  getToneForAutomationRunStatus,
+  indexLatestAutomationRuns
+} from './automation-list-last-run'
+
+function makeAutomation(overrides: Partial<Automation> = {}): Automation {
+  return {
+    id: 'automation-1',
+    name: 'Nightly',
+    prompt: 'run',
+    precheck: null,
+    agentId: 'codex',
+    projectId: 'repo-1',
+    executionTargetType: 'local',
+    executionTargetId: 'local',
+    schedulerOwner: 'local_host_service',
+    workspaceMode: 'existing',
+    workspaceId: 'worktree-1',
+    baseBranch: null,
+    reuseSession: false,
+    timezone: 'UTC',
+    rrule: 'FREQ=DAILY',
+    dtstart: 1,
+    enabled: true,
+    nextRunAt: 2,
+    missedRunPolicy: 'run_once_within_grace',
+    missedRunGraceMinutes: 720,
+    createdAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+function makeRun(overrides: Partial<AutomationRun> = {}): AutomationRun {
+  return {
+    id: 'run-1',
+    automationId: 'automation-1',
+    title: 'Nightly',
+    scheduledFor: 10,
+    status: 'completed',
+    trigger: 'scheduled',
+    workspaceId: 'worktree-1',
+    sessionKind: 'terminal',
+    chatSessionId: null,
+    terminalSessionId: null,
+    terminalPaneKey: null,
+    terminalPtyId: null,
+    outputSnapshot: null,
+    precheckResult: null,
+    usage: null,
+    error: null,
+    startedAt: 20,
+    dispatchedAt: 30,
+    createdAt: 10,
+    ...overrides
+  }
+}
+
+function makeJob(overrides: Partial<ExternalAutomationJob> = {}): ExternalAutomationJob {
+  return {
+    id: 'job-1',
+    managerId: 'manager-1',
+    provider: 'hermes',
+    name: 'Digest',
+    schedule: '0 9 * * 1-5',
+    rawSchedule: null,
+    enabled: true,
+    state: 'enabled',
+    prompt: null,
+    promptPreview: '',
+    nextRunAt: null,
+    lastRunAt: null,
+    lastStatus: null,
+    lastError: null,
+    workdir: null,
+    runCount: 0,
+    runs: [],
+    ...overrides
+  }
+}
+
+describe('automation-list-last-run', () => {
+  it('indexes the newest run per automation', () => {
+    const latest = indexLatestAutomationRuns([
+      makeRun({ id: 'old', createdAt: 10, dispatchedAt: 10 }),
+      makeRun({ id: 'new', createdAt: 50, dispatchedAt: 50, status: 'dispatch_failed' }),
+      makeRun({ id: 'other', automationId: 'automation-2', createdAt: 20 })
+    ])
+    expect(latest.get('automation-1')?.id).toBe('new')
+    expect(latest.get('automation-2')?.id).toBe('other')
+  })
+
+  it('classifies local run statuses', () => {
+    expect(getToneForAutomationRunStatus('dispatch_failed')).toBe('failed')
+    expect(getToneForAutomationRunStatus('completed')).toBe('succeeded')
+    expect(getToneForAutomationRunStatus('dispatched')).toBe('running')
+    expect(getToneForAutomationRunStatus('skipped_precheck')).toBe('skipped')
+  })
+
+  it('prefers the latest run over lastRunAt-only metadata', () => {
+    const snapshot = getLocalAutomationLastRunSnapshot(
+      makeAutomation({ lastRunAt: 5 }),
+      makeRun({ status: 'dispatch_failed', dispatchedAt: 40, createdAt: 40 })
+    )
+    expect(snapshot.tone).toBe('failed')
+    expect(snapshot.at).toBe(40)
+    expect(snapshot.statusLabel).toBe('Failed')
+  })
+
+  it('falls back to lastRunAt when no run history exists', () => {
+    const snapshot = getLocalAutomationLastRunSnapshot(makeAutomation({ lastRunAt: 99 }), undefined)
+    expect(snapshot).toEqual({ at: 99, tone: 'unknown', statusLabel: '' })
+  })
+
+  it('treats missing local history as never run', () => {
+    expect(getLocalAutomationLastRunSnapshot(makeAutomation(), undefined).tone).toBe('never')
+  })
+
+  it('classifies external last-run status and errors', () => {
+    expect(
+      getExternalAutomationLastRunSnapshot(
+        makeJob({ lastRunAt: '2026-08-12T01:00:00Z', lastStatus: 'failed' })
+      )
+    ).toMatchObject({ tone: 'failed', statusLabel: 'Failed' })
+    expect(
+      getExternalAutomationLastRunSnapshot(
+        makeJob({ lastRunAt: '2026-08-12T01:00:00Z', lastStatus: 'ok' })
+      )
+    ).toMatchObject({ tone: 'succeeded', statusLabel: 'Done' })
+    expect(
+      getExternalAutomationLastRunSnapshot(makeJob({ lastError: 'boom', lastStatus: null }))
+    ).toMatchObject({ tone: 'failed', statusLabel: 'Failed' })
+    expect(
+      getExternalAutomationLastRunSnapshot(
+        makeJob({ lastRunAt: '2026-08-12T01:00:00Z', lastStatus: 'ok', lastError: 'stale' })
+      )
+    ).toMatchObject({ tone: 'succeeded', statusLabel: 'Done' })
+    expect(getExternalAutomationLastRunSnapshot(makeJob()).tone).toBe('never')
+  })
+
+  it('formats last-run cells as status plus relative time', () => {
+    const now = Date.parse('2026-08-12T10:00:00Z')
+    const failed = formatAutomationLastRunCell(
+      { at: now - 8 * 60 * 60 * 1000, tone: 'failed', statusLabel: 'Failed' },
+      now
+    )
+    expect(failed.text).toBe('Failed 8h ago')
+    expect(failed.tone).toBe('failed')
+    expect(
+      formatAutomationLastRunCell({ at: null, tone: 'never', statusLabel: '' }, now).text
+    ).toBe('Never')
+    const failedNoTime = formatAutomationLastRunCell(
+      { at: null, tone: 'failed', statusLabel: 'Failed' },
+      now
+    )
+    expect(failedNoTime.text).toBe('Failed')
+    expect(failedNoTime.tone).toBe('failed')
+  })
+})
diff --git a/src/renderer/src/components/automations/automation-list-last-run.ts b/src/renderer/src/components/automations/automation-list-last-run.ts
new file mode 100644
index 00000000000..7d5127337fa
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-list-last-run.ts
@@ -0,0 +1,152 @@
+import { translate } from '@/i18n/i18n'
+import type {
+  Automation,
+  AutomationRun,
+  AutomationRunStatus,
+  ExternalAutomationJob
+} from '../../../../shared/automations-types'
+import {
+  formatAutomationDateTime,
+  formatAutomationRelativeTime,
+  getAutomationRunStatusLabel
+} from './automation-page-parts'
+
+export type AutomationLastRunTone =
+  | 'failed'
+  | 'succeeded'
+  | 'running'
+  | 'skipped'
+  | 'never'
+  | 'unknown'
+
+export type AutomationLastRunSnapshot = {
+  at: number | null
+  tone: AutomationLastRunTone
+  statusLabel: string
+}
+
+const EXTERNAL_FAILED_STATUSES = new Set(['failed', 'fail', 'error', 'dispatch_failed'])
+const EXTERNAL_SUCCEEDED_STATUSES = new Set([
+  'ok',
+  'completed',
+  'success',
+  'succeeded',
+  'done',
+  'healthy'
+])
+
+export function indexLatestAutomationRuns(
+  runs: readonly AutomationRun[]
+): ReadonlyMap<string, AutomationRun> {
+  const latest = new Map<string, AutomationRun>()
+  for (const run of runs) {
+    const existing = latest.get(run.automationId)
+    if (!existing || run.createdAt > existing.createdAt) {
+      latest.set(run.automationId, run)
+    }
+  }
+  return latest
+}
+
+export function getAutomationRunLastRunAt(run: AutomationRun): number {
+  return run.dispatchedAt ?? run.startedAt ?? run.createdAt
+}
+
+export function getToneForAutomationRunStatus(status: AutomationRunStatus): AutomationLastRunTone {
+  if (status === 'dispatch_failed') {
+    return 'failed'
+  }
+  if (status === 'completed') {
+    return 'succeeded'
+  }
+  if (status === 'pending' || status === 'dispatching' || status === 'dispatched') {
+    return 'running'
+  }
+  if (status.startsWith('skipped')) {
+    return 'skipped'
+  }
+  return 'unknown'
+}
+
+export function getLocalAutomationLastRunSnapshot(
+  automation: Automation,
+  lastRun: AutomationRun | undefined
+): AutomationLastRunSnapshot {
+  if (lastRun) {
+    return {
+      at: getAutomationRunLastRunAt(lastRun),
+      tone: getToneForAutomationRunStatus(lastRun.status),
+      statusLabel: getAutomationRunStatusLabel(lastRun.status)
+    }
+  }
+  if (automation.lastRunAt) {
+    return {
+      at: automation.lastRunAt,
+      tone: 'unknown',
+      statusLabel: ''
+    }
+  }
+  return { at: null, tone: 'never', statusLabel: '' }
+}
+
+function parseExternalLastRunAt(value: string | null): number | null {
+  if (!value) {
+    return null
+  }
+  const parsed = Date.parse(value)
+  return Number.isFinite(parsed) ? parsed : null
+}
+
+export function getExternalAutomationLastRunSnapshot(
+  job: ExternalAutomationJob
+): AutomationLastRunSnapshot {
+  const at = parseExternalLastRunAt(job.lastRunAt)
+  const raw = job.lastStatus?.trim() ?? ''
+  const normalized = raw.toLowerCase()
+  if (!at && !raw && !job.lastError) {
+    return { at: null, tone: 'never', statusLabel: '' }
+  }
+  if (EXTERNAL_SUCCEEDED_STATUSES.has(normalized)) {
+    return {
+      at,
+      tone: 'succeeded',
+      statusLabel: translate('auto.components.automations.automation.list.last.run.done', 'Done')
+    }
+  }
+  if (EXTERNAL_FAILED_STATUSES.has(normalized) || Boolean(job.lastError)) {
+    return {
+      at,
+      tone: 'failed',
+      statusLabel: translate(
+        'auto.components.automations.automation.list.last.run.failed',
+        'Failed'
+      )
+    }
+  }
+  if (raw) {
+    return { at, tone: 'unknown', statusLabel: raw }
+  }
+  return { at, tone: 'unknown', statusLabel: '' }
+}
+
+export function formatAutomationLastRunCell(
+  snapshot: AutomationLastRunSnapshot,
+  now: number
+): { text: string; title: string; tone: AutomationLastRunTone } {
+  const status = snapshot.statusLabel.trim()
+  if (snapshot.tone === 'never') {
+    const never = formatAutomationDateTime(null)
+    return { text: never, title: never, tone: 'never' }
+  }
+  if (snapshot.at == null) {
+    return { text: status || formatAutomationDateTime(null), title: status, tone: snapshot.tone }
+  }
+  const relative = formatAutomationRelativeTime(snapshot.at, now)
+  const absolute = formatAutomationDateTime(snapshot.at)
+  const text = status && relative ? `${status} ${relative}` : status || relative || absolute
+  return {
+    text,
+    title: status ? `${status} · ${absolute}` : absolute,
+    tone: snapshot.tone
+  }
+}
diff --git a/src/renderer/src/components/automations/automation-list-view.test.ts b/src/renderer/src/components/automations/automation-list-view.test.ts
new file mode 100644
index 00000000000..01a0cfa7799
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-list-view.test.ts
@@ -0,0 +1,167 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  Automation,
+  AutomationRun,
+  ExternalAutomationJob,
+  ExternalAutomationManager
+} from '../../../../shared/automations-types'
+import {
+  applyAutomationListView,
+  countAutomationListFilters,
+  isAutomationListFilterActive,
+  nextAutomationListSort
+} from './automation-list-view'
+import type { ExternalAutomationListEntry } from './external-automation-list-entries'
+
+function makeAutomation(overrides: Partial<Automation> = {}): Automation {
+  return {
+    id: 'automation-1',
+    name: 'Zebra job',
+    prompt: 'run',
+    precheck: null,
+    agentId: 'codex',
+    projectId: 'repo-1',
+    executionTargetType: 'local',
+    executionTargetId: 'local',
+    schedulerOwner: 'local_host_service',
+    workspaceMode: 'existing',
+    workspaceId: 'worktree-1',
+    baseBranch: null,
+    reuseSession: false,
+    timezone: 'UTC',
+    rrule: 'FREQ=DAILY',
+    dtstart: 1,
+    enabled: true,
+    nextRunAt: 2,
+    missedRunPolicy: 'run_once_within_grace',
+    missedRunGraceMinutes: 720,
+    createdAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+function makeRun(overrides: Partial<AutomationRun> = {}): AutomationRun {
+  return {
+    id: 'run-1',
+    automationId: 'automation-1',
+    title: 'Zebra job',
+    scheduledFor: 10,
+    status: 'completed',
+    trigger: 'scheduled',
+    workspaceId: 'worktree-1',
+    sessionKind: 'terminal',
+    chatSessionId: null,
+    terminalSessionId: null,
+    terminalPaneKey: null,
+    terminalPtyId: null,
+    outputSnapshot: null,
+    precheckResult: null,
+    usage: null,
+    error: null,
+    startedAt: 20,
+    dispatchedAt: 30,
+    createdAt: 10,
+    ...overrides
+  }
+}
+
+function makeExternalEntry(
+  overrides: Partial<ExternalAutomationJob> = {}
+): ExternalAutomationListEntry {
+  const manager: ExternalAutomationManager = {
+    id: 'manager-1',
+    provider: 'hermes',
+    label: 'Local Hermes',
+    targetLabel: 'Local',
+    target: { type: 'local' },
+    status: 'available',
+    error: null,
+    canManage: true,
+    jobs: []
+  }
+  const job: ExternalAutomationJob = {
+    id: 'job-1',
+    managerId: manager.id,
+    provider: 'hermes',
+    name: 'Alpha digest',
+    schedule: '0 9 * * 1-5',
+    rawSchedule: null,
+    enabled: true,
+    state: 'enabled',
+    prompt: null,
+    promptPreview: '',
+    nextRunAt: null,
+    lastRunAt: '2026-08-12T01:00:00Z',
+    lastStatus: 'failed',
+    lastError: null,
+    workdir: null,
+    runCount: 1,
+    runs: [],
+    ...overrides
+  }
+  return { key: `${manager.id}:${job.id}`, manager, job }
+}
+
+describe('automation-list-view', () => {
+  it('counts and detects active filters', () => {
+    expect(isAutomationListFilterActive({ status: 'all', lastRun: 'all' })).toBe(false)
+    expect(isAutomationListFilterActive({ status: 'paused', lastRun: 'all' })).toBe(true)
+    expect(countAutomationListFilters({ status: 'paused', lastRun: 'failed' })).toBe(2)
+  })
+
+  it('toggles sort direction and defaults last run to newest first', () => {
+    expect(nextAutomationListSort(null, 'name')).toEqual({ field: 'name', direction: 'asc' })
+    expect(nextAutomationListSort(null, 'lastRun')).toEqual({ field: 'lastRun', direction: 'desc' })
+    expect(nextAutomationListSort({ field: 'name', direction: 'asc' }, 'name')).toEqual({
+      field: 'name',
+      direction: 'desc'
+    })
+    expect(nextAutomationListSort({ field: 'name', direction: 'asc' }, 'lastRun')).toEqual({
+      field: 'lastRun',
+      direction: 'desc'
+    })
+  })
+
+  it('filters by enabled state and last-run outcome', () => {
+    const items = applyAutomationListView({
+      automations: [
+        makeAutomation({ id: 'paused', name: 'Paused', enabled: false }),
+        makeAutomation({ id: 'ok', name: 'Healthy' })
+      ],
+      externalEntries: [makeExternalEntry()],
+      runs: [
+        makeRun({ automationId: 'paused', status: 'completed' }),
+        makeRun({ automationId: 'ok', status: 'dispatch_failed' })
+      ],
+      filter: { status: 'enabled', lastRun: 'failed' },
+      sort: null
+    })
+    expect(items.map((item) => item.id)).toEqual(['ok', 'manager-1:job-1'])
+  })
+
+  it('sorts by name across local and external rows', () => {
+    const items = applyAutomationListView({
+      automations: [makeAutomation({ name: 'Zebra job' })],
+      externalEntries: [makeExternalEntry({ name: 'Alpha digest' })],
+      runs: [],
+      filter: { status: 'all', lastRun: 'all' },
+      sort: { field: 'name', direction: 'asc' }
+    })
+    expect(items.map((item) => item.name)).toEqual(['Alpha digest', 'Zebra job'])
+  })
+
+  it('sorts by last run newest first and keeps never-run rows last', () => {
+    const items = applyAutomationListView({
+      automations: [
+        makeAutomation({ id: 'old', name: 'Old' }),
+        makeAutomation({ id: 'never', name: 'Never' })
+      ],
+      externalEntries: [makeExternalEntry({ lastRunAt: '2026-08-12T09:00:00Z' })],
+      runs: [makeRun({ automationId: 'old', dispatchedAt: Date.parse('2026-08-11T09:00:00Z') })],
+      filter: { status: 'all', lastRun: 'all' },
+      sort: { field: 'lastRun', direction: 'desc' }
+    })
+    expect(items.map((item) => item.id)).toEqual(['manager-1:job-1', 'old', 'never'])
+  })
+})
diff --git a/src/renderer/src/components/automations/automation-list-view.ts b/src/renderer/src/components/automations/automation-list-view.ts
new file mode 100644
index 00000000000..49d44aadb3d
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-list-view.ts
@@ -0,0 +1,191 @@
+import { getIntlLocale } from '@/i18n/i18n'
+import type { Automation, AutomationRun } from '../../../../shared/automations-types'
+import type { ExternalAutomationListEntry } from './external-automation-list-entries'
+import {
+  getExternalAutomationLastRunSnapshot,
+  getLocalAutomationLastRunSnapshot,
+  indexLatestAutomationRuns,
+  type AutomationLastRunSnapshot
+} from './automation-list-last-run'
+
+export type AutomationListStatusFilter = 'all' | 'enabled' | 'paused'
+export type AutomationListLastRunFilter = 'all' | 'failed' | 'succeeded' | 'never'
+export type AutomationListSortField = 'name' | 'lastRun'
+export type AutomationListSortDirection = 'asc' | 'desc'
+
+export type AutomationListSort = {
+  field: AutomationListSortField
+  direction: AutomationListSortDirection
+}
+
+export type AutomationListViewItem =
+  | {
+      kind: 'local'
+      id: string
+      name: string
+      enabled: boolean
+      lastRunAt: number | null
+      lastRun: AutomationLastRunSnapshot
+      automation: Automation
+    }
+  | {
+      kind: 'external'
+      id: string
+      name: string
+      enabled: boolean
+      lastRunAt: number | null
+      lastRun: AutomationLastRunSnapshot
+      entry: ExternalAutomationListEntry
+    }
+
+export type AutomationListFilter = {
+  status: AutomationListStatusFilter
+  lastRun: AutomationListLastRunFilter
+}
+
+export const EMPTY_AUTOMATION_LIST_FILTER: AutomationListFilter = {
+  status: 'all',
+  lastRun: 'all'
+}
+
+export function isAutomationListFilterActive(filter: AutomationListFilter): boolean {
+  return filter.status !== 'all' || filter.lastRun !== 'all'
+}
+
+export function countAutomationListFilters(filter: AutomationListFilter): number {
+  return (filter.status !== 'all' ? 1 : 0) + (filter.lastRun !== 'all' ? 1 : 0)
+}
+
+export function defaultAutomationListSortDirection(
+  field: AutomationListSortField
+): AutomationListSortDirection {
+  return field === 'lastRun' ? 'desc' : 'asc'
+}
+
+export function nextAutomationListSort(
+  current: AutomationListSort | null,
+  field: AutomationListSortField
+): AutomationListSort {
+  if (current?.field !== field) {
+    return { field, direction: defaultAutomationListSortDirection(field) }
+  }
+  return {
+    field,
+    direction: current.direction === 'asc' ? 'desc' : 'asc'
+  }
+}
+
+function matchesStatusFilter(enabled: boolean, filter: AutomationListStatusFilter): boolean {
+  if (filter === 'all') {
+    return true
+  }
+  return filter === 'enabled' ? enabled : !enabled
+}
+
+function matchesLastRunFilter(
+  snapshot: AutomationLastRunSnapshot,
+  filter: AutomationListLastRunFilter
+): boolean {
+  if (filter === 'all') {
+    return true
+  }
+  return snapshot.tone === filter
+}
+
+export function buildAutomationListViewItems({
+  automations,
+  externalEntries,
+  runs
+}: {
+  automations: readonly Automation[]
+  externalEntries: readonly ExternalAutomationListEntry[]
+  runs: readonly AutomationRun[]
+}): AutomationListViewItem[] {
+  const lastRunByAutomationId = indexLatestAutomationRuns(runs)
+  const locals: AutomationListViewItem[] = automations.map((automation) => {
+    const lastRun = getLocalAutomationLastRunSnapshot(
+      automation,
+      lastRunByAutomationId.get(automation.id)
+    )
+    return {
+      kind: 'local',
+      id: automation.id,
+      name: automation.name,
+      enabled: automation.enabled,
+      lastRunAt: lastRun.at,
+      lastRun,
+      automation
+    }
+  })
+  const externals: AutomationListViewItem[] = externalEntries.map((entry) => {
+    const lastRun = getExternalAutomationLastRunSnapshot(entry.job)
+    return {
+      kind: 'external',
+      id: entry.key,
+      name: entry.job.name,
+      enabled: entry.job.enabled,
+      lastRunAt: lastRun.at,
+      lastRun,
+      entry
+    }
+  })
+  return [...locals, ...externals]
+}
+
+export function filterAutomationListViewItems(
+  items: readonly AutomationListViewItem[],
+  filter: AutomationListFilter
+): AutomationListViewItem[] {
+  if (!isAutomationListFilterActive(filter)) {
+    return [...items]
+  }
+  return items.filter(
+    (item) =>
+      matchesStatusFilter(item.enabled, filter.status) &&
+      matchesLastRunFilter(item.lastRun, filter.lastRun)
+  )
+}
+
+export function sortAutomationListViewItems(
+  items: readonly AutomationListViewItem[],
+  sort: AutomationListSort | null
+): AutomationListViewItem[] {
+  if (!sort) {
+    return [...items]
+  }
+  const next = [...items]
+  const locale = getIntlLocale()
+  next.sort((left, right) => {
+    const compared =
+      sort.field === 'name'
+        ? left.name.localeCompare(right.name, locale, { sensitivity: 'base' })
+        : (left.lastRunAt ?? 0) - (right.lastRunAt ?? 0)
+    if (compared !== 0) {
+      return sort.direction === 'asc' ? compared : -compared
+    }
+    return left.id.localeCompare(right.id)
+  })
+  return next
+}
+
+export function applyAutomationListView({
+  automations,
+  externalEntries,
+  runs,
+  filter,
+  sort
+}: {
+  automations: readonly Automation[]
+  externalEntries: readonly ExternalAutomationListEntry[]
+  runs: readonly AutomationRun[]
+  filter: AutomationListFilter
+  sort: AutomationListSort | null
+}): AutomationListViewItem[] {
+  return sortAutomationListViewItems(
+    filterAutomationListViewItems(
+      buildAutomationListViewItems({ automations, externalEntries, runs }),
+      filter
+    ),
+    sort
+  )
+}
diff --git a/src/renderer/src/components/automations/automations-table-layout.ts b/src/renderer/src/components/automations/automations-table-layout.ts
index 17f3af46681..b32c09d9fac 100644
--- a/src/renderer/src/components/automations/automations-table-layout.ts
+++ b/src/renderer/src/components/automations/automations-table-layout.ts
@@ -1,8 +1,8 @@
 /** Shared layout classes for the automations list table.
  * Matches AutomationRunHistory / ExternalAutomationRunTable / Tasks list tables. */
-// Name | Schedule | Project | Next run | Status | Agent | Actions
+// Name | Schedule | Project | Next run | Last run | Status | Agent | Actions
 export const AUTOMATIONS_TABLE_GRID_CLASS =
-  'grid grid-cols-[minmax(0,1.5fr)_minmax(7rem,10rem)_minmax(5rem,9rem)_minmax(10rem,1.2fr)_minmax(4.5rem,6rem)_2.5rem_2.5rem]'
+  'grid grid-cols-[minmax(0,1.4fr)_minmax(7.5rem,10rem)_minmax(4.5rem,8rem)_minmax(8.5rem,1fr)_minmax(8rem,11rem)_minmax(4.5rem,6rem)_2.5rem_2.5rem]'
 
 export const AUTOMATIONS_TABLE_CONTAINER_CLASS = 'rounded-md border border-border/50 bg-muted/20'
 
diff --git a/src/renderer/src/components/automations/use-automation-list-view.ts b/src/renderer/src/components/automations/use-automation-list-view.ts
new file mode 100644
index 00000000000..f87550c4079
--- /dev/null
+++ b/src/renderer/src/components/automations/use-automation-list-view.ts
@@ -0,0 +1,98 @@
+import { useEffect, useMemo } from 'react'
+import type { Automation, AutomationRun } from '../../../../shared/automations-types'
+import type { ExternalAutomationListEntry } from './external-automation-list-entries'
+import {
+  applyAutomationListView,
+  isAutomationListFilterActive,
+  type AutomationListFilter,
+  type AutomationListSort,
+  type AutomationListViewItem
+} from './automation-list-view'
+
+export function useAutomationListView({
+  automations,
+  externalEntries,
+  runs,
+  filter,
+  sort,
+  selectedId,
+  selectedExternalKey,
+  selectAutomationId,
+  selectExternalKey
+}: {
+  automations: readonly Automation[]
+  externalEntries: readonly ExternalAutomationListEntry[]
+  runs: readonly AutomationRun[]
+  filter: AutomationListFilter
+  sort: AutomationListSort | null
+  selectedId: string | null
+  selectedExternalKey: string | null
+  selectAutomationId: (automationId: string | null) => void
+  selectExternalKey: (externalKey: string | null) => void
+}): {
+  visibleItems: readonly AutomationListViewItem[]
+  isListFilterActive: boolean
+  hasVisibleListItems: boolean
+} {
+  const isListFilterActive = isAutomationListFilterActive(filter)
+  const visibleItems = useMemo(
+    () =>
+      applyAutomationListView({
+        automations,
+        externalEntries,
+        runs,
+        filter,
+        sort
+      }),
+    [automations, externalEntries, filter, runs, sort]
+  )
+  const hasVisibleListItems = visibleItems.length > 0
+
+  // Why: search already hides rows; filter/sort must keep highlight + detail on a
+  // still-visible row so the list never points at something the user cannot see.
+  useEffect(() => {
+    if (!isListFilterActive && !sort) {
+      return
+    }
+    const localVisible =
+      selectedExternalKey === null &&
+      selectedId != null &&
+      visibleItems.some((item) => item.kind === 'local' && item.id === selectedId)
+    const externalVisible =
+      selectedExternalKey != null &&
+      visibleItems.some((item) => item.kind === 'external' && item.id === selectedExternalKey)
+    if (localVisible || externalVisible) {
+      return
+    }
+    const first = visibleItems[0]
+    if (!first) {
+      return
+    }
+    if (first.kind === 'local') {
+      if (selectedExternalKey !== null) {
+        selectExternalKey(null)
+      }
+      if (selectedId !== first.id) {
+        selectAutomationId(first.id)
+      }
+      return
+    }
+    if (selectedExternalKey !== first.id) {
+      selectExternalKey(first.id)
+    }
+  }, [
+    isListFilterActive,
+    selectAutomationId,
+    selectExternalKey,
+    selectedExternalKey,
+    selectedId,
+    sort,
+    visibleItems
+  ])
+
+  return {
+    visibleItems,
+    isListFilterActive,
+    hasVisibleListItems
+  }
+}
diff --git a/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx b/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
index 6ef0481edab..0d17baed21b 100644
--- a/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
+++ b/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
@@ -1,24 +1,29 @@
 /**
  * @vitest-environment happy-dom
  *
- * STA-3811: imports never touch the Google cookie family, so both import menus must say so at
- * the moment of decision. Covers the browser toolbar menu and the Settings profile row.
+ * STA-3811: imports never touch the Google cookie family, so every import menu must disclose it
+ * at the moment of decision.
  */
 import { act, type ReactNode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import en from '@/i18n/locales/en.json'
 
-const DISCLOSURE = 'Google requires signing in directly - imports skip it.'
+const DISCLOSURE_TITLE = "Google logins aren't imported"
+const DISCLOSURE_DESCRIPTION = 'Sign in to Google directly in Orca.'
 
 vi.mock('@/components/ui/dropdown-menu', () => dropdownMenuStubs())
 vi.mock('../ui/dropdown-menu', () => dropdownMenuStubs())
+vi.mock('@/components/ui/popover', () => popoverStubs())
 vi.mock('@/store', () => ({ useAppStore: appStoreStub() }))
 vi.mock('../../store', () => ({ useAppStore: appStoreStub() }))
 vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } }))
 
+import { BrowserCookieImportDisclosure } from './BrowserCookieImportDisclosure'
+import { BrowserImportHintButton } from './browser-pane/BrowserImportHintButton'
 import { BrowserToolbarMenuDropdown } from './browser-pane/browser-toolbar-menu-dropdown'
 import { BrowserProfileRow } from './settings/BrowserProfileRow'
+import { BrowserUseCookieImportStep } from './settings/BrowserUseCookieImportStep'
 
 const DETECTED_BROWSERS = [
   {
@@ -29,7 +34,7 @@ const DETECTED_BROWSERS = [
   }
 ]
 
-describe('cookie-import Google disclosure caption', () => {
+describe('cookie-import Google disclosure footer', () => {
   let container: HTMLDivElement
   let root: Root
 
@@ -44,9 +49,10 @@ describe('cookie-import Google disclosure caption', () => {
     container.remove()
   })
 
-  it('is shown in the browser toolbar import menu', () => {
-    act(() => {
-      root.render(
+  it.each([
+    [
+      'browser toolbar overflow',
+      () => (
         <BrowserToolbarMenuDropdown
           menuOpen
           onMenuOpenChange={vi.fn()}
@@ -63,14 +69,22 @@ describe('cookie-import Google disclosure caption', () => {
           onApplyViewportPreset={vi.fn()}
         />
       )
-    })
-
-    expect(container.textContent).toContain(DISCLOSURE)
-  })
-
-  it('is shown in the Settings browser-profile import menu', () => {
-    act(() => {
-      root.render(
+    ],
+    ['browser toolbar hint', () => <BrowserImportHintButton profileId="default" />],
+    [
+      'Settings browser-use setup',
+      () => (
+        <BrowserUseCookieImportStep
+          cookiesImported={false}
+          isImportingDefault={false}
+          step3Blocked={false}
+          sourceLabel={null}
+        />
+      )
+    ],
+    [
+      'Settings browser-profile row',
+      () => (
         <BrowserProfileRow
           profile={{ id: 'default', name: 'Default', partition: 'persist:default' } as never}
           detectedBrowsers={DETECTED_BROWSERS}
@@ -79,18 +93,29 @@ describe('cookie-import Google disclosure caption', () => {
           onSelect={vi.fn()}
         />
       )
-    })
+    ]
+  ] satisfies [string, () => ReactNode][])('is shown in the %s menu', (_name, renderSurface) => {
+    act(() => root.render(renderSurface()))
 
-    expect(container.textContent).toContain(DISCLOSURE)
+    expect(container.textContent).toContain(DISCLOSURE_TITLE)
+    expect(container.textContent).toContain(DISCLOSURE_DESCRIPTION)
   })
 
-  // Why: the rendered text comes from the catalog, not the translate() fallback, so a copy
-  // drift in en.json alone would otherwise slip through both render assertions.
-  it('reads the same copy from the catalog on both surfaces', () => {
-    expect(catalogEntry('auto.components.browser.pane.BrowserToolbarMenu.c186b4d890')).toBe(
-      DISCLOSURE
+  it('renders the icon and separator as non-interactive footer chrome', () => {
+    act(() => root.render(<BrowserCookieImportDisclosure />))
+
+    const label = container.querySelector('[data-testid="dropdown-menu-label"]')
+    expect(label?.querySelector('svg')).not.toBeNull()
+    expect(label?.previousElementSibling?.tagName).toBe('HR')
+  })
+
+  it('reads the footer copy from the catalog', () => {
+    expect(catalogEntry('auto.components.BrowserCookieImportDisclosure.title')).toBe(
+      DISCLOSURE_TITLE
+    )
+    expect(catalogEntry('auto.components.BrowserCookieImportDisclosure.description')).toBe(
+      DISCLOSURE_DESCRIPTION
     )
-    expect(catalogEntry('auto.components.settings.BrowserProfileRow.654a0c2073')).toBe(DISCLOSURE)
   })
 })
 
@@ -113,11 +138,13 @@ function dropdownMenuStubs(): Record<string, unknown> {
     DropdownMenu: passthrough,
     DropdownMenuContent: block,
     DropdownMenuItem: block,
-    DropdownMenuLabel: block,
+    DropdownMenuLabel: ({ children }: { children?: ReactNode }): ReactNode => (
+      <div data-testid="dropdown-menu-label">{children}</div>
+    ),
     DropdownMenuPortal: passthrough,
     DropdownMenuRadioGroup: passthrough,
     DropdownMenuRadioItem: block,
-    DropdownMenuSeparator: () => null,
+    DropdownMenuSeparator: () => <hr />,
     DropdownMenuSub: passthrough,
     DropdownMenuSubContent: block,
     DropdownMenuSubTrigger: block,
@@ -125,11 +152,33 @@ function dropdownMenuStubs(): Record<string, unknown> {
   }
 }
 
+function popoverStubs(): Record<string, unknown> {
+  const passthrough = ({ children }: { children?: ReactNode }): ReactNode => children
+  const block = ({ children }: { children?: ReactNode }): ReactNode => <div>{children}</div>
+  return { Popover: passthrough, PopoverContent: block, PopoverTrigger: passthrough }
+}
+
 function appStoreStub(): unknown {
   const state = {
+    browserImportHintHidden: false,
+    browserSessionImportState: null,
+    detectedBrowsers: [
+      {
+        family: 'chrome',
+        label: 'Google Chrome',
+        profiles: [{ name: 'Default', directory: 'Default' }],
+        selectedProfile: 'Default'
+      }
+    ],
+    detectedBrowsersLoaded: true,
     fetchDetectedBrowsers: vi.fn(),
+    importCookiesFromBrowser: vi.fn(),
+    importCookiesToProfile: vi.fn(),
     openSettingsTarget: vi.fn(),
-    openSettingsPage: vi.fn()
+    openSettingsPage: vi.fn(),
+    persistedUIReady: true,
+    setBrowserImportHintHidden: vi.fn(),
+    settingsSearchQuery: ''
   }
   const useAppStore = (selector?: (s: typeof state) => unknown): unknown =>
     selector ? selector(state) : state
diff --git a/src/renderer/src/components/browser-pane/BrowserImportHintButton.tsx b/src/renderer/src/components/browser-pane/BrowserImportHintButton.tsx
index 32af12eeb10..0f318fb8107 100644
--- a/src/renderer/src/components/browser-pane/BrowserImportHintButton.tsx
+++ b/src/renderer/src/components/browser-pane/BrowserImportHintButton.tsx
@@ -3,6 +3,7 @@ import { Import } from 'lucide-react'
 import { toast } from 'sonner'
 import { emitBrowserCookieImportToast } from '@/lib/browser-cookie-import-toast'
 import { Button } from '@/components/ui/button'
+import { BrowserCookieImportDisclosure } from '@/components/BrowserCookieImportDisclosure'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -100,7 +101,8 @@ export function BrowserImportHintButton({
               value1: browser?.label ?? browserFamily,
               value2: browserProfile ? ` (${browserProfile})` : ''
             }
-          )
+          ),
+          result.executionHostLabel
         )
         return
       }
@@ -120,7 +122,8 @@ export function BrowserImportHintButton({
           'auto.components.browser.pane.BrowserImportHintButton.d40d584769',
           'Imported {{value0}} cookies from file.',
           { value0: result.summary.importedCookies }
-        )
+        ),
+        result.executionHostLabel
       )
       return
     }
@@ -257,6 +260,7 @@ export function BrowserImportHintButton({
                     'From File…'
                   )}
                 </DropdownMenuItem>
+                <BrowserCookieImportDisclosure />
               </DropdownMenuContent>
             </DropdownMenu>
 
diff --git a/src/renderer/src/components/browser-pane/BrowserPane.remote-link-routing.test.ts b/src/renderer/src/components/browser-pane/BrowserPane.remote-link-routing.test.ts
new file mode 100644
index 00000000000..2ea6375f123
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/BrowserPane.remote-link-routing.test.ts
@@ -0,0 +1,19 @@
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+
+describe('remote browser link routing', () => {
+  it('pins context-menu opens to the runtime that owns the pane', () => {
+    const source = readFileSync(
+      fileURLToPath(new URL('./BrowserPane.tsx', import.meta.url)),
+      'utf8'
+    )
+    const paneStart = source.indexOf('function RemoteBrowserPagePane')
+    const actionStart = source.indexOf('void openWorkspaceBrowserTab({', paneStart)
+    const actionEnd = source.indexOf('}).catch((error) => {', actionStart)
+    const openRequest = source.slice(actionStart, actionEnd)
+
+    expect(openRequest).toContain('workspaceId: worktreeId')
+    expect(openRequest).toContain('expectedRuntimeEnvironmentId: runtimeEnvironmentId')
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/BrowserPane.tsx b/src/renderer/src/components/browser-pane/BrowserPane.tsx
index ada2d7a07ae..9158962d88c 100644
--- a/src/renderer/src/components/browser-pane/BrowserPane.tsx
+++ b/src/renderer/src/components/browser-pane/BrowserPane.tsx
@@ -189,6 +189,7 @@ import { shouldPollChromiumErrorPage } from './chromium-error-page-polling'
 import { useContextualTour } from '@/components/contextual-tours/use-contextual-tour'
 import { translate } from '@/i18n/i18n'
 import { isBrowserPagePanePaintable } from './browser-page-paintability'
+import { openWorkspaceBrowserTab } from '@/lib/workspace-browser-tab-open'
 import { useMarkupMode, type MarkupCaptureContext } from './markup/useMarkupMode'
 import { MarkupOverlay } from './markup/MarkupOverlay'
 import { MarkupDrawButton } from './markup/MarkupDrawButton'
@@ -935,7 +936,6 @@ function RemoteBrowserPagePane({
   const remotePageHandle = useAppStore(
     (s) => s.remoteBrowserPageHandlesByPageId[browserTab.id] ?? null
   )
-  const createBrowserTab = useAppStore((s) => s.createBrowserTab)
   const closeBrowserPage = useAppStore((s) => s.closeBrowserPage)
   const closeBrowserTab = useAppStore((s) => s.closeBrowserTab)
   const keybindings = useAppStore((state) => state.keybindings)
@@ -2037,10 +2037,19 @@ function RemoteBrowserPagePane({
                       role="menuitem"
                       className="relative flex w-full cursor-default items-center gap-2 rounded-[7px] px-2 py-0.5 text-[12px] leading-5 font-medium outline-none select-none hover:bg-black/8 dark:hover:bg-white/14"
                       onClick={() => {
-                        createBrowserTab(worktreeId, contextMenu.linkUrl!, {
-                          title: contextMenu.linkUrl!
-                        })
+                        const linkUrl = contextMenu.linkUrl!
                         setContextMenu(null)
+                        void openWorkspaceBrowserTab({
+                          workspaceId: worktreeId,
+                          url: linkUrl,
+                          intent: { kind: 'url' },
+                          expectedRuntimeEnvironmentId: runtimeEnvironmentId
+                        }).catch((error) => {
+                          setPaneNotice({
+                            kind: 'direct',
+                            text: error instanceof Error ? error.message : String(error)
+                          })
+                        })
                       }}
                     >
                       {translate(
@@ -2883,7 +2892,7 @@ function BrowserPagePane({
         return
       }
       // Why: convert OS screen cursor coords to renderer CSS pixels — immune to guest/renderer coordinate-space mismatches from zoom/DPI.
-      const zoomFactor = Math.pow(1.2, window.api.ui.getZoomLevel())
+      const zoomFactor = 1.2 ** window.api.ui.getZoomLevel()
       const x = Math.round((event.screenX - window.screenX) / zoomFactor)
       const y = Math.round((event.screenY - window.screenY) / zoomFactor)
       console.debug(
diff --git a/src/renderer/src/components/browser-pane/BrowserToolbarMenu.tsx b/src/renderer/src/components/browser-pane/BrowserToolbarMenu.tsx
index 90afa5aec59..f712d33abd2 100644
--- a/src/renderer/src/components/browser-pane/BrowserToolbarMenu.tsx
+++ b/src/renderer/src/components/browser-pane/BrowserToolbarMenu.tsx
@@ -205,7 +205,8 @@ export function BrowserToolbarMenu({
                 value0: result.summary.importedCookies,
                 value1: browser?.label ?? browserFamily
               }
-            )
+            ),
+        result.executionHostLabel
       )
     } else {
       toast.error(result.reason)
@@ -221,7 +222,8 @@ export function BrowserToolbarMenu({
           'auto.components.browser.pane.BrowserToolbarMenu.53bbe3dab4',
           'Imported {{value0}} cookies from file.',
           { value0: result.summary.importedCookies }
-        )
+        ),
+        result.executionHostLabel
       )
     } else if (result.reason !== 'canceled') {
       toast.error(result.reason)
diff --git a/src/renderer/src/components/browser-pane/browser-address-bar-suggestions.ts b/src/renderer/src/components/browser-pane/browser-address-bar-suggestions.ts
index 5351073140b..6ac0fe12c52 100644
--- a/src/renderer/src/components/browser-pane/browser-address-bar-suggestions.ts
+++ b/src/renderer/src/components/browser-pane/browser-address-bar-suggestions.ts
@@ -127,7 +127,7 @@ export function buildBrowserAddressBarSuggestions({
 
   // Why: the history row gives Enter the same target while showing real page metadata.
   const duplicateIdx = historySuggestions.findIndex((h) => h.url === topAction.url)
-  if (duplicateIdx >= 0) {
+  if (duplicateIdx !== -1) {
     return historySuggestions.slice(0, MAX_BROWSER_ADDRESS_BAR_SUGGESTIONS)
   }
 
diff --git a/src/renderer/src/components/browser-pane/browser-toolbar-menu-dropdown.tsx b/src/renderer/src/components/browser-pane/browser-toolbar-menu-dropdown.tsx
index 0491f55db05..508eb059ca2 100644
--- a/src/renderer/src/components/browser-pane/browser-toolbar-menu-dropdown.tsx
+++ b/src/renderer/src/components/browser-pane/browser-toolbar-menu-dropdown.tsx
@@ -4,7 +4,6 @@ import {
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
-  DropdownMenuLabel,
   DropdownMenuPortal,
   DropdownMenuRadioGroup,
   DropdownMenuRadioItem,
@@ -14,6 +13,7 @@ import {
   DropdownMenuSubTrigger,
   DropdownMenuTrigger
 } from '@/components/ui/dropdown-menu'
+import { BrowserCookieImportDisclosure } from '@/components/BrowserCookieImportDisclosure'
 import { useAppStore } from '@/store'
 import { BROWSER_FAMILY_LABELS } from '../../../../shared/constants'
 import type { BrowserSessionProfile, BrowserViewportPresetId } from '../../../../shared/types'
@@ -128,12 +128,6 @@ export function BrowserToolbarMenuDropdown({
           </DropdownMenuSubTrigger>
           <DropdownMenuPortal>
             <DropdownMenuSubContent>
-              <DropdownMenuLabel className="font-normal">
-                {translate(
-                  'auto.components.browser.pane.BrowserToolbarMenu.c186b4d890',
-                  'Google requires signing in directly - imports skip it.'
-                )}
-              </DropdownMenuLabel>
               {detectedBrowsers.map((browser) =>
                 browser.profiles.length > 1 ? (
                   <DropdownMenuSub key={browser.family}>
@@ -177,6 +171,7 @@ export function BrowserToolbarMenuDropdown({
                   'From File…'
                 )}
               </DropdownMenuItem>
+              <BrowserCookieImportDisclosure />
             </DropdownMenuSubContent>
           </DropdownMenuPortal>
         </DropdownMenuSub>
diff --git a/src/renderer/src/components/browser-pane/context-menu-positioning.test.ts b/src/renderer/src/components/browser-pane/context-menu-positioning.test.ts
index 397647b181f..647b6696907 100644
--- a/src/renderer/src/components/browser-pane/context-menu-positioning.test.ts
+++ b/src/renderer/src/components/browser-pane/context-menu-positioning.test.ts
@@ -43,7 +43,7 @@ function computeCorrection(
 
 describe('screen-to-viewport coordinate conversion', () => {
   it('converts screen coords to viewport at zoom 1.0', () => {
-    const result = computeViewportCoords(650, 400, 100, 50, 1.0)
+    const result = computeViewportCoords(650, 400, 100, 50, 1)
     expect(result.x).toBe(550)
     expect(result.y).toBe(350)
   })
@@ -64,7 +64,7 @@ describe('screen-to-viewport coordinate conversion', () => {
   })
 
   it('handles cursor at window origin', () => {
-    const result = computeViewportCoords(100, 50, 100, 50, 1.0)
+    const result = computeViewportCoords(100, 50, 100, 50, 1)
     expect(result.x).toBe(0)
     expect(result.y).toBe(0)
   })
@@ -203,7 +203,7 @@ describe('full pipeline', () => {
       screenCursor.y,
       windowPos.x,
       windowPos.y,
-      1.0
+      1
     )
 
     expect(menuPos.x).toBe(550)
@@ -236,7 +236,7 @@ describe('full pipeline', () => {
       screenCursor.y,
       windowPos.x,
       windowPos.y,
-      1.0
+      1
     )
     const cssOffset = { x: 60, y: 40 }
     const measured = { left: menuPos.x + cssOffset.x, top: menuPos.y + cssOffset.y }
@@ -255,7 +255,7 @@ describe('full pipeline', () => {
       screenCursor.y,
       windowPos.x,
       windowPos.y,
-      1.0
+      1
     )
     const corrected = computeCorrection(menuPos.x, menuPos.y, menuPos.x, menuPos.y)
 
diff --git a/src/renderer/src/components/cmd-j/PaletteCreateWorktreeRow.tsx b/src/renderer/src/components/cmd-j/PaletteCreateWorktreeRow.tsx
new file mode 100644
index 00000000000..2079a0c8fbf
--- /dev/null
+++ b/src/renderer/src/components/cmd-j/PaletteCreateWorktreeRow.tsx
@@ -0,0 +1,172 @@
+import React, { useEffect, useState } from 'react'
+import { Github, Gitlab, Plus } from 'lucide-react'
+import { LinearIcon } from '@/components/icons/LinearIcon'
+import { JiraIcon } from '@/components/icons/JiraIcon'
+import { CommandItem } from '@/components/ui/command'
+import { CREATE_WORKTREE_ITEM_ID } from '@/lib/worktree-palette-create-action'
+import type { CmdJTaskUrlCreatePreview } from '@/lib/worktree-palette-task-url-match'
+import type { LinearIssue } from '../../../../shared/types'
+import { translate } from '@/i18n/i18n'
+
+function TaskUrlProviderIcon({
+  provider
+}: {
+  provider: CmdJTaskUrlCreatePreview['provider']
+}): React.JSX.Element {
+  if (provider === 'github') {
+    return <Github className="size-3" aria-hidden="true" />
+  }
+  if (provider === 'gitlab') {
+    return <Gitlab className="size-3" aria-hidden="true" />
+  }
+  return <JiraIcon className="size-3" />
+}
+
+export function PaletteCreateWorktreeRow({
+  className,
+  createWorktreeName,
+  linearIdentifier,
+  linearIssue,
+  linearPending,
+  showLinearLoadingFeedback,
+  taskUrlPreview,
+  onSelect
+}: {
+  className: string
+  createWorktreeName: string
+  linearIdentifier: string | null
+  linearIssue: Pick<LinearIssue, 'identifier' | 'title'> | null
+  linearPending: boolean
+  showLinearLoadingFeedback: boolean
+  taskUrlPreview: CmdJTaskUrlCreatePreview | null
+  onSelect: () => void
+}): React.JSX.Element {
+  const showLinearPreview = linearPending || linearIssue !== null
+  const linearPreviewLabel = linearIssue
+    ? translate(
+        'worktreeJumpPalette.linearIssue.createLabel',
+        'Create worktree from Linear issue {{value0}}: {{value1}}',
+        { value0: linearIssue.identifier, value1: linearIssue.title }
+      )
+    : linearPending && showLinearLoadingFeedback
+      ? translate(
+          'worktreeJumpPalette.linearIssue.loadingLabel',
+          'Loading Linear issue {{value0}}',
+          { value0: linearIdentifier ?? '' }
+        )
+      : linearPending
+        ? translate(
+            'worktreeJumpPalette.linearIssue.pendingLabel',
+            'Create worktree from Linear issue {{value0}}',
+            { value0: linearIdentifier ?? '' }
+          )
+        : undefined
+  const previewLabel = showLinearPreview
+    ? linearPreviewLabel
+    : (taskUrlPreview?.createLabel ?? undefined)
+  const [showTaskUrlLoadingFeedback, setShowTaskUrlLoadingFeedback] = useState(false)
+  useEffect(() => {
+    if (!taskUrlPreview?.loading) {
+      setShowTaskUrlLoadingFeedback(false)
+      return
+    }
+    setShowTaskUrlLoadingFeedback(false)
+    const timer = window.setTimeout(() => setShowTaskUrlLoadingFeedback(true), 200)
+    return () => window.clearTimeout(timer)
+  }, [taskUrlPreview?.identifier, taskUrlPreview?.loading])
+
+  return (
+    <CommandItem
+      value={CREATE_WORKTREE_ITEM_ID}
+      onSelect={onSelect}
+      aria-label={previewLabel}
+      aria-busy={linearPending || Boolean(taskUrlPreview?.loading && !showLinearPreview)}
+      data-cmd-j-linear-issue-preview={showLinearPreview ? 'true' : undefined}
+      data-cmd-j-linear-issue-state={
+        linearIssue ? 'resolved' : linearPending ? 'loading' : undefined
+      }
+      data-cmd-j-task-url-preview={taskUrlPreview && !showLinearPreview ? 'true' : undefined}
+      data-cmd-j-task-url-provider={
+        taskUrlPreview && !showLinearPreview ? taskUrlPreview.provider : undefined
+      }
+      data-cmd-j-task-url-state={
+        taskUrlPreview && !showLinearPreview
+          ? taskUrlPreview.loading
+            ? 'loading'
+            : 'resolved'
+          : undefined
+      }
+      className={className}
+    >
+      {showLinearPreview ? (
+        <>
+          <div className="flex h-5 w-5 shrink-0 items-center justify-center rounded-full border border-border/60 bg-muted/25 text-muted-foreground/70">
+            <LinearIcon className="size-3" />
+          </div>
+          <div className="min-w-0 flex-1">
+            <div className="flex min-w-0 items-baseline gap-2">
+              <span className="shrink-0 font-mono text-[12px] font-semibold text-muted-foreground">
+                {linearIssue?.identifier ?? linearIdentifier}
+              </span>
+              {linearIssue ? (
+                <span className="truncate text-[14px] font-semibold tracking-[-0.01em] text-foreground">
+                  {linearIssue.title}
+                </span>
+              ) : null}
+            </div>
+            <div className="mt-0.5 truncate text-[12px] text-muted-foreground">
+              {linearIssue || !showLinearLoadingFeedback
+                ? translate(
+                    'worktreeJumpPalette.linearIssue.createHint',
+                    'Create worktree from Linear issue'
+                  )
+                : translate('worktreeJumpPalette.linearIssue.loadingHint', 'Loading Linear issue…')}
+            </div>
+          </div>
+        </>
+      ) : taskUrlPreview ? (
+        <>
+          <div className="flex h-5 w-5 shrink-0 items-center justify-center rounded-full border border-border/60 bg-muted/25 text-muted-foreground/70">
+            <TaskUrlProviderIcon provider={taskUrlPreview.provider} />
+          </div>
+          <div className="min-w-0 flex-1">
+            <div className="flex min-w-0 items-baseline gap-2">
+              <span className="shrink-0 font-mono text-[12px] font-semibold text-muted-foreground">
+                {taskUrlPreview.identifier}
+              </span>
+              <span className="truncate text-[14px] font-semibold tracking-[-0.01em] text-foreground">
+                {taskUrlPreview.subtitle}
+              </span>
+            </div>
+            <div className="mt-0.5 truncate text-[12px] text-muted-foreground">
+              {taskUrlPreview.loading && showTaskUrlLoadingFeedback
+                ? translate('worktreeJumpPalette.taskUrl.loadingHint', 'Loading {{value0}}…', {
+                    value0: taskUrlPreview.kindLabel
+                  })
+                : translate(
+                    'worktreeJumpPalette.taskUrl.createHint',
+                    'Create worktree from {{value0}}',
+                    { value0: taskUrlPreview.kindLabel }
+                  )}
+            </div>
+          </div>
+        </>
+      ) : (
+        <>
+          <div className="flex h-5 w-5 shrink-0 items-center justify-center rounded-full border border-dashed border-border/60 bg-muted/25 text-muted-foreground/70">
+            <Plus size={13} aria-hidden="true" />
+          </div>
+          <div className="min-w-0 flex-1">
+            <div className="text-[14px] font-semibold tracking-[-0.01em] text-foreground">
+              {translate(
+                'auto.components.WorktreeJumpPalette.95be6587d3',
+                'Create worktree "{{value0}}"',
+                { value0: createWorktreeName }
+              )}
+            </div>
+          </div>
+        </>
+      )}
+    </CommandItem>
+  )
+}
diff --git a/src/renderer/src/components/cmd-j/palette-activation-focus-routing.test.ts b/src/renderer/src/components/cmd-j/palette-activation-focus-routing.test.ts
index afe3b97da70..be90cc29c94 100644
--- a/src/renderer/src/components/cmd-j/palette-activation-focus-routing.test.ts
+++ b/src/renderer/src/components/cmd-j/palette-activation-focus-routing.test.ts
@@ -53,8 +53,9 @@ describe('Cmd+J activation focus routing (#9939)', () => {
     )
     const activationCalls =
       handler.match(/const activation = activateAndRevealWorktree\(activeMatch\.id\)/g)?.length ?? 0
-    // Both issue/PR match paths must restore focus when terminal routing declines.
-    expect(activationCalls).toBe(2)
+    // Typed #N still jumps from create. Pasted issue/PR URLs jump via the
+    // worktree row (handleSelectWorktree), which has its own focus routing.
+    expect(activationCalls).toBe(1)
     expect(
       handler.match(
         /if \(!queueWorkspaceActivationTerminalFocus\(activeMatch\.id, activation\)\) \{\s*focusFallbackSurface\(\)\s*\}/g
diff --git a/src/renderer/src/components/cmd-j/quick-action-context.test.ts b/src/renderer/src/components/cmd-j/quick-action-context.test.ts
index 5e753b42372..7ce2e107613 100644
--- a/src/renderer/src/components/cmd-j/quick-action-context.test.ts
+++ b/src/renderer/src/components/cmd-j/quick-action-context.test.ts
@@ -278,6 +278,43 @@ describe('Cmd+J quick action context', () => {
     expect(calls).toEqual([])
   })
 
+  it('omits unsupported paired-web browser execution without affecting terminal or markdown', async () => {
+    const calls: string[] = []
+    const actions = new Map(getCmdJQuickActions().map((action) => [action.id, action]))
+    const context = {
+      ...ctx({}),
+      activeWorktree: null,
+      runtimeMode: 'paired-web' as const,
+      managedBrowserCreationEnabled: false,
+      openNewBrowserTab: async () => {
+        calls.push('browser')
+      },
+      openNewMarkdownFile: async () => {
+        calls.push('markdown')
+      },
+      openNewTerminalTab: async () => {
+        calls.push('terminal')
+      },
+      openCreateWorkspace: () => {},
+      deleteActiveWorkspace: () => {},
+      openAddQuickCommand: () => {}
+    } satisfies CmdJQuickActionContext
+
+    expect(actions.get('new-browser-tab')?.isAvailable(context)).toEqual({
+      available: false,
+      reason: 'client-action-unsupported'
+    })
+    await expect(actions.get('new-browser-tab')?.run(context)).resolves.toEqual({
+      status: 'unavailable',
+      reason: 'client-action-unsupported'
+    })
+    expect(actions.get('new-markdown-file')?.isAvailable(context)).toEqual({ available: true })
+    expect(actions.get('new-terminal-tab')?.isAvailable(context)).toEqual({ available: true })
+    await actions.get('new-markdown-file')?.run(context)
+    await actions.get('new-terminal-tab')?.run(context)
+    expect(calls).toEqual(['markdown', 'terminal'])
+  })
+
   it('runtime re-check invokes the current workspace delete action when available', async () => {
     const calls: string[] = []
     const action = getCmdJQuickActions().find((entry) => entry.id === 'delete-workspace')
diff --git a/src/renderer/src/components/cmd-j/quick-action-context.ts b/src/renderer/src/components/cmd-j/quick-action-context.ts
index bf3e764f5ab..79007eae750 100644
--- a/src/renderer/src/components/cmd-j/quick-action-context.ts
+++ b/src/renderer/src/components/cmd-j/quick-action-context.ts
@@ -2,12 +2,14 @@ import type { AppState } from '@/store/types'
 import { findWorktreeById } from '@/store/slices/worktree-helpers'
 import type { Worktree } from '../../../../shared/types'
 import type { SshConnectionStatus } from '../../../../shared/ssh-types'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export type CmdJUnavailableReason =
   | 'loading'
   | 'no-active-workspace'
   | 'ssh-disconnected'
   | 'no-active-group'
+  | 'client-action-unsupported'
 
 export type CmdJQuickActionAvailability =
   | { available: true }
@@ -25,6 +27,7 @@ export type CmdJQuickActionContext = {
   isLoading: boolean
   sshStatus: SshConnectionStatus | null
   runtimeMode: 'local-desktop' | 'paired-web'
+  managedBrowserCreationEnabled?: boolean
   activeGroupId: string | null
   openNewBrowserTab: (groupId: string) => Promise<void>
   openNewMarkdownFile: (groupId: string) => Promise<void>
@@ -110,6 +113,15 @@ export function getWorkspaceScopedActionAvailability(
   return { available: true }
 }
 
+export function getBrowserWorkspaceActionAvailability(
+  ctx: CmdJQuickActionContext
+): CmdJQuickActionAvailability {
+  if (ctx.managedBrowserCreationEnabled === false) {
+    return { available: false, reason: 'client-action-unsupported' }
+  }
+  return getWorkspaceScopedActionAvailability(ctx)
+}
+
 export function getCurrentWorkspaceActionAvailability(
   ctx: Pick<CmdJQuickActionContext, 'activeView' | 'activeWorktreeId' | 'isLoading' | 'sshStatus'>
 ): CmdJQuickActionAvailability {
@@ -151,6 +163,9 @@ export function buildCmdJQuickActionContext(args: {
     args.state.settings?.activeRuntimeEnvironmentId?.trim()
       ? 'paired-web'
       : 'local-desktop'
+  const managedBrowserCreationEnabled =
+    getClientCreationActionPolicy(args.state, activeWorktreeId)['managed-browser'].state ===
+    'enabled'
 
   return {
     activeView: args.state.activeView,
@@ -159,6 +174,7 @@ export function buildCmdJQuickActionContext(args: {
     isLoading,
     sshStatus: getActiveWorktreeSshStatus(args.state, activeWorktree),
     runtimeMode,
+    managedBrowserCreationEnabled,
     activeGroupId,
     openNewBrowserTab: args.openNewBrowserTab,
     openNewMarkdownFile: args.openNewMarkdownFile,
@@ -182,5 +198,7 @@ export function getUnavailableQuickActionMessage(
       return `Can't ${actionTitle.toLowerCase()} — workspace is disconnected.`
     case 'no-active-group':
       return `Can't ${actionTitle.toLowerCase()} — no tab group is available.`
+    case 'client-action-unsupported':
+      return `Can't ${actionTitle.toLowerCase()} — this client and runtime do not support it.`
   }
 }
diff --git a/src/renderer/src/components/cmd-j/quick-actions.ts b/src/renderer/src/components/cmd-j/quick-actions.ts
index 8ad3f957a16..70f0e5f6859 100644
--- a/src/renderer/src/components/cmd-j/quick-actions.ts
+++ b/src/renderer/src/components/cmd-j/quick-actions.ts
@@ -3,6 +3,7 @@ import type { LucideIcon } from 'lucide-react'
 import type { CmdJQuickActionAvailability, CmdJQuickActionContext } from './quick-action-context'
 import {
   getCurrentWorkspaceActionAvailability,
+  getBrowserWorkspaceActionAvailability,
   getWorkspaceScopedActionAvailability
 } from './quick-action-context'
 import { translate } from '@/i18n/i18n'
@@ -38,6 +39,12 @@ function currentWorkspaceActionAvailability(
   return getCurrentWorkspaceActionAvailability(ctx)
 }
 
+function browserWorkspaceActionAvailability(
+  ctx: CmdJQuickActionContext
+): CmdJQuickActionAvailability {
+  return getBrowserWorkspaceActionAvailability(ctx)
+}
+
 async function runWorkspaceAction(
   ctx: CmdJQuickActionContext,
   run: (groupId: string) => Promise<void>
@@ -72,8 +79,14 @@ export const getCmdJQuickActions = createLocalizedCatalog((): CmdJQuickAction[]
       translate('auto.components.cmd.j.quick.actions.verbs.openBrowser', 'open browser'),
       translate('auto.components.cmd.j.quick.actions.verbs.browserTab', 'browser tab')
     ],
-    isAvailable: workspaceActionAvailability,
-    run: (ctx) => runWorkspaceAction(ctx, ctx.openNewBrowserTab)
+    isAvailable: browserWorkspaceActionAvailability,
+    run: async (ctx) => {
+      const availability = browserWorkspaceActionAvailability(ctx)
+      if (!availability.available) {
+        return { status: 'unavailable', reason: availability.reason }
+      }
+      return runWorkspaceAction(ctx, ctx.openNewBrowserTab)
+    }
   },
   {
     id: 'new-markdown-file',
diff --git a/src/renderer/src/components/contextual-tours/contextual-tour-gate.ts b/src/renderer/src/components/contextual-tours/contextual-tour-gate.ts
index 07ffc248c28..155f2bfb5a8 100644
--- a/src/renderer/src/components/contextual-tours/contextual-tour-gate.ts
+++ b/src/renderer/src/components/contextual-tours/contextual-tour-gate.ts
@@ -173,7 +173,7 @@ export function getContextualTourStepProgress(args: {
   stepIndex: number
 }): { current: number; total: number } | null {
   const visibleIndex = args.visibleStepIndexes.indexOf(args.stepIndex)
-  if (visibleIndex < 0) {
+  if (visibleIndex === -1) {
     return null
   }
   return { current: visibleIndex + 1, total: args.visibleStepIndexes.length }
diff --git a/src/renderer/src/components/dashboard-popout/AgentKanbanCard.test.tsx b/src/renderer/src/components/dashboard-popout/AgentKanbanCard.test.tsx
index 5036478d94c..523da058675 100644
--- a/src/renderer/src/components/dashboard-popout/AgentKanbanCard.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentKanbanCard.test.tsx
@@ -102,6 +102,23 @@ describe('AgentKanbanCard', () => {
     expect(container.querySelector('.lucide-message-circle-question-mark')).toBeNull()
   })
 
+  it('shows the saved SSH host beside the repository metadata', () => {
+    const { container } = renderCard({
+      card: card({
+        hostKind: 'ssh',
+        executionHostId: 'ssh:opaque-target',
+        hostLabel: 'openclaw'
+      }),
+      now: 2_000
+    })
+
+    expect(screen.getByLabelText('SSH host · openclaw')).toHaveAttribute(
+      'data-dashboard-host-badge',
+      'ssh'
+    )
+    expect(container.querySelector('.lucide-server')).toBeInTheDocument()
+  })
+
   it('shows review metadata and expands grouped subagents without opening the terminal', () => {
     const onOpenTerminal = vi.fn()
     renderCard({
diff --git a/src/renderer/src/components/dashboard-popout/AgentKanbanCard.tsx b/src/renderer/src/components/dashboard-popout/AgentKanbanCard.tsx
index 4e6cffa14af..580c6c3a165 100644
--- a/src/renderer/src/components/dashboard-popout/AgentKanbanCard.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentKanbanCard.tsx
@@ -20,6 +20,7 @@ import {
 } from '../../../../shared/dashboard-snapshot'
 import type { RepoIcon } from '../../../../shared/repo-icon'
 import { translate } from '@/i18n/i18n'
+import { DashboardHostBadge } from './DashboardHostBadge'
 
 /** Compact "started N ago" (the card is glanceable — coarse units are fine). */
 function formatStartedAgo(startedAt: number, now: number): string {
@@ -95,6 +96,9 @@ function sameCard(a: DashboardCard, b: DashboardCard): boolean {
     a.leafId === b.leafId &&
     a.repoName === b.repoName &&
     a.worktreeName === b.worktreeName &&
+    a.hostKind === b.hostKind &&
+    a.executionHostId === b.executionHostId &&
+    a.hostLabel === b.hostLabel &&
     a.hasReview === b.hasReview &&
     a.review?.number === b.review?.number &&
     a.review?.state === b.review?.state &&
@@ -327,6 +331,12 @@ export const AgentKanbanCard = memo(
               {card.repoName}
             </TooltipContent>
           </Tooltip>
+          <DashboardHostBadge
+            hostKind={card.hostKind}
+            executionHostId={card.executionHostId}
+            hostLabel={card.hostLabel}
+            className="size-[18px] rounded-[5px] bg-muted-foreground/10 transition-colors group-hover:text-foreground"
+          />
           {worktreeInFooter ? <span className="truncate">{card.worktreeName}</span> : null}
           <ReviewPill card={card} />
           {displayTimestamp(card) > 0 ? (
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapProjectLabel.test.tsx b/src/renderer/src/components/dashboard-popout/AgentMapProjectLabel.test.tsx
index c900aa01740..afc3b44c057 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMapProjectLabel.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMapProjectLabel.test.tsx
@@ -5,6 +5,7 @@ import { render } from '@testing-library/react'
 import { describe, expect, it, vi } from 'vitest'
 import type { AgentMapLayout } from './agent-map-layout'
 import { AgentMapScene } from './AgentMapScene'
+import { TooltipProvider } from '@/components/ui/tooltip'
 
 const LAYOUT: AgentMapLayout = {
   projects: [
@@ -60,4 +61,56 @@ describe('AgentMapScene project labels', () => {
     expect(container.querySelector('.agent-map-project-label-frame')).toHaveAttribute('x', '-48')
     expect(container.querySelector('.agent-map-project-label-frame')).toHaveAttribute('width', '96')
   })
+
+  it('labels an SSH-backed project ring with its saved host', () => {
+    const sshLayout: AgentMapLayout = {
+      ...LAYOUT,
+      projects: [
+        {
+          ...LAYOUT.projects[0],
+          worktrees: [
+            {
+              id: 'worktree-1:openclaw',
+              worktreeId: 'worktree-1',
+              executionHostId: 'ssh:opaque-target',
+              hostKind: 'ssh',
+              hostLabel: 'openclaw',
+              name: 'humpback',
+              workspaceKind: 'worktree',
+              x: 120,
+              y: 120,
+              radius: 48,
+              agents: [],
+              statusCounts: { working: 0, blocked: 0, waiting: 0, done: 0, idle: 0 },
+              quiet: true
+            }
+          ]
+        }
+      ]
+    }
+    const { container } = render(
+      <TooltipProvider>
+        <svg>
+          <AgentMapScene
+            layout={sshLayout}
+            zoom={1}
+            labelScale={1}
+            mapScale={0.5}
+            heldProjectId={null}
+            heldWorktreeId={null}
+            selectedPaneKey={null}
+            allowAggregation
+            showOrchestrationLinks
+            nodeRefs={{ current: new Map() }}
+            onSelectAgent={vi.fn()}
+            onAgentKeyDown={vi.fn()}
+          />
+        </svg>
+      </TooltipProvider>
+    )
+
+    const badge = container.querySelector('[data-dashboard-host-badge="ssh"]')
+    expect(badge).toHaveAccessibleName('SSH host · openclaw')
+    expect(badge).toHaveClass('agent-map-project-host-badge', 'pointer-events-auto')
+  })
 })
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapScene.tsx b/src/renderer/src/components/dashboard-popout/AgentMapScene.tsx
index 2181e4c0f2c..ea7ed7d192e 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMapScene.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMapScene.tsx
@@ -15,6 +15,7 @@ import { selectVisibleAgentMapLabels } from './agent-map-label-declutter'
 import { agentMapDirectLineageChevronPath } from './agent-map-lineage-chevron-path'
 import { AgentMapWorktreeLabel } from './AgentMapWorktreeLabel'
 import { AgentMapWorktreeRingNode } from './AgentMapWorktreeRingNode'
+import { DashboardHostBadge } from './DashboardHostBadge'
 
 type AgentMapSceneProps = {
   layout: AgentMapLayout
@@ -129,6 +130,13 @@ export const AgentMapScene = memo(function AgentMapScene({
       {layout.projects.map((project) => {
         const worktreesById = new Map(project.worktrees.map((worktree) => [worktree.id, worktree]))
         const projectLabelHalfWidth = project.radius * mapScale
+        const projectHostsById = new Map<string, AgentMapWorktreeRing>()
+        for (const worktree of project.worktrees) {
+          if (worktree.hostKind === 'ssh' || worktree.hostKind === 'remote') {
+            projectHostsById.set(`${worktree.hostKind}:${worktree.executionHostId ?? ''}`, worktree)
+          }
+        }
+        const projectHosts = [...projectHostsById.values()]
         const projectCountText = translate(
           'dashboardPopout.map.projectCount',
           '{{agents}} agents · {{workspaces}} workspaces',
@@ -253,6 +261,16 @@ export const AgentMapScene = memo(function AgentMapScene({
                   <span className="agent-map-project-name min-w-0 truncate">
                     {project.name.toUpperCase()}
                   </span>
+                  {projectHosts.map((host) => (
+                    <DashboardHostBadge
+                      key={`${host.hostKind}:${host.executionHostId ?? ''}`}
+                      hostKind={host.hostKind}
+                      executionHostId={host.executionHostId}
+                      hostLabel={host.hostLabel}
+                      keyboardFocusable
+                      className="agent-map-project-host-badge"
+                    />
+                  ))}
                 </div>
               </foreignObject>
               {visibleLabels.projectCountIds.has(project.id) ? (
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
index 2d72b7304f9..cc20e2db048 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
@@ -44,6 +44,7 @@ const imeHarness = vi.hoisted(() => ({
     claimKeyEvent: ReturnType<typeof vi.fn>
     dispose: ReturnType<typeof vi.fn>
     sendInput: (data: string) => void
+    getKittyKeyboardFlags: () => number
   }[],
   trackers: [] as { dispose: ReturnType<typeof vi.fn> }[],
   claimResult: false
@@ -115,11 +116,17 @@ vi.mock('@/lib/shortcut-platform', () => ({
   getShortcutPlatform: () => platformState.value
 }))
 vi.mock('@/components/terminal-pane/terminal-ime-native-text-forwarder', () => ({
-  installTerminalImeNativeTextForwarder: (args: { sendInput: (data: string) => void }) => {
+  installTerminalImeNativeTextForwarder: (args: {
+    sendInput: (data: string) => void
+    getKittyKeyboardFlags?: () => number
+  }) => {
     const forwarder = {
       claimKeyEvent: vi.fn(() => imeHarness.claimResult),
       dispose: vi.fn(),
-      sendInput: args.sendInput
+      sendInput: args.sendInput,
+      // Why captured: the bridge's whole job is handing the live mirror to the
+      // forwarder, so the test reads what a real commit would read.
+      getKittyKeyboardFlags: args.getKittyKeyboardFlags ?? ((): number => 0)
     }
     imeHarness.forwarders.push(forwarder)
     return forwarder
@@ -270,6 +277,26 @@ describe('AgentTerminalPreview', () => {
     expect(imeHarness.trackers).toHaveLength(0)
   })
 
+  // The bridge omitted this dependency entirely, so every Preview
+  // commit was evaluated at flags 0. Ordering and provenance live in
+  // preview-terminal-snapshot-replay.test.ts; this pins the wiring.
+  it('hands the forwarder the live mirror seeded from the snapshot flags', async () => {
+    platformState.value = 'darwin'
+    connect.mockResolvedValue({
+      snapshot: { data: '', cols: 80, rows: 24, seq: 1, kittyKeyboardFlags: 8 },
+      replay: []
+    })
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await waitFor(() => expect(imeHarness.forwarders).toHaveLength(1))
+    await waitFor(() => expect(imeHarness.forwarders[0]!.getKittyKeyboardFlags()).toBe(8))
+
+    // Live output keeps advancing the same mirror the forwarder reads.
+    act(() => {
+      emitData?.({ type: 'data', ptyId: 'pty-1', data: '\x1b[<u', bytes: 4 })
+    })
+    expect(imeHarness.forwarders[0]!.getKittyKeyboardFlags()).toBe(0)
+  })
+
   it('disposes the IME bridge on unmount', async () => {
     platformState.value = 'darwin'
     const view = render(<AgentTerminalPreview ptyId="pty-1" />)
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
index d187694b841..340225784f2 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
@@ -6,6 +6,7 @@ import { subscribeToTerminalUserInput } from '@/components/terminal-pane/termina
 import { composeActiveTerminalTheme } from '@/components/terminal-pane/terminal-appearance'
 import { useSystemPrefersDark } from '@/components/terminal-pane/use-system-prefers-dark'
 import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import { replayPreviewConnectionSnapshot } from './preview-terminal-snapshot-replay'
 import { useEffectiveMacOptionAsAlt } from '@/lib/keyboard-layout/use-effective-mac-option-as-alt'
 import {
   buildPreviewAppearanceOptions,
@@ -210,7 +211,11 @@ export function AgentTerminalPreview({
 
     const installImeNativeTextBridge = (): void => {
       if (terminal) {
-        imeBridge = installPreviewImeBridge(terminal)
+        // Why a live getter: kitty state can change between keydown and commit,
+        // and the tracker outlives every reconnect inside this effect.
+        imeBridge = installPreviewImeBridge(terminal, {
+          getKittyKeyboardFlags: () => kittyKeyboardModes.flags
+        })
       }
     }
 
@@ -304,22 +309,13 @@ export function AgentTerminalPreview({
           clamp(snap.rows ?? FALLBACK_ROWS, 2, 200)
         )
         terminal.reset()
-        // Why: the reset drops xterm's kitty flags, so the mirror must restart
-        // from the incoming snapshot instead of the dead session's state.
-        kittyKeyboardModes.reset()
-      }
-      if (snap.scrollbackAnsi) {
-        writeReplayed(snap.scrollbackAnsi)
-      }
-      if (snap.data) {
-        writeReplayed(snap.data)
-      }
-      if (snap.pendingEscapeTailAnsi) {
-        writeReplayed(snap.pendingEscapeTailAnsi)
-      }
-      for (const data of connection.replay) {
-        writeReplayed(data)
       }
+      replayPreviewConnectionSnapshot({
+        snapshot: snap,
+        replay: connection.replay,
+        kittyKeyboardModes,
+        write: (chunk, live) => writeReplayed(chunk, undefined, live)
+      })
       for (const payload of pendingLivePayloads.splice(0)) {
         writeLive(payload)
       }
diff --git a/src/renderer/src/components/dashboard-popout/DashboardHostBadge.test.tsx b/src/renderer/src/components/dashboard-popout/DashboardHostBadge.test.tsx
new file mode 100644
index 00000000000..08211439eb7
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/DashboardHostBadge.test.tsx
@@ -0,0 +1,54 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it } from 'vitest'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { DashboardHostBadge } from './DashboardHostBadge'
+
+afterEach(cleanup)
+
+describe('DashboardHostBadge', () => {
+  it('names a saved SSH host in its focusable tooltip', async () => {
+    render(
+      <TooltipProvider>
+        <DashboardHostBadge
+          hostKind="ssh"
+          executionHostId="ssh:opaque-target"
+          hostLabel="openclaw"
+          keyboardFocusable
+        />
+      </TooltipProvider>
+    )
+
+    const badge = screen.getByLabelText('SSH host · openclaw')
+    expect(badge).toHaveAttribute('data-dashboard-host-badge', 'ssh')
+    expect(badge.querySelector('.lucide-server')).toBeInTheDocument()
+
+    fireEvent.focus(badge)
+    expect(await screen.findByRole('tooltip')).toHaveTextContent('SSH host · openclaw')
+  })
+
+  it('distinguishes paired Orca hosts and omits local hosts', () => {
+    const { rerender } = render(
+      <TooltipProvider>
+        <DashboardHostBadge
+          hostKind="remote"
+          executionHostId="runtime:server-1"
+          hostLabel="Build Mac"
+        />
+      </TooltipProvider>
+    )
+
+    const badge = screen.getByLabelText('Remote Orca host · Build Mac')
+    expect(badge).toHaveAttribute('data-dashboard-host-badge', 'remote')
+    expect(badge.querySelector('.lucide-server')).toBeInTheDocument()
+
+    rerender(
+      <TooltipProvider>
+        <DashboardHostBadge hostKind="local" executionHostId="local" />
+      </TooltipProvider>
+    )
+    expect(screen.queryByLabelText(/host/i)).not.toBeInTheDocument()
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/DashboardHostBadge.tsx b/src/renderer/src/components/dashboard-popout/DashboardHostBadge.tsx
new file mode 100644
index 00000000000..6b8f0d88f03
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/DashboardHostBadge.tsx
@@ -0,0 +1,81 @@
+import { Server } from 'lucide-react'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+import type { DashboardCardHostKind } from '../../../../shared/dashboard-snapshot'
+import { parseExecutionHostId, type ExecutionHostId } from '../../../../shared/execution-host'
+
+type DashboardHostBadgeProps = {
+  hostKind?: DashboardCardHostKind
+  executionHostId?: ExecutionHostId
+  hostLabel?: string
+  keyboardFocusable?: boolean
+  className?: string
+  iconClassName?: string
+}
+
+function fallbackHostLabel(executionHostId: ExecutionHostId | undefined): string | null {
+  const parsed = parseExecutionHostId(executionHostId)
+  if (parsed?.kind === 'ssh') {
+    return parsed.targetId
+  }
+  if (parsed?.kind === 'runtime') {
+    return parsed.environmentId
+  }
+  return null
+}
+
+export function dashboardHostTooltipLabel({
+  hostKind,
+  executionHostId,
+  hostLabel
+}: Pick<DashboardHostBadgeProps, 'hostKind' | 'executionHostId' | 'hostLabel'>): string | null {
+  if (hostKind !== 'ssh' && hostKind !== 'remote') {
+    return null
+  }
+  const label = hostLabel?.trim() || fallbackHostLabel(executionHostId)
+  if (hostKind === 'ssh') {
+    return label
+      ? translate('dashboardPopout.host.sshNamed', 'SSH host · {{host}}', { host: label })
+      : translate('dashboardPopout.host.ssh', 'SSH host')
+  }
+  return label
+    ? translate('dashboardPopout.host.remoteNamed', 'Remote Orca host · {{host}}', { host: label })
+    : translate('dashboardPopout.host.remote', 'Remote Orca host')
+}
+
+export function DashboardHostBadge({
+  hostKind,
+  executionHostId,
+  hostLabel,
+  keyboardFocusable = false,
+  className,
+  iconClassName
+}: DashboardHostBadgeProps): React.JSX.Element | null {
+  const tooltipLabel = dashboardHostTooltipLabel({ hostKind, executionHostId, hostLabel })
+  if (!tooltipLabel) {
+    return null
+  }
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <span
+          className={cn(
+            'inline-flex shrink-0 items-center justify-center text-muted-foreground',
+            keyboardFocusable &&
+              'pointer-events-auto focus-visible:rounded-sm focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none',
+            className
+          )}
+          data-dashboard-host-badge={hostKind}
+          aria-label={tooltipLabel}
+          tabIndex={keyboardFocusable ? 0 : undefined}
+        >
+          <Server className={cn('size-3', iconClassName)} aria-hidden />
+        </span>
+      </TooltipTrigger>
+      <TooltipContent side="top" sideOffset={4}>
+        {tooltipLabel}
+      </TooltipContent>
+    </Tooltip>
+  )
+}
diff --git a/src/renderer/src/components/dashboard-popout/agent-map-layout-metadata.ts b/src/renderer/src/components/dashboard-popout/agent-map-layout-metadata.ts
index 69238b73cf3..e24274b7718 100644
--- a/src/renderer/src/components/dashboard-popout/agent-map-layout-metadata.ts
+++ b/src/renderer/src/components/dashboard-popout/agent-map-layout-metadata.ts
@@ -1,5 +1,6 @@
-import type { DashboardCard } from '../../../../shared/dashboard-snapshot'
+import type { DashboardCard, DashboardWorkspace } from '../../../../shared/dashboard-snapshot'
 import type { AgentMapLayout, AgentMapStatusCounts } from './agent-map-layout'
+import { agentMapWorkspaceIdentity } from './agent-map-workspace-identity'
 import { agentMapDurationMinutes, agentMapNodeStatus } from './agent-map-node-metadata'
 
 function emptyStatusCounts(): AgentMapStatusCounts {
@@ -9,15 +10,25 @@ function emptyStatusCounts(): AgentMapStatusCounts {
 export function refreshAgentMapMetadata(
   geometry: AgentMapLayout,
   cards: DashboardCard[],
+  workspaces: DashboardWorkspace[],
   now: number
 ): AgentMapLayout {
   const cardsByPaneKey = new Map(cards.map((card) => [card.paneKey, card]))
+  const workspacesById = new Map(
+    workspaces.map((workspace) => [agentMapWorkspaceIdentity(workspace), workspace])
+  )
   const projects = geometry.projects.map((project) => {
     let projectName = project.name
     let agentCount = 0
     const worktrees = project.worktrees.map((worktree) => {
-      let worktreeName = worktree.name
-      let workspaceKind = worktree.workspaceKind
+      const workspace = workspacesById.get(worktree.id)
+      if (workspace) {
+        projectName = workspace.repoName
+      }
+      let worktreeName = workspace?.worktreeName ?? worktree.name
+      let workspaceKind = workspace?.workspaceKind ?? worktree.workspaceKind
+      let hostKind = workspace?.hostKind ?? worktree.hostKind
+      let hostLabel = workspace?.hostLabel ?? worktree.hostLabel
       const statusCounts = emptyStatusCounts()
       const agents = worktree.agents.flatMap((agent) => {
         const card = cardsByPaneKey.get(agent.card.paneKey)
@@ -27,6 +38,8 @@ export function refreshAgentMapMetadata(
         projectName = card.repoName
         worktreeName = card.worktreeName
         workspaceKind = card.workspaceKind ?? 'worktree'
+        hostKind = card.hostKind ?? hostKind
+        hostLabel = card.hostLabel ?? hostLabel
         agentCount += 1
         statusCounts[agentMapNodeStatus(card)] += 1
         return [
@@ -42,6 +55,8 @@ export function refreshAgentMapMetadata(
         ...worktree,
         name: worktreeName,
         workspaceKind,
+        hostKind,
+        hostLabel,
         agents,
         statusCounts,
         quiet: statusCounts.idle === agents.length
diff --git a/src/renderer/src/components/dashboard-popout/agent-map-layout.test.ts b/src/renderer/src/components/dashboard-popout/agent-map-layout.test.ts
index 52c47be08f5..c36cbda6ff2 100644
--- a/src/renderer/src/components/dashboard-popout/agent-map-layout.test.ts
+++ b/src/renderer/src/components/dashboard-popout/agent-map-layout.test.ts
@@ -142,6 +142,25 @@ describe('agent map layout', () => {
     )
   })
 
+  it('preserves remote host presentation on its workspace ring', () => {
+    const layout = deriveAgentMapLayout(
+      [
+        card({
+          executionHostId: 'ssh:opaque-target',
+          hostKind: 'ssh',
+          hostLabel: 'openclaw'
+        })
+      ],
+      NOW
+    )
+
+    expect(layout.projects[0].worktrees[0]).toMatchObject({
+      executionHostId: 'ssh:opaque-target',
+      hostKind: 'ssh',
+      hostLabel: 'openclaw'
+    })
+  })
+
   it('reserves project and workspace header bands above dense ring contents', () => {
     const layout = deriveAgentMapLayout(
       Array.from({ length: 24 }, (_unused, index) =>
@@ -448,6 +467,38 @@ describe('agent map layout', () => {
     expect(topologyChanged.cache.packingGeneration).toBe(2)
   })
 
+  it('refreshes saved host labels without repacking geometry', () => {
+    const cards = [
+      card({
+        executionHostId: 'ssh:builder',
+        hostKind: 'ssh',
+        hostLabel: 'Builder'
+      })
+    ]
+    const workspaces = [
+      workspace({
+        worktreeId: 'worktree-1',
+        executionHostId: 'ssh:builder',
+        hostKind: 'ssh',
+        hostLabel: 'Builder'
+      })
+    ]
+    const initial = updateAgentMapLayout(null, cards, NOW, workspaces)
+    packWorktrees.mockClear()
+
+    const updated = updateAgentMapLayout(
+      initial.cache,
+      cards.map((candidate) => ({ ...candidate, hostLabel: 'CI Builder' })),
+      NOW,
+      workspaces.map((candidate) => ({ ...candidate, hostLabel: 'CI Builder' }))
+    )
+
+    expect(updated.cache).toBe(initial.cache)
+    expect(updated.cache.packingGeneration).toBe(1)
+    expect(packWorktrees).not.toHaveBeenCalled()
+    expect(updated.layout.projects[0].worktrees[0].hostLabel).toBe('CI Builder')
+  })
+
   it('packs worktree rings tightly without a square grid', () => {
     const layout = deriveAgentMapLayout(
       Array.from({ length: 36 }, (_, index) =>
diff --git a/src/renderer/src/components/dashboard-popout/agent-map-layout.ts b/src/renderer/src/components/dashboard-popout/agent-map-layout.ts
index 79f5e7c77f0..f8a5d975233 100644
--- a/src/renderer/src/components/dashboard-popout/agent-map-layout.ts
+++ b/src/renderer/src/components/dashboard-popout/agent-map-layout.ts
@@ -13,6 +13,7 @@ import {
   agentMapWorktreeIdentityFromParts
 } from './agent-map-workspace-identity'
 import { layoutAgentMapWorktreeLineage } from './agent-map-worktree-lineage-layout'
+import { agentMapWorktreeHost } from './agent-map-worktree-host'
 
 type DashboardCard = DashboardSnapshotTypes.DashboardCard
 type DashboardCardDotState = DashboardSnapshotTypes.DashboardCardDotState
@@ -58,6 +59,8 @@ export type AgentMapWorktreeRing = {
   clusterParentId?: string
   worktreeId: string
   executionHostId: DashboardCard['executionHostId']
+  hostKind?: DashboardCard['hostKind']
+  hostLabel?: string
   name: string
   workspaceKind: NonNullable<DashboardCard['workspaceKind']>
   x: number
@@ -154,7 +157,8 @@ function buildLocalWorktree(
   for (const card of cards) {
     statusCounts[agentMapNodeStatus(card)] += 1
   }
-  const executionHostId = workspace?.executionHostId ?? cards[0]?.executionHostId
+  const host = agentMapWorktreeHost(cards, workspace)
+  const executionHostId = host.executionHostId
   const parentWorktreeId = workspace?.parentWorktreeId ?? cards[0]?.parentWorktreeId
   return {
     id,
@@ -162,7 +166,7 @@ function buildLocalWorktree(
       ? agentMapWorktreeIdentityFromParts(parentWorktreeId, executionHostId)
       : undefined,
     worktreeId: workspace?.worktreeId ?? cards[0]?.worktreeId ?? id,
-    executionHostId,
+    ...host,
     name: workspace?.worktreeName ?? cards[0]?.worktreeName ?? id,
     workspaceKind: workspace?.workspaceKind ?? cards[0]?.workspaceKind ?? 'worktree',
     x: 0,
@@ -316,6 +320,6 @@ export function updateAgentMapLayout(
       layout: geometry
     }
   }
-  const layout = refreshAgentMapMetadata(cache.geometry, cards, now)
+  const layout = refreshAgentMapMetadata(cache.geometry, cards, workspaces, now)
   return { cache, layout }
 }
diff --git a/src/renderer/src/components/dashboard-popout/agent-map-worktree-host.ts b/src/renderer/src/components/dashboard-popout/agent-map-worktree-host.ts
new file mode 100644
index 00000000000..247b3f5b08c
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/agent-map-worktree-host.ts
@@ -0,0 +1,25 @@
+import type { DashboardCard, DashboardWorkspace } from '../../../../shared/dashboard-snapshot'
+import { parseExecutionHostId } from '../../../../shared/execution-host'
+
+export function agentMapWorktreeHost(
+  cards: DashboardCard[],
+  workspace?: DashboardWorkspace
+): {
+  executionHostId: DashboardCard['executionHostId']
+  hostKind: DashboardCard['hostKind']
+  hostLabel: DashboardCard['hostLabel']
+} {
+  const executionHostId = workspace?.executionHostId ?? cards[0]?.executionHostId
+  const parsedHost = parseExecutionHostId(executionHostId)
+  const hostKind =
+    parsedHost?.kind === 'ssh'
+      ? 'ssh'
+      : parsedHost?.kind === 'runtime'
+        ? 'remote'
+        : (workspace?.hostKind ?? cards[0]?.hostKind)
+  return {
+    executionHostId,
+    hostKind,
+    hostLabel: workspace?.hostLabel ?? cards[0]?.hostLabel
+  }
+}
diff --git a/src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.ts b/src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.ts
index f3d32a9b462..816474eb70f 100644
--- a/src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.ts
+++ b/src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.ts
@@ -35,7 +35,7 @@ export function patchDashboardSnapshotFromAgentStatus(
     return { matched: true, snapshot }
   }
   const index = snapshot.cards.findIndex((card) => card.paneKey === event.paneKey)
-  if (index < 0) {
+  if (index === -1) {
     return { matched: false, snapshot }
   }
   const card = snapshot.cards[index]
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts
new file mode 100644
index 00000000000..3e69cd75d3b
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts
@@ -0,0 +1,281 @@
+// @vitest-environment happy-dom
+// The release oracle: exact outbound bytes from the REAL shared
+// forwarder behind installPreviewImeBridge. A wiring-only mock cannot show that
+// a Preview opened on a bit-3 TUI commits CSI-u, nor that exactly one release
+// leaves the forwarder in either macOS event order.
+import { Terminal } from '@xterm/xterm'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { installPreviewImeBridge } from './preview-terminal-ime-bridge'
+
+vi.mock('@/lib/shortcut-platform', () => ({
+  getShortcutPlatform: () => 'darwin'
+}))
+
+const COMMA = { key: ',', code: 'Comma', keyCode: 188 }
+
+type Session = {
+  emitted: string[]
+  flagReads: number
+  setFlags: (flags: number) => void
+  keydown: (init?: { shiftKey?: boolean; repeat?: boolean; key?: string; code?: string }) => void
+  keyup: (init?: { shiftKey?: boolean; key?: string; code?: string }) => void
+  commit: (text: string) => void
+  /** An input event the text system produced without committing text. */
+  swallow: () => void
+  xtermKittyFlags: () => number
+  dispose: () => void
+}
+
+function open(initialFlags: number): Session {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const terminal = new Terminal()
+  terminal.open(container)
+  const textarea = terminal.textarea!
+  let flags = initialFlags
+  let flagReads = 0
+  const bridge = installPreviewImeBridge(terminal, {
+    getKittyKeyboardFlags: () => {
+      flagReads += 1
+      return flags
+    }
+  })!
+  terminal.attachCustomKeyEventHandler((event) => !bridge.claimKeyEvent(event))
+  const emitted: string[] = []
+  terminal.onData((data) => emitted.push(data))
+
+  const key = (
+    type: string,
+    init: { key?: string; code?: string; shiftKey?: boolean; repeat?: boolean }
+  ): void => {
+    const event = new KeyboardEvent(type, {
+      key: init.key ?? COMMA.key,
+      code: init.code ?? COMMA.code,
+      shiftKey: init.shiftKey === true,
+      repeat: init.repeat === true,
+      bubbles: true,
+      cancelable: true
+    })
+    Object.defineProperty(event, 'keyCode', { value: COMMA.keyCode })
+    textarea.dispatchEvent(event)
+  }
+
+  const input = (data: string | null): void => {
+    for (const type of ['beforeinput', 'input']) {
+      const event = new InputEvent(type, { bubbles: true })
+      Object.defineProperty(event, 'inputType', { value: 'insertText' })
+      Object.defineProperty(event, 'data', { value: data })
+      textarea.dispatchEvent(event)
+    }
+  }
+
+  return {
+    emitted,
+    get flagReads() {
+      return flagReads
+    },
+    setFlags: (next) => {
+      flags = next
+    },
+    keydown: (init = {}) => key('keydown', init),
+    keyup: (init = {}) => key('keyup', init),
+    commit: (text) => input(text),
+    swallow: () => input(null),
+    xtermKittyFlags: () =>
+      (
+        terminal as unknown as {
+          _core?: { coreService?: { kittyKeyboard?: { flags?: number } } }
+        }
+      )._core?.coreService?.kittyKeyboard?.flags ?? 0,
+    dispose: () => {
+      bridge.dispose()
+      terminal.dispose()
+    }
+  }
+}
+
+describe('preview IME bridge outbound bytes', () => {
+  beforeEach(() => {
+    vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockReturnValue({
+      measureText: () => ({ width: 10 })
+    } as unknown as CanvasRenderingContext2D)
+  })
+  afterEach(() => {
+    vi.restoreAllMocks()
+    document.body.replaceChildren()
+  })
+
+  // The bug: the bridge omitted getKittyKeyboardFlags entirely, so every commit
+  // was evaluated at flags 0 and a bit-3 TUI received the legacy text it declined.
+  it('encodes the commit from the flags proven before any live output', () => {
+    const session = open(8)
+    session.keydown()
+    session.commit('，')
+    session.keyup()
+    expect(session.emitted.join('')).toBe('\x1b[44u')
+    session.dispose()
+  })
+
+  describe.each([
+    ['keydown -> insertText -> keyup', false],
+    // An ordering some macOS input sources use; the earlier design cleared the
+    // claimed press here, so the later commit could never be encoded as CSI-u.
+    ['keydown -> keyup -> insertText', true]
+  ])('in %s order', (_name, keyupFirst) => {
+    const type = (session: Session): void => {
+      session.keydown()
+      if (keyupFirst) {
+        session.keyup()
+        session.commit('，')
+      } else {
+        session.commit('，')
+        session.keyup()
+      }
+    }
+
+    it.each([
+      ['no flags', 0, '，'],
+      ['disambiguate only', 1, '，'],
+      ['event types', 2, '，\x1b[44;1:3u'],
+      ['all keys as escape codes', 8, '\x1b[44u'],
+      ['all keys + event types', 10, '\x1b[44u\x1b[44;1:3u']
+    ])('emits the %s byte shape', (_flagName, flags, expected) => {
+      const session = open(flags)
+      type(session)
+      expect(session.emitted.join('')).toBe(expected)
+      session.dispose()
+    })
+
+    it('owns the release even though xterm holds no kitty state', () => {
+      const session = open(10)
+      // The forwarder must not delegate the keyup: Preview deliberately never
+      // restores kitty flags into xterm, so xterm would emit nothing here.
+      expect(session.xtermKittyFlags()).toBe(0)
+      type(session)
+      expect(session.emitted.join('')).toBe('\x1b[44u\x1b[44;1:3u')
+      session.dispose()
+    })
+
+    it('reads the mutable getter exactly once, at commit time', () => {
+      const session = open(0)
+      session.keydown()
+      expect(session.flagReads).toBe(0)
+      session.setFlags(8)
+      if (keyupFirst) {
+        session.keyup()
+        expect(session.flagReads).toBe(0)
+        session.commit('，')
+      } else {
+        session.commit('，')
+        session.keyup()
+      }
+      expect(session.flagReads).toBe(1)
+      // The commit-time read is what both the press AND its release encode from.
+      expect(session.emitted.join('')).toBe('\x1b[44u')
+      session.dispose()
+    })
+
+    it('emits nothing when the input source swallowed the press', () => {
+      const session = open(10)
+      session.keydown()
+      if (keyupFirst) {
+        session.keyup()
+        session.swallow()
+      } else {
+        session.swallow()
+        session.keyup()
+      }
+      // A release describes a press the app received; none did.
+      expect(session.emitted.join('')).toBe('')
+      session.dispose()
+    })
+  })
+
+  it('encodes the release from the keyup state when Shift is released first', () => {
+    const session = open(10)
+    // `!` on Digit1: the press reports the base key with the Shift modifier.
+    session.keydown({ key: '!', code: 'Digit1', shiftKey: true })
+    session.commit('！')
+    session.keyup({ key: '1', code: 'Digit1', shiftKey: false })
+    // 49 is `1`; the release carries no modifier because none was held at release.
+    expect(session.emitted.join('')).toBe('\x1b[49;2u\x1b[49;1:3u')
+    session.dispose()
+  })
+
+  it('emits one release for a held key across auto-repeat', () => {
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.keydown({ repeat: true })
+    session.commit('，')
+    session.keyup()
+    // Press, repeat, then exactly one release for the single physical press.
+    expect(session.emitted.join('')).toBe('\x1b[44u\x1b[44;1:2u\x1b[44;1:3u')
+    session.dispose()
+  })
+
+  it('keeps an owed release when a later repeat commits under flags that owe none', () => {
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.setFlags(8)
+    session.keydown({ repeat: true })
+    session.commit('，')
+    session.setFlags(10)
+    session.keyup()
+    // The repeat requested no event types, but its commit must not erase the
+    // release the delivered first press still owes under the flags it was
+    // sent with.
+    expect(session.emitted.join('')).toBe('\x1b[44u\x1b[44u\x1b[44;1:3u')
+    session.dispose()
+  })
+
+  it('suppresses the owed release when event types are no longer negotiated at keyup', () => {
+    // xterm parity: KittyKeyboard.evaluate drops RELEASE reports the moment
+    // report_event_types is gone, so an app that popped the mode — or the
+    // successor shell of a TUI that quit on this very key — never receives
+    // CSI-u bytes it did not negotiate.
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.setFlags(0)
+    session.keyup()
+    expect(session.emitted.join('')).toBe('\x1b[44u')
+    session.dispose()
+  })
+
+  it('releases each key of a two-key rollover exactly once', () => {
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.keydown({ key: '.', code: 'Period' })
+    session.commit('。')
+    session.keyup()
+    session.keyup({ key: '.', code: 'Period' })
+    expect(session.emitted.join('')).toBe('\x1b[44u\x1b[46u\x1b[44;1:3u\x1b[46;1:3u')
+    session.dispose()
+  })
+
+  it('leaves no release behind when a claim is retired without committing', () => {
+    const session = open(10)
+    session.keydown()
+    // The input source ate the first press; the next keydown retires it.
+    session.keydown({ key: '.', code: 'Period' })
+    session.commit('。')
+    session.keyup()
+    session.keyup({ key: '.', code: 'Period' })
+    expect(session.emitted.join('')).toBe('\x1b[46u\x1b[46;1:3u')
+    session.dispose()
+  })
+
+  it('synthesizes nothing on blur or disposal', () => {
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.emitted.length = 0
+    document.querySelector('.xterm')?.dispatchEvent(new FocusEvent('blur', { bubbles: true }))
+    session.keyup()
+    session.dispose()
+    expect(session.emitted.join('')).toBe('')
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge.ts
index 5171a529edb..dcfa851d920 100644
--- a/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge.ts
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge.ts
@@ -9,14 +9,29 @@ export type PreviewImeBridge = {
   dispose: () => void
 }
 
+export type PreviewImeBridgeOptions = {
+  /**
+   * The preview's live kitty mirror, read once per commit. Required, not
+   * optional: omitting it evaluated every commit at flags `0`, so a Preview on
+   * a bit-3 TUI silently sent legacy text the app had declined.
+   */
+  getKittyKeyboardFlags: () => number
+}
+
 /**
  * Native-text bridge for the preview terminal.
  *
  * Why: xterm's kitty encoder can encode+cancel a printable keydown before
  * Chromium commits IME/native text, silently dropping the glyph. Mirrors
  * TerminalPane's forwarder, macOS-only like the pane's install.
+ *
+ * Bit policy stays in terminal-ime-kitty-commit-encoding.ts: the getter is
+ * forwarded unchanged, never masked or reduced to a boolean.
  */
-export function installPreviewImeBridge(terminal: Terminal): PreviewImeBridge | null {
+export function installPreviewImeBridge(
+  terminal: Terminal,
+  options: PreviewImeBridgeOptions
+): PreviewImeBridge | null {
   if (getShortcutPlatform() !== 'darwin') {
     return null
   }
@@ -24,7 +39,8 @@ export function installPreviewImeBridge(terminal: Terminal): PreviewImeBridge |
   const forwarder = installTerminalImeNativeTextForwarder({
     terminalElement: terminal.element,
     isComposing: () => compositionTracker?.isActive() ?? false,
-    sendInput: (data) => terminal.input(data)
+    sendInput: (data) => terminal.input(data),
+    getKittyKeyboardFlags: options.getKittyKeyboardFlags
   })
   return {
     claimKeyEvent: (event) => forwarder?.claimKeyEvent(event) ?? false,
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts
new file mode 100644
index 00000000000..3e288626259
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts
@@ -0,0 +1,124 @@
+import { describe, expect, it } from 'vitest'
+import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import type {
+  TerminalPreviewReplayChunk,
+  TerminalPreviewSnapshot
+} from '../../../../shared/terminal-preview'
+import { replayPreviewConnectionSnapshot } from './preview-terminal-snapshot-replay'
+
+function apply(
+  snapshot: Partial<TerminalPreviewSnapshot>,
+  replay: TerminalPreviewReplayChunk[] = [],
+  kittyKeyboardModes = new TerminalKittyKeyboardModeTracker()
+): { modes: TerminalKittyKeyboardModeTracker; written: string[] } {
+  const written: string[] = []
+  replayPreviewConnectionSnapshot({
+    snapshot: { data: '', cols: 80, rows: 24, ...snapshot },
+    replay,
+    kittyKeyboardModes,
+    write: (chunk, live) => {
+      written.push(chunk)
+      if (live) {
+        kittyKeyboardModes.scan(chunk)
+      } else {
+        kittyKeyboardModes.scanReplay(chunk)
+      }
+    }
+  })
+  return { modes: kittyKeyboardModes, written }
+}
+
+// The Preview's mirror is the only thing that can tell the IME
+// forwarder what the TUI negotiated, and snapshot ANSI never carries kitty
+// pushes — so the flags have to arrive as metadata and be applied in order.
+describe('replayPreviewConnectionSnapshot', () => {
+  it('adopts flags the snapshot owner proved, before any live output', () => {
+    const { modes } = apply({ kittyKeyboardFlags: 8 })
+    expect(modes.flags).toBe(8)
+    expect(modes.snapshotFlags).toBe(8)
+  })
+
+  it('leaves the mirror unproven and at the raw-text fallback when the field is absent', () => {
+    const { modes } = apply({ data: 'plain output' })
+    expect(modes.flags).toBe(0)
+    expect(modes.snapshotFlags).toBeUndefined()
+
+    // A later explicit negotiation still upgrades it.
+    modes.scan('\x1b[>8u')
+    expect(modes.flags).toBe(8)
+  })
+
+  it('replaces an earlier 8 when a replacement snapshot proves 0', () => {
+    const modes = new TerminalKittyKeyboardModeTracker()
+    apply({ kittyKeyboardFlags: 8 }, [], modes)
+    apply({ kittyKeyboardFlags: 0 }, [], modes)
+    expect(modes.flags).toBe(0)
+    expect(modes.snapshotFlags).toBe(0)
+  })
+
+  it('carries live-proven flags across a resync snapshot that proves nothing', () => {
+    // A grid change or capture overflow against an old host fetches a
+    // replacement snapshot with no kitty metadata; wiping the mirror there
+    // reintroduces the raw-text-into-a-bit-3-TUI bug on every resync.
+    const modes = new TerminalKittyKeyboardModeTracker()
+    apply({ data: 'first frame' }, [], modes)
+    modes.scan('\x1b[>8u')
+    apply({ data: 'second frame' }, [], modes)
+    expect(modes.flags).toBe(8)
+    expect(modes.snapshotFlags).toBe(8)
+  })
+
+  it('carries nothing across a flagless snapshot when the mirror never proved state', () => {
+    // The constructor's known-zero was never proven for the previewed PTY;
+    // carrying it would launder a fresh default into a host-proven inactive.
+    const modes = new TerminalKittyKeyboardModeTracker()
+    apply({ data: 'first frame' }, [], modes)
+    apply({ data: 'second frame' }, [], modes)
+    expect(modes.flags).toBe(0)
+    expect(modes.snapshotFlags).toBeUndefined()
+  })
+
+  it('keeps proven flags across a replacement snapshot whose ANSI carries no kitty bytes', () => {
+    // The resync path used to reset the mirror and then scan kitty-free ANSI,
+    // which is what silently dropped a live TUI's negotiation.
+    const modes = new TerminalKittyKeyboardModeTracker()
+    apply({ data: 'first frame' }, [], modes)
+    apply({ data: 'second frame', cols: 90, rows: 30, kittyKeyboardFlags: 8 }, [], modes)
+    expect(modes.flags).toBe(8)
+  })
+
+  it('restores onto the screen the snapshot scan selected', () => {
+    const { modes } = apply({ data: '\x1b[?1049h', kittyKeyboardFlags: 8 })
+    expect(modes.isAlternateScreen).toBe(true)
+    expect(modes.snapshotFlags).toBe(8)
+    // Leaving the alternate screen returns to the main screen's own slot, which
+    // this snapshot never proved.
+    modes.scan('\x1b[?1049l')
+    expect(modes.snapshotFlags).toBeUndefined()
+  })
+
+  it('advances a proven suffix with live semantics and applies redelivery idempotently', () => {
+    const { modes } = apply({ kittyKeyboardFlags: 0 }, [
+      { data: '\x1b[>8u', mode: 'live' },
+      // A redelivered push applied as a push would leave the app's single pop
+      // landing on a stale frame.
+      { data: '\x1b[>8u', mode: 'replay' }
+    ])
+    expect(modes.flags).toBe(8)
+    modes.scan('\x1b[<u')
+    expect(modes.flags).toBe(0)
+    expect(modes.snapshotFlags).toBe(0)
+  })
+
+  it('writes scrollback, frame, escape tail, then replay, in that order', () => {
+    const { written } = apply(
+      {
+        scrollbackAnsi: 'history',
+        data: 'frame',
+        pendingEscapeTailAnsi: '\x1b['
+      },
+      [{ data: 'tail', mode: 'live' }]
+    )
+    expect(written).toEqual(['history', 'frame', '\x1b[', 'tail'])
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts
new file mode 100644
index 00000000000..43d4333cc17
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts
@@ -0,0 +1,41 @@
+import type { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import { parseTerminalKittyKeyboardFlags } from '../../../../shared/terminal-kitty-keyboard-flags'
+import type {
+  TerminalPreviewReplayChunk,
+  TerminalPreviewSnapshot
+} from '../../../../shared/terminal-preview'
+
+/**
+ * Apply snapshot + buffered replay, restoring proven kitty flags after the
+ * snapshot scan (snapshot ANSI omits kitty pushes). Synchronous so no browser
+ * event observes the temporary reset.
+ */
+export function replayPreviewConnectionSnapshot(args: {
+  snapshot: TerminalPreviewSnapshot
+  replay: TerminalPreviewReplayChunk[]
+  kittyKeyboardModes: TerminalKittyKeyboardModeTracker
+  /** Scans the chunk into the mirror and queues it for xterm. */
+  write: (chunk: string, live: boolean) => void
+}): void {
+  const { snapshot, kittyKeyboardModes } = args
+  // Why: carry only live-proven flags across a flagless resync; a fresh mirror's zero is ungrounded.
+  const provenFlags =
+    parseTerminalKittyKeyboardFlags(snapshot.kittyKeyboardFlags) ??
+    (kittyKeyboardModes.hasProvenBaseline ? kittyKeyboardModes.snapshotFlags : undefined)
+  kittyKeyboardModes.resetForSnapshot()
+  if (snapshot.scrollbackAnsi) {
+    args.write(snapshot.scrollbackAnsi, false)
+  }
+  if (snapshot.data) {
+    args.write(snapshot.data, false)
+  }
+  if (snapshot.pendingEscapeTailAnsi) {
+    args.write(snapshot.pendingEscapeTailAnsi, false)
+  }
+  if (provenFlags !== undefined) {
+    kittyKeyboardModes.restoreSnapshotFlags(provenFlags)
+  }
+  for (const chunk of args.replay) {
+    args.write(chunk.data, chunk.mode === 'live')
+  }
+}
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
index 92df277ef9d..84116333a1c 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest'
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
 import { lastEnteredDoneAt } from './agent-finished-timestamp'
 
@@ -37,3 +38,17 @@ describe('lastEnteredDoneAt session boundaries (STA-3386)', () => {
     ).toBe(1_000)
   })
 })
+
+describe('lastEnteredDoneAt shares the Smart Sort completion clock', () => {
+  it('times an ordinary completion from stateStartedAt, not updatedAt', () => {
+    const entry = doneEntry({ stateStartedAt: 2_000, updatedAt: 190_000 })
+    expect(lastEnteredDoneAt(row(entry))).toBe(2_000)
+    expect(agentEntryCompletionAt(entry)).toBe(2_000)
+  })
+
+  it('still shows when an interrupted turn stopped, though it never ranks as done', () => {
+    const entry = doneEntry({ interrupted: true, stateStartedAt: 2_000 })
+    expect(lastEnteredDoneAt(row(entry))).toBe(2_000)
+    expect(agentEntryCompletionAt(entry)).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
index 6449e570fe1..599a07d118a 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
@@ -1,3 +1,4 @@
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import type { DashboardAgentRow } from './useDashboardData'
 
 /**
@@ -15,9 +16,15 @@ export function lastEnteredDoneAt(
     return null
   }
   const entry = agent.entry
-  // Why: a session-boundary done means the session connected idle (STA-3386) — nothing
-  // finished; fall through to history (which never records session boundaries).
-  if (entry.state === 'done' && entry.sessionBoundary !== true) {
+  // Why: same primitive Smart Sort ranks on, so the displayed age and Done eligibility share a clock.
+  // (Session-boundary `done` means the session connected idle — STA-3386 — so it resolves to the real
+  // completion it displaced, if any.)
+  const completedAt = agentEntryCompletionAt(entry)
+  if (completedAt !== null) {
+    return completedAt
+  }
+  // Why: display is looser than ranking — an interrupted turn still shows when it stopped.
+  if (entry.state === 'done' && entry.interrupted === true && entry.sessionBoundary !== true) {
     return entry.stateStartedAt
   }
   for (let i = (entry.stateHistory?.length ?? 0) - 1; i >= 0; i--) {
diff --git a/src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts b/src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts
index f5db7045970..822a3b80e96 100644
--- a/src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts
+++ b/src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts
@@ -100,7 +100,9 @@ function state(): DashboardSnapshotState {
 
 describe('buildDashboardSnapshot folder workspaces', () => {
   it('places folder-workspace agents in their real project group without git assumptions', () => {
-    const snapshot = buildDashboardSnapshot(state(), NOW)
+    const sshState = state()
+    sshState.sshTargetLabels = new Map([['ssh-1', 'openclaw']])
+    const snapshot = buildDashboardSnapshot(sshState, NOW)
 
     expect(snapshot.cards).toHaveLength(1)
     expect(snapshot.cards[0]).toMatchObject({
@@ -111,7 +113,8 @@ describe('buildDashboardSnapshot folder workspaces', () => {
       worktreeName: 'Docs workspace',
       workspaceKind: 'folder',
       hostKind: 'ssh',
-      executionHostId: 'ssh:ssh-1'
+      executionHostId: 'ssh:ssh-1',
+      hostLabel: 'openclaw'
     })
     expect(snapshot.filterOptions?.projects).toEqual([
       { id: 'folder-workspace:group-1', label: 'Documentation' }
@@ -124,7 +127,8 @@ describe('buildDashboardSnapshot folder workspaces', () => {
         worktreeName: 'Docs workspace',
         workspaceKind: 'folder',
         hostKind: 'ssh',
-        executionHostId: 'ssh:ssh-1'
+        executionHostId: 'ssh:ssh-1',
+        hostLabel: 'openclaw'
       })
     ])
   })
@@ -135,10 +139,35 @@ describe('buildDashboardSnapshot folder workspaces', () => {
       { ...folderWorkspace(), connectionId: null, executionHostId: 'runtime:environment-1' }
     ]
     runtimeState.projectGroups = [{ ...projectGroup(), connectionId: null }]
+    runtimeState.runtimeEnvironments = [
+      { id: 'environment-1', name: 'Build Mac' }
+    ] as unknown as DashboardSnapshotState['runtimeEnvironments']
 
     const snapshot = buildDashboardSnapshot(runtimeState, NOW)
 
     expect(snapshot.cards[0].hostKind).toBe('remote')
     expect(snapshot.cards[0].executionHostId).toBe('runtime:environment-1')
+    expect(snapshot.cards[0].hostLabel).toBe('Build Mac')
+  })
+
+  it('uses the user-facing host label override', () => {
+    const runtimeState = state()
+    runtimeState.folderWorkspaces = [
+      { ...folderWorkspace(), connectionId: null, executionHostId: 'runtime:environment-1' }
+    ]
+    runtimeState.projectGroups = [{ ...projectGroup(), connectionId: null }]
+    runtimeState.runtimeEnvironments = [
+      { id: 'environment-1', name: 'Build Mac' }
+    ] as unknown as DashboardSnapshotState['runtimeEnvironments']
+    runtimeState.settings = {
+      hostSettingOverrides: {
+        'runtime:environment-1': { displayLabel: 'CI Builder' }
+      }
+    } as unknown as DashboardSnapshotState['settings']
+
+    const snapshot = buildDashboardSnapshot(runtimeState, NOW)
+
+    expect(snapshot.cards[0].hostLabel).toBe('CI Builder')
+    expect(snapshot.workspaces?.[0].hostLabel).toBe('CI Builder')
   })
 })
diff --git a/src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts b/src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts
index 90630a3d924..d4e9bdc565a 100644
--- a/src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts
+++ b/src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts
@@ -603,6 +603,50 @@ describe('buildDashboardSnapshot', () => {
     expect(mapMetadataCalls.parentPaneKey).not.toHaveBeenCalled()
   })
 
+  it('indexes runtime host labels once per detailed snapshot', () => {
+    let environmentIdReads = 0
+    const environmentCount = 24
+    const runtimeEnvironments = Array.from({ length: environmentCount }, (_, index) => {
+      const environment = { id: `environment-${index}`, name: `Builder ${index}` }
+      Object.defineProperty(environment, 'id', {
+        enumerable: true,
+        get: () => {
+          environmentIdReads += 1
+          return `environment-${index}`
+        }
+      })
+      return environment
+    }) as unknown as DashboardSnapshotState['runtimeEnvironments']
+    const executionHostId = `runtime:environment-${environmentCount - 1}` as const
+
+    const snapshot = buildDashboardSnapshot(
+      baseState({
+        repos: [
+          {
+            id: 'r1',
+            path: '/r1',
+            displayName: 'Repo One',
+            badgeColor: '#000',
+            addedAt: 0,
+            executionHostId
+          }
+        ],
+        worktreesByRepo: {
+          r1: [
+            { ...worktree(), hostId: executionHostId },
+            { ...worktree('w2', 'wt-two'), hostId: executionHostId }
+          ]
+        },
+        runtimeEnvironments,
+        agentStatusByPaneKey: { [PANE_KEY]: entry({}) }
+      }),
+      NOW
+    )
+
+    expect(snapshot.cards[0].hostLabel).toBe(`Builder ${environmentCount - 1}`)
+    expect(environmentIdReads).toBe(environmentCount)
+  })
+
   it("resolves a live pty's host-input profile for card snapshots", () => {
     const snapshot = buildDashboardSnapshot(
       baseState({ agentStatusByPaneKey: { [PANE_KEY]: entry({}) } }),
diff --git a/src/renderer/src/components/dashboard/build-dashboard-snapshot.ts b/src/renderer/src/components/dashboard/build-dashboard-snapshot.ts
index 808ffba0236..53e959f489c 100644
--- a/src/renderer/src/components/dashboard/build-dashboard-snapshot.ts
+++ b/src/renderer/src/components/dashboard/build-dashboard-snapshot.ts
@@ -40,8 +40,8 @@ import {
   type DashboardCardContextState
 } from './dashboard-card-context'
 import {
-  dashboardCardMapWorkspaceMetadata,
-  collectActiveDashboardWorkspaces
+  collectActiveDashboardWorkspaces,
+  dashboardCardMapWorkspaceMetadata
 } from './dashboard-snapshot-workspaces'
 import {
   boundedLabel,
@@ -75,7 +75,11 @@ export type DashboardSnapshotState = Pick<
   | 'settings'
 > &
   DashboardCardContextState &
-  Partial<DashboardCardTerminalInputState & DashboardLaunchDetectionState>
+  Partial<
+    DashboardCardTerminalInputState &
+      DashboardLaunchDetectionState &
+      Pick<AppState, 'runtimeEnvironments' | 'sshTargetLabels'>
+  >
 
 /**
  * Derive the serializable dashboard snapshot from the live renderer store.
@@ -185,13 +189,19 @@ export function buildDashboardSnapshot(
       ? resolveDashboardCardContext(state, repo, worktree)
       : undefined
     if (workspaces && workspaces.length < DASHBOARD_MAX_MAP_WORKSPACES) {
+      const hostMetadata = dashboardCardMapWorkspaceMetadata(
+        workspace,
+        null,
+        undefined,
+        clientHost.platform
+      )
       workspaces.push({
         repoId: workspace.projectId,
         worktreeId,
         repoName: boundedLabel(workspace.projectName),
         worktreeName: boundedLabel(worktree.displayName),
         ...(parentWorktreeId ? { parentWorktreeId } : {}),
-        ...dashboardCardMapWorkspaceMetadata(workspace, null, undefined, clientHost.platform),
+        ...hostMetadata,
         workspaceStatusId: context?.workspaceStatus.id,
         workspaceStatusLabel: context?.workspaceStatus.label,
         workspaceStatusColor: context?.workspaceStatus.color,
@@ -246,6 +256,14 @@ export function buildDashboardSnapshot(
             })
           : null
       const finishedAt = lastEnteredDoneAt(row)
+      const hostMetadata = includeCardDetails
+        ? dashboardCardMapWorkspaceMetadata(
+            workspace,
+            ptyId,
+            terminalInput ?? undefined,
+            clientHost.platform
+          )
+        : undefined
       // Only repos that actually contribute a card ship their icon.
       repoIconsByRepoId[workspace.projectId] = workspace.repoIcon
 
@@ -266,12 +284,7 @@ export function buildDashboardSnapshot(
           ? {
               parentPaneKey: dashboardCardParentPaneKey(row),
               ...(parentWorktreeId ? { parentWorktreeId } : {}),
-              ...dashboardCardMapWorkspaceMetadata(
-                workspace,
-                ptyId,
-                terminalInput ?? undefined,
-                clientHost.platform
-              )
+              ...hostMetadata
             }
           : {}),
         workspaceStatusId: context?.workspaceStatus.id,
diff --git a/src/renderer/src/components/dashboard/dashboard-snapshot-workspaces.ts b/src/renderer/src/components/dashboard/dashboard-snapshot-workspaces.ts
index a83619511f8..fcb34581414 100644
--- a/src/renderer/src/components/dashboard/dashboard-snapshot-workspaces.ts
+++ b/src/renderer/src/components/dashboard/dashboard-snapshot-workspaces.ts
@@ -1,13 +1,21 @@
 import type { AppState } from '@/store/types'
 import { getRemoteRuntimePtyEnvironmentId } from '@/runtime/runtime-terminal-stream'
-import type {
-  DashboardCard,
-  DashboardCardHostKind,
-  DashboardCardWorkspaceKind
+import {
+  DASHBOARD_MAX_LABEL_LENGTH,
+  type DashboardCard,
+  type DashboardCardHostKind,
+  type DashboardCardWorkspaceKind
 } from '../../../../shared/dashboard-snapshot'
 import type { RepoIcon } from '../../../../shared/repo-icon'
-import { getWorktreeExecutionHostId, type ExecutionHostId } from '../../../../shared/execution-host'
+import {
+  getWorktreeExecutionHostId,
+  parseExecutionHostId,
+  toRuntimeExecutionHostId,
+  toSshExecutionHostId,
+  type ExecutionHostId
+} from '../../../../shared/execution-host'
 import { folderWorkspaceToWorktree } from '../../../../shared/folder-workspace-worktree'
+import { getHostDisplayLabelOverrides } from '../../../../shared/host-setting-overrides'
 import { isFolderRepo } from '../../../../shared/repo-kind'
 import { parseAppSshPtyId } from '../../../../shared/ssh-pty-id'
 
@@ -19,10 +27,32 @@ export type ActiveDashboardWorkspace = {
   worktree: AppState['worktreesByRepo'][string][number] & { parentWorktreeId?: string | null }
   workspaceKind: DashboardCardWorkspaceKind
   remoteHostKind: Extract<DashboardCardHostKind, 'ssh' | 'remote'> | null
+  hostLabel?: string
 }
 
 type DashboardWorkspaceState = Pick<AppState, 'repos' | 'worktreesByRepo'> &
-  Partial<Pick<AppState, 'folderWorkspaces' | 'projectGroups'>>
+  Partial<
+    Pick<
+      AppState,
+      'folderWorkspaces' | 'projectGroups' | 'runtimeEnvironments' | 'settings' | 'sshTargetLabels'
+    >
+  >
+
+function buildHostLabelLookup(
+  state: DashboardWorkspaceState
+): ReadonlyMap<ExecutionHostId, string> {
+  const labels = new Map<ExecutionHostId, string>()
+  for (const [targetId, label] of state.sshTargetLabels ?? []) {
+    labels.set(toSshExecutionHostId(targetId), label)
+  }
+  for (const environment of state.runtimeEnvironments ?? []) {
+    labels.set(toRuntimeExecutionHostId(environment.id), environment.name)
+  }
+  for (const [hostId, label] of getHostDisplayLabelOverrides(state.settings)) {
+    labels.set(hostId, label)
+  }
+  return labels
+}
 
 function remoteHostKind(
   connectionId: string | null | undefined,
@@ -40,6 +70,20 @@ export function collectActiveDashboardWorkspaces(
 ): ActiveDashboardWorkspace[] {
   const workspaces: ActiveDashboardWorkspace[] = []
   const seenWorkspaceIds = new Set<string>()
+  let hostLabels: ReadonlyMap<ExecutionHostId, string> | null = null
+  const resolveHostLabel = (executionHostId: ExecutionHostId): string | undefined => {
+    const parsed = includeMapMetadata ? parseExecutionHostId(executionHostId) : null
+    if (parsed?.kind !== 'ssh' && parsed?.kind !== 'runtime') {
+      return undefined
+    }
+    hostLabels ??= buildHostLabelLookup(state)
+    const label =
+      hostLabels.get(executionHostId) ??
+      (parsed.kind === 'ssh' ? parsed.targetId : parsed.environmentId)
+    return label.length > DASHBOARD_MAX_LABEL_LENGTH
+      ? label.slice(0, DASHBOARD_MAX_LABEL_LENGTH)
+      : label
+  }
 
   for (const repo of state.repos ?? []) {
     for (const worktree of state.worktreesByRepo?.[repo.id] ?? []) {
@@ -47,6 +91,9 @@ export function collectActiveDashboardWorkspaces(
         continue
       }
       seenWorkspaceIds.add(worktree.id)
+      const workspaceHostLabel = includeMapMetadata
+        ? resolveHostLabel(getWorktreeExecutionHostId(worktree, repo))
+        : undefined
       workspaces.push({
         projectId: repo.id,
         projectName: repo.displayName,
@@ -56,7 +103,8 @@ export function collectActiveDashboardWorkspaces(
         workspaceKind: includeMapMetadata && isFolderRepo(repo) ? 'folder' : 'worktree',
         remoteHostKind: includeMapMetadata
           ? remoteHostKind(repo.connectionId, worktree.hostId ?? repo.executionHostId)
-          : null
+          : null,
+        ...(workspaceHostLabel ? { hostLabel: workspaceHostLabel } : {})
       })
     }
   }
@@ -70,6 +118,9 @@ export function collectActiveDashboardWorkspaces(
       continue
     }
     const projectGroup = projectGroupsById.get(folderWorkspace.projectGroupId)
+    const workspaceHostLabel = includeMapMetadata
+      ? resolveHostLabel(getWorktreeExecutionHostId(worktree, undefined))
+      : undefined
     workspaces.push({
       projectId: `folder-workspace:${folderWorkspace.projectGroupId}`,
       projectName: projectGroup?.name ?? folderWorkspace.name,
@@ -82,7 +133,8 @@ export function collectActiveDashboardWorkspaces(
             folderWorkspace.connectionId ?? projectGroup?.connectionId,
             worktree.hostId ?? projectGroup?.executionHostId
           )
-        : null
+        : null,
+      ...(workspaceHostLabel ? { hostLabel: workspaceHostLabel } : {})
     })
   }
   return workspaces
@@ -115,10 +167,12 @@ export function dashboardCardMapWorkspaceMetadata(
   hostKind: DashboardCardHostKind
   executionHostId: ExecutionHostId
   workspaceKind: DashboardCardWorkspaceKind
+  hostLabel?: string
 } {
   return {
     hostKind: dashboardCardHostKind(workspace, ptyId, terminalInput, clientPlatform),
     executionHostId: getWorktreeExecutionHostId(workspace.worktree, workspace.repo ?? undefined),
-    workspaceKind: workspace.workspaceKind
+    workspaceKind: workspace.workspaceKind,
+    ...(workspace.hostLabel ? { hostLabel: workspace.hostLabel } : {})
   }
 }
diff --git a/src/renderer/src/components/dashboard/useDashboardPopoutBridge.test.tsx b/src/renderer/src/components/dashboard/useDashboardPopoutBridge.test.tsx
index c632f19bc4e..7cd7bf94c93 100644
--- a/src/renderer/src/components/dashboard/useDashboardPopoutBridge.test.tsx
+++ b/src/renderer/src/components/dashboard/useDashboardPopoutBridge.test.tsx
@@ -77,6 +77,7 @@ function makeSnapshotWatchState(): DashboardSnapshotWatchState {
     detectedWorktreesByRepo: {},
     folderWorkspaces: [],
     projectGroups: [],
+    sshTargetLabels: new Map(),
     restoredRuntimeHostIdByWorkspaceSessionKey: {},
     runtimeEnvironments: [],
     runtimeEnvironmentCatalogHydrated: false,
@@ -207,6 +208,12 @@ describe('useDashboardPopoutBridge', () => {
     expect(
       dashboardSnapshotInputsChanged({ ...previousState, agentStatusEpoch: 1 }, previousState)
     ).toBe(false)
+    expect(
+      dashboardSnapshotInputsChanged(
+        { ...previousState, sshTargetLabels: new Map([['target-1', 'Builder']]) },
+        previousState
+      )
+    ).toBe(true)
 
     // Why: each card's preview terminal keys against a host-input profile
     // derived from these. Not republishing leaves the pop-out encoding bytes
diff --git a/src/renderer/src/components/dashboard/useDashboardPopoutBridge.ts b/src/renderer/src/components/dashboard/useDashboardPopoutBridge.ts
index 2c42757036d..3d58b9100c8 100644
--- a/src/renderer/src/components/dashboard/useDashboardPopoutBridge.ts
+++ b/src/renderer/src/components/dashboard/useDashboardPopoutBridge.ts
@@ -78,6 +78,7 @@ export function dashboardSnapshotInputsChanged(
     // these two instead of worktreesByRepo.
     state.folderWorkspaces !== previousState.folderWorkspaces ||
     state.projectGroups !== previousState.projectGroups ||
+    state.sshTargetLabels !== previousState.sshTargetLabels ||
     state.restoredRuntimeHostIdByWorkspaceSessionKey !==
       previousState.restoredRuntimeHostIdByWorkspaceSessionKey ||
     state.runtimeEnvironments !== previousState.runtimeEnvironments ||
diff --git a/src/renderer/src/components/dashboard/useLiveDashboardSnapshot.test.ts b/src/renderer/src/components/dashboard/useLiveDashboardSnapshot.test.ts
index 2b6c35db8f0..d2481a9201e 100644
--- a/src/renderer/src/components/dashboard/useLiveDashboardSnapshot.test.ts
+++ b/src/renderer/src/components/dashboard/useLiveDashboardSnapshot.test.ts
@@ -161,4 +161,17 @@ describe('useLiveDashboardSnapshot', () => {
     rerender()
     expect(result.current.cards[0].terminalInput?.hostPlatform).toBe('win32')
   })
+
+  it('re-derives saved SSH labels when the target catalog changes', () => {
+    seed({ tabAutoGenerateTitle: false })
+    useAppStore.setState({
+      repos: [{ ...repo(), connectionId: 'target-1', executionHostId: 'ssh:target-1' }]
+    })
+    const { result, rerender } = renderHook(() => useLiveDashboardSnapshot())
+    expect(result.current.cards[0].hostLabel).toBe('target-1')
+
+    useAppStore.setState({ sshTargetLabels: new Map([['target-1', 'Builder']]) })
+    rerender()
+    expect(result.current.cards[0].hostLabel).toBe('Builder')
+  })
 })
diff --git a/src/renderer/src/components/dashboard/useLiveDashboardSnapshot.ts b/src/renderer/src/components/dashboard/useLiveDashboardSnapshot.ts
index 9782f91c697..d3848178509 100644
--- a/src/renderer/src/components/dashboard/useLiveDashboardSnapshot.ts
+++ b/src/renderer/src/components/dashboard/useLiveDashboardSnapshot.ts
@@ -41,6 +41,7 @@ export function useLiveDashboardSnapshot(): DashboardSnapshot {
   // these two instead of worktreesByRepo.
   const folderWorkspaces = useAppStore((s) => s.folderWorkspaces)
   const projectGroups = useAppStore((s) => s.projectGroups)
+  const sshTargetLabels = useAppStore((s) => s.sshTargetLabels)
   const sshConnectionStates = useAppStore((s) => s.sshConnectionStates)
   const sshStateByEnvironment = useAppStore((s) => s.sshStateByEnvironment)
   const runtimeStatusByEnvironmentId = useAppStore((s) => s.runtimeStatusByEnvironmentId)
@@ -82,6 +83,7 @@ export function useLiveDashboardSnapshot(): DashboardSnapshot {
           detectedWorktreesByRepo,
           folderWorkspaces,
           projectGroups,
+          sshTargetLabels,
           sshConnectionStates,
           sshStateByEnvironment,
           runtimeStatusByEnvironmentId,
@@ -120,6 +122,7 @@ export function useLiveDashboardSnapshot(): DashboardSnapshot {
       detectedWorktreesByRepo,
       folderWorkspaces,
       projectGroups,
+      sshTargetLabels,
       sshConnectionStates,
       sshStateByEnvironment,
       runtimeStatusByEnvironmentId,
diff --git a/src/renderer/src/components/editor/CheckRunDetailsPanel.tsx b/src/renderer/src/components/editor/CheckRunDetailsPanel.tsx
index 50350fb1b47..6003be19e05 100644
--- a/src/renderer/src/components/editor/CheckRunDetailsPanel.tsx
+++ b/src/renderer/src/components/editor/CheckRunDetailsPanel.tsx
@@ -27,8 +27,8 @@ function formatCheckTimestamp(value: string | null | undefined): string | null {
 }
 
 type CheckStatusLike = {
-  status: PRCheckDetail['status'] | string | null | undefined
-  conclusion: PRCheckDetail['conclusion'] | string | null | undefined
+  status: PRCheckDetail['status'] | (string & {}) | null | undefined
+  conclusion: PRCheckDetail['conclusion'] | (string & {}) | null | undefined
 }
 
 function getCheckStatusLabel(check: CheckStatusLike): string {
diff --git a/src/renderer/src/components/editor/CombinedDiffViewer.tsx b/src/renderer/src/components/editor/CombinedDiffViewer.tsx
index f4bf62d3d54..fd87b515349 100644
--- a/src/renderer/src/components/editor/CombinedDiffViewer.tsx
+++ b/src/renderer/src/components/editor/CombinedDiffViewer.tsx
@@ -13,7 +13,7 @@ import { getVirtualizedScrollAnchorForOffset } from '@/hooks/virtualized-scroll-
 import { createProgrammaticScrollMarks } from '@/hooks/programmatic-scroll-marks'
 import { joinPath } from '@/lib/path'
 import { detectLanguage } from '@/lib/language-detect'
-import { openFilePreviewToSide } from '@/lib/file-preview'
+import { openFilePreviewToSide, useWorkspaceFileBrowserActionPredicate } from '@/lib/file-preview'
 import { canOpenDiffSectionPreviewToSide } from './diff-section-preview'
 import { setWithLRU } from '@/lib/scroll-cache'
 import { getCombinedDiffSectionConnectionId } from './combined-diff-section-connection'
@@ -247,6 +247,7 @@ export default function CombinedDiffViewer({
     selectWorktreeDiffCommentsOrEmpty(s, file.worktreeId)
   )
   const activeGroupId = useAppStore((s) => s.activeGroupIdByWorktree[file.worktreeId])
+  const canOpenWorkspaceFileBrowserForPath = useWorkspaceFileBrowserActionPredicate(file.worktreeId)
   const isDark =
     settings?.theme === 'dark' ||
     (settings?.theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
@@ -1182,10 +1183,7 @@ export default function CombinedDiffViewer({
       if (!detail || detail.worktreeId !== file.worktreeId) {
         return
       }
-      const hasRuntimeOwnerFilter = Object.prototype.hasOwnProperty.call(
-        detail,
-        'runtimeEnvironmentId'
-      )
+      const hasRuntimeOwnerFilter = Object.hasOwn(detail, 'runtimeEnvironmentId')
       const targetRuntimeOwner = detail.runtimeEnvironmentId?.trim() || null
       const fileRuntimeOwner = file.runtimeEnvironmentId?.trim() || null
       if (hasRuntimeOwnerFilter && targetRuntimeOwner !== fileRuntimeOwner) {
@@ -1294,7 +1292,10 @@ export default function CombinedDiffViewer({
         !canOpenDiffSectionPreviewToSide({
           path: section.path,
           status: section.status,
-          isCommitSurface: isCommitMode
+          isCommitSurface: isCommitMode,
+          canOpenWorkspaceFileBrowser: canOpenWorkspaceFileBrowserForPath(
+            joinPath(file.filePath, section.path)
+          )
         })
       ) {
         return
@@ -1316,7 +1317,14 @@ export default function CombinedDiffViewer({
         sourceGroupId
       })
     },
-    [activeGroupId, file.filePath, file.id, file.worktreeId, isCommitMode]
+    [
+      activeGroupId,
+      canOpenWorkspaceFileBrowserForPath,
+      file.filePath,
+      file.id,
+      file.worktreeId,
+      isCommitMode
+    ]
   )
 
   const handleSectionSave = useCallback(
@@ -2063,7 +2071,10 @@ export default function CombinedDiffViewer({
                           canOpenDiffSectionPreviewToSide({
                             path: section.path,
                             status: section.status,
-                            isCommitSurface: isCommitMode
+                            isCommitSurface: isCommitMode,
+                            canOpenWorkspaceFileBrowser: canOpenWorkspaceFileBrowserForPath(
+                              joinPath(file.filePath, section.path)
+                            )
                           })
                             ? openSectionPreview
                             : undefined
diff --git a/src/renderer/src/components/editor/EditorPanel.tsx b/src/renderer/src/components/editor/EditorPanel.tsx
index 233d8a9e123..60dcf72f811 100644
--- a/src/renderer/src/components/editor/EditorPanel.tsx
+++ b/src/renderer/src/components/editor/EditorPanel.tsx
@@ -2,7 +2,7 @@ import React, { useCallback, useMemo, useRef, useState } from 'react'
 import { useAppStore } from '@/store'
 import { getConnectionId } from '@/lib/connection-context'
 import { detectLanguage } from '@/lib/language-detect'
-import { openFilePreviewToSide } from '@/lib/file-preview'
+import { canShowWorkspaceFileBrowserAction, openFilePreviewToSide } from '@/lib/file-preview'
 import { getEditorHeaderCopyState } from './editor-header'
 import { isLocalPathOpenBlocked, showLocalPathOpenBlockedToast } from '@/lib/local-path-open-guard'
 import { settingsForRuntimeOwner } from '@/runtime/runtime-rpc-client'
@@ -45,6 +45,11 @@ function EditorPanelInner({
   const activeViewStateId = activeViewStateIdProp ?? activeFileId
   const activeFile = openFiles.find((f) => f.id === activeFileId) ?? null
   const activeWorktreeId = activeFile?.worktreeId
+  const canOpenWorkspaceFileBrowser = useAppStore((s) =>
+    activeWorktreeId && activeFile
+      ? canShowWorkspaceFileBrowserAction(s, activeWorktreeId, activeFile.filePath)
+      : false
+  )
   const markFileDirty = useAppStore((s) => s.markFileDirty)
   const pendingEditorReveal = useAppStore((s) => s.pendingEditorReveal)
   // Why: background Git refreshes for other worktrees must not wake every
@@ -229,7 +234,8 @@ function EditorPanelInner({
     gitStatusEntries,
     gitBranchEntries,
     markdownViewMode,
-    isChangesMode
+    isChangesMode,
+    canOpenWorkspaceFileBrowser
   })
 
   const handleOpenPreviewToSide = (): void => {
diff --git a/src/renderer/src/components/editor/IpynbViewer.tsx b/src/renderer/src/components/editor/IpynbViewer.tsx
index bbf7ded32ed..4aac74ae495 100644
--- a/src/renderer/src/components/editor/IpynbViewer.tsx
+++ b/src/renderer/src/components/editor/IpynbViewer.tsx
@@ -435,7 +435,7 @@ function getCellKey(cell: IpynbCell, index: number): string {
 }
 
 function hasOwnDraft(drafts: Record<string, string>, key: string): boolean {
-  return Object.prototype.hasOwnProperty.call(drafts, key)
+  return Object.hasOwn(drafts, key)
 }
 
 function EditableTextCell({
diff --git a/src/renderer/src/components/editor/diff-section-preview.test.ts b/src/renderer/src/components/editor/diff-section-preview.test.ts
index 20ecbae22a2..c419171c202 100644
--- a/src/renderer/src/components/editor/diff-section-preview.test.ts
+++ b/src/renderer/src/components/editor/diff-section-preview.test.ts
@@ -7,7 +7,8 @@ describe('canOpenDiffSectionPreviewToSide', () => {
       canOpenDiffSectionPreviewToSide({
         path: 'docs/demo.html',
         status: 'modified',
-        isCommitSurface: false
+        isCommitSurface: false,
+        canOpenWorkspaceFileBrowser: true
       })
     ).toBe(true)
   })
@@ -17,7 +18,8 @@ describe('canOpenDiffSectionPreviewToSide', () => {
       canOpenDiffSectionPreviewToSide({
         path: 'index.htm',
         status: 'added',
-        isCommitSurface: false
+        isCommitSurface: false,
+        canOpenWorkspaceFileBrowser: true
       })
     ).toBe(true)
   })
@@ -27,14 +29,16 @@ describe('canOpenDiffSectionPreviewToSide', () => {
       canOpenDiffSectionPreviewToSide({
         path: 'scratch.html',
         status: 'untracked',
-        isCommitSurface: false
+        isCommitSurface: false,
+        canOpenWorkspaceFileBrowser: true
       })
     ).toBe(true)
     expect(
       canOpenDiffSectionPreviewToSide({
         path: 'renamed.html',
         status: 'renamed',
-        isCommitSurface: false
+        isCommitSurface: false,
+        canOpenWorkspaceFileBrowser: true
       })
     ).toBe(true)
   })
@@ -44,7 +48,8 @@ describe('canOpenDiffSectionPreviewToSide', () => {
       canOpenDiffSectionPreviewToSide({
         path: 'Docs/DEMO.HTML',
         status: 'modified',
-        isCommitSurface: false
+        isCommitSurface: false,
+        canOpenWorkspaceFileBrowser: true
       })
     ).toBe(true)
   })
@@ -54,7 +59,8 @@ describe('canOpenDiffSectionPreviewToSide', () => {
       canOpenDiffSectionPreviewToSide({
         path: 'gone.html',
         status: 'deleted',
-        isCommitSurface: false
+        isCommitSurface: false,
+        canOpenWorkspaceFileBrowser: true
       })
     ).toBe(false)
   })
@@ -64,7 +70,8 @@ describe('canOpenDiffSectionPreviewToSide', () => {
       canOpenDiffSectionPreviewToSide({
         path: 'docs/demo.html',
         status: 'modified',
-        isCommitSurface: true
+        isCommitSurface: true,
+        canOpenWorkspaceFileBrowser: true
       })
     ).toBe(false)
   })
@@ -74,7 +81,19 @@ describe('canOpenDiffSectionPreviewToSide', () => {
       canOpenDiffSectionPreviewToSide({
         path: 'src/app.ts',
         status: 'modified',
-        isCommitSurface: false
+        isCommitSurface: false,
+        canOpenWorkspaceFileBrowser: true
+      })
+    ).toBe(false)
+  })
+
+  it('disables previews when the workspace browser provider is unavailable', () => {
+    expect(
+      canOpenDiffSectionPreviewToSide({
+        path: 'docs/demo.html',
+        status: 'modified',
+        isCommitSurface: false,
+        canOpenWorkspaceFileBrowser: false
       })
     ).toBe(false)
   })
diff --git a/src/renderer/src/components/editor/diff-section-preview.ts b/src/renderer/src/components/editor/diff-section-preview.ts
index 6e0fa684822..479709d3a91 100644
--- a/src/renderer/src/components/editor/diff-section-preview.ts
+++ b/src/renderer/src/components/editor/diff-section-preview.ts
@@ -8,7 +8,11 @@ export function canOpenDiffSectionPreviewToSide(params: {
   path: string
   status: string
   isCommitSurface: boolean
+  canOpenWorkspaceFileBrowser: boolean
 }): boolean {
+  if (!params.canOpenWorkspaceFileBrowser) {
+    return false
+  }
   if (params.isCommitSurface) {
     return false
   }
diff --git a/src/renderer/src/components/editor/editor-autosave.ts b/src/renderer/src/components/editor/editor-autosave.ts
index c6d01a8cdf8..c647fbfb779 100644
--- a/src/renderer/src/components/editor/editor-autosave.ts
+++ b/src/renderer/src/components/editor/editor-autosave.ts
@@ -23,6 +23,9 @@ export type EditorPathMutationTarget = {
   relativePath: string
   runtimeEnvironmentId?: string | null
   allowLocalWindowsWslAliases?: true
+  indexedOpenFiles?: {
+    matches: (openFiles: OpenFile[]) => OpenFile[]
+  }
 }
 
 export type EditorSaveQuiesceTarget = { fileId: string } | EditorPathMutationTarget
@@ -127,8 +130,11 @@ export function getOpenFilesForExternalFileChange(
   openFiles: OpenFile[],
   target: EditorPathMutationTarget
 ): OpenFile[] {
+  if (target.indexedOpenFiles) {
+    return target.indexedOpenFiles.matches(openFiles)
+  }
   const absolutePath = joinPath(target.worktreePath, target.relativePath)
-  const hasRuntimeOwnerFilter = Object.prototype.hasOwnProperty.call(target, 'runtimeEnvironmentId')
+  const hasRuntimeOwnerFilter = Object.hasOwn(target, 'runtimeEnvironmentId')
   const targetRuntimeOwner = target.runtimeEnvironmentId?.trim() || null
   return openFiles.filter((file) => {
     if (file.worktreeId !== target.worktreeId) {
diff --git a/src/renderer/src/components/editor/editor-external-watch-path-index.test.ts b/src/renderer/src/components/editor/editor-external-watch-path-index.test.ts
new file mode 100644
index 00000000000..68e33bc6baf
--- /dev/null
+++ b/src/renderer/src/components/editor/editor-external-watch-path-index.test.ts
@@ -0,0 +1,185 @@
+import { describe, expect, it } from 'vitest'
+import type { OpenFile } from '@/store/slices/editor'
+import { indexEditorExternalWatchBatchPaths } from './editor-external-watch-path-index'
+
+const wslScope = {
+  worktreeId: 'wt-wsl',
+  worktreePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo',
+  runtimeEnvironmentId: null,
+  allowLocalWindowsWslAliases: true as const
+}
+
+function file(overrides: Partial<OpenFile> & Pick<OpenFile, 'id' | 'filePath'>): OpenFile {
+  return {
+    relativePath: 'file.ts',
+    worktreeId: 'wt-wsl',
+    mode: 'edit',
+    isDirty: false,
+    content: '',
+    language: 'typescript',
+    ...overrides
+  } as OpenFile
+}
+
+describe('editor external watch path batch index', () => {
+  it('matches UNC aliases for updates, deletes, and restored tombstones', () => {
+    const restored = file({
+      id: 'restored',
+      filePath: '//wsl.localhost/Ubuntu/workspace/repo/file.ts',
+      externalMutation: 'deleted'
+    })
+    const index = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: wslScope.worktreePath,
+        events: [
+          {
+            kind: 'delete',
+            absolutePath: '\\\\wsl$\\Ubuntu\\workspace\\repo\\file.ts'
+          },
+          {
+            kind: 'create',
+            absolutePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo\\file.ts'
+          }
+        ]
+      },
+      [restored],
+      wslScope
+    )
+
+    expect(index.deletedOpenEditors).toEqual([
+      {
+        file: restored,
+        normalizedDeletePath: '//wsl/ubuntu/workspace/repo/file.ts'
+      }
+    ])
+    expect(index.matchesCreateOrUpdate(restored)).toBe(true)
+    expect(index.matchingOpenFiles(index.changes[0])).toEqual([restored])
+  })
+
+  it('matches /mnt drive aliases without folding WSL filesystem case', () => {
+    const mounted = file({
+      id: 'mounted',
+      filePath: '//wsl.localhost/Ubuntu/mnt/c/Repo/File.ts'
+    })
+    const nativeScope = { ...wslScope, worktreePath: 'C:\\Repo' }
+    const matching = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: nativeScope.worktreePath,
+        events: [{ kind: 'update', absolutePath: 'c:\\repo\\file.ts' }]
+      },
+      [mounted],
+      nativeScope
+    )
+    const wrongLinuxCase = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: nativeScope.worktreePath,
+        events: [{ kind: 'update', absolutePath: 'C:\\Repo\\File.ts' }]
+      },
+      [
+        file({
+          id: 'linux-case',
+          filePath: '//wsl.localhost/Ubuntu/home/Alice/File.ts'
+        })
+      ],
+      nativeScope
+    )
+
+    expect(matching.matchingOpenFiles(matching.changes[0])).toEqual([mounted])
+    expect(wrongLinuxCase.matchingOpenFiles(wrongLinuxCase.changes[0])).toEqual([])
+  })
+
+  it('keeps aliases literal for SSH, runtimes, and POSIX scopes', () => {
+    const restored = file({
+      id: 'restored',
+      filePath: '//wsl.localhost/Ubuntu/workspace/repo/file.ts'
+    })
+    const payload = {
+      worktreePath: wslScope.worktreePath,
+      events: [
+        {
+          kind: 'update' as const,
+          absolutePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo\\file.ts'
+        }
+      ]
+    }
+
+    for (const scope of [
+      { ...wslScope, allowLocalWindowsWslAliases: undefined },
+      { ...wslScope, runtimeEnvironmentId: 'env-1', allowLocalWindowsWslAliases: undefined }
+    ]) {
+      const index = indexEditorExternalWatchBatchPaths(payload, [restored], scope)
+      expect(index.matchingOpenFiles(index.changes[0])).toEqual([])
+    }
+
+    const posix = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: '/srv/repo',
+        events: [{ kind: 'update', absolutePath: '/srv/repo/file.ts' }]
+      },
+      [restored],
+      {
+        ...wslScope,
+        worktreePath: '/srv/repo',
+        allowLocalWindowsWslAliases: undefined
+      }
+    )
+    expect(posix.matchingOpenFiles(posix.changes[0])).toEqual([])
+  })
+
+  it('filters owners and preserves open-file ordering across edit and diff matches', () => {
+    const edit = file({ id: 'edit', filePath: 'C:\\Repo\\file.ts' })
+    const runtime = file({
+      id: 'runtime',
+      filePath: 'C:\\Repo\\file.ts',
+      runtimeEnvironmentId: 'env-1'
+    })
+    const diff = file({
+      id: 'diff',
+      filePath: 'C:\\Repo\\file.ts',
+      mode: 'diff',
+      diffSource: 'unstaged'
+    })
+    const index = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: 'C:\\Repo',
+        events: [{ kind: 'update', absolutePath: 'c:\\repo\\file.ts' }]
+      },
+      [diff, runtime, edit],
+      { ...wslScope, worktreePath: 'C:\\Repo' }
+    )
+
+    expect(index.matchingOpenFiles(index.changes[0]).map(({ id }) => id)).toEqual(['diff', 'edit'])
+  })
+
+  it('deduplicates repeated events and detects only working-tree combined diffs', () => {
+    const index = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: 'C:\\Repo',
+        events: [
+          { kind: 'create', absolutePath: 'C:\\Repo\\file.ts' },
+          { kind: 'update', absolutePath: 'C:\\Repo\\file.ts' },
+          { kind: 'update', absolutePath: 'C:\\Repo\\folder', isDirectory: true }
+        ]
+      },
+      [
+        file({
+          id: 'combined',
+          filePath: 'C:\\Repo',
+          mode: 'diff',
+          diffSource: 'combined-uncommitted'
+        }),
+        file({
+          id: 'branch',
+          filePath: 'C:\\Repo',
+          mode: 'diff',
+          diffSource: 'combined-branch'
+        })
+      ],
+      { ...wslScope, worktreePath: 'C:\\Repo' }
+    )
+
+    expect(index.changes.map(({ relativePath }) => relativePath)).toEqual(['file.ts'])
+    expect(index.createOrUpdatePaths.size).toBe(1)
+    expect(index.hasCombinedDiffConsumer).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/editor/editor-external-watch-path-index.ts b/src/renderer/src/components/editor/editor-external-watch-path-index.ts
new file mode 100644
index 00000000000..f1cb7054c67
--- /dev/null
+++ b/src/renderer/src/components/editor/editor-external-watch-path-index.ts
@@ -0,0 +1,256 @@
+import { joinPath } from '@/lib/path'
+import { getExternalFileChangeRelativePath } from '@/components/right-sidebar/useFileExplorerWatch'
+import type { OpenFile } from '@/store/slices/editor'
+import type { FsChangedPayload } from '../../../../shared/types'
+import {
+  getLocalWindowsWslPathIdentity,
+  normalizeRuntimePathForComparison,
+  type LocalWindowsWslPathIdentity
+} from '../../../../shared/cross-platform-path'
+
+type WatchScope = {
+  worktreeId: string
+  worktreePath: string
+  runtimeEnvironmentId: string | null
+  allowLocalWindowsWslAliases?: true
+}
+
+type IndexedPath = {
+  absolutePath: string
+  identity: LocalWindowsWslPathIdentity
+}
+
+type IndexedOpenFile = {
+  file: OpenFile
+  index: number
+  identity: LocalWindowsWslPathIdentity | null
+}
+
+export type IndexedExternalWatchChange = IndexedPath & {
+  relativePath: string
+}
+
+export type EditorExternalWatchBatchPathIndex = {
+  createOrUpdatePaths: ReadonlyMap<string, string>
+  changes: readonly IndexedExternalWatchChange[]
+  deletedOpenEditors: readonly { file: OpenFile; normalizedDeletePath: string }[]
+  hasCombinedDiffConsumer: boolean
+  matchesCreateOrUpdate: (file: OpenFile) => boolean
+  matchingOpenFiles: (
+    change: IndexedExternalWatchChange,
+    currentOpenFiles?: OpenFile[]
+  ) => OpenFile[]
+}
+
+function openFileRuntimeOwner(file: Pick<OpenFile, 'runtimeEnvironmentId'>): string | null {
+  return file.runtimeEnvironmentId?.trim() || null
+}
+
+function addToListMap<T>(map: Map<string, T[]>, key: string, value: T): void {
+  const existing = map.get(key)
+  if (existing) {
+    existing.push(value)
+  } else {
+    map.set(key, [value])
+  }
+}
+
+class IndexedPathLookup<T> {
+  private readonly direct = new Map<string, T>()
+  private readonly aliases = new Map<string, T>()
+  private readonly wslAliases = new Map<string, T>()
+
+  constructor(private readonly allowAliases: boolean) {}
+
+  add(path: IndexedPath, value: T): void {
+    this.direct.set(path.identity.normalizedPath, value)
+    if (!this.allowAliases) {
+      return
+    }
+    this.aliases.set(path.identity.aliasComparisonPath, value)
+    if (path.identity.isWslUnc) {
+      this.wslAliases.set(path.identity.aliasComparisonPath, value)
+    }
+  }
+
+  get(identity: LocalWindowsWslPathIdentity): T | undefined {
+    const direct = this.direct.get(identity.normalizedPath)
+    if (direct !== undefined || !this.allowAliases) {
+      return direct
+    }
+    return identity.isWslUnc
+      ? this.aliases.get(identity.aliasComparisonPath)
+      : this.wslAliases.get(identity.aliasComparisonPath)
+  }
+}
+
+function pathIdentity(value: string, allowAliases: boolean): LocalWindowsWslPathIdentity {
+  if (allowAliases) {
+    return getLocalWindowsWslPathIdentity(value)
+  }
+  const normalizedPath = normalizeRuntimePathForComparison(value)
+  return { normalizedPath, aliasComparisonPath: normalizedPath, isWslUnc: false }
+}
+
+function collectMatchingFiles(
+  direct: readonly IndexedOpenFile[],
+  aliases: readonly IndexedOpenFile[],
+  diffs: readonly IndexedOpenFile[]
+): OpenFile[] {
+  const byIndex = new Map<number, OpenFile>()
+  for (const entry of [...direct, ...aliases, ...diffs]) {
+    byIndex.set(entry.index, entry.file)
+  }
+  return [...byIndex.entries()].sort(([left], [right]) => left - right).map(([, file]) => file)
+}
+
+class IndexedOpenFileLookup {
+  private readonly directEditors = new Map<string, IndexedOpenFile[]>()
+  private readonly aliasEditors = new Map<string, IndexedOpenFile[]>()
+  private readonly wslAliasEditors = new Map<string, IndexedOpenFile[]>()
+  private readonly diffsByRelativePath = new Map<string, IndexedOpenFile[]>()
+  readonly indexedOpenFiles = new Map<string, IndexedOpenFile>()
+  readonly hasCombinedDiffConsumer: boolean
+
+  constructor(
+    openFiles: OpenFile[],
+    scope: WatchScope,
+    private readonly allowAliases: boolean
+  ) {
+    let hasCombinedDiffConsumer = false
+    for (const [index, file] of openFiles.entries()) {
+      if (
+        file.worktreeId !== scope.worktreeId ||
+        openFileRuntimeOwner(file) !== scope.runtimeEnvironmentId
+      ) {
+        continue
+      }
+      if (
+        file.mode === 'diff' &&
+        (file.diffSource === 'combined-uncommitted' || file.diffSource === 'combined-all')
+      ) {
+        hasCombinedDiffConsumer = true
+        continue
+      }
+      if (file.mode === 'diff') {
+        if (file.diffSource === 'unstaged' || file.diffSource === 'staged') {
+          addToListMap(this.diffsByRelativePath, file.relativePath, {
+            file,
+            index,
+            identity: null
+          })
+        }
+        continue
+      }
+      if (file.mode !== 'edit' && file.mode !== 'markdown-preview') {
+        continue
+      }
+      const identity = pathIdentity(file.filePath, allowAliases)
+      const indexedFile = { file, index, identity }
+      this.indexedOpenFiles.set(file.id, indexedFile)
+      addToListMap(this.directEditors, file.filePath, indexedFile)
+      if (allowAliases) {
+        addToListMap(this.aliasEditors, identity.aliasComparisonPath, indexedFile)
+        if (identity.isWslUnc) {
+          addToListMap(this.wslAliasEditors, identity.aliasComparisonPath, indexedFile)
+        }
+      }
+    }
+    this.hasCombinedDiffConsumer = hasCombinedDiffConsumer
+  }
+
+  matchingOpenFiles(change: IndexedExternalWatchChange): OpenFile[] {
+    const aliases = !this.allowAliases
+      ? []
+      : change.identity.isWslUnc
+        ? (this.aliasEditors.get(change.identity.aliasComparisonPath) ?? [])
+        : (this.wslAliasEditors.get(change.identity.aliasComparisonPath) ?? [])
+    return collectMatchingFiles(
+      this.directEditors.get(change.absolutePath) ?? [],
+      aliases,
+      this.diffsByRelativePath.get(change.relativePath) ?? []
+    )
+  }
+}
+
+export function indexEditorExternalWatchBatchPaths(
+  payload: FsChangedPayload,
+  openFiles: OpenFile[],
+  scope: WatchScope
+): EditorExternalWatchBatchPathIndex {
+  const allowAliases = scope.allowLocalWindowsWslAliases === true
+  const createOrUpdateLookup = new IndexedPathLookup<IndexedPath>(allowAliases)
+  const deleteLookup = new IndexedPathLookup<IndexedPath>(allowAliases)
+  const createOrUpdatePaths = new Map<string, string>()
+  const changesByRelativePath = new Map<string, IndexedExternalWatchChange>()
+
+  for (const event of payload.events) {
+    if (event.kind === 'overflow') {
+      continue
+    }
+    const eventPath: IndexedPath = {
+      absolutePath: event.absolutePath,
+      identity: pathIdentity(event.absolutePath, allowAliases)
+    }
+    if (event.kind === 'delete') {
+      deleteLookup.add(eventPath, eventPath)
+      continue
+    }
+    if (event.isDirectory !== true) {
+      createOrUpdatePaths.set(eventPath.identity.normalizedPath, event.absolutePath)
+      createOrUpdateLookup.add(eventPath, eventPath)
+    }
+    const relativePath = getExternalFileChangeRelativePath(
+      scope.worktreePath,
+      event.absolutePath,
+      event.isDirectory
+    )
+    if (relativePath && !changesByRelativePath.has(relativePath)) {
+      const absolutePath = joinPath(scope.worktreePath, relativePath)
+      changesByRelativePath.set(relativePath, {
+        relativePath,
+        absolutePath,
+        identity: eventPath.identity
+      })
+    }
+  }
+
+  const initialOpenFileLookup = new IndexedOpenFileLookup(openFiles, scope, allowAliases)
+  const openFileLookups = new WeakMap<OpenFile[], IndexedOpenFileLookup>()
+  openFileLookups.set(openFiles, initialOpenFileLookup)
+  const getOpenFileLookup = (currentOpenFiles: OpenFile[]): IndexedOpenFileLookup => {
+    const existing = openFileLookups.get(currentOpenFiles)
+    if (existing) {
+      return existing
+    }
+    const indexed = new IndexedOpenFileLookup(currentOpenFiles, scope, allowAliases)
+    openFileLookups.set(currentOpenFiles, indexed)
+    return indexed
+  }
+  const matchesCreateOrUpdate = (file: OpenFile): boolean => {
+    const identity =
+      initialOpenFileLookup.indexedOpenFiles.get(file.id)?.identity ??
+      pathIdentity(file.filePath, allowAliases)
+    return createOrUpdateLookup.get(identity) !== undefined
+  }
+  const deletedOpenEditors: { file: OpenFile; normalizedDeletePath: string }[] = []
+  for (const indexedFile of initialOpenFileLookup.indexedOpenFiles.values()) {
+    const deletedPath = deleteLookup.get(indexedFile.identity!)
+    if (deletedPath) {
+      deletedOpenEditors.push({
+        file: indexedFile.file,
+        normalizedDeletePath: deletedPath.identity.normalizedPath
+      })
+    }
+  }
+
+  return {
+    createOrUpdatePaths,
+    changes: [...changesByRelativePath.values()],
+    deletedOpenEditors,
+    hasCombinedDiffConsumer: initialOpenFileLookup.hasCombinedDiffConsumer,
+    matchesCreateOrUpdate,
+    matchingOpenFiles: (change, currentOpenFiles = openFiles) =>
+      getOpenFileLookup(currentOpenFiles).matchingOpenFiles(change)
+  }
+}
diff --git a/src/renderer/src/components/editor/editor-panel-draft-selector.ts b/src/renderer/src/components/editor/editor-panel-draft-selector.ts
index 8cc7e07fb27..b455af4e56f 100644
--- a/src/renderer/src/components/editor/editor-panel-draft-selector.ts
+++ b/src/renderer/src/components/editor/editor-panel-draft-selector.ts
@@ -43,7 +43,7 @@ export function createEditorPanelDraftSelector(
       const draft = state.editorDrafts[fileId]
       return (
         draft !== previousSelection[fileId] ||
-        (draft === undefined && Object.prototype.hasOwnProperty.call(previousSelection, fileId))
+        (draft === undefined && Object.hasOwn(previousSelection, fileId))
       )
     })
     if (!changed) {
diff --git a/src/renderer/src/components/editor/editor-panel-render-model.test.ts b/src/renderer/src/components/editor/editor-panel-render-model.test.ts
index fc4efff0a5c..fc7e66a78ea 100644
--- a/src/renderer/src/components/editor/editor-panel-render-model.test.ts
+++ b/src/renderer/src/components/editor/editor-panel-render-model.test.ts
@@ -42,7 +42,8 @@ function renderModel(args: {
     gitStatusEntries: args.gitStatusByWorktree?.[activeFile.worktreeId],
     gitBranchEntries: undefined,
     markdownViewMode: args.markdownViewMode ?? {},
-    isChangesMode: args.isChangesMode ?? false
+    isChangesMode: args.isChangesMode ?? false,
+    canOpenWorkspaceFileBrowser: true
   })
 }
 
@@ -66,6 +67,22 @@ describe('getEditorPanelRenderModel HTML preview affordance', () => {
     )
   })
 
+  it('disables preview when the workspace browser provider is unavailable', () => {
+    const activeFile = htmlFile()
+    const model = getEditorPanelRenderModel({
+      activeFile,
+      fileContents: {},
+      editorDrafts: {},
+      gitStatusEntries: undefined,
+      gitBranchEntries: undefined,
+      markdownViewMode: {},
+      isChangesMode: false,
+      canOpenWorkspaceFileBrowser: false
+    })
+
+    expect(model.canOpenPreviewToSide).toBe(false)
+  })
+
   it('enables preview for single HTML diffs whose file exists on disk', () => {
     const model = renderModel({
       activeFile: htmlFile({ mode: 'diff', diffSource: 'unstaged' } as Partial<OpenFile>),
diff --git a/src/renderer/src/components/editor/editor-panel-render-model.ts b/src/renderer/src/components/editor/editor-panel-render-model.ts
index 4f46a0f1717..87fa868c1dd 100644
--- a/src/renderer/src/components/editor/editor-panel-render-model.ts
+++ b/src/renderer/src/components/editor/editor-panel-render-model.ts
@@ -26,6 +26,7 @@ type EditorPanelRenderModelParams = {
   gitBranchEntries: StoreState['gitBranchChangesByWorktree'][string] | undefined
   markdownViewMode: StoreState['markdownViewMode']
   isChangesMode: boolean
+  canOpenWorkspaceFileBrowser: boolean
 }
 
 export function getEditorPanelRenderModel({
@@ -35,7 +36,8 @@ export function getEditorPanelRenderModel({
   gitStatusEntries,
   gitBranchEntries,
   markdownViewMode,
-  isChangesMode
+  isChangesMode,
+  canOpenWorkspaceFileBrowser
 }: EditorPanelRenderModelParams) {
   const isSingleDiff =
     activeFile.mode === 'diff' &&
@@ -163,6 +165,7 @@ export function getEditorPanelRenderModel({
     // when the modified side still exists on disk (canOpen excludes deleted
     // files and commit diffs whose content may not match the working tree).
     canOpenPreviewToSide:
+      canOpenWorkspaceFileBrowser &&
       canPreviewLanguage(viewerLanguage) &&
       (activeFile.mode === 'edit' || (isSingleDiff && openFileState.canOpen)),
     mdViewMode,
diff --git a/src/renderer/src/components/editor/monaco-context-menu-paste.ts b/src/renderer/src/components/editor/monaco-context-menu-paste.ts
index 4a33fb68352..9b513f8e426 100644
--- a/src/renderer/src/components/editor/monaco-context-menu-paste.ts
+++ b/src/renderer/src/components/editor/monaco-context-menu-paste.ts
@@ -60,7 +60,7 @@ function resolvePasteMetadata(
   return {
     pasteOnNewLine: emptySelectionClipboard && metadata.isFromEmptySelection === true,
     multicursorText:
-      typeof metadata.multicursorText !== 'undefined' ? (metadata.multicursorText ?? null) : null,
+      metadata.multicursorText !== undefined ? (metadata.multicursorText ?? null) : null,
     mode: metadata.mode ?? null
   }
 }
diff --git a/src/renderer/src/components/editor/monaco-markdown-doc-completions.ts b/src/renderer/src/components/editor/monaco-markdown-doc-completions.ts
index 882b011e9b3..4d33a1f3985 100644
--- a/src/renderer/src/components/editor/monaco-markdown-doc-completions.ts
+++ b/src/renderer/src/components/editor/monaco-markdown-doc-completions.ts
@@ -9,7 +9,7 @@ import {
 type MonacoApi = Parameters<OnMount>[1]
 
 let provider: IDisposable | null = null
-let providerMonaco: MonacoApi | null = null
+let providerMonaco: MonacoApi = null
 const documentsByModel = new Map<string, MarkdownDocument[]>()
 
 export function ensureMarkdownDocCompletionProvider(monaco: MonacoApi): void {
diff --git a/src/renderer/src/components/editor/rich-markdown-slash-command-catalog.tsx b/src/renderer/src/components/editor/rich-markdown-slash-command-catalog.tsx
index 922e1abe2f1..3cd31be6f6d 100644
--- a/src/renderer/src/components/editor/rich-markdown-slash-command-catalog.tsx
+++ b/src/renderer/src/components/editor/rich-markdown-slash-command-catalog.tsx
@@ -1,4 +1,3 @@
-import type {} from '@tiptap/extension-mathematics'
 import {
   ChevronRight,
   ImageIcon,
diff --git a/src/renderer/src/components/editor/rich-markdown-terminal-path-paste.ts b/src/renderer/src/components/editor/rich-markdown-terminal-path-paste.ts
index cfdb7f422fd..037004a5303 100644
--- a/src/renderer/src/components/editor/rich-markdown-terminal-path-paste.ts
+++ b/src/renderer/src/components/editor/rich-markdown-terminal-path-paste.ts
@@ -14,7 +14,7 @@ function readClipboardText(event: ClipboardEvent, type: string): string {
 function getWindowsPathBasename(filePath: string): string {
   const normalized = filePath.replaceAll('/', '\\')
   const separatorIndex = normalized.lastIndexOf('\\')
-  return separatorIndex >= 0 ? normalized.slice(separatorIndex + 1) : normalized
+  return separatorIndex !== -1 ? normalized.slice(separatorIndex + 1) : normalized
 }
 
 function extractClipboardAnchors(html: string): ClipboardAnchor[] {
diff --git a/src/renderer/src/components/editor/useLocalImageSrc.ts b/src/renderer/src/components/editor/useLocalImageSrc.ts
index 9a8327af090..df174160bb8 100644
--- a/src/renderer/src/components/editor/useLocalImageSrc.ts
+++ b/src/renderer/src/components/editor/useLocalImageSrc.ts
@@ -130,7 +130,7 @@ if (typeof window !== 'undefined') {
   window.addEventListener('focus', invalidateImageCache)
 }
 
-if (typeof import.meta !== 'undefined' && import.meta.hot) {
+if (import.meta !== undefined && import.meta.hot) {
   // Why: Vite can re-evaluate this module without a full renderer reload.
   // Disposing the module-level listener and blob URLs prevents dev-session leaks.
   import.meta.hot.dispose(disposeImageCacheModuleState)
diff --git a/src/renderer/src/components/feature-wall/FeatureWallBrowserAction.tsx b/src/renderer/src/components/feature-wall/FeatureWallBrowserAction.tsx
index 2e039c2f2ce..b6d185e9092 100644
--- a/src/renderer/src/components/feature-wall/FeatureWallBrowserAction.tsx
+++ b/src/renderer/src/components/feature-wall/FeatureWallBrowserAction.tsx
@@ -16,9 +16,15 @@ import {
   promptForSetupGuideProject,
   useSetupTargetWorktree
 } from './FeatureWallSetupWorkflowActions'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export function BrowserAction(props: { done: boolean }): React.JSX.Element {
   const targetWorktree = useSetupTargetWorktree()
+  const browserCreationEnabled = useAppStore(
+    (state) =>
+      getClientCreationActionPolicy(state, targetWorktree?.id ?? null)['managed-browser'].state ===
+      'enabled'
+  )
   const openModal = useAppStore((s) => s.openModal)
   const closeModal = useAppStore((s) => s.closeModal)
   const openNewBrowserTabInActiveWorkspace = useAppStore(
@@ -39,7 +45,9 @@ export function BrowserAction(props: { done: boolean }): React.JSX.Element {
       state.activeGroupIdByWorktree[targetWorktree.id] ??
       state.groupsByWorktree[targetWorktree.id]?.[0]?.id
     if (groupId) {
-      void openNewBrowserTabInActiveWorkspace(groupId)
+      void openNewBrowserTabInActiveWorkspace(groupId).catch((error) => {
+        toast.error(error instanceof Error ? error.message : String(error))
+      })
     } else {
       toast.warning(
         translate(
@@ -58,7 +66,7 @@ export function BrowserAction(props: { done: boolean }): React.JSX.Element {
 
   return (
     <div className="flex flex-wrap items-center gap-2.5">
-      {props.done ? null : (
+      {props.done || !browserCreationEnabled ? null : (
         <Button type="button" size="sm" className="w-fit gap-2" onClick={handleTryIt}>
           <ArrowUpRight className="size-3.5" />
           {translate(
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tsx
index 1cede3297a4..2f60cb89902 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tsx
@@ -116,6 +116,7 @@ import { shouldRestoreMaximizedPanelBounds } from './floating-terminal-panel-res
 import { translate } from '@/i18n/i18n'
 import { consumeFloatingTerminalOpenMaximizedIntent } from '@/lib/floating-terminal'
 import { selectFloatingTerminalPanelInputs } from './floating-terminal-panel-inputs'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 const LOCAL_RUNTIME_SETTINGS = { activeRuntimeEnvironmentId: null } as const
 const NO_ACTIVITY_TERMINAL_PORTALS = []
 
@@ -271,6 +272,11 @@ export function FloatingTerminalPanel({
   const newMarkdownShortcut = useShortcutKeyDetails('tab.newMarkdown')
   const openMarkdownShortcut = useShortcutKeyDetails('tab.openMarkdown')
   const closeShortcut = useShortcutKeyDetails('tab.close')
+  const managedBrowserCreationEnabled = useAppStore(
+    (state) =>
+      getClientCreationActionPolicy(state, FLOATING_TERMINAL_WORKTREE_ID)['managed-browser']
+        .state === 'enabled'
+  )
 
   const [cwd, setCwd] = useState<string | null>(null)
   const [markdownCwd, setMarkdownCwd] = useState<string | null>(null)
@@ -389,6 +395,7 @@ export function FloatingTerminalPanel({
     terminalTabs: tabs,
     assignments: terminalAssignments,
     isWorktreeActive: open,
+    activeTerminalTabId: activeTerminalId,
     coldParkTerminalPanes: false,
     shouldMeasureHiddenWorktree: false,
     activityTerminalPortals: NO_ACTIVITY_TERMINAL_PORTALS
@@ -794,6 +801,14 @@ export function FloatingTerminalPanel({
   )
 
   const createFloatingBrowserTab = useCallback(() => {
+    const availability = getClientCreationActionPolicy(
+      useAppStore.getState(),
+      FLOATING_TERMINAL_WORKTREE_ID
+    )['managed-browser']
+    if (availability.state !== 'enabled') {
+      toast.error(availability.reason)
+      return
+    }
     const url = browserDefaultUrl ?? 'about:blank'
     createBrowserTab(FLOATING_TERMINAL_WORKTREE_ID, url, {
       title: translate(
@@ -1284,6 +1299,14 @@ export function FloatingTerminalPanel({
         if (resolution.action === 'tab.newTerminal') {
           createFloatingTerminalTab()
         } else if (resolution.action === 'tab.newBrowser') {
+          const availability = getClientCreationActionPolicy(
+            useAppStore.getState(),
+            FLOATING_TERMINAL_WORKTREE_ID
+          )['managed-browser']
+          if (availability.state !== 'enabled') {
+            toast.error(availability.reason)
+            return 'handled'
+          }
           createFloatingBrowserTab()
         } else if (resolution.action === 'tab.newMarkdown') {
           createFloatingMarkdownTab()
@@ -1959,6 +1982,7 @@ export function FloatingTerminalPanel({
               onNewMarkdown={createFloatingMarkdownTab}
               onOpenMarkdown={openFloatingMarkdownTab}
               onNewBrowser={createFloatingBrowserTab}
+              showNewBrowser={managedBrowserCreationEnabled}
               onClose={() => onOpenChange(false)}
               onFocusPanel={focusPanelForShortcuts}
               newTerminalShortcut={newTerminalShortcut}
@@ -2101,6 +2125,7 @@ function FloatingTerminalEmptyState({
   onNewMarkdown,
   onOpenMarkdown,
   onNewBrowser,
+  showNewBrowser,
   onClose,
   onFocusPanel,
   newTerminalShortcut,
@@ -2113,6 +2138,7 @@ function FloatingTerminalEmptyState({
   onNewMarkdown: () => void
   onOpenMarkdown: () => void
   onNewBrowser: () => void
+  showNewBrowser: boolean
   onClose: () => void
   onFocusPanel: () => void
   newTerminalShortcut: ShortcutKeyComboDetails
@@ -2176,21 +2202,23 @@ function FloatingTerminalEmptyState({
           </span>
           <FloatingEmptyStateShortcut shortcut={openMarkdownShortcut} />
         </Button>
-        <Button
-          type="button"
-          variant="ghost"
-          className="grid h-8 w-full grid-cols-[1rem_minmax(0,1fr)_auto] items-center gap-2.5 rounded-md px-3 py-0 text-sm font-normal text-foreground hover:bg-muted/40 hover:text-foreground"
-          onClick={onNewBrowser}
-        >
-          <Globe className="size-3.5 opacity-90" />
-          <span className="truncate text-left leading-none">
-            {translate(
-              'auto.components.floating.terminal.FloatingTerminalPanel.8b07759314',
-              'New Browser'
-            )}
-          </span>
-          <FloatingEmptyStateShortcut shortcut={newBrowserShortcut} />
-        </Button>
+        {showNewBrowser ? (
+          <Button
+            type="button"
+            variant="ghost"
+            className="grid h-8 w-full grid-cols-[1rem_minmax(0,1fr)_auto] items-center gap-2.5 rounded-md px-3 py-0 text-sm font-normal text-foreground hover:bg-muted/40 hover:text-foreground"
+            onClick={onNewBrowser}
+          >
+            <Globe className="size-3.5 opacity-90" />
+            <span className="truncate text-left leading-none">
+              {translate(
+                'auto.components.floating.terminal.FloatingTerminalPanel.8b07759314',
+                'New Browser'
+              )}
+            </span>
+            <FloatingEmptyStateShortcut shortcut={newBrowserShortcut} />
+          </Button>
+        ) : null}
         <Button
           type="button"
           variant="ghost"
diff --git a/src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.ts b/src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.ts
index aef4c99dfe6..91e97c2de79 100644
--- a/src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.ts
+++ b/src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.ts
@@ -60,7 +60,7 @@ function clampValue(value: number, min: number, max: number): number {
 }
 
 function getWindowStorage(): Storage | null {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined'
+  return typeof window !== 'undefined' && window.localStorage !== undefined
     ? window.localStorage
     : null
 }
diff --git a/src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.ts b/src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.ts
index effee92d52a..fb127b23778 100644
--- a/src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.ts
+++ b/src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.ts
@@ -48,7 +48,7 @@ function isAnchorY(value: unknown): value is FloatingTerminalAnchorY {
 }
 
 function getWindowStorage(): Storage | null {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined'
+  return typeof window !== 'undefined' && window.localStorage !== undefined
     ? window.localStorage
     : null
 }
diff --git a/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts b/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
index b96d3fad358..826d70aea9f 100644
--- a/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
+++ b/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
@@ -43,14 +43,14 @@ function hasClaudeModelSwitchSuccess(buffer: string, modelLabel: string): boolea
   // every picker token prevents one context variant from confirming another.
   const labelTokens = modelLabel.toLowerCase().match(/[a-z]+|\d+[a-z]*/g) ?? []
   const successStart = text.lastIndexOf('setmodelto')
-  if (successStart < 0 || labelTokens.length === 0) {
+  if (successStart === -1 || labelTokens.length === 0) {
     return false
   }
   const successText = text.slice(successStart)
   let tokenEnd = 0
   for (const token of labelTokens) {
     const tokenStart = successText.indexOf(token, tokenEnd)
-    if (tokenStart < 0) {
+    if (tokenStart === -1) {
       return false
     }
     tokenEnd = tokenStart + token.length
diff --git a/src/renderer/src/components/native-chat/claude-terminal-session-options.ts b/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
index 3b8ad86a47a..c7e88eaa898 100644
--- a/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
+++ b/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
@@ -52,7 +52,7 @@ function frameCell(line: string): string {
   if (line.startsWith(FRAME_COLUMN)) {
     const afterBorder = line.slice(FRAME_COLUMN.length)
     const columnEnd = afterBorder.indexOf(FRAME_COLUMN)
-    return (columnEnd < 0 ? afterBorder : afterBorder.slice(0, columnEnd)).trim()
+    return (columnEnd === -1 ? afterBorder : afterBorder.slice(0, columnEnd)).trim()
   }
   // Unframed buffers put the descriptor on the row directly, behind box art.
   return line.replace(/^[^A-Za-z0-9]+/, '').trim()
@@ -171,7 +171,7 @@ function labelNamesReportedModel(reportedModel: string, label: string): boolean
   let cursor = 1
   for (const token of labelTokens.slice(1)) {
     const found = nameTokens.indexOf(token, cursor)
-    if (found < 0) {
+    if (found === -1) {
       return false
     }
     cursor = found + 1
@@ -212,7 +212,7 @@ export function readClaudeSessionOptionsFromTerminalScreen(
   }
   const lines = normalizedScreenLines(screen)
   const headerIndex = lines.findIndex(isClaudeHeaderRow)
-  if (headerIndex < 0) {
+  if (headerIndex === -1) {
     return null
   }
   const descriptorCell = claudeModelDescriptorCell(lines, headerIndex)
diff --git a/src/renderer/src/components/native-chat/native-chat-pending-occurrence.ts b/src/renderer/src/components/native-chat/native-chat-pending-occurrence.ts
index 7185b6ad1d3..a994ecf8da7 100644
--- a/src/renderer/src/components/native-chat/native-chat-pending-occurrence.ts
+++ b/src/renderer/src/components/native-chat/native-chat-pending-occurrence.ts
@@ -1,9 +1,8 @@
-import { stripImagePromptMarker } from '../../../../shared/native-chat-image-transcript-markers'
 import {
-  isImageRefBlock,
-  isTextBlock,
-  type NativeChatMessage
-} from '../../../../shared/native-chat-types'
+  normalizeNativeChatUserText,
+  normalizedNativeChatUserMessageText
+} from '../../../../shared/native-chat-image-transcript-markers'
+import { isImageRefBlock, type NativeChatMessage } from '../../../../shared/native-chat-types'
 
 export type NativeChatPendingOccurrence = {
   text: string
@@ -16,7 +15,7 @@ export type NativeChatPendingOccurrence = {
 }
 
 export function normalizeNativeChatPendingText(text: string): string {
-  return stripImagePromptMarker(text).trim().replace(/\s+/g, ' ')
+  return normalizeNativeChatUserText(text)
 }
 
 export function nativeChatPendingContentKey(
@@ -34,15 +33,15 @@ function nativeChatUserMessageContentKey(message: NativeChatMessage): string | n
   if (message.role !== 'user') {
     return null
   }
-  const text = message.blocks
-    .filter(isTextBlock)
-    .map((block) => block.text)
-    .join(' ')
+  const text = normalizedNativeChatUserMessageText(message) ?? ''
+  if (text) {
+    return `text:${text}`
+  }
   const imagePaths = message.blocks
     .filter(isImageRefBlock)
     .map((block) => block.path)
     .filter((path): path is string => Boolean(path))
-  const key = nativeChatPendingContentKey({ text, imagePaths })
+  const key = nativeChatPendingContentKey({ text: '', imagePaths })
   return key === 'empty' ? null : key
 }
 
@@ -80,19 +79,6 @@ export function advancedNativeChatUserContentCounts(
   return advanced
 }
 
-function nativeChatUserMessageNormalizedText(message: NativeChatMessage): string | null {
-  if (message.role !== 'user') {
-    return null
-  }
-  const text = normalizeNativeChatPendingText(
-    message.blocks
-      .filter(isTextBlock)
-      .map((block) => block.text)
-      .join(' ')
-  )
-  return text.length > 0 ? text : null
-}
-
 /** User texts that already have a later non-user turn (ready to prune echoes). */
 export function advancedNativeChatUserTexts(
   messages: readonly NativeChatMessage[]
@@ -101,7 +87,7 @@ export function advancedNativeChatUserTexts(
   const waiting: string[] = []
   for (const message of messages) {
     if (message.role === 'user') {
-      const text = nativeChatUserMessageNormalizedText(message)
+      const text = normalizedNativeChatUserMessageText(message)
       if (text) {
         waiting.push(text)
       }
@@ -119,7 +105,7 @@ export function matchingNativeChatUserTexts(
 ): readonly string[] {
   const texts: string[] = []
   for (const message of messages) {
-    const text = nativeChatUserMessageNormalizedText(message)
+    const text = normalizedNativeChatUserMessageText(message)
     if (text) {
       texts.push(text)
     }
@@ -191,7 +177,7 @@ export function selectPendingIndicesRepresentedByUserTexts(
       }
       represented.add(entry.index)
       const at = remaining.findIndex((candidate) => candidate.index === entry.index)
-      if (at >= 0) {
+      if (at !== -1) {
         remaining.splice(at, 1)
       }
     }
diff --git a/src/renderer/src/components/native-chat/native-chat-pending.test.ts b/src/renderer/src/components/native-chat/native-chat-pending.test.ts
index 9686aa3eb38..75b2c3d34c7 100644
--- a/src/renderer/src/components/native-chat/native-chat-pending.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-pending.test.ts
@@ -95,6 +95,34 @@ describe('prunePendingSends', () => {
     expect(next).toEqual([])
   })
 
+  it('drops an attachment pending send once a trailing-marker prompt advances', () => {
+    const pending = [
+      { ...pendingOf('p1', 'what do you see'), imagePaths: ['/Users/me/Downloads/3d.png'] }
+    ]
+    const next = prunePendingSends(pending, [
+      userMessage('m1', 'what do you see[Image #1]'),
+      assistantMessage('m2', 'an image')
+    ])
+    expect(next).toEqual([])
+  })
+
+  it('drops a pending send represented by multiple marker-bearing text blocks', () => {
+    const prompt: NativeChatMessage = {
+      ...userMessage('m1', 'unused'),
+      blocks: [
+        { type: 'text', text: 'what do' },
+        { type: 'image-ref', path: '/tmp/a.png' },
+        { type: 'text', text: '[Image #1] you see' }
+      ]
+    }
+    const next = prunePendingSends(
+      [pendingOf('p1', 'what do you see')],
+      [prompt, assistantMessage('m2', 'an image')]
+    )
+
+    expect(next).toEqual([])
+  })
+
   it('drops an attachment-only pending send once its image turn advances', () => {
     const pending = [{ ...pendingOf('p1', ''), imagePaths: ['/tmp/first.png', '/tmp/second.png'] }]
     const transcript = [
diff --git a/src/renderer/src/components/native-chat/native-chat-pending.ts b/src/renderer/src/components/native-chat/native-chat-pending.ts
index 410de8add38..a33b4e27838 100644
--- a/src/renderer/src/components/native-chat/native-chat-pending.ts
+++ b/src/renderer/src/components/native-chat/native-chat-pending.ts
@@ -99,7 +99,7 @@ function messagesAfterPendingBoundary(
     return messages.filter((message) => messageIsAfterPendingTimestamp(message, pending))
   }
   const boundaryIndex = messages.findIndex((message) => message.id === pending.afterMessageId)
-  if (boundaryIndex >= 0) {
+  if (boundaryIndex !== -1) {
     return messages.slice(boundaryIndex + 1)
   }
   // A bounded authoritative read can page the boundary out. Fall back to the
@@ -164,7 +164,7 @@ export function prunePendingSends(
       return false
     }
     const openIndex = stillOpen.indexOf(entry)
-    return openIndex < 0 || !gluedRepresented.has(openIndex)
+    return openIndex === -1 || !gluedRepresented.has(openIndex)
   })
   return next.length === pending.length ? pending : next
 }
@@ -208,7 +208,7 @@ export function pendingSendsAsMessages(
         return false
       }
       const openIndex = stillVisible.indexOf(entry)
-      return openIndex < 0 || !gluedRepresented.has(openIndex)
+      return openIndex === -1 || !gluedRepresented.has(openIndex)
     })
     .map((entry) => ({
       id: `pending:${entry.id}`,
diff --git a/src/renderer/src/components/native-chat/native-chat-preassembled-session-parity.test.ts b/src/renderer/src/components/native-chat/native-chat-preassembled-session-parity.test.ts
index 0575ba0a3f9..eb7f2f0d617 100644
--- a/src/renderer/src/components/native-chat/native-chat-preassembled-session-parity.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-preassembled-session-parity.test.ts
@@ -74,6 +74,29 @@ describe('preassembled native-chat live sessions', () => {
     expect(out[0]).toMatchObject({ id: 'image-prompt', source: 'transcript' })
   })
 
+  it('keeps legacy parity for trailing image prompt markers', () => {
+    const transcript: NativeChatMessage[] = [
+      message('image-source', {
+        role: 'user',
+        blocks: [{ type: 'text', text: '[Image: source: /tmp/a.png]' }],
+        timestamp: 1
+      }),
+      message('image-prompt', {
+        role: 'user',
+        blocks: [{ type: 'text', text: 'describe this[Image #1]' }],
+        timestamp: 2
+      })
+    ]
+
+    const out = expectLegacyMessageParity(transcript)
+
+    expect(out).toHaveLength(1)
+    expect(out[0]?.blocks).toEqual([
+      { type: 'image-ref', path: '/tmp/a.png' },
+      { type: 'text', text: 'describe this' }
+    ])
+  })
+
   it('re-dedupes surfaced skill envelopes that collide across sources', () => {
     const skill = (id: string, plugin: string, source: 'transcript' | 'scrape') =>
       message(id, {
diff --git a/src/renderer/src/components/native-chat/native-chat-session-assembler.test.ts b/src/renderer/src/components/native-chat/native-chat-session-assembler.test.ts
index 8c081b12796..78321d61548 100644
--- a/src/renderer/src/components/native-chat/native-chat-session-assembler.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-session-assembler.test.ts
@@ -112,6 +112,34 @@ describe('assembleNativeChatSession', () => {
     ])
   })
 
+  it('merges Claude image source markers into a trailing-marker prompt', () => {
+    const imageSource = msg({
+      id: 'u-image-source',
+      role: 'user',
+      timestamp: 100,
+      blocks: [{ type: 'text', text: '[Image: source: /Users/me/Downloads/3d.png]' }]
+    })
+    const prompt = msg({
+      id: 'u-prompt',
+      role: 'user',
+      timestamp: 101,
+      blocks: [{ type: 'text', text: 'what do you see[Image #1]' }]
+    })
+
+    const session = assembleNativeChatSession({
+      sources: { transcript: [imageSource, prompt] },
+      sessionId: 's1',
+      agent: 'claude'
+    })
+
+    expect(session.messages).toHaveLength(1)
+    expect(session.messages[0]).toMatchObject({ id: 'u-prompt', role: 'user' })
+    expect(session.messages[0].blocks).toEqual([
+      { type: 'image-ref', path: '/Users/me/Downloads/3d.png' },
+      { type: 'text', text: 'what do you see' }
+    ])
+  })
+
   it('drops a scrape duplicate even when scrape is processed first by id', () => {
     const scrape = msg({
       id: 'shared-id',
diff --git a/src/renderer/src/components/native-chat/use-native-chat-skills.react.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-skills.react.test.tsx
index 647a07b2f4f..8004071d679 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-skills.react.test.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-skills.react.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment happy-dom
 
-import { cleanup, render, waitFor } from '@testing-library/react'
+import { act, cleanup, render, waitFor } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { NativeChatSkillDiscovery } from './use-native-chat-skills'
 
@@ -130,6 +130,31 @@ describe('useNativeChatSkills', () => {
     expect(mocks.callRuntimeRpc).not.toHaveBeenCalled()
   })
 
+  it('makes Retry reach disk instead of the host shared scan', async () => {
+    render(<Probe enabled />)
+    await waitFor(() => expect(mocks.snapshots.at(-1)?.status).toBe('ready'))
+    expect(mocks.callRuntimeRpc).toHaveBeenLastCalledWith(
+      { kind: 'local' },
+      'skills.discover',
+      { cwd: '/repo/worktree', worktreeId: 'worktree-1' },
+      { timeoutMs: 10_000 }
+    )
+
+    act(() => {
+      mocks.snapshots.at(-1)?.retry()
+    })
+    await waitFor(() => expect(mocks.callRuntimeRpc).toHaveBeenCalledTimes(2))
+
+    // Why: Retry is the user saying "I changed something" — without `refresh` it
+    // would be answered from the scan it is trying to get past.
+    expect(mocks.callRuntimeRpc).toHaveBeenLastCalledWith(
+      { kind: 'local' },
+      'skills.discover',
+      { cwd: '/repo/worktree', worktreeId: 'worktree-1', refresh: true },
+      { timeoutMs: 10_000 }
+    )
+  })
+
   it('routes runtime-owned panes through their saved environment', async () => {
     mocks.state = stateForHost('runtime:env-1')
     render(<Probe enabled />)
diff --git a/src/renderer/src/components/native-chat/use-native-chat-skills.ts b/src/renderer/src/components/native-chat/use-native-chat-skills.ts
index 42c7702d017..f8a7e943935 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-skills.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-skills.ts
@@ -83,11 +83,17 @@ export function useNativeChatSkills(
   const [state, setState] = useState<StoredDiscoveryState>(IDLE_STATE)
   const [retryGeneration, setRetryGeneration] = useState(0)
   const paneDiscoveryCache = useRef(new Map<string, SkillDiscoveryResult>())
+  // Why: retry intent belongs to the next request, not to every later render —
+  // keying off the generation counter would keep forcing after a pane switch.
+  const forceNextDiscovery = useRef(false)
   const profile = getNativeChatAgentProfile(agent)
 
   useEffect(() => {
     let cancelled = false
     if (!profile || !enabled || !context) {
+      // Why: there is no pane to retry into, so a pending retry intent must not
+      // survive to force an unrelated pane's first scan.
+      forceNextDiscovery.current = false
       setState(IDLE_STATE)
       return
     }
@@ -119,7 +125,12 @@ export function useNativeChatSkills(
       return
     }
     setState({ status: 'loading', skills: [], error: null, contextKey: context.key })
-    const request = getOrStartDiscovery(context)
+    // Why: Retry is an explicit "I changed something, look again", so it has to
+    // reach the host's disk rather than its shared scans. The first attempt for a
+    // pane rides those scans like every other passive reader.
+    const forced = forceNextDiscovery.current
+    forceNextDiscovery.current = false
+    const request = getOrStartDiscovery(context, forced)
     void request.then(
       (result) => {
         paneDiscoveryCache.current.set(paneCacheKey, result)
@@ -182,6 +193,7 @@ export function useNativeChatSkills(
   }, [agent, context, effectiveState, profile])
 
   const retry = useCallback(() => {
+    forceNextDiscovery.current = true
     if (context) {
       paneDiscoveryCache.current.delete(context.key)
       setState({ status: 'loading', skills: [], error: null, contextKey: context.key })
@@ -201,10 +213,11 @@ export function useNativeChatSkills(
 }
 
 function getOrStartDiscovery(
-  context: NativeChatSkillDiscoveryContext
+  context: NativeChatSkillDiscoveryContext,
+  refresh = false
 ): Promise<SkillDiscoveryResult> {
   const existing = inFlightDiscovery.get(context.key)
-  if (existing) {
+  if (existing && !refresh) {
     return existing
   }
   // Why: the local runtime.call branch ignores timeoutMs, so the renderer must
@@ -213,7 +226,7 @@ function getOrStartDiscovery(
     callRuntimeRpc<SkillDiscoveryResult>(
       context.runtimeTarget,
       'skills.discover',
-      context.discoveryTarget,
+      refresh ? { ...context.discoveryTarget, refresh: true } : context.discoveryTarget,
       {
         timeoutMs: DISCOVERY_TIMEOUT_MS
       }
diff --git a/src/renderer/src/components/new-workspace/SmartWorkspaceNameField-source-boundaries.test.ts b/src/renderer/src/components/new-workspace/SmartWorkspaceNameField-source-boundaries.test.ts
index 414b438bad7..10857e8d67a 100644
--- a/src/renderer/src/components/new-workspace/SmartWorkspaceNameField-source-boundaries.test.ts
+++ b/src/renderer/src/components/new-workspace/SmartWorkspaceNameField-source-boundaries.test.ts
@@ -99,6 +99,31 @@ describe('SmartWorkspaceNameField repo-backed source boundaries', () => {
     expect(githubLookupSection).toContain('repoBackedSearchTargets.map')
   })
 
+  it('does not fan decisive Linear URLs out to unrelated providers', () => {
+    const githubGate = sourceBetween(
+      FIELD_SOURCE,
+      'const shouldQueryGithub =',
+      'const shouldQueryLinear ='
+    )
+    const branchGate = sourceBetween(
+      FIELD_SOURCE,
+      'const branchSearchRequest = useMemo',
+      'useEffect(() => {\n    if (!branchSearchRequest)'
+    )
+    const gitlabGate = sourceBetween(
+      FIELD_SOURCE,
+      'const shouldQueryGitlab =',
+      'useEffect(() => {\n    if (!shouldQueryGitlab'
+    )
+
+    expect(FIELD_SOURCE).toContain(
+      "linearUrlIntent !== null && (mode === 'smart' || mode === 'linear')"
+    )
+    expect(githubGate).toContain('!linearUrlIntentOwnsInput')
+    expect(branchGate).toContain('linearUrlIntentOwnsInput')
+    expect(gitlabGate).toContain('!linearUrlIntentOwnsInput')
+  })
+
   it('reports the active source mode without lifting source search state', () => {
     expect(FIELD_SOURCE).toContain('onActiveSourceModeChange?: (mode: SmartNameMode) => void')
     expect(FIELD_SOURCE).toContain('onActiveSourceModeChange')
diff --git a/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.ime-enter.test.tsx b/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.ime-enter.test.tsx
index f3c81f5b573..8055d963e1f 100644
--- a/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.ime-enter.test.tsx
+++ b/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.ime-enter.test.tsx
@@ -3,6 +3,7 @@
 import React, { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
 import SmartWorkspaceNameField from './SmartWorkspaceNameField'
 
 vi.mock('@/store', () => {
@@ -10,6 +11,7 @@ vi.mock('@/store', () => {
     repos: [],
     addRepo: vi.fn(),
     checkLinearConnection: vi.fn(),
+    fetchLinearIssue: vi.fn(),
     fetchWorkItems: vi.fn(),
     fetchWorkItemsAcrossRepos: vi.fn(),
     getCachedWorkItems: vi.fn(() => null),
@@ -25,6 +27,7 @@ vi.mock('@/store', () => {
   }
   const useAppStore = (selector: (s: typeof state) => unknown): unknown => selector(state)
   useAppStore.getState = () => state
+  useAppStore.setState = (patch: Partial<typeof state>) => Object.assign(state, patch)
   return { useAppStore }
 })
 
@@ -79,6 +82,13 @@ let container: HTMLDivElement
 let root: Root
 
 beforeEach(() => {
+  useAppStore.setState({
+    linearStatus: { connected: false, viewer: null },
+    linearStatusChecked: false,
+    fetchLinearIssue: vi.fn(async () => null),
+    listLinearIssues: vi.fn(async () => ({ items: [] })),
+    searchLinearIssues: vi.fn(async () => [])
+  })
   container = document.createElement('div')
   document.body.appendChild(container)
   root = createRoot(container)
@@ -88,6 +98,7 @@ afterEach(() => {
   act(() => {
     root.unmount()
   })
+  vi.useRealTimers()
   container.remove()
 })
 
@@ -261,6 +272,87 @@ describe('SmartWorkspaceNameField IME Enter guard', () => {
   })
 })
 
+describe('SmartWorkspaceNameField Linear URL loading', () => {
+  it('blocks Enter and delays visible loading feedback while preserving its layout', async () => {
+    vi.useFakeTimers()
+    const url = 'https://linear.app/stably/issue/STA-4084/restore-shell-integration'
+    const onPlainEnter = vi.fn()
+    const onValueChange = vi.fn()
+    const onLinearIssueSelect = vi.fn()
+    useAppStore.setState({
+      linearStatus: {
+        connected: true,
+        viewer: null,
+        activeWorkspaceId: 'workspace-1',
+        selectedWorkspaceId: 'workspace-1',
+        workspaces: [
+          {
+            id: 'workspace-1',
+            displayName: 'Stably User',
+            email: null,
+            organizationId: 'organization-stably',
+            organizationName: 'Stably',
+            organizationUrlKey: 'stably'
+          }
+        ]
+      },
+      linearStatusChecked: true,
+      fetchLinearIssue: vi.fn(() => new Promise<null>(() => {}))
+    })
+
+    await act(async () => {
+      root.render(
+        <SmartWorkspaceNameField
+          repos={[]}
+          repoId="repo-1"
+          onRepoChange={vi.fn()}
+          value={url}
+          onValueChange={onValueChange}
+          onGitHubItemSelect={vi.fn()}
+          onBranchSelect={vi.fn()}
+          onLinearIssueSelect={onLinearIssueSelect}
+          selectedSource={null}
+          onClearSelectedSource={vi.fn()}
+          onPlainEnter={onPlainEnter}
+        />
+      )
+    })
+
+    const input = container.querySelector<HTMLInputElement>('[data-workspace-name-input="true"]')
+    const describedBy = input?.getAttribute('aria-describedby')
+    const status = describedBy ? container.querySelector<HTMLElement>(`#${describedBy}`) : null
+    const reservedResults = container.querySelector<HTMLElement>('[aria-hidden="true"].space-y-1')
+    expect(input?.getAttribute('aria-busy')).toBe('true')
+    expect(status?.getAttribute('role')).toBe('status')
+    expect(status?.getAttribute('aria-live')).toBe('polite')
+    expect(status?.textContent).toContain('Loading Linear issue…')
+    expect(container.textContent).not.toContain('Start typing to create a name or find a source.')
+    expect(reservedResults?.classList.contains('invisible')).toBe(true)
+    expect(reservedResults?.children).toHaveLength(3)
+
+    if (!input) {
+      throw new Error('workspace name input not rendered')
+    }
+    pressEnter(input)
+    expect(onPlainEnter).not.toHaveBeenCalled()
+    expect(onValueChange).not.toHaveBeenCalled()
+    expect(onLinearIssueSelect).not.toHaveBeenCalled()
+
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(199)
+    })
+    expect(reservedResults?.classList.contains('invisible')).toBe(true)
+
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(1)
+    })
+    const visibleResults = container.querySelector<HTMLElement>('[aria-hidden="true"].space-y-1')
+    expect(visibleResults).toBe(reservedResults)
+    expect(visibleResults?.classList.contains('invisible')).toBe(false)
+    expect(visibleResults?.querySelectorAll('.animate-pulse')).toHaveLength(3)
+  })
+})
+
 describe('SmartWorkspaceNameField emoji shortcodes', () => {
   it('replaces a completed shortcode as it is typed', () => {
     const onValueChange = vi.fn()
diff --git a/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.tsx b/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.tsx
index 6ddc4e3ae93..b87523a7d2d 100644
--- a/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.tsx
+++ b/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.tsx
@@ -61,10 +61,18 @@ import {
   getVisibleBranchResults,
   getVisibleHeldProviderResults,
   isBlockingJiraUrlIntent,
-  isSmartWorkspaceSourceQueryWithinLimit,
   type SmartNameMode,
   type SmartWorkspaceSourceRow
 } from './smart-workspace-source-results'
+import {
+  getSmartWorkspaceLinearSearchQuery,
+  isBlockingLinearUrlIntent,
+  isSmartWorkspaceLinearIssueIntentMatch,
+  parseBoundedSmartWorkspaceLinearIssueInput,
+  parseBoundedSmartWorkspaceLinearIssueUrlIntent,
+  prioritizeSmartWorkspaceLinearIssueResults
+} from '../../../../shared/new-workspace/smart-workspace-linear-intent'
+import { isSmartWorkspaceSourceQueryWithinLimit } from '../../../../shared/new-workspace/smart-workspace-source-query'
 import { filterAvailableTaskProviders } from '../../../../shared/task-providers'
 import type {
   BaseRefSearchResult,
@@ -109,6 +117,7 @@ import {
   type WorkspaceEmojiSuggestion
 } from '@/lib/workspace-emoji-shortcodes'
 import { WorkspaceEmojiSuggestionPopover } from '@/components/workspace-emoji/WorkspaceEmojiSuggestionPopover'
+import { lookupLinearIssueUrl } from '@/lib/linear-issue-url-lookup'
 
 type RepoOption = ReturnType<typeof useAppStore.getState>['repos'][number]
 const EMPTY_REPO_SEARCH_REPOS: readonly RepoOption[] = []
@@ -259,6 +268,7 @@ export default function SmartWorkspaceNameField({
     checkLinearConnection,
     fetchWorkItems,
     fetchWorkItemsAcrossRepos,
+    fetchLinearIssue,
     getCachedWorkItems,
     linearStatus,
     linearStatusChecked,
@@ -277,6 +287,7 @@ export default function SmartWorkspaceNameField({
       checkLinearConnection: s.checkLinearConnection,
       fetchWorkItems: s.fetchWorkItems,
       fetchWorkItemsAcrossRepos: s.fetchWorkItemsAcrossRepos,
+      fetchLinearIssue: s.fetchLinearIssue,
       getCachedWorkItems: s.getCachedWorkItems,
       linearStatus: s.linearStatus,
       linearStatusChecked: s.linearStatusChecked,
@@ -378,6 +389,10 @@ export default function SmartWorkspaceNameField({
   const [gitlabLoading, setGitlabLoading] = useState(false)
   const [branchesLoading, setBranchesLoading] = useState(false)
   const [linearLoading, setLinearLoading] = useState(false)
+  const [linearUrlLoadingFeedbackQuery, setLinearUrlLoadingFeedbackQuery] = useState<string | null>(
+    null
+  )
+  const [settledLinearUrlQuery, setSettledLinearUrlQuery] = useState<string | null>(null)
   const [jiraLoading, setJiraLoading] = useState(false)
   const [commandValue, setCommandValue] = useState('')
   const [emojiCommandValue, setEmojiCommandValue] = useState('')
@@ -411,6 +426,7 @@ export default function SmartWorkspaceNameField({
   const jiraSourceConnected = jiraConnectionStatus?.connected === true
   const showJiraSiteContext = mode === 'jira' && jiraConnectionStatus?.selectedSiteId === 'all'
   const jiraStatusId = React.useId()
+  const linearStatusId = React.useId()
 
   useEffect(() => {
     onActiveSourceModeChange?.(mode)
@@ -626,15 +642,32 @@ export default function SmartWorkspaceNameField({
     () => (sourceQueryWithinLimit ? parseGitHubIssueOrPRLink(debouncedQuery) : null),
     [debouncedQuery, sourceQueryWithinLimit]
   )
+  const linearUrlIntent = useMemo(
+    () => parseBoundedSmartWorkspaceLinearIssueUrlIntent(value),
+    [value]
+  )
+  const linearUrlIntentOwnsInput =
+    linearUrlIntent !== null && (mode === 'smart' || mode === 'linear')
+  const linearQuery = linearUrlIntentOwnsInput ? value : debouncedQuery
+  useEffect(() => {
+    if (!linearUrlIntentOwnsInput || !linearLoading) {
+      setLinearUrlLoadingFeedbackQuery(null)
+      return
+    }
+    setLinearUrlLoadingFeedbackQuery(null)
+    const timer = window.setTimeout(() => setLinearUrlLoadingFeedbackQuery(linearQuery), 200)
+    return () => window.clearTimeout(timer)
+  }, [linearLoading, linearQuery, linearUrlIntentOwnsInput])
   const shouldQueryGithub =
     sourceQueryWithinLimit &&
     !repoBackedSourcesDisabled &&
     !jiraSource.intent &&
+    !linearUrlIntentOwnsInput &&
     !textOnly &&
     repoBackedSearchTargets.length > 0 &&
     (mode === 'smart' || mode === 'github')
   const shouldQueryLinear =
-    sourceQueryWithinLimit &&
+    isSmartWorkspaceSourceQueryWithinLimit(linearQuery) &&
     !jiraSource.intent &&
     !textOnly &&
     linearAvailable &&
@@ -909,7 +942,7 @@ export default function SmartWorkspaceNameField({
   const branchSearchRequest = useMemo(
     () =>
       getBranchSearchRequest({
-        disabled: disabled || jiraSource.intent,
+        disabled: disabled || jiraSource.intent || linearUrlIntentOwnsInput,
         branchesEnabled: branchesEnabled && !repoBackedSourcesDisabled,
         textOnly,
         mode,
@@ -922,6 +955,7 @@ export default function SmartWorkspaceNameField({
       debouncedQuery,
       disabled,
       jiraSource.intent,
+      linearUrlIntentOwnsInput,
       mode,
       repoBackedSourcesDisabled,
       selectedRepo?.id,
@@ -975,21 +1009,32 @@ export default function SmartWorkspaceNameField({
     if (disabled || !shouldQueryLinear || !linearStatus.connected) {
       setLinearIssues([])
       setLinearLoading(false)
+      setSettledLinearUrlQuery(null)
       return
     }
     let stale = false
     setLinearLoading(true)
-    const trimmed = debouncedQuery.trim()
+    setSettledLinearUrlQuery(null)
+    const trimmed = linearQuery.trim()
     // Why: empty-query list must not briefly paint the previous non-empty result set.
     if (trimmed === '') {
       setLinearIssues([])
     }
-    const request = trimmed
-      ? searchLinearIssues(trimmed, RESULT_LIMIT, { sourceContext: linearSourceContext })
-      : listLinearIssues(
-          { kind: 'list', filter: 'assigned', limit: RESULT_LIMIT },
-          { sourceContext: linearSourceContext }
-        ).then((result) => result.items)
+    const request = linearUrlIntent
+      ? lookupLinearIssueUrl({
+          intent: linearUrlIntent,
+          knownStatus: linearStatus,
+          sourceContext: linearSourceContext,
+          fetchLinearIssue
+        }).then((issue) => (issue ? [issue] : []))
+      : trimmed
+        ? searchLinearIssues(getSmartWorkspaceLinearSearchQuery(trimmed), RESULT_LIMIT, {
+            sourceContext: linearSourceContext
+          })
+        : listLinearIssues(
+            { kind: 'list', filter: 'assigned', limit: RESULT_LIMIT },
+            { sourceContext: linearSourceContext }
+          ).then((result) => result.items)
     void request
       .then((issues) => {
         if (!stale) {
@@ -1004,6 +1049,7 @@ export default function SmartWorkspaceNameField({
       .finally(() => {
         if (!stale) {
           setLinearLoading(false)
+          setSettledLinearUrlQuery(linearUrlIntent ? trimmed : null)
         }
       })
     return () => {
@@ -1011,7 +1057,7 @@ export default function SmartWorkspaceNameField({
     }
     // Why: list/search are stable store methods; depending on them would refetch on unrelated store writes.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [debouncedQuery, disabled, linearSourceContext, linearStatus.connected, shouldQueryLinear])
+  }, [disabled, linearQuery, linearSourceContext, linearStatus, linearUrlIntent, shouldQueryLinear])
 
   useEffect(() => {
     if (!shouldQueryJira || !jiraSourceContext || !jiraSearchJql) {
@@ -1067,6 +1113,7 @@ export default function SmartWorkspaceNameField({
     sourceQueryWithinLimit &&
     !repoBackedSourcesDisabled &&
     !jiraSource.intent &&
+    !linearUrlIntentOwnsInput &&
     !textOnly &&
     gitlabSourceAvailable &&
     repoBackedSearchTargets.length > 0 &&
@@ -1199,6 +1246,11 @@ export default function SmartWorkspaceNameField({
     shouldQueryGitlab
   ])
 
+  const linearUrlLookupFailed =
+    linearUrlIntentOwnsInput &&
+    settledLinearUrlQuery === linearQuery.trim() &&
+    !linearLoading &&
+    linearIssues.length === 0
   const rows = useMemo<RowEntry[]>(() => {
     if (jiraSource.intent && jiraSource.accountChoices.length > 0) {
       return jiraSource.accountChoices.map((site) => ({
@@ -1234,12 +1286,16 @@ export default function SmartWorkspaceNameField({
         value,
         debouncedQuery
       }),
-      linearAvailable,
-      linearIssues: getVisibleHeldProviderResults({
-        items: linearIssues,
+      linearAvailable: linearAvailable && !linearUrlLookupFailed,
+      linearIssues: prioritizeSmartWorkspaceLinearIssueResults(
         value,
-        debouncedQuery
-      }),
+        getVisibleHeldProviderResults({
+          items: linearIssues,
+          value,
+          debouncedQuery: linearUrlIntentOwnsInput ? value : debouncedQuery
+        })
+      ),
+      linearUrlIntentOwnsResults: true,
       mode,
       resultLimit: RESULT_LIMIT,
       value
@@ -1257,6 +1313,8 @@ export default function SmartWorkspaceNameField({
     jiraIssues,
     linearAvailable,
     linearIssues,
+    linearUrlLookupFailed,
+    linearUrlIntentOwnsInput,
     mode,
     selectedRepo?.id,
     value
@@ -1274,7 +1332,8 @@ export default function SmartWorkspaceNameField({
   const debouncedQueryWithinSourceLimit = isSmartWorkspaceSourceQueryWithinLimit(debouncedQuery)
   const trimmedValue = valueWithinSourceLimit ? value.trim() : ''
   const trimmedDebouncedQuery = debouncedQueryWithinSourceLimit ? debouncedQuery.trim() : ''
-  const isQueryStale = trimmedValue.length > 0 && trimmedDebouncedQuery !== trimmedValue
+  const isQueryStale =
+    !linearUrlIntentOwnsInput && trimmedValue.length > 0 && trimmedDebouncedQuery !== trimmedValue
 
   // Why: when the typed value is an unambiguous source ref, snap the highlight to that row so Enter picks it over the typed-text fallback.
   const sourceIntent = useMemo<'github' | 'gitlab' | 'linear' | 'jira' | null>(() => {
@@ -1294,11 +1353,25 @@ export default function SmartWorkspaceNameField({
     if (parseGitLabIssueOrMRLink(trimmed) !== null) {
       return 'gitlab'
     }
-    if (linearAvailable && /^[A-Za-z][A-Za-z0-9_]*-\d+$/.test(trimmed)) {
-      return 'linear'
+    if (linearAvailable) {
+      const linearIntent = parseBoundedSmartWorkspaceLinearIssueInput(trimmed)
+      if (
+        linearIntent &&
+        rows.some(
+          (row) =>
+            row.kind === 'linear' && isSmartWorkspaceLinearIssueIntentMatch(linearIntent, row.issue)
+        )
+      ) {
+        return 'linear'
+      }
     }
     return null
-  }, [jiraSource.intent, linearAvailable, value])
+  }, [jiraSource.intent, linearAvailable, rows, value])
+  const unresolvedLinearUrlIntent =
+    linearUrlIntentOwnsInput &&
+    linearAvailable &&
+    sourceIntent !== 'linear' &&
+    (linearLoading || settledLinearUrlQuery !== linearQuery.trim())
 
   const resolvedCommandValue = resolveSmartWorkspaceCommandValue({
     currentValue: commandValue,
@@ -1342,9 +1415,14 @@ export default function SmartWorkspaceNameField({
       (suggestion) => `emoji:${suggestion.shortcode}` === resolvedEmojiCommandValue
     ) ?? null
 
+  const showLinearUrlLoadingFeedback =
+    linearLoading && linearUrlIntentOwnsInput && linearUrlLoadingFeedbackQuery === linearQuery
+  const visibleLinearLoading =
+    linearLoading && (!linearUrlIntentOwnsInput || showLinearUrlLoadingFeedback)
   const loading = jiraSource.intent
     ? jiraSource.loading
-    : githubLoading || gitlabLoading || branchesLoading || linearLoading || jiraLoading
+    : githubLoading || gitlabLoading || branchesLoading || visibleLinearLoading || jiraLoading
+  const reserveLinearLoadingResults = unresolvedLinearUrlIntent && searchResultRows.length === 0
   // Why: only spin on first load — not on every in-flight refresh while rows stay visible.
   const showSearchSpinner = loading && searchResultRows.length === 0
   const ActiveInputIcon =
@@ -1831,7 +1909,11 @@ export default function SmartWorkspaceNameField({
                     onPaste={(event) => {
                       // Why: a pasted issue URL is the whole intent — don't splice it into a name.
                       const pasted = event.clipboardData.getData('text')
-                      if (!pasted || !isBlockingJiraUrlIntent(mode, pasted)) {
+                      if (
+                        !pasted ||
+                        (!isBlockingJiraUrlIntent(mode, pasted) &&
+                          !isBlockingLinearUrlIntent(mode, pasted))
+                      ) {
                         return
                       }
                       event.preventDefault()
@@ -1896,6 +1978,10 @@ export default function SmartWorkspaceNameField({
                           handleEmojiSelect(selectedEmojiSuggestion)
                           return
                         }
+                        if (unresolvedLinearUrlIntent) {
+                          event.preventDefault()
+                          return
+                        }
                         if (open && rows.length > 0) {
                           const row = rows.find((entry) => entry.value === resolvedCommandValue)
                           if (row) {
@@ -1934,8 +2020,16 @@ export default function SmartWorkspaceNameField({
                     }}
                     placeholder={placeholder}
                     disabled={disabled}
-                    aria-busy={jiraSource.intent && jiraSource.loading}
-                    aria-describedby={jiraSource.intent ? jiraStatusId : undefined}
+                    aria-busy={
+                      (jiraSource.intent && jiraSource.loading) || unresolvedLinearUrlIntent
+                    }
+                    aria-describedby={
+                      jiraSource.intent
+                        ? jiraStatusId
+                        : unresolvedLinearUrlIntent
+                          ? linearStatusId
+                          : undefined
+                    }
                     // Why: match the project/run-on comboboxes' solid `bg-background` — the input's
                     // default transparent fill made it read a different color on light mode.
                     className="h-9 bg-background pl-8 text-sm"
@@ -2011,8 +2105,23 @@ export default function SmartWorkspaceNameField({
                   </CommandItem>
                 </div>
               ) : null}
-              {jiraSource.errorKind ? null : loading && searchResultRows.length === 0 ? (
-                <div className="space-y-1 p-1">
+              {jiraSource.errorKind ? null : reserveLinearLoadingResults ? (
+                <div
+                  aria-hidden="true"
+                  className={cn('space-y-1 p-1', !showLinearUrlLoadingFeedback && 'invisible')}
+                >
+                  {[0, 1, 2].map((index) => (
+                    <div
+                      key={index}
+                      className={cn(
+                        'h-8 rounded bg-muted/40',
+                        showLinearUrlLoadingFeedback && 'animate-pulse'
+                      )}
+                    />
+                  ))}
+                </div>
+              ) : showSearchSpinner ? (
+                <div aria-hidden="true" className="space-y-1 p-1">
                   {[0, 1, 2].map((index) => (
                     <div key={index} className="h-8 animate-pulse rounded bg-muted/40" />
                   ))}
@@ -2088,6 +2197,14 @@ export default function SmartWorkspaceNameField({
           ) : null}
         </div>
       ) : null}
+      {unresolvedLinearUrlIntent ? (
+        <div id={linearStatusId} role="status" aria-live="polite" className="sr-only">
+          {translate(
+            'auto.components.new.workspace.SmartWorkspaceNameField.loadingLinearIssue',
+            'Loading Linear issue…'
+          )}
+        </div>
+      ) : null}
       <WorkspaceEmojiSuggestionPopover
         anchorRef={localInputRef}
         open={emojiMenuOpen}
diff --git a/src/renderer/src/components/new-workspace/project-combobox-matching.ts b/src/renderer/src/components/new-workspace/project-combobox-matching.ts
index ac298ebd6c5..2e3459ac745 100644
--- a/src/renderer/src/components/new-workspace/project-combobox-matching.ts
+++ b/src/renderer/src/components/new-workspace/project-combobox-matching.ts
@@ -10,7 +10,7 @@ export type ScoredProjectOption = {
 
 function substringHits(text: string, query: string): number[] | null {
   const at = text.toLowerCase().indexOf(query)
-  return at < 0 ? null : Array.from({ length: query.length }, (_, offset) => at + offset)
+  return at === -1 ? null : Array.from({ length: query.length }, (_, offset) => at + offset)
 }
 
 /**
@@ -27,7 +27,7 @@ function nameHitsFor(name: string, query: string): number[] | null {
   let cursor = 0
   for (const char of query) {
     const found = haystack.indexOf(char, cursor)
-    if (found < 0) {
+    if (found === -1) {
       return null
     }
     hits.push(found)
@@ -60,7 +60,7 @@ export function rankProjectOptions(
   const scored: ScoredProjectOption[] = []
   for (const option of options) {
     const recentAt = recentIds.indexOf(option.id)
-    const recency = recentAt < 0 ? 0 : 32 - recentAt * 4
+    const recency = recentAt === -1 ? 0 : 32 - recentAt * 4
     if (query.length === 0) {
       scored.push({ option, score: recency, nameHits: [], detailHits: [] })
       continue
diff --git a/src/renderer/src/components/new-workspace/smart-workspace-command-value.test.ts b/src/renderer/src/components/new-workspace/smart-workspace-command-value.test.ts
index 8a25b457c3e..7e5f36ec13e 100644
--- a/src/renderer/src/components/new-workspace/smart-workspace-command-value.test.ts
+++ b/src/renderer/src/components/new-workspace/smart-workspace-command-value.test.ts
@@ -31,6 +31,17 @@ describe('resolveSmartWorkspaceCommandValue', () => {
     ).toBe('use-name')
   })
 
+  it('keeps arbitrary text armed when Linear search results are present', () => {
+    expect(
+      resolveSmartWorkspaceCommandValue({
+        currentValue: '',
+        rows: [row('use-name', 'use-name'), row('linear', 'linear-STA-4084')],
+        isQueryStale: false,
+        sourceIntent: null
+      })
+    ).toBe('use-name')
+  })
+
   it('keeps typed text armed while the query is ahead of debounced search', () => {
     expect(
       resolveSmartWorkspaceCommandValue({
diff --git a/src/renderer/src/components/new-workspace/smart-workspace-source-results.test.ts b/src/renderer/src/components/new-workspace/smart-workspace-source-results.test.ts
index ff76c018426..780800bb9a4 100644
--- a/src/renderer/src/components/new-workspace/smart-workspace-source-results.test.ts
+++ b/src/renderer/src/components/new-workspace/smart-workspace-source-results.test.ts
@@ -1,6 +1,5 @@
 import { describe, expect, it } from 'vitest'
 import {
-  SMART_WORKSPACE_SOURCE_QUERY_MAX_BYTES,
   buildJiraIssueSearchJql,
   buildSmartWorkspaceSourceRows,
   getBranchSearchRequest,
@@ -8,9 +7,20 @@ import {
   getVisibleBranchResults,
   getVisibleHeldProviderResults,
   isBlockingJiraUrlIntent,
-  isSmartWorkspaceSourceQueryWithinLimit,
   shouldHoldSourceResultsForQuery
 } from './smart-workspace-source-results'
+import {
+  getSmartWorkspaceLinearSearchQuery,
+  isBlockingLinearUrlIntent,
+  isSmartWorkspaceLinearIssueIntentMatch,
+  parseBoundedSmartWorkspaceLinearIssueInput,
+  parseBoundedSmartWorkspaceLinearIssueUrlIntent,
+  prioritizeSmartWorkspaceLinearIssueResults
+} from '../../../../shared/new-workspace/smart-workspace-linear-intent'
+import {
+  SMART_WORKSPACE_SOURCE_QUERY_MAX_BYTES,
+  isSmartWorkspaceSourceQueryWithinLimit
+} from '../../../../shared/new-workspace/smart-workspace-source-query'
 
 describe('Branch source results', () => {
   it('requests empty-query branch results in Branch mode', () => {
@@ -497,6 +507,183 @@ describe('source query byte limits', () => {
   })
 })
 
+describe('Linear issue source input', () => {
+  const issueUrl = 'https://linear.app/stably/issue/STA-4084/restore-osc-133-shell-integration'
+
+  it('normalizes a Linear issue URL to its identifier for search', () => {
+    expect(parseBoundedSmartWorkspaceLinearIssueInput(issueUrl)).toEqual({
+      identifier: 'STA-4084',
+      organizationUrlKey: 'stably'
+    })
+    expect(getSmartWorkspaceLinearSearchQuery(issueUrl)).toBe('STA-4084')
+  })
+
+  it('keeps arbitrary names as ordinary Linear search text', () => {
+    expect(parseBoundedSmartWorkspaceLinearIssueInput('restore shell integration')).toBeNull()
+    expect(getSmartWorkspaceLinearSearchQuery(' restore shell integration ')).toBe(
+      'restore shell integration'
+    )
+  })
+
+  it('only replaces the whole field for unmistakable Linear URL intent', () => {
+    expect(isBlockingLinearUrlIntent('smart', issueUrl)).toBe(true)
+    expect(isBlockingLinearUrlIntent('linear', issueUrl)).toBe(true)
+    expect(isBlockingLinearUrlIntent('text', issueUrl)).toBe(false)
+    expect(isBlockingLinearUrlIntent('github', issueUrl)).toBe(false)
+    expect(isBlockingLinearUrlIntent('gitlab', issueUrl)).toBe(false)
+    expect(isBlockingLinearUrlIntent('branches', issueUrl)).toBe(false)
+    expect(isBlockingLinearUrlIntent('smart', 'STA-4084')).toBe(false)
+    expect(isBlockingLinearUrlIntent('smart', 'restore-4084')).toBe(false)
+    expect(
+      isBlockingLinearUrlIntent('smart', 'https://linear.app.evil.test/stably/issue/STA-4084')
+    ).toBe(false)
+    expect(
+      isBlockingLinearUrlIntent('smart', 'https://linear.app/stably/not-an-issue/issue/STA-4084')
+    ).toBe(false)
+    expect(
+      isBlockingLinearUrlIntent('smart', 'https://linear.app/stably/issue/STA-4084/title/more')
+    ).toBe(false)
+    expect(
+      isBlockingLinearUrlIntent(
+        'smart',
+        'https://linear.app/stably/issue/STA-4084%2Fnot-the-identifier'
+      )
+    ).toBe(false)
+    expect(
+      parseBoundedSmartWorkspaceLinearIssueUrlIntent(
+        'https://linear.app/stably/issue/STA-4084/title'
+      )
+    ).toEqual({ identifier: 'STA-4084', organizationUrlKey: 'stably' })
+  })
+
+  it('keeps the exact Linear URL result ahead of provider result caps', () => {
+    const exactIssue = {
+      id: 'stably-issue',
+      identifier: 'STA-4084',
+      url: issueUrl
+    } as never
+    const rows = buildSmartWorkspaceSourceRows({
+      mode: 'smart',
+      value: issueUrl,
+      branches: Array.from({ length: 12 }, (_, index) => ({
+        refName: `origin/provider-result-${index}`,
+        localBranchName: `provider-result-${index}`
+      })),
+      githubItems: Array.from({ length: 12 }, (_, index) => ({
+        repoId: 'repo-1',
+        type: 'issue',
+        number: index + 1
+      })) as never,
+      gitlabItems: [],
+      linearIssues: [exactIssue],
+      gitlabAvailable: false,
+      linearAvailable: true,
+      linearUrlIntentOwnsResults: true,
+      resultLimit: 12
+    })
+
+    expect(rows.map((row) => row.kind)).toEqual(['use-name', 'linear'])
+    expect(rows[0]).toMatchObject({ kind: 'use-name', value: 'use-name', name: issueUrl })
+    expect(rows[1]).toMatchObject({ value: 'linear-stably-issue', issue: exactIssue })
+  })
+
+  it('keeps typed-text available while a Linear URL has not resolved yet', () => {
+    expect(
+      buildSmartWorkspaceSourceRows({
+        mode: 'smart',
+        value: issueUrl,
+        branches: [],
+        githubItems: [],
+        gitlabItems: [],
+        linearIssues: [],
+        gitlabAvailable: false,
+        linearAvailable: true,
+        linearUrlIntentOwnsResults: true,
+        resultLimit: 12
+      })
+    ).toEqual([{ kind: 'use-name', value: 'use-name', name: issueUrl }])
+  })
+
+  it('preserves arbitrary-name fallback for consumers without exact URL lookup', () => {
+    const rows = buildSmartWorkspaceSourceRows({
+      mode: 'smart',
+      value: issueUrl,
+      branches: [],
+      githubItems: [],
+      gitlabItems: [],
+      linearIssues: [],
+      gitlabAvailable: false,
+      linearAvailable: true,
+      resultLimit: 12
+    })
+
+    expect(rows).toEqual([{ kind: 'use-name', value: 'use-name', name: issueUrl }])
+  })
+
+  it('prioritizes only the issue from the URL organization', () => {
+    const otherWorkspace = {
+      id: 'other-issue',
+      identifier: 'STA-4084',
+      url: 'https://linear.app/other/issue/STA-4084'
+    } as never
+    const exactIssue = {
+      id: 'stably-issue',
+      identifier: 'STA-4084',
+      url: issueUrl
+    } as never
+    const unrelatedIssue = {
+      id: 'unrelated-issue',
+      identifier: 'STA-9999',
+      url: 'https://linear.app/stably/issue/STA-9999'
+    } as never
+
+    expect(
+      prioritizeSmartWorkspaceLinearIssueResults(issueUrl, [
+        otherWorkspace,
+        unrelatedIssue,
+        exactIssue
+      ]).map((issue) => issue.id)
+    ).toEqual(['stably-issue', 'other-issue', 'unrelated-issue'])
+    expect(
+      isSmartWorkspaceLinearIssueIntentMatch(
+        parseBoundedSmartWorkspaceLinearIssueInput(issueUrl)!,
+        otherWorkspace
+      )
+    ).toBe(false)
+  })
+
+  it('matches bare Linear keys by identifier without changing provider order for names', () => {
+    const issue = {
+      id: 'stably-issue',
+      identifier: 'STA-4084',
+      url: issueUrl
+    } as never
+    const other = {
+      id: 'other-issue',
+      identifier: 'STA-9999',
+      url: 'https://linear.app/stably/issue/STA-9999'
+    } as never
+
+    expect(
+      isSmartWorkspaceLinearIssueIntentMatch(
+        parseBoundedSmartWorkspaceLinearIssueInput('sta-4084')!,
+        issue
+      )
+    ).toBe(true)
+    expect(prioritizeSmartWorkspaceLinearIssueResults('restore shell', [other, issue])).toEqual([
+      other,
+      issue
+    ])
+  })
+
+  it('rejects oversized Linear input before parsing it', () => {
+    const oversized = `${issueUrl}#${'x'.repeat(SMART_WORKSPACE_SOURCE_QUERY_MAX_BYTES)}`
+
+    expect(parseBoundedSmartWorkspaceLinearIssueInput(oversized)).toBeNull()
+    expect(isBlockingLinearUrlIntent('smart', oversized)).toBe(false)
+  })
+})
+
 describe('Jira issue search', () => {
   it('keeps valid Jira URL intent blocking in both Smart and Jira modes', () => {
     const firstUrl = 'https://company.atlassian.net/browse/ORCA-1'
diff --git a/src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx b/src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx
index fc3a60a5504..1f6df54bfb2 100644
--- a/src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx
+++ b/src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx
@@ -50,7 +50,7 @@ function site(id: string, email = `${id}@example.com`): JiraSite {
 
 function status(
   sites: JiraSite[],
-  selectedSiteId: string | 'all' | null = null
+  selectedSiteId: (string & {}) | 'all' | null = null
 ): JiraConnectionStatus {
   return {
     connected: true,
diff --git a/src/renderer/src/components/new-workspace/use-jira-url-source.ts b/src/renderer/src/components/new-workspace/use-jira-url-source.ts
index e1dc6efd6a6..0441e37edc9 100644
--- a/src/renderer/src/components/new-workspace/use-jira-url-source.ts
+++ b/src/renderer/src/components/new-workspace/use-jira-url-source.ts
@@ -54,7 +54,7 @@ function getPreferredSite(
   matches: JiraSite[],
   selectedAccount: AccountSelection | null,
   requestKey: string,
-  selectedSiteId: string | 'all' | null | undefined,
+  selectedSiteId: (string & {}) | 'all' | null | undefined,
   activeSiteId: string | null | undefined
 ): JiraSite | null {
   const explicitId = selectedAccount?.requestKey === requestKey ? selectedAccount.siteId : null
diff --git a/src/renderer/src/components/right-sidebar/FileExplorer.tsx b/src/renderer/src/components/right-sidebar/FileExplorer.tsx
index 8db2f1d0be1..e8191d1b3e7 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorer.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorer.tsx
@@ -57,6 +57,7 @@ import { CLOSE_ALL_CONTEXT_MENUS_EVENT } from '@/components/tab-bar/SortableTab'
 import type { RightSidebarExplorerView } from '../../../../shared/types'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { createNewTerminalTab } from '@/components/terminal/terminal-tab-create'
+import { useWorkspaceFileBrowserActionPredicate } from '@/lib/file-preview'
 
 function FileExplorerFiles(): React.JSX.Element {
   const explorerView = useAppStore((s) => s.rightSidebarExplorerView)
@@ -80,6 +81,8 @@ function FileExplorerFiles(): React.JSX.Element {
     [nameFilterQuery, showRightSidebarFiles, showRightSidebarSearch]
   )
   const activeWorktreeId = useAppStore((s) => s.activeWorktreeId)
+  const canOpenWorkspaceFileBrowserForPath =
+    useWorkspaceFileBrowserActionPredicate(activeWorktreeId)
   const activeWorktree = useActiveWorktree()
   const activeRepo = useRepoById(activeWorktree?.repoId ?? null)
   const supportsFolderDownload = useAppStore((s) => {
@@ -778,6 +781,7 @@ function FileExplorerFiles(): React.JSX.Element {
                 connectionId={activeRepo?.connectionId ?? null}
                 runtimeDownloadContext={runtimeDownloadContext}
                 supportsFolderDownload={supportsFolderDownload}
+                canOpenInOrcaBrowser={canOpenWorkspaceFileBrowserForPath}
                 onClick={handleRowClick}
                 onDoubleClick={handleDoubleClick}
                 onViewFile={handleClick}
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx b/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
index 9fec091faf0..a5e232cb29e 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
@@ -267,6 +267,7 @@ type FileExplorerRowProps = {
   connectionId?: string | null
   runtimeDownloadContext?: RuntimeFileOperationArgs | null
   supportsFolderDownload?: boolean
+  canOpenInOrcaBrowser: boolean
   canCollapseFolderSubtree: boolean
   targetDir: string
   targetDepth: number
@@ -455,6 +456,7 @@ export function FileExplorerRow({
   connectionId,
   runtimeDownloadContext,
   supportsFolderDownload = false,
+  canOpenInOrcaBrowser,
   canCollapseFolderSubtree,
   targetDir,
   targetDepth,
@@ -764,7 +766,7 @@ export function FileExplorerRow({
             {translate('auto.components.right.sidebar.FileExplorerRow.1d8e182c32', 'View File')}
           </ContextMenuItem>
         )}
-        {!node.isDirectory && activeWorktreeId && (
+        {!node.isDirectory && activeWorktreeId && canOpenInOrcaBrowser && (
           <ContextMenuItem onSelect={handleOpenInOrcaBrowser}>
             <Globe />
             {translate(
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsx b/src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsx
index 67a52bb7c9e..d72e7a5ca19 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsx
@@ -29,6 +29,7 @@ type FileExplorerVirtualRowsProps = {
   connectionId?: string | null
   runtimeDownloadContext?: RuntimeFileOperationArgs | null
   supportsFolderDownload?: boolean
+  canOpenInOrcaBrowser?: (filePath: string) => boolean
   onClick: (node: TreeNode, event: React.MouseEvent<HTMLButtonElement>) => void
   onDoubleClick: (node: TreeNode) => void
   onViewFile: (node: TreeNode) => void
@@ -75,6 +76,7 @@ export function FileExplorerVirtualRows(props: FileExplorerVirtualRowsProps): Re
     connectionId,
     runtimeDownloadContext,
     supportsFolderDownload = false,
+    canOpenInOrcaBrowser = () => false,
     onClick,
     onDoubleClick,
     onViewFile,
@@ -179,6 +181,7 @@ export function FileExplorerVirtualRows(props: FileExplorerVirtualRowsProps): Re
               connectionId={connectionId}
               runtimeDownloadContext={runtimeDownloadContext}
               supportsFolderDownload={supportsFolderDownload}
+              canOpenInOrcaBrowser={canOpenInOrcaBrowser(n.path)}
               canCollapseFolderSubtree={canCollapseFolderSubtree}
               targetDir={n.isDirectory ? n.path : dirname(n.path)}
               targetDepth={n.isDirectory ? n.depth + 1 : n.depth}
diff --git a/src/renderer/src/components/right-sidebar/GitHistoryCommitContextMenu.tsx b/src/renderer/src/components/right-sidebar/GitHistoryCommitContextMenu.tsx
index 4746a1cacf8..5ff8e9691fd 100644
--- a/src/renderer/src/components/right-sidebar/GitHistoryCommitContextMenu.tsx
+++ b/src/renderer/src/components/right-sidebar/GitHistoryCommitContextMenu.tsx
@@ -7,6 +7,8 @@ import {
 } from '@/components/ui/context-menu'
 import { translate } from '@/i18n/i18n'
 import type { GitHistoryItem } from '../../../../shared/git-history'
+import { useAppStore } from '@/store'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export type GitHistoryCommitAction = 'open-remote' | 'copy-hash' | 'copy-message' | 'explain'
 
@@ -17,15 +19,22 @@ export function GitHistoryCommitContextMenu({
   item: GitHistoryItem
   onAction: (action: GitHistoryCommitAction, item: GitHistoryItem) => void
 }): React.JSX.Element {
+  const managedBrowserCreationEnabled = useAppStore(
+    (state) =>
+      getClientCreationActionPolicy(state, state.activeWorktreeId)['managed-browser'].state ===
+      'enabled'
+  )
   return (
     <ContextMenuContent className="w-56">
-      <ContextMenuItem onSelect={() => onAction('open-remote', item)}>
-        <Globe className="size-3.5" />
-        {translate(
-          'auto.components.right.sidebar.GitHistoryCommitContextMenu.7b1c4e9a02',
-          'Open commit in browser'
-        )}
-      </ContextMenuItem>
+      {managedBrowserCreationEnabled ? (
+        <ContextMenuItem onSelect={() => onAction('open-remote', item)}>
+          <Globe className="size-3.5" />
+          {translate(
+            'auto.components.right.sidebar.GitHistoryCommitContextMenu.7b1c4e9a02',
+            'Open commit in browser'
+          )}
+        </ContextMenuItem>
+      ) : null}
       <ContextMenuItem onSelect={() => onAction('copy-hash', item)}>
         <Hash className="size-3.5" />
         {translate(
diff --git a/src/renderer/src/components/right-sidebar/GitHistoryRow.tsx b/src/renderer/src/components/right-sidebar/GitHistoryRow.tsx
index b236d15533c..f41ea2f92b4 100644
--- a/src/renderer/src/components/right-sidebar/GitHistoryRow.tsx
+++ b/src/renderer/src/components/right-sidebar/GitHistoryRow.tsx
@@ -94,7 +94,12 @@ export const GitHistoryRow = React.forwardRef<HTMLElement, GitHistoryRowProps>(
                 {item.subject}
               </span>
             </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={6} className="max-w-96 whitespace-pre-wrap">
+            <TooltipContent
+              side="bottom"
+              sideOffset={6}
+              collisionPadding={8}
+              className="max-w-[min(76ch,var(--radix-tooltip-content-available-width))] break-words text-wrap whitespace-pre-wrap"
+            >
               {rowTooltip}
             </TooltipContent>
           </Tooltip>
diff --git a/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx b/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
index 1dc5b616ed5..9cb86404dd8 100644
--- a/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
+++ b/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
@@ -61,7 +61,8 @@ const compatibleStatus = {
   runtimeId: 'runtime-1',
   graphStatus: 'ready',
   runtimeProtocolVersion: RUNTIME_PROTOCOL_VERSION,
-  minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION
+  minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
+  capabilities: ['browser.screencast.v1']
 }
 
 const localScan = vi.fn()
@@ -318,7 +319,7 @@ describe('PortsPanel runtime routing', () => {
     ).toEqual(['runtime-repo::/srv/app', 'repo::/workspace/app'])
   })
 
-  it('opens remote workspace ports in the server-side browser and binds the local page handle', async () => {
+  it('reuses the capability verdict across remote port opens', async () => {
     runtimeEnvironmentCall.mockImplementation(({ method }: { method: string }) =>
       Promise.resolve({
         id: method,
@@ -331,6 +332,14 @@ describe('PortsPanel runtime routing', () => {
     const createBrowserTab = vi.fn(() => ({ activePageId: 'local-page-1' }))
     const setRemoteBrowserPageHandle = vi.fn()
 
+    await expect(
+      openWorkspacePortInBrowser({
+        port: workspacePort,
+        runtimeTarget: { kind: 'environment', environmentId: 'env-1' },
+        createBrowserTab: createBrowserTab as never,
+        setRemoteBrowserPageHandle: setRemoteBrowserPageHandle as never
+      })
+    ).resolves.toEqual({ ok: true })
     await expect(
       openWorkspacePortInBrowser({
         port: workspacePort,
@@ -340,9 +349,11 @@ describe('PortsPanel runtime routing', () => {
       })
     ).resolves.toEqual({ ok: true })
 
+    expect(activateAndRevealWorktreeMock).toHaveBeenCalledTimes(2)
     expect(activateAndRevealWorktreeMock).toHaveBeenCalledWith('repo::/workspace/app')
     expect(runtimeEnvironmentCall.mock.calls.map((call) => call[0].method)).toEqual([
       'status.get',
+      'browser.tabCreate',
       'browser.tabCreate'
     ])
     expect(runtimeEnvironmentCall.mock.calls[1][0].params).toEqual({
@@ -353,7 +364,8 @@ describe('PortsPanel runtime routing', () => {
       'repo::/workspace/app',
       'http://127.0.0.1:63468',
       {
-        activate: true
+        activate: true,
+        browserRuntimeEnvironmentId: 'env-1'
       }
     )
     expect(setRemoteBrowserPageHandle).toHaveBeenCalledWith('local-page-1', {
@@ -362,6 +374,34 @@ describe('PortsPanel runtime routing', () => {
     })
   })
 
+  it('rejects remote port browser creation before RPC without the screencast provider', async () => {
+    runtimeEnvironmentCall.mockImplementation(({ method }: { method: string }) =>
+      Promise.resolve({
+        id: method,
+        ok: true,
+        result: { ...compatibleStatus, capabilities: [] },
+        _meta: { runtimeId: 'runtime-1' }
+      })
+    )
+    const createBrowserTab = vi.fn()
+
+    await expect(
+      openWorkspacePortInBrowser({
+        port: workspacePort,
+        runtimeTarget: { kind: 'environment', environmentId: 'env-1' },
+        createBrowserTab: createBrowserTab as never,
+        setRemoteBrowserPageHandle: vi.fn() as never
+      })
+    ).resolves.toEqual({
+      ok: false,
+      reason:
+        'Managed browser tabs are unavailable because the paired runtime does not support browser streaming.'
+    })
+
+    expect(runtimeEnvironmentCall.mock.calls.map((call) => call[0].method)).toEqual(['status.get'])
+    expect(createBrowserTab).not.toHaveBeenCalled()
+  })
+
   it('opens workspace ports in the system browser when link routing is off', async () => {
     const createBrowserTab = vi.fn()
     const setRemoteBrowserPageHandle = vi.fn()
@@ -579,7 +619,7 @@ describe('PortsPanel runtime routing', () => {
     expect(createBrowserTab).toHaveBeenCalledWith(
       'repo::/workspace/app',
       'http://127.0.0.1:63468',
-      { activate: true }
+      { activate: true, browserRuntimeEnvironmentId: 'env-1' }
     )
     expect(setRemoteBrowserPageHandle).toHaveBeenCalledWith('local-page-1', {
       environmentId: 'env-1',
diff --git a/src/renderer/src/components/right-sidebar/PortsPanel.tsx b/src/renderer/src/components/right-sidebar/PortsPanel.tsx
index b0c1dae3a4d..2f481e8014d 100644
--- a/src/renderer/src/components/right-sidebar/PortsPanel.tsx
+++ b/src/renderer/src/components/right-sidebar/PortsPanel.tsx
@@ -58,6 +58,7 @@ import {
 import type { PortForwardEntry, EnrichedDetectedPort } from '../../../../shared/ssh-types'
 import type { WorkspacePort } from '../../../../shared/workspace-ports'
 import { translate } from '@/i18n/i18n'
+import { openWorkspaceBrowserTab } from '@/lib/workspace-browser-tab-open'
 
 export {
   killWorkspacePortForTarget,
@@ -804,7 +805,6 @@ function SshPortsPanel(): React.JSX.Element {
   const portForwardsByConnection = useAppStore((s) => s.portForwardsByConnection)
   const detectedPortsByConnection = useAppStore((s) => s.detectedPortsByConnection)
   const sshConnectionStates = useAppStore((s) => s.sshConnectionStates)
-  const createBrowserTab = useAppStore((s) => s.createBrowserTab)
   // Why: scope the panel to the active worktree's SSH connection so
   // actions target the correct machine and the disconnected state
   // reflects the active worktree, not some other SSH session.
@@ -884,11 +884,15 @@ function SshPortsPanel(): React.JSX.Element {
         )
         return
       }
-      createBrowserTab(activeWorktree.id, url, {
-        activate: true
+      void openWorkspaceBrowserTab({
+        workspaceId: activeWorktree.id,
+        url,
+        intent: { kind: 'url' }
+      }).catch((error) => {
+        toast.error(error instanceof Error ? error.message : String(error))
       })
     },
-    [activeWorktree?.id, createBrowserTab, settings]
+    [activeWorktree?.id, settings]
   )
 
   const handleDialogClose = useCallback(() => {
diff --git a/src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx b/src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx
index ee90c607ada..c3544b4ff1f 100644
--- a/src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx
+++ b/src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx
@@ -8,7 +8,8 @@ const { openHttpLinkMock } = vi.hoisted(() => ({ openHttpLinkMock: vi.fn() }))
 
 vi.mock('@/lib/http-link-routing', () => ({
   openHttpLink: openHttpLinkMock,
-  registerHttpLinkStoreAccessor: vi.fn()
+  registerHttpLinkStoreAccessor: vi.fn(),
+  registerRuntimeHttpLinkBrowserOpener: vi.fn()
 }))
 
 function makeReview(overrides: Partial<HostedReviewInfo> = {}): HostedReviewInfo {
diff --git a/src/renderer/src/components/right-sidebar/ai-vault-scope-paths.ts b/src/renderer/src/components/right-sidebar/ai-vault-scope-paths.ts
index 7bc85b13093..c9ad8137fc9 100644
--- a/src/renderer/src/components/right-sidebar/ai-vault-scope-paths.ts
+++ b/src/renderer/src/components/right-sidebar/ai-vault-scope-paths.ts
@@ -3,7 +3,7 @@ import {
   normalizeRuntimePathForComparison
 } from '../../../../shared/cross-platform-path'
 import type { ProjectHostSetupProjection } from '../../../../shared/project-host-setup-projection'
-import type { Worktree } from '../../../../shared/types'
+import type { ProjectHostSetup, Worktree } from '../../../../shared/types'
 import { splitWorktreeIdForFilesystem } from '../../../../shared/worktree-id'
 
 export function deriveAiVaultWorkspaceScopePaths(
@@ -88,10 +88,10 @@ export function deriveAiVaultScopeSessionPaths(
 
 function buildProjectSetupsByRepoId(
   projection?: ProjectHostSetupProjection
-): Map<string, ProjectHostSetupProjection['setups']> {
-  const setupsByRepoId = new Map<string, ProjectHostSetupProjection['setups']>()
+): Map<string, ProjectHostSetup[]> {
+  const setupsByRepoId = new Map<string, ProjectHostSetup[]>()
   for (const setup of projection?.setups ?? []) {
-    const setups = setupsByRepoId.get(setup.repoId) ?? []
+    const setups: ProjectHostSetup[] = setupsByRepoId.get(setup.repoId) ?? []
     setups.push(setup)
     setupsByRepoId.set(setup.repoId, setups)
   }
diff --git a/src/renderer/src/components/right-sidebar/checks-panel-review-creation.ts b/src/renderer/src/components/right-sidebar/checks-panel-review-creation.ts
index 95c9ccfde97..d0534124397 100644
--- a/src/renderer/src/components/right-sidebar/checks-panel-review-creation.ts
+++ b/src/renderer/src/components/right-sidebar/checks-panel-review-creation.ts
@@ -63,7 +63,7 @@ export function isChecksPanelCreateEligibilityConfirmable(input: {
  * provisional or draft-preserve path.
  */
 export function shouldOpenChecksPanelCreateComposer(input: {
-  activeReview: unknown | null
+  activeReview: unknown
   isFolder: boolean
   branch: string
   hostedReviewCreation: HostedReviewCreationEligibility | null
diff --git a/src/renderer/src/components/right-sidebar/hosted-review-header-chrome.tsx b/src/renderer/src/components/right-sidebar/hosted-review-header-chrome.tsx
index 66733779c77..b13a5728d2f 100644
--- a/src/renderer/src/components/right-sidebar/hosted-review-header-chrome.tsx
+++ b/src/renderer/src/components/right-sidebar/hosted-review-header-chrome.tsx
@@ -1,5 +1,5 @@
 import React from 'react'
-import { GitMerge } from 'lucide-react'
+import { GitMerge, GitPullRequestClosed, GitPullRequestDraft } from 'lucide-react'
 import type { HostedReviewInfo } from '../../../../shared/hosted-review'
 import { cn } from '@/lib/utils'
 import { PullRequestIcon } from './checks-panel-content'
@@ -17,6 +17,23 @@ function hostedReviewStateClass(review: HostedReviewInfo): string {
   return 'text-muted-foreground/50'
 }
 
+// Why: draft and closed only differed by a near-identical muted tone on the same
+// glyph, so a draft review read as closed.
+function hostedReviewStateIcon(
+  review: HostedReviewInfo
+): React.ComponentType<{ className?: string }> | null {
+  if (review.state === 'merged') {
+    return GitMerge
+  }
+  if (review.state === 'closed') {
+    return GitPullRequestClosed
+  }
+  if (review.state === 'draft') {
+    return GitPullRequestDraft
+  }
+  return null
+}
+
 export function HostedReviewIcon({
   review,
   className
@@ -24,7 +41,8 @@ export function HostedReviewIcon({
   review: HostedReviewInfo
   className?: string
 }): React.JSX.Element {
-  const Icon = review.provider === 'gitlab' ? GitMerge : PullRequestIcon
+  const providerIcon = review.provider === 'gitlab' ? GitMerge : PullRequestIcon
+  const Icon = hostedReviewStateIcon(review) ?? providerIcon
   return <Icon className={cn(className, hostedReviewStateClass(review))} />
 }
 
diff --git a/src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.ts b/src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.ts
index 89212dd6149..08bc9fb6d9d 100644
--- a/src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.ts
+++ b/src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.ts
@@ -21,7 +21,7 @@ function textGenerationRecipeIsConfigured(
   actionId: SourceControlTextActionId,
   recipe: TextGenerationRecipeConfiguration | null | undefined
 ): boolean {
-  if (Object.prototype.hasOwnProperty.call(recipe ?? {}, 'agentId')) {
+  if (Object.hasOwn(recipe ?? {}, 'agentId')) {
     return true
   }
   if (
diff --git a/src/renderer/src/components/right-sidebar/useGitHistoryCommitActions.ts b/src/renderer/src/components/right-sidebar/useGitHistoryCommitActions.ts
index ed943889453..c60c6f1f3e0 100644
--- a/src/renderer/src/components/right-sidebar/useGitHistoryCommitActions.ts
+++ b/src/renderer/src/components/right-sidebar/useGitHistoryCommitActions.ts
@@ -18,6 +18,7 @@ import {
   type SourceControlRowOpenEvent
 } from './source-control-split-open'
 import type { GitHistoryCommitAction } from './GitHistoryCommitContextMenu'
+import { openWorkspaceBrowserTab } from '@/lib/workspace-browser-tab-open'
 
 const EMPTY_BRANCH_CHANGE_ENTRIES: GitBranchChangeEntry[] = []
 
@@ -47,7 +48,6 @@ export function useGitHistoryCommitActions({
 }): GitHistoryCommitActions {
   const openCommitAllDiffs = useAppStore((s) => s.openCommitAllDiffs)
   const openCommitDiff = useAppStore((s) => s.openCommitDiff)
-  const createBrowserTab = useAppStore((s) => s.createBrowserTab)
 
   // Caches each commit's compare result so expanding a commit fetches its files
   // once, and opening a single file (or the combined diff) reuses that same
@@ -202,16 +202,20 @@ export function useGitHistoryCommitActions({
           { sha: item.id }
         )
           .then((url) => {
-            if (url) {
-              createBrowserTab(activeWorktreeId, url, { activate: true })
-            } else {
+            if (!url) {
               toast.error(
                 translate(
                   'auto.components.right.sidebar.SourceControl.04a5d7239b',
                   'This repository has no supported web remote'
                 )
               )
+              return
             }
+            return openWorkspaceBrowserTab({
+              workspaceId: activeWorktreeId,
+              url,
+              intent: { kind: 'url' }
+            })
           })
           .catch(() => {
             toast.error(
@@ -279,7 +283,7 @@ export function useGitHistoryCommitActions({
         promptDelivery: 'submit-after-ready'
       })
     },
-    [activeRepoSettings, activeWorktreeId, copyCommitText, createBrowserTab, worktreePath]
+    [activeRepoSettings, activeWorktreeId, copyCommitText, worktreePath]
   )
 
   return { loadCommitFiles, openHistoryCommitDiff, openCommitFile, handleCommitAction }
diff --git a/src/renderer/src/components/settings/AccountsPane.tsx b/src/renderer/src/components/settings/AccountsPane.tsx
index 81dd540ff5f..c8500b99cfa 100644
--- a/src/renderer/src/components/settings/AccountsPane.tsx
+++ b/src/renderer/src/components/settings/AccountsPane.tsx
@@ -383,12 +383,12 @@ export function AccountsPane({
     useState<CodexRateLimitAccountsState>(emptyCodexAccountsState)
   const [codexAccountsLoaded, setCodexAccountsLoaded] = useState(false)
   const [codexAction, setCodexAction] = useState<
-    'idle' | 'adding' | `reauth:${string}` | `remove:${string}` | `select:${string | 'system'}`
+    'idle' | 'adding' | `reauth:${string}` | `remove:${string}` | `select:${string}`
   >('idle')
   const [claudeAccounts, setClaudeAccounts] =
     useState<ClaudeRateLimitAccountsState>(emptyClaudeAccountsState)
   const [claudeAction, setClaudeAction] = useState<
-    'idle' | 'adding' | `reauth:${string}` | `remove:${string}` | `select:${string | 'system'}`
+    'idle' | 'adding' | `reauth:${string}` | `remove:${string}` | `select:${string}`
   >('idle')
   // Why: capture the account's runtime slot when the dialog opens; the roster
   // can change underneath an open dialog and lose the slot to diff for restarts.
diff --git a/src/renderer/src/components/settings/BrowserProfileRow.tsx b/src/renderer/src/components/settings/BrowserProfileRow.tsx
index 7ab502698ee..a6324661901 100644
--- a/src/renderer/src/components/settings/BrowserProfileRow.tsx
+++ b/src/renderer/src/components/settings/BrowserProfileRow.tsx
@@ -7,7 +7,6 @@ import {
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
-  DropdownMenuLabel,
   DropdownMenuPortal,
   DropdownMenuSeparator,
   DropdownMenuSub,
@@ -15,6 +14,7 @@ import {
   DropdownMenuSubTrigger,
   DropdownMenuTrigger
 } from '../ui/dropdown-menu'
+import { BrowserCookieImportDisclosure } from '../BrowserCookieImportDisclosure'
 import { useAppStore } from '../../store'
 import { BROWSER_FAMILY_LABELS } from '../../../../shared/constants'
 import { translate } from '@/i18n/i18n'
@@ -81,7 +81,8 @@ export function BrowserProfileRow({
                 value1: browser?.label ?? browserFamily,
                 value2: profile.label
               }
-            )
+            ),
+        result.executionHostLabel
       )
     } else {
       toast.error(result.reason)
@@ -97,7 +98,8 @@ export function BrowserProfileRow({
           'auto.components.settings.BrowserProfileRow.b4c167764d',
           'Imported {{value0}} cookies from file into {{value1}}.',
           { value0: result.summary.importedCookies, value1: profile.label }
-        )
+        ),
+        result.executionHostLabel
       )
     } else if (result.reason !== 'canceled') {
       toast.error(result.reason)
@@ -172,12 +174,6 @@ export function BrowserProfileRow({
             </Button>
           </DropdownMenuTrigger>
           <DropdownMenuContent align="end">
-            <DropdownMenuLabel className="font-normal">
-              {translate(
-                'auto.components.settings.BrowserProfileRow.654a0c2073',
-                'Google requires signing in directly - imports skip it.'
-              )}
-            </DropdownMenuLabel>
             {detectedBrowsers.map((browser) =>
               browser.profiles.length > 1 ? (
                 <DropdownMenuSub key={browser.family}>
@@ -220,6 +216,7 @@ export function BrowserProfileRow({
             <DropdownMenuItem onSelect={() => void handleImportFromFile()}>
               {translate('auto.components.settings.BrowserProfileRow.ebb78dfd6f', 'From File…')}
             </DropdownMenuItem>
+            <BrowserCookieImportDisclosure />
           </DropdownMenuContent>
         </DropdownMenu>
         {isDefault ? (
diff --git a/src/renderer/src/components/settings/BrowserUseCookieImportStep.tsx b/src/renderer/src/components/settings/BrowserUseCookieImportStep.tsx
index 1332883e4a1..28f6f5221c9 100644
--- a/src/renderer/src/components/settings/BrowserUseCookieImportStep.tsx
+++ b/src/renderer/src/components/settings/BrowserUseCookieImportStep.tsx
@@ -3,6 +3,7 @@ import { toast } from 'sonner'
 import { emitBrowserCookieImportToast } from '@/lib/browser-cookie-import-toast'
 import { cn } from '@/lib/utils'
 import { Button } from '../ui/button'
+import { BrowserCookieImportDisclosure } from '../BrowserCookieImportDisclosure'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -58,7 +59,8 @@ export function BrowserUseCookieImportStep({
             value1: browser?.label ?? browserFamily,
             value2: browserProfile ? ` (${browserProfile})` : ''
           }
-        )
+        ),
+        result.executionHostLabel
       )
     } else {
       toast.error(result.reason)
@@ -74,7 +76,8 @@ export function BrowserUseCookieImportStep({
           'auto.components.settings.BrowserUsePane.8f2675c2f3',
           'Imported {{value0}} cookies from file.',
           { value0: result.summary.importedCookies }
-        )
+        ),
+        result.executionHostLabel
       )
     } else if (result.reason !== 'canceled') {
       toast.error(result.reason)
@@ -204,6 +207,7 @@ export function BrowserUseCookieImportStep({
             <DropdownMenuItem onSelect={() => void handleImportFromFile()}>
               {translate('auto.components.settings.BrowserUsePane.be6df68384', 'From File…')}
             </DropdownMenuItem>
+            <BrowserCookieImportDisclosure />
           </DropdownMenuContent>
         </DropdownMenu>
       </div>
diff --git a/src/renderer/src/components/settings/FloatingWorkspacePane.tsx b/src/renderer/src/components/settings/FloatingWorkspacePane.tsx
index acffb2d007c..14ace880d92 100644
--- a/src/renderer/src/components/settings/FloatingWorkspacePane.tsx
+++ b/src/renderer/src/components/settings/FloatingWorkspacePane.tsx
@@ -10,6 +10,7 @@ import { getFloatingWorkspaceSearchEntries } from './floating-workspace-search'
 import { matchesSettingsSearch } from './settings-search'
 import { useAppStore } from '../../store'
 import { translate } from '@/i18n/i18n'
+import { isWebClientLocation } from '@/lib/web-client-location'
 
 type FloatingWorkspacePaneProps = {
   settings: GlobalSettings
@@ -35,6 +36,7 @@ export function FloatingWorkspacePane({
   updateSettings
 }: FloatingWorkspacePaneProps): React.JSX.Element | null {
   const searchQuery = useAppStore((state) => state.settingsSearchQuery)
+  const includeBrowser = !isWebClientLocation()
   const [resolvedFloatingWorkspacePath, setResolvedFloatingWorkspacePath] = useState('')
 
   useEffect(() => {
@@ -72,7 +74,7 @@ export function FloatingWorkspacePane({
     resolvedFloatingWorkspacePath
   })
 
-  if (!matchesSettingsSearch(searchQuery, getFloatingWorkspaceSearchEntries())) {
+  if (!matchesSettingsSearch(searchQuery, getFloatingWorkspaceSearchEntries({ includeBrowser }))) {
     return null
   }
 
@@ -91,7 +93,7 @@ export function FloatingWorkspacePane({
           'floating workspace',
           'floating terminal',
           'terminal',
-          'browser',
+          ...(includeBrowser ? ['browser'] : []),
           'markdown',
           'note',
           'global',
diff --git a/src/renderer/src/components/settings/GitPane.tsx b/src/renderer/src/components/settings/GitPane.tsx
index ccf1befdeb7..72eb70f15c2 100644
--- a/src/renderer/src/components/settings/GitPane.tsx
+++ b/src/renderer/src/components/settings/GitPane.tsx
@@ -322,55 +322,6 @@ export function GitPane({
         branchPromptDiscardSignal={branchPromptDiscardSignal}
         settingsSearchQuery={searchQuery}
       />
-    ) : null,
-    matchesSettingsSearch(searchQuery, {
-      title: translate('auto.components.settings.GitPane.e02ea23a32', 'Orca Attribution'),
-      description: translate(
-        'auto.components.settings.GitPane.d2eede4c54',
-        'Add Orca attribution to commits, PRs, and issues.'
-      ),
-      keywords: [
-        translate('auto.components.settings.GitPane.32dca11189', 'github'),
-        translate('auto.components.settings.GitPane.895d3f70b8', 'gh'),
-        translate('auto.components.settings.GitPane.b4ef5428a7', 'pr'),
-        translate('auto.components.settings.GitPane.afada55042', 'issue'),
-        translate('auto.components.settings.GitPane.9838c921ed', 'co-author'),
-        translate('auto.components.settings.GitPane.b5f534717a', 'coauthored'),
-        translate('auto.components.settings.GitPane.b9b5771bb1', 'attribution'),
-        translate('auto.components.settings.GitPane.e71ce09c42', 'orca')
-      ]
-    }) ? (
-      <SearchableSetting
-        key="github-attribution"
-        title={translate('auto.components.settings.GitPane.e02ea23a32', 'Orca Attribution')}
-        description={translate(
-          'auto.components.settings.GitPane.d2eede4c54',
-          'Add Orca attribution to commits, PRs, and issues.'
-        )}
-        keywords={['github', 'gh', 'pr', 'issue', 'co-author', 'coauthored', 'attribution', 'orca']}
-        className="flex items-center justify-between gap-4 py-2"
-      >
-        <div className="space-y-0.5">
-          <Label>
-            {translate('auto.components.settings.GitPane.e02ea23a32', 'Orca Attribution')}
-          </Label>
-          <p className="text-xs text-muted-foreground">
-            {translate(
-              'auto.components.settings.GitPane.d2eede4c54',
-              'Add Orca attribution to commits, PRs, and issues.'
-            )}
-          </p>
-        </div>
-        <Switch
-          aria-label={translate('auto.components.settings.GitPane.e02ea23a32', 'Orca Attribution')}
-          checked={settings.enableGitHubAttribution}
-          onCheckedChange={(checked) =>
-            updateSettings({
-              enableGitHubAttribution: checked
-            })
-          }
-        />
-      </SearchableSetting>
     ) : null
   ].filter(Boolean)
 
diff --git a/src/renderer/src/components/settings/QuickCommandsList.tsx b/src/renderer/src/components/settings/QuickCommandsList.tsx
index ec377677ee5..3a0042b32a8 100644
--- a/src/renderer/src/components/settings/QuickCommandsList.tsx
+++ b/src/renderer/src/components/settings/QuickCommandsList.tsx
@@ -1,4 +1,4 @@
-import { Check, Copy, Pencil, Trash2 } from 'lucide-react'
+import { Check, Copy, Pencil, TerminalSquare, Trash2 } from 'lucide-react'
 import type {
   Repo,
   TerminalQuickCommand,
@@ -29,6 +29,15 @@ function getScopeLabel(
   return repo ? getQuickCommandRepoLabel(repo) : 'Missing project'
 }
 
+function getRunModeLabel(command: TerminalQuickCommand): string {
+  if (isTerminalAgentQuickCommand(command)) {
+    return translate('auto.components.settings.QuickCommandsPane.4ccc63da87', 'Agent')
+  }
+  return command.appendEnter
+    ? translate('auto.components.settings.QuickCommandsPane.9b3e338d62', 'Enter')
+    : translate('auto.components.settings.QuickCommandsPane.9fcfc29519', 'Insert')
+}
+
 function QuickCommandRow({
   command,
   repoById,
@@ -43,6 +52,7 @@ function QuickCommandRow({
   const scope = getTerminalQuickCommandScope(command)
   const body = getTerminalQuickCommandBody(command)
   const { canCopy, copyText, status } = useClipboardTextCopyFeedback(body)
+  const commandName = command.label || 'quick command'
 
   const copyLabel =
     status === 'copied'
@@ -51,19 +61,24 @@ function QuickCommandRow({
         ? translate('auto.components.settings.QuickCommandsPane.53b17a4b1b', "Couldn't copy")
         : canCopy
           ? translate('auto.components.settings.QuickCommandsPane.a9a564b7e7', 'Copy {{value0}}', {
-              value0: command.label || 'quick command'
+              value0: commandName
             })
           : translate('auto.components.settings.QuickCommandsPane.69a1441a21', 'Nothing to copy')
+  const editLabel = translate(
+    'auto.components.settings.QuickCommandsPane.7d90fd5299',
+    'Edit {{value0}}',
+    { value0: commandName }
+  )
 
   return (
-    <div className="flex items-center gap-3 rounded-md border border-border/60 bg-background px-3 py-2 shadow-xs">
+    <div className="group/qc flex items-center gap-3 rounded-md px-2 py-2.5 transition-colors hover:bg-accent/60 focus-within:bg-accent/60">
       <div className="min-w-0 flex-1">
         <div className="flex min-w-0 items-center gap-2">
           <div className="truncate text-sm font-medium">
             {command.label ||
               translate('auto.components.settings.QuickCommandsPane.2bb9e38e93', 'Untitled')}
           </div>
-          <Badge variant="outline" className="max-w-44 gap-1.5">
+          <Badge variant="outline" className="max-w-44 gap-1.5 text-[11px] font-normal">
             {scope.type === 'repo' ? (
               <>
                 <RepoBadgeMark color={repoById.get(scope.repoId)?.badgeColor} />
@@ -74,9 +89,9 @@ function QuickCommandRow({
             )}
           </Badge>
         </div>
-        <div className="flex min-w-0 items-center gap-1.5 text-xs text-foreground/80">
+        <div className="mt-0.5 flex min-w-0 items-center gap-1.5 text-xs text-muted-foreground">
           {isTerminalAgentQuickCommand(command) ? (
-            <span className="shrink-0 text-muted-foreground">
+            <span className="shrink-0">
               <AgentIcon agent={command.agent} size={12} />
             </span>
           ) : null}
@@ -91,59 +106,95 @@ function QuickCommandRow({
           </span>
         </div>
       </div>
-      <div className="shrink-0 text-[11px] font-medium text-foreground/75">
-        {isTerminalAgentQuickCommand(command)
-          ? translate('auto.components.settings.QuickCommandsPane.4ccc63da87', 'Agent')
-          : command.appendEnter
-            ? translate('auto.components.settings.QuickCommandsPane.9b3e338d62', 'Enter')
-            : translate('auto.components.settings.QuickCommandsPane.9fcfc29519', 'Insert')}
+      <div className="w-12 shrink-0 text-right text-[11px] text-muted-foreground">
+        {getRunModeLabel(command)}
+      </div>
+      {/* Why can-hover: touch devices never hover, so the actions must stay visible there. */}
+      <div className="flex shrink-0 items-center gap-0.5 transition-opacity can-hover:opacity-0 group-hover/qc:opacity-100 group-focus-within/qc:opacity-100">
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-sm"
+          aria-label={editLabel}
+          title={editLabel}
+          onClick={() => onEdit(command)}
+        >
+          <Pencil />
+        </Button>
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-sm"
+          disabled={!canCopy}
+          aria-label={copyLabel}
+          title={copyLabel}
+          onClick={() => void copyText()}
+          className={cn(
+            status === 'copied' && 'text-status-success',
+            status === 'failed' && 'text-destructive'
+          )}
+        >
+          {status === 'copied' ? <Check /> : <Copy />}
+        </Button>
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-sm"
+          aria-label={translate(
+            'auto.components.settings.QuickCommandsPane.8764c6e9e4',
+            'Remove {{value0}}',
+            { value0: commandName }
+          )}
+          onClick={() => onRemove(command)}
+          className="text-muted-foreground hover:text-destructive"
+        >
+          <Trash2 />
+        </Button>
+      </div>
+    </div>
+  )
+}
+
+function QuickCommandsEmptyState({
+  hasCommands,
+  hasQuery
+}: {
+  hasCommands: boolean
+  hasQuery: boolean
+}): React.JSX.Element {
+  if (hasCommands) {
+    return (
+      <div className="px-2 py-10 text-center text-sm text-muted-foreground">
+        {hasQuery
+          ? translate(
+              'auto.components.settings.QuickCommandsList.noSearchMatches',
+              'No commands match this search.'
+            )
+          : translate(
+              'auto.components.settings.QuickCommandsPane.3eb9897ab0',
+              'No commands in the selected scopes.'
+            )}
+      </div>
+    )
+  }
+  // Why no action here: the toolbar's Add Command sits directly above.
+  return (
+    <div className="flex flex-col items-center gap-3 px-2 py-10 text-center">
+      <TerminalSquare className="size-7 text-muted-foreground/50" />
+      <div className="space-y-1">
+        <p className="text-sm text-muted-foreground">
+          {translate(
+            'auto.components.settings.QuickCommandsPane.38d61927e6',
+            'No quick commands saved.'
+          )}
+        </p>
+        <p className="text-xs text-muted-foreground/80">
+          {translate(
+            'auto.components.settings.QuickCommandsPane.c36912efd5',
+            'Run them from the Quick Commands button in the tab bar, or right-click inside any terminal.'
+          )}
+        </p>
       </div>
-      <Button
-        type="button"
-        variant="ghost"
-        size="icon-sm"
-        disabled={!canCopy}
-        aria-label={copyLabel}
-        title={copyLabel}
-        onClick={() => void copyText()}
-        className={cn(
-          status === 'copied' && 'text-status-success',
-          status === 'failed' && 'text-destructive'
-        )}
-      >
-        {status === 'copied' ? <Check /> : <Copy />}
-      </Button>
-      <Button
-        type="button"
-        variant="ghost"
-        size="icon-sm"
-        aria-label={translate(
-          'auto.components.settings.QuickCommandsPane.7d90fd5299',
-          'Edit {{value0}}',
-          {
-            value0: command.label || 'quick command'
-          }
-        )}
-        onClick={() => onEdit(command)}
-      >
-        <Pencil />
-      </Button>
-      <Button
-        type="button"
-        variant="ghost"
-        size="icon-sm"
-        aria-label={translate(
-          'auto.components.settings.QuickCommandsPane.8764c6e9e4',
-          'Remove {{value0}}',
-          {
-            value0: command.label || 'quick command'
-          }
-        )}
-        onClick={() => onRemove(command)}
-        className="text-muted-foreground hover:text-destructive"
-      >
-        <Trash2 />
-      </Button>
     </div>
   )
 }
@@ -151,43 +202,32 @@ function QuickCommandRow({
 export function QuickCommandsList({
   commands,
   visibleCommands,
+  hasQuery,
   repoById,
   onEdit,
   onRemove
 }: {
   commands: TerminalQuickCommand[]
   visibleCommands: TerminalQuickCommand[]
+  hasQuery: boolean
   repoById: Map<string, Pick<Repo, 'displayName' | 'path' | 'badgeColor'>>
   onEdit: (command: TerminalQuickCommand) => void
   onRemove: (command: TerminalQuickCommand) => void
 }): React.JSX.Element {
+  if (visibleCommands.length === 0) {
+    return <QuickCommandsEmptyState hasCommands={commands.length > 0} hasQuery={hasQuery} />
+  }
   return (
-    <div className="overflow-hidden rounded-lg border border-border/50 bg-muted/20">
-      {visibleCommands.length === 0 ? (
-        <div className="px-3 py-6 text-sm text-muted-foreground">
-          {commands.length === 0
-            ? translate(
-                'auto.components.settings.QuickCommandsPane.38d61927e6',
-                'No quick commands saved.'
-              )
-            : translate(
-                'auto.components.settings.QuickCommandsPane.3eb9897ab0',
-                'No commands in the selected scopes.'
-              )}
-        </div>
-      ) : (
-        <div className="max-h-[60vh] space-y-2 overflow-y-auto p-2 scrollbar-sleek">
-          {visibleCommands.map((command) => (
-            <QuickCommandRow
-              key={command.id}
-              command={command}
-              repoById={repoById}
-              onEdit={onEdit}
-              onRemove={onRemove}
-            />
-          ))}
-        </div>
-      )}
+    <div className="-mx-2 divide-y divide-border/50">
+      {visibleCommands.map((command) => (
+        <QuickCommandRow
+          key={command.id}
+          command={command}
+          repoById={repoById}
+          onEdit={onEdit}
+          onRemove={onRemove}
+        />
+      ))}
     </div>
   )
 }
diff --git a/src/renderer/src/components/settings/QuickCommandsPane.tsx b/src/renderer/src/components/settings/QuickCommandsPane.tsx
index f7f703e7ac1..a4f1ea85fe4 100644
--- a/src/renderer/src/components/settings/QuickCommandsPane.tsx
+++ b/src/renderer/src/components/settings/QuickCommandsPane.tsx
@@ -1,26 +1,25 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Plus } from 'lucide-react'
 import type { GlobalSettings, TerminalQuickCommand } from '../../../../shared/types'
 import { getTerminalQuickCommandScope } from '../../../../shared/terminal-quick-commands'
 import {
   createTerminalQuickCommandDraft,
   TerminalQuickCommandDialog
 } from '@/components/terminal-quick-commands/TerminalQuickCommandDialog'
+import { searchTerminalQuickCommands } from '@/lib/terminal-quick-command-search'
 import { useAppStore } from '../../store'
 import { Button } from '../ui/button'
-import { Label } from '../ui/label'
 import { useConfirmationDialog } from '@/components/confirmation-dialog-context'
 import { getSettingOwnershipSummary } from './setting-ownership'
 import { translate } from '@/i18n/i18n'
 import { QuickCommandsList } from './QuickCommandsList'
-import { GLOBAL_SCOPE_KEY, QuickCommandsScopeFilter } from './QuickCommandsScopeFilter'
+import { QuickCommandsToolbar } from './QuickCommandsToolbar'
+import { GLOBAL_SCOPE_KEY } from './QuickCommandsScopeFilter'
 import {
   getRepoExecutionHostId,
   LOCAL_EXECUTION_HOST_ID,
   parseExecutionHostId,
   type ExecutionHostId
 } from '../../../../shared/execution-host'
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '../ui/select'
 import {
   getTerminalQuickCommandHostOptions,
   shouldShowTerminalQuickCommandHostOwnership
@@ -130,6 +129,7 @@ export function QuickCommandsPane({
   // automatically rather than being silently excluded.
   const [scopeSelection, setScopeSelection] = useState<ReadonlySet<string> | null>(null)
   const [scopePopoverOpen, setScopePopoverOpen] = useState(false)
+  const [query, setQuery] = useState('')
 
   const availableHostId = getAvailableQuickCommandHostId(selectedHostId, hostOptions)
   const editorHostIsCurrent =
@@ -164,7 +164,7 @@ export function QuickCommandsPane({
   const effectiveSelection: ReadonlySet<string> = scopeSelection ?? allScopeKeys
   const showAll = scopeSelection === null
 
-  const visibleCommands = commands.filter((command) => {
+  const scopedCommands = commands.filter((command) => {
     const scope = getTerminalQuickCommandScope(command)
     if (showAll) {
       return true
@@ -174,6 +174,7 @@ export function QuickCommandsPane({
     }
     return effectiveSelection.has(scope.repoId)
   })
+  const visibleCommands = searchTerminalQuickCommands(scopedCommands, query)
 
   const createDraftForCurrentFilter = useCallback((): TerminalQuickCommand => {
     // Why: when the user has narrowed to a single repo scope, the natural
@@ -273,68 +274,32 @@ export function QuickCommandsPane({
     void useAppStore.getState().deleteTerminalQuickCommand(selectedHostId, command.id)
   }
 
-  return (
-    <div className="space-y-3">
-      <div className="flex items-center justify-between gap-3 py-2">
-        <div className="space-y-1">
-          <Label>
-            {translate('auto.components.settings.QuickCommandsPane.f91b649324', 'Saved Commands')}
-          </Label>
-          <p className="text-xs text-muted-foreground">
-            {shouldShowTerminalQuickCommandHostOwnership(hostOptions)
-              ? ownership.description
-              : translate(
-                  'auto.components.settings.settingOwnership.terminalQuickCommands',
-                  'Commands are saved on this client, then scoped globally or to a project setup so they run from the selected terminal context.'
-                )}
-          </p>
-        </div>
-        <Button
-          type="button"
-          variant="outline"
-          size="sm"
-          disabled={!canManageSelectedHost}
-          onClick={() =>
-            setEditor({
-              mode: 'add',
-              command: createDraftForCurrentFilter(),
-              connectionGeneration: selectedRuntimeConnectionGeneration,
-              hostId: selectedHostId
-            })
-          }
-        >
-          <Plus />
-          {translate('auto.components.settings.QuickCommandsPane.5aacc8f7dc', 'Add Command')}
-        </Button>
-      </div>
+  const openAddDialog = (): void =>
+    setEditor({
+      mode: 'add',
+      command: createDraftForCurrentFilter(),
+      connectionGeneration: selectedRuntimeConnectionGeneration,
+      hostId: selectedHostId
+    })
 
+  return (
+    <div className="space-y-4">
       {shouldShowTerminalQuickCommandHostOwnership(hostOptions) ? (
-        <div className="space-y-2">
-          <Label htmlFor="quick-command-storage-host">
-            {translate('auto.components.settings.QuickCommandsPane.89f7e57fcc', 'Saved on')}
-          </Label>
-          <Select
-            value={selectedHostId}
-            onValueChange={(value) => {
-              setSelectedHostId(value as ExecutionHostId)
-              setScopeSelection(null)
-            }}
-          >
-            <SelectTrigger id="quick-command-storage-host" size="sm" className="w-56">
-              <SelectValue />
-            </SelectTrigger>
-            <SelectContent>
-              {hostOptions.map((host) => (
-                <SelectItem key={host.id} value={host.id}>
-                  {host.label}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
-        </div>
+        <p className="text-xs text-muted-foreground">{ownership.description}</p>
       ) : null}
 
-      <QuickCommandsScopeFilter
+      <QuickCommandsToolbar
+        query={query}
+        setQuery={setQuery}
+        hostOptions={hostOptions}
+        showHostSelect={shouldShowTerminalQuickCommandHostOwnership(hostOptions)}
+        selectedHostId={selectedHostId}
+        onHostChange={(hostId) => {
+          setSelectedHostId(hostId)
+          setScopeSelection(null)
+        }}
+        canAdd={canManageSelectedHost}
+        onAdd={openAddDialog}
         repos={hostRepos}
         effectiveSelection={effectiveSelection}
         showAll={showAll}
@@ -408,6 +373,7 @@ export function QuickCommandsPane({
           <QuickCommandsList
             commands={commands}
             visibleCommands={visibleCommands}
+            hasQuery={query.trim().length > 0}
             repoById={repoById}
             onEdit={(command) =>
               setEditor({
@@ -428,6 +394,7 @@ export function QuickCommandsPane({
           mode={editor.mode}
           command={editor.command}
           repos={hostRepos}
+          defaultAdvancedOpen
           onOpenChange={(open) => !open && setEditor(null)}
           onSave={saveCommand}
         />
diff --git a/src/renderer/src/components/settings/QuickCommandsToolbar.tsx b/src/renderer/src/components/settings/QuickCommandsToolbar.tsx
new file mode 100644
index 00000000000..65e034eeb3f
--- /dev/null
+++ b/src/renderer/src/components/settings/QuickCommandsToolbar.tsx
@@ -0,0 +1,116 @@
+import type { Dispatch, SetStateAction } from 'react'
+import { Plus, Search } from 'lucide-react'
+import type { Repo } from '../../../../shared/types'
+import type { ExecutionHostId } from '../../../../shared/execution-host'
+import { Button } from '../ui/button'
+import { Input } from '../ui/input'
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '../ui/select'
+import { translate } from '@/i18n/i18n'
+import { QuickCommandsScopeFilter } from './QuickCommandsScopeFilter'
+
+type QuickCommandsToolbarProps = {
+  query: string
+  setQuery: (query: string) => void
+  hostOptions: readonly { id: ExecutionHostId; label: string }[]
+  showHostSelect: boolean
+  selectedHostId: ExecutionHostId
+  onHostChange: (hostId: ExecutionHostId) => void
+  canAdd: boolean
+  onAdd: () => void
+  repos: readonly Repo[]
+  effectiveSelection: ReadonlySet<string>
+  showAll: boolean
+  scopePopoverOpen: boolean
+  setScopePopoverOpen: Dispatch<SetStateAction<boolean>>
+  handleSelectAll: () => void
+  toggleScope: (key: string) => void
+}
+
+export function QuickCommandsToolbar({
+  query,
+  setQuery,
+  hostOptions,
+  showHostSelect,
+  selectedHostId,
+  onHostChange,
+  canAdd,
+  onAdd,
+  repos,
+  effectiveSelection,
+  showAll,
+  scopePopoverOpen,
+  setScopePopoverOpen,
+  handleSelectAll,
+  toggleScope
+}: QuickCommandsToolbarProps): React.JSX.Element {
+  const searchLabel = translate(
+    'auto.components.settings.QuickCommandsToolbar.searchLabel',
+    'Search commands'
+  )
+
+  return (
+    <div className="flex flex-wrap items-center gap-2">
+      <div className="relative min-w-52 flex-1">
+        <Search className="pointer-events-none absolute top-1/2 left-2.5 size-3.5 -translate-y-1/2 text-muted-foreground" />
+        <Input
+          value={query}
+          onChange={(event) => setQuery(event.target.value)}
+          placeholder={searchLabel}
+          aria-label={searchLabel}
+          className="h-8 pl-8 text-xs"
+        />
+      </div>
+
+      <QuickCommandsScopeFilter
+        repos={repos}
+        effectiveSelection={effectiveSelection}
+        showAll={showAll}
+        scopePopoverOpen={scopePopoverOpen}
+        setScopePopoverOpen={setScopePopoverOpen}
+        handleSelectAll={handleSelectAll}
+        toggleScope={toggleScope}
+      />
+
+      {showHostSelect ? (
+        <Select
+          value={selectedHostId}
+          onValueChange={(value) => onHostChange(value as ExecutionHostId)}
+        >
+          <SelectTrigger
+            id="quick-command-storage-host"
+            size="sm"
+            aria-label={translate(
+              'auto.components.settings.QuickCommandsPane.89f7e57fcc',
+              'Saved on'
+            )}
+            className="text-xs"
+          >
+            <span className="text-muted-foreground">
+              {translate('auto.components.settings.QuickCommandsPane.89f7e57fcc', 'Saved on')}
+            </span>
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            {hostOptions.map((host) => (
+              <SelectItem key={host.id} value={host.id}>
+                {host.label}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      ) : null}
+
+      <Button
+        type="button"
+        variant="outline"
+        size="sm"
+        disabled={!canAdd}
+        onClick={onAdd}
+        className="ml-auto"
+      >
+        <Plus />
+        {translate('auto.components.settings.QuickCommandsPane.5aacc8f7dc', 'Add Command')}
+      </Button>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/settings/Settings.tsx b/src/renderer/src/components/settings/Settings.tsx
index 393f70a6b35..cf07ff934cd 100644
--- a/src/renderer/src/components/settings/Settings.tsx
+++ b/src/renderer/src/components/settings/Settings.tsx
@@ -1464,7 +1464,7 @@ function Settings(): React.JSX.Element {
                   )}
                   description={translate(
                     'auto.components.settings.Settings.cfa34f4465',
-                    'Branch naming, base refs, attribution, and Git AI Author.'
+                    'Branch naming, base refs, and Git AI Author.'
                   )}
                   searchEntries={getSectionSearchEntries('git')}
                   forceVisible={hasUnsavedSourceControlAiPromptChanges}
diff --git a/src/renderer/src/components/settings/SettingsConstants.ts b/src/renderer/src/components/settings/SettingsConstants.ts
index 260d8b48971..f129bea3265 100644
--- a/src/renderer/src/components/settings/SettingsConstants.ts
+++ b/src/renderer/src/components/settings/SettingsConstants.ts
@@ -11,7 +11,7 @@ export {
 } from '../../../../shared/ui-zoom-level'
 
 export function zoomLevelToPercent(level: number): number {
-  return Math.round(100 * Math.pow(1.2, level))
+  return Math.round(100 * 1.2 ** level)
 }
 
 export function mergeFontSuggestions(
diff --git a/src/renderer/src/components/settings/ShortcutsPane.tsx b/src/renderer/src/components/settings/ShortcutsPane.tsx
index 8c8b2eb2222..97d5a553163 100644
--- a/src/renderer/src/components/settings/ShortcutsPane.tsx
+++ b/src/renderer/src/components/settings/ShortcutsPane.tsx
@@ -1,4 +1,5 @@
 import React, { useEffect, useMemo, useState } from 'react'
+import { useShallow } from 'zustand/react/shallow'
 import {
   findKeybindingConflictsForDefinitions,
   formatKeybindingList,
@@ -14,22 +15,12 @@ import { EMPTY_DISABLED_TUI_AGENTS } from './shortcut-groups'
 import { useAppStore } from '../../store'
 import { KeybindingsFileActions } from './KeybindingsFileActions'
 import { SettingsSubsectionHeader } from './SettingsFormControls'
-import { getShortcutTerminalStatus } from './shortcut-terminal-status'
 import {
   hasCommonBindingOverride,
-  hasOwnBindingOverride,
   removeBindingOverride,
   sameBindings
 } from './keybinding-override-edits'
-import {
-  buildShortcutGlobalSearchMatcher,
-  matchesShortcutFilter,
-  matchesShortcutLocalSearch,
-  normalizeShortcutLocalSearchQuery,
-  ShortcutFilterRail,
-  type ShortcutFilter,
-  type ShortcutRowsByGroup
-} from './ShortcutFilterRail'
+import { ShortcutFilterRail, type ShortcutFilter } from './ShortcutFilterRail'
 import { ShortcutRowsList } from './ShortcutRowsList'
 import { ShortcutTerminalPolicyControl } from './ShortcutTerminalPolicyControl'
 import { getTerminalShortcutPolicySearchEntry } from './shortcuts-search'
@@ -45,6 +36,8 @@ import { useMountedRef } from '@/hooks/useMountedRef'
 import { translate } from '@/i18n/i18n'
 import { useEditablePluginCommands } from '@/store/plugin-panels'
 import { buildShortcutDefinitionCatalog } from './shortcut-definition-catalog'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
+import { buildShortcutRowVisibility } from './shortcut-row-visibility'
 
 const isMac = navigator.userAgent.includes('Mac')
 const platform: NodeJS.Platform = isMac
@@ -68,23 +61,28 @@ export function ShortcutsPane(): React.JSX.Element {
   const resetKeybindingOverride = useAppStore((state) => state.resetKeybindingOverride)
   const disableKeybindingAction = useAppStore((state) => state.disableKeybindingAction)
   const pluginCommands = useEditablePluginCommands()
+  const [managedBrowserCreationEnabled, mobileEmulatorCreationEnabled] = useAppStore(
+    useShallow((state) => {
+      const policy = getClientCreationActionPolicy(state, state.activeWorktreeId)
+      return [
+        policy['managed-browser'].state === 'enabled',
+        policy['mobile-emulator'].state === 'enabled'
+      ] as const
+    })
+  )
   const mountedRef = useMountedRef()
   const [errors, setErrors] = useState<Partial<Record<KeybindingActionId, string>>>({})
   const [recordingActionId, setRecordingActionId] = useState<KeybindingActionId | null>(null)
-  // Which binding index of the recording action is being captured. Equals the
-  // effective length when capturing a brand-new (appended) binding.
+  // The effective length targets a new appended binding.
   const [recordingBindingIndex, setRecordingBindingIndex] = useState<number | null>(null)
-  // Bindings an action had right before it was disabled, so "Enable" can restore
-  // them in one click instead of forcing a reset-to-default.
+  // Preserve disabled bindings so Enable can restore them.
   const [disableMemory, setDisableMemory] = useState<Partial<Record<KeybindingActionId, string[]>>>(
     {}
   )
   const [shortcutQuery, setShortcutQuery] = useState('')
   const [shortcutFilter, setShortcutFilter] = useState<ShortcutFilter>('all')
 
-  // Why: tell the main process to suspend global shortcut dispatch while any row
-  // is recording, so the captured chord lands in the editor instead of firing.
-  // One source of truth here avoids races between per-row recorder effects.
+  // Why: suspend global dispatch so a captured chord reaches the editor.
   useEffect(() => {
     window.api.ui.setShortcutRecorderFocused(recordingActionId !== null)
     return () => window.api.ui.setShortcutRecorderFocused(false)
@@ -110,55 +108,31 @@ export function ShortcutsPane(): React.JSX.Element {
     const definition = definitionForAction(actionId)
     return definition ? getEffectiveKeybindingsForDefinition(definition, platform, overrides) : []
   }
-  const shortcutGroups = useMemo<ShortcutRowsByGroup[]>(
+  const { filterCounts, shortcutRows, visibleShortcutCount, visibleShortcutGroups } = useMemo(
     () =>
-      groups.map((group) => ({
-        title: group.title,
-        rows: group.items.map((item) => {
-          const effective = getEffectiveKeybindingsForDefinition(item, platform, keybindings)
-          const modified = hasOwnBindingOverride(keybindings, item.id)
-          const warnings = conflictByAction.get(item.id) ?? []
-          return {
-            item,
-            groupTitle: group.title,
-            effective,
-            modified,
-            warnings,
-            terminalStatus: getShortcutTerminalStatus(
-              item,
-              terminalShortcutPolicy,
-              effective.length > 0
-            )
-          }
-        })
-      })),
-    [conflictByAction, groups, keybindings, terminalShortcutPolicy]
-  )
-  const shortcutSearchQuery = normalizeShortcutLocalSearchQuery(shortcutQuery)
-  const shortcutRows = shortcutGroups.flatMap((group) => group.rows)
-  const matchesShortcutGlobalSearch = buildShortcutGlobalSearchMatcher(shortcutRows, searchQuery)
-  const matchesShortcutSearch = (row: ShortcutRowsByGroup['rows'][number]): boolean =>
-    shortcutSearchQuery !== null &&
-    matchesShortcutGlobalSearch(row) &&
-    matchesShortcutLocalSearch(row, shortcutSearchQuery, platform)
-  const baseVisibleRows = shortcutRows.filter((row) => matchesShortcutSearch(row))
-  const filterCounts: Record<ShortcutFilter, number> = {
-    all: baseVisibleRows.length,
-    modified: baseVisibleRows.filter((row) => row.modified).length,
-    unassigned: baseVisibleRows.filter((row) => row.effective.length === 0).length,
-    conflicts: baseVisibleRows.filter((row) => row.warnings.length > 0).length
-  }
-  const visibleShortcutGroups = shortcutGroups
-    .map((group) => ({
-      title: group.title,
-      rows: group.rows.filter(
-        (row) => matchesShortcutSearch(row) && matchesShortcutFilter(row, shortcutFilter)
-      )
-    }))
-    .filter((group) => group.rows.length > 0)
-  const visibleShortcutCount = visibleShortcutGroups.reduce(
-    (sum, group) => sum + group.rows.length,
-    0
+      buildShortcutRowVisibility({
+        groups,
+        keybindings,
+        conflictByAction,
+        terminalShortcutPolicy,
+        platform,
+        managedBrowserCreationEnabled,
+        mobileEmulatorCreationEnabled,
+        settingsSearchQuery: searchQuery,
+        shortcutQuery,
+        shortcutFilter
+      }),
+    [
+      conflictByAction,
+      groups,
+      keybindings,
+      managedBrowserCreationEnabled,
+      mobileEmulatorCreationEnabled,
+      searchQuery,
+      shortcutFilter,
+      shortcutQuery,
+      terminalShortcutPolicy
+    ]
   )
 
   const saveBindings = async (
@@ -236,8 +210,7 @@ export function ShortcutsPane(): React.JSX.Element {
       return
     }
 
-    // Edit just the targeted binding (or append a new one) instead of replacing
-    // the whole list, so an action's other bindings survive the capture.
+    // Preserve sibling bindings when editing or appending one chord.
     const current = effectiveBindingsForAction(actionId)
     const next =
       recordingBindingIndex === null || recordingBindingIndex >= current.length
@@ -290,8 +263,7 @@ export function ShortcutsPane(): React.JSX.Element {
   }
 
   const clearRecordingForAction = (actionId: KeybindingActionId): void => {
-    // Why: disable/reset are final shortcut edits; the next keypress must not
-    // be captured into the shortcut the user just removed or restored.
+    // Why: final edits must not leave the recorder armed.
     if (recordingActionId === actionId) {
       setRecordingBindingIndex(null)
     }
@@ -367,9 +339,7 @@ export function ShortcutsPane(): React.JSX.Element {
           />
 
           <ShortcutRowsList
-            // overflow-x-hidden is explicit: overflow-y-auto alone makes the
-            // browser compute overflow-x to auto, which produced the phantom
-            // horizontal scroll when long edit-time content popped in.
+            // Why: overflow-y-auto otherwise creates a phantom horizontal scrollbar.
             className="min-h-0 min-w-0 flex-1 overflow-x-hidden overflow-y-auto pr-1 scrollbar-sleek"
             groups={visibleShortcutGroups}
             platform={platform}
diff --git a/src/renderer/src/components/settings/floating-workspace-search.ts b/src/renderer/src/components/settings/floating-workspace-search.ts
index 9ca0dca43f6..e0a40747702 100644
--- a/src/renderer/src/components/settings/floating-workspace-search.ts
+++ b/src/renderer/src/components/settings/floating-workspace-search.ts
@@ -2,69 +2,86 @@ import { translate } from '@/i18n/i18n'
 import { translateSearchKeyword } from './settings-search-keywords'
 import { createLocalizedCatalog } from '@/i18n/localized-catalog'
 
-export const getFloatingWorkspaceSearchEntries = createLocalizedCatalog(() => [
-  {
-    title: translate(
-      'auto.components.settings.floating.workspace.search.b2b60e7163',
-      'Floating Workspace'
-    ),
-    description: translate(
-      'auto.components.settings.floating.workspace.search.b96b5ee6cf',
-      'Enable the floating workspace, choose where new tabs start, and choose where the toggle button appears.'
-    ),
-    keywords: [
-      translate(
-        'auto.components.settings.floating.workspace.search.a08e482f6d',
-        'floating workspace'
+function buildFloatingWorkspaceSearchEntries(includeBrowser: boolean) {
+  return [
+    {
+      title: translate(
+        'auto.components.settings.floating.workspace.search.b2b60e7163',
+        'Floating Workspace'
       ),
-      translate(
-        'auto.components.settings.floating.workspace.search.6f183fa1b9',
-        'floating terminal'
+      description: translate(
+        'auto.components.settings.floating.workspace.search.b96b5ee6cf',
+        'Enable the floating workspace, choose where new tabs start, and choose where the toggle button appears.'
       ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.ebeedb2f6a',
-        'quick terminal'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.2b5efa55c9',
-        'global'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.6410fe83d8',
-        'terminal'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.49db74a92d',
-        'browser'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.884e5e6132',
-        'markdown'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.156ffeee08',
-        'note'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.52db6e3baf',
-        'notes'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.a38bfc3f77',
-        'quick panel'
-      ),
-      translate(
-        'auto.components.settings.floating.workspace.search.6765b85e48',
-        'launch directory'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.a452146574',
-        'toggle button'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.94f4d013c8',
-        'status bar'
-      )
-    ]
-  }
-])
+      keywords: [
+        translate(
+          'auto.components.settings.floating.workspace.search.a08e482f6d',
+          'floating workspace'
+        ),
+        translate(
+          'auto.components.settings.floating.workspace.search.6f183fa1b9',
+          'floating terminal'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.ebeedb2f6a',
+          'quick terminal'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.2b5efa55c9',
+          'global'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.6410fe83d8',
+          'terminal'
+        ),
+        ...(includeBrowser
+          ? translateSearchKeyword(
+              'auto.components.settings.floating.workspace.search.49db74a92d',
+              'browser'
+            )
+          : []),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.884e5e6132',
+          'markdown'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.156ffeee08',
+          'note'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.52db6e3baf',
+          'notes'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.a38bfc3f77',
+          'quick panel'
+        ),
+        translate(
+          'auto.components.settings.floating.workspace.search.6765b85e48',
+          'launch directory'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.a452146574',
+          'toggle button'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.94f4d013c8',
+          'status bar'
+        )
+      ]
+    }
+  ]
+}
+
+const getFloatingWorkspaceSearchEntriesWithBrowser = createLocalizedCatalog(() =>
+  buildFloatingWorkspaceSearchEntries(true)
+)
+const getFloatingWorkspaceSearchEntriesWithoutBrowser = createLocalizedCatalog(() =>
+  buildFloatingWorkspaceSearchEntries(false)
+)
+
+export function getFloatingWorkspaceSearchEntries(options?: { includeBrowser?: boolean }) {
+  return options?.includeBrowser === false
+    ? getFloatingWorkspaceSearchEntriesWithoutBrowser()
+    : getFloatingWorkspaceSearchEntriesWithBrowser()
+}
diff --git a/src/renderer/src/components/settings/git-search.ts b/src/renderer/src/components/settings/git-search.ts
index 70b67a70864..b130c4587c5 100644
--- a/src/renderer/src/components/settings/git-search.ts
+++ b/src/renderer/src/components/settings/git-search.ts
@@ -121,22 +121,5 @@ export const getGitPaneSearchEntries = createLocalizedCatalog(() => [
       )
     ]
   },
-  ...getAutoRenameBranchSearchEntries(),
-  {
-    title: translate('auto.components.settings.git.search.bc7d9f69ce', 'Orca Attribution'),
-    description: translate(
-      'auto.components.settings.git.search.118c23484b',
-      'Add Orca attribution to commits, PRs, and issues.'
-    ),
-    keywords: [
-      ...translateSearchKeyword('auto.components.settings.git.search.d088806071', 'github'),
-      ...translateSearchKeyword('auto.components.settings.git.search.16f53f7323', 'gh'),
-      ...translateSearchKeyword('auto.components.settings.git.search.6bdea421bb', 'pr'),
-      ...translateSearchKeyword('auto.components.settings.git.search.af0a144bfb', 'issue'),
-      ...translateSearchKeyword('auto.components.settings.git.search.61f9f5d1fc', 'co-author'),
-      ...translateSearchKeyword('auto.components.settings.git.search.8461c908ae', 'coauthored'),
-      ...translateSearchKeyword('auto.components.settings.git.search.1b93c1143c', 'attribution'),
-      ...translateSearchKeyword('auto.components.settings.git.search.61eab13403', 'orca')
-    ]
-  }
+  ...getAutoRenameBranchSearchEntries()
 ])
diff --git a/src/renderer/src/components/settings/keybinding-override-edits.ts b/src/renderer/src/components/settings/keybinding-override-edits.ts
index e0e88d00782..21b339ba98f 100644
--- a/src/renderer/src/components/settings/keybinding-override-edits.ts
+++ b/src/renderer/src/components/settings/keybinding-override-edits.ts
@@ -15,7 +15,7 @@ export function hasOwnBindingOverride(
   overrides: KeybindingOverrides,
   actionId: KeybindingActionId
 ): boolean {
-  return Object.prototype.hasOwnProperty.call(overrides, actionId)
+  return Object.hasOwn(overrides, actionId)
 }
 
 export function removeBindingOverride(
diff --git a/src/renderer/src/components/settings/repository-source-control-ai-draft.ts b/src/renderer/src/components/settings/repository-source-control-ai-draft.ts
index 1e516bab7a8..370f60f3d2f 100644
--- a/src/renderer/src/components/settings/repository-source-control-ai-draft.ts
+++ b/src/renderer/src/components/settings/repository-source-control-ai-draft.ts
@@ -19,7 +19,7 @@ export function hasOwnActionOverride(
   overrides: RepoSourceControlAiOverrides['actionOverrides'],
   actionId: SourceControlActionId
 ): boolean {
-  return Object.prototype.hasOwnProperty.call(overrides ?? {}, actionId)
+  return Object.hasOwn(overrides ?? {}, actionId)
 }
 
 export function triStateValue(value: boolean | null | undefined): 'inherit' | 'on' | 'off' {
diff --git a/src/renderer/src/components/settings/shortcut-row-visibility.test.ts b/src/renderer/src/components/settings/shortcut-row-visibility.test.ts
new file mode 100644
index 00000000000..9077e36cd97
--- /dev/null
+++ b/src/renderer/src/components/settings/shortcut-row-visibility.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import { getKeybindingDefinition } from '../../../../shared/keybindings'
+import type { ShortcutGroup } from './shortcut-groups'
+import { buildShortcutRowVisibility } from './shortcut-row-visibility'
+
+function creationGroup(): ShortcutGroup {
+  const items = (
+    ['tab.newTerminal', 'tab.newBrowser', 'tab.newMarkdown', 'tab.newSimulator'] as const
+  ).map((actionId) => {
+    const definition = getKeybindingDefinition(actionId)
+    if (!definition) {
+      throw new Error(`Missing keybinding definition: ${actionId}`)
+    }
+    return definition
+  })
+  return { title: 'Tabs', items }
+}
+
+describe('buildShortcutRowVisibility', () => {
+  it('hides client-impossible creation shortcuts without hiding terminal or markdown', () => {
+    const result = buildShortcutRowVisibility({
+      groups: [creationGroup()],
+      keybindings: {},
+      conflictByAction: new Map(),
+      terminalShortcutPolicy: 'orca-first',
+      platform: 'darwin',
+      managedBrowserCreationEnabled: false,
+      mobileEmulatorCreationEnabled: false,
+      settingsSearchQuery: '',
+      shortcutQuery: '',
+      shortcutFilter: 'all'
+    })
+
+    expect(result.shortcutRows.map((row) => row.item.id)).toEqual([
+      'tab.newTerminal',
+      'tab.newMarkdown'
+    ])
+  })
+})
diff --git a/src/renderer/src/components/settings/shortcut-row-visibility.ts b/src/renderer/src/components/settings/shortcut-row-visibility.ts
new file mode 100644
index 00000000000..4a2a6e08f16
--- /dev/null
+++ b/src/renderer/src/components/settings/shortcut-row-visibility.ts
@@ -0,0 +1,96 @@
+import {
+  getEffectiveKeybindingsForDefinition,
+  type KeybindingActionId,
+  type KeybindingOverrides,
+  type TerminalShortcutPolicy
+} from '../../../../shared/keybindings'
+import { hasOwnBindingOverride } from './keybinding-override-edits'
+import type { ShortcutGroup } from './shortcut-groups'
+import { getShortcutTerminalStatus } from './shortcut-terminal-status'
+import {
+  buildShortcutGlobalSearchMatcher,
+  matchesShortcutFilter,
+  matchesShortcutLocalSearch,
+  normalizeShortcutLocalSearchQuery,
+  type ShortcutFilter,
+  type ShortcutRowsByGroup
+} from './ShortcutFilterRail'
+
+export function buildShortcutRowVisibility(options: {
+  groups: ShortcutGroup[]
+  keybindings: KeybindingOverrides
+  conflictByAction: Map<KeybindingActionId, string[]>
+  terminalShortcutPolicy: TerminalShortcutPolicy
+  platform: NodeJS.Platform
+  managedBrowserCreationEnabled: boolean
+  mobileEmulatorCreationEnabled: boolean
+  settingsSearchQuery: string
+  shortcutQuery: string
+  shortcutFilter: ShortcutFilter
+}): {
+  filterCounts: Record<ShortcutFilter, number>
+  shortcutRows: ShortcutRowsByGroup['rows']
+  visibleShortcutCount: number
+  visibleShortcutGroups: ShortcutRowsByGroup[]
+} {
+  const shortcutGroups = options.groups.map((group) => ({
+    title: group.title,
+    rows: group.items
+      .filter(
+        (item) =>
+          (options.managedBrowserCreationEnabled || item.id !== 'tab.newBrowser') &&
+          (options.mobileEmulatorCreationEnabled || item.id !== 'tab.newSimulator')
+      )
+      .map((item) => {
+        const effective = getEffectiveKeybindingsForDefinition(
+          item,
+          options.platform,
+          options.keybindings
+        )
+        return {
+          item,
+          groupTitle: group.title,
+          effective,
+          modified: hasOwnBindingOverride(options.keybindings, item.id),
+          warnings: options.conflictByAction.get(item.id) ?? [],
+          terminalStatus: getShortcutTerminalStatus(
+            item,
+            options.terminalShortcutPolicy,
+            effective.length > 0
+          )
+        }
+      })
+  }))
+  const shortcutRows = shortcutGroups.flatMap((group) => group.rows)
+  const localQuery = normalizeShortcutLocalSearchQuery(options.shortcutQuery)
+  const matchesGlobalSearch = buildShortcutGlobalSearchMatcher(
+    shortcutRows,
+    options.settingsSearchQuery
+  )
+  const matchesSearch = (row: ShortcutRowsByGroup['rows'][number]): boolean =>
+    localQuery !== null &&
+    matchesGlobalSearch(row) &&
+    matchesShortcutLocalSearch(row, localQuery, options.platform)
+  const baseVisibleRows = shortcutRows.filter(matchesSearch)
+  const filterCounts: Record<ShortcutFilter, number> = {
+    all: baseVisibleRows.length,
+    modified: baseVisibleRows.filter((row) => row.modified).length,
+    unassigned: baseVisibleRows.filter((row) => row.effective.length === 0).length,
+    conflicts: baseVisibleRows.filter((row) => row.warnings.length > 0).length
+  }
+  const visibleShortcutGroups = shortcutGroups
+    .map((group) => ({
+      title: group.title,
+      rows: group.rows.filter(
+        (row) => matchesSearch(row) && matchesShortcutFilter(row, options.shortcutFilter)
+      )
+    }))
+    .filter((group) => group.rows.length > 0)
+
+  return {
+    filterCounts,
+    shortcutRows,
+    visibleShortcutCount: visibleShortcutGroups.reduce((sum, group) => sum + group.rows.length, 0),
+    visibleShortcutGroups
+  }
+}
diff --git a/src/renderer/src/components/settings/shortcuts-search.ts b/src/renderer/src/components/settings/shortcuts-search.ts
index 223b1421ee4..2746056f46e 100644
--- a/src/renderer/src/components/settings/shortcuts-search.ts
+++ b/src/renderer/src/components/settings/shortcuts-search.ts
@@ -34,15 +34,35 @@ export const getTerminalShortcutPolicySearchEntry = createLocalizedCatalog(
   })
 )
 
-export const getShortcutsPaneSearchEntries = createLocalizedCatalog(() => [
-  ...KEYBINDING_DEFINITIONS.map((item) => ({
-    title: item.title,
-    description: translate(
-      'auto.components.settings.shortcuts.search.groupShortcut',
-      '{{value0}} shortcut',
-      { value0: item.group }
-    ),
-    keywords: [...item.searchKeywords]
-  })),
-  getTerminalShortcutPolicySearchEntry()
-])
+const getShortcutDefinitionSearchEntries = createLocalizedCatalog(() =>
+  KEYBINDING_DEFINITIONS.map((item) => ({
+    actionId: item.id,
+    searchEntry: {
+      title: item.title,
+      description: translate(
+        'auto.components.settings.shortcuts.search.groupShortcut',
+        '{{value0}} shortcut',
+        { value0: item.group }
+      ),
+      keywords: [...item.searchKeywords]
+    }
+  }))
+)
+
+export function getShortcutsPaneSearchEntries(options?: {
+  includeManagedBrowser?: boolean
+  includeMobileEmulator?: boolean
+}): SettingsSearchEntry[] {
+  const includeManagedBrowser = options?.includeManagedBrowser !== false
+  const includeMobileEmulator = options?.includeMobileEmulator !== false
+  return [
+    ...getShortcutDefinitionSearchEntries()
+      .filter(
+        ({ actionId }) =>
+          (includeManagedBrowser || actionId !== 'tab.newBrowser') &&
+          (includeMobileEmulator || actionId !== 'tab.newSimulator')
+      )
+      .map(({ searchEntry }) => searchEntry),
+    getTerminalShortcutPolicySearchEntry()
+  ]
+}
diff --git a/src/renderer/src/components/sidebar/AddRepoDialog.tsx b/src/renderer/src/components/sidebar/AddRepoDialog.tsx
index 54148a0d4a3..ade12730dee 100644
--- a/src/renderer/src/components/sidebar/AddRepoDialog.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoDialog.tsx
@@ -18,6 +18,7 @@ import {
   useAddRepoHostedController,
   type AddRepoDialogHostedController
 } from './use-add-repo-hosted-controller'
+import { routeAddRepoBrowse } from './add-repo-browse-authority'
 
 export default React.memo(function AddRepoDialog({
   hosted
@@ -308,7 +309,7 @@ export default React.memo(function AddRepoDialog({
         selectedSshTargetId={hostSelection.selectedSshTargetId}
         selectedHostLabel={
           hostSelection.hostOptions.find((host) => host.id === hostSelection.selectedHostId)
-            ?.label ?? hostSelection.selectedHostId
+            ?.label ?? null
         }
         lockSshTargetSelection={hostSelection.selectedParsedHost?.kind === 'ssh'}
         remotePath={remotePath}
@@ -324,26 +325,31 @@ export default React.memo(function AddRepoDialog({
         isCreating={isCreating}
         hostSelector={<AddRepoHostSelectorSlot hostSelection={hostSelection} />}
         showRemoteAction={false}
-        browseHostKind={
-          selectedHostKind === 'ssh' || selectedHostKind === 'runtime' ? selectedHostKind : 'local'
-        }
+        actionsDisabled={!hostSelection.selectedHostId}
+        browseHostKind={selectedHostKind ?? 'runtime'}
         createDefaultParent={createDefaultParent}
         createGitAvailability={createGitAvailability}
         createRuntimeParentStatus={createRuntimeParentStatus}
         createParentDefaultPending={createParentDefaultPending}
         manualCreateParentEntry={isRuntimeEnvironmentActive || selectedHostKind === 'ssh'}
-        onBrowse={
-          selectedHostKind === 'ssh'
-            ? () => void handleOpenRemoteStep(hostSelection.selectedSshTargetId)
-            : selectedHostKind === 'runtime'
-              ? () => setStep('server-path')
-              : handleBrowse
+        onBrowse={() =>
+          routeAddRepoBrowse(hostSelection.selectedParsedHost, {
+            browseLocal: () => void handleBrowse(),
+            browseRuntime: () => setStep('server-path'),
+            browseSsh: (targetId) => void handleOpenRemoteStep(targetId)
+          })
         }
         onOpenCloneStep={() => {
+          if (!hostSelection.selectedHostId) {
+            return
+          }
           setCloneError(null)
           setStep('clone')
         }}
         onOpenCreateStep={() => {
+          if (!hostSelection.selectedHostId) {
+            return
+          }
           setCreateError(null)
           setStep('create')
         }}
diff --git a/src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx b/src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx
index b70c299be36..abdd169d4fd 100644
--- a/src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx
@@ -281,4 +281,16 @@ describe('AddRepoDialogStepContent nested imports', () => {
     expect(html).not.toContain('Create on host')
     expect(html).not.toContain('Want to import many repos at once?')
   })
+
+  it('opens the in-app filesystem browser for a paired runtime', () => {
+    const html = renderStepContent({
+      step: 'server-path',
+      isRuntimeEnvironmentActive: true,
+      activeRuntimeEnvironmentId: 'paired-host'
+    })
+
+    expect(html).toContain('Browse host filesystem')
+    expect(html).toContain('Navigate to a directory and click Select to choose it.')
+    expect(html).toContain('Select folder')
+  })
 })
diff --git a/src/renderer/src/components/sidebar/AddRepoDialogStepContent.tsx b/src/renderer/src/components/sidebar/AddRepoDialogStepContent.tsx
index ee05b70b433..9a0da649f8c 100644
--- a/src/renderer/src/components/sidebar/AddRepoDialogStepContent.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoDialogStepContent.tsx
@@ -46,6 +46,7 @@ type AddRepoDialogStepContentProps = {
   hostSelector?: ReactNode
   showRemoteAction?: boolean
   canCreateProject?: boolean
+  actionsDisabled?: boolean
   manualCreateParentEntry?: boolean
   browseHostKind?: 'local' | 'ssh' | 'runtime'
   createDefaultParent: string
@@ -115,6 +116,7 @@ export function AddRepoDialogStepContent({
   hostSelector,
   showRemoteAction = true,
   canCreateProject = true,
+  actionsDisabled = false,
   manualCreateParentEntry = isRuntimeEnvironmentActive,
   browseHostKind = 'local',
   createDefaultParent,
@@ -159,6 +161,7 @@ export function AddRepoDialogStepContent({
         hostSelector={hostSelector}
         showRemoteAction={showRemoteAction}
         canCreateProject={canCreateProject}
+        actionsDisabled={actionsDisabled}
         browseHostKind={browseHostKind}
         onBrowse={onBrowse}
         onOpenCloneStep={onOpenCloneStep}
diff --git a/src/renderer/src/components/sidebar/AddRepoHostSelector.tsx b/src/renderer/src/components/sidebar/AddRepoHostSelector.tsx
index 0d73eca96cd..b9ab6c89068 100644
--- a/src/renderer/src/components/sidebar/AddRepoHostSelector.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoHostSelector.tsx
@@ -13,7 +13,7 @@ import { canConnectAddRepoHost, canSelectAddRepoHost } from './add-repo-host-ava
 
 type AddRepoHostSelectorProps = {
   hosts: SidebarHostOption[]
-  selectedHostId: ExecutionHostId
+  selectedHostId: ExecutionHostId | null
   open: boolean
   onOpenChange: (open: boolean) => void
   onSelectHost: (hostId: ExecutionHostId) => void
diff --git a/src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx b/src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx
index 40fc712810a..6fa3b88aceb 100644
--- a/src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx
@@ -53,6 +53,7 @@ function renderServerPathStartStep(runtimeEnvironmentId: string | null): string
 
 type LocalStartStepDomOptions = {
   isAdding?: boolean
+  actionsDisabled?: boolean
   addProjectBusyLabel?: string | null
   nestedScanInProgress?: boolean
   nestedScanId?: string | null
@@ -76,6 +77,7 @@ async function renderLocalStartStepDom(
           repoCount={1}
           isSshLikely={isSshLikely}
           isAdding={options.isAdding ?? false}
+          actionsDisabled={options.actionsDisabled ?? false}
           addProjectBusyLabel={options.addProjectBusyLabel ?? null}
           nestedScanInProgress={options.nestedScanInProgress ?? false}
           nestedScanId={options.nestedScanId ?? null}
@@ -257,6 +259,20 @@ describe('AddRepoLocalStartStep', () => {
     })
   })
 
+  it('disables host-scoped actions until a host is selectable', async () => {
+    const { container, root } = await renderLocalStartStepDom(false, { actionsDisabled: true })
+
+    expect(findButton(container, 'Browse folder').disabled).toBe(true)
+    expect(findButton(container, 'Clone from URL').disabled).toBe(true)
+    expect(findButton(container, 'Project on SSH host').disabled).toBe(true)
+    expect(findButton(container, 'Create new project').disabled).toBe(true)
+    expect(findButton(container, 'Browse folder').textContent).not.toContain('⏎')
+
+    await act(async () => {
+      root.unmount()
+    })
+  })
+
   it('marks the autofocused Browse action as selected with the ⏎ chip', async () => {
     const { container, root } = await renderLocalStartStepDom(false)
 
diff --git a/src/renderer/src/components/sidebar/AddRepoStartSteps.tsx b/src/renderer/src/components/sidebar/AddRepoStartSteps.tsx
index 71f8485842b..e5e4b409abc 100644
--- a/src/renderer/src/components/sidebar/AddRepoStartSteps.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoStartSteps.tsx
@@ -69,6 +69,7 @@ type AddRepoLocalStartStepProps = {
   hostSelector?: ReactNode
   showRemoteAction?: boolean
   canCreateProject?: boolean
+  actionsDisabled?: boolean
   browseHostKind?: 'local' | 'ssh' | 'runtime'
   onBrowse: () => void
   onOpenCloneStep: () => void
@@ -87,6 +88,7 @@ export function AddRepoLocalStartStep({
   hostSelector,
   showRemoteAction = true,
   canCreateProject = true,
+  actionsDisabled = false,
   browseHostKind = 'local',
   onBrowse,
   onOpenCloneStep,
@@ -96,6 +98,7 @@ export function AddRepoLocalStartStep({
 }: AddRepoLocalStartStepProps): React.JSX.Element {
   const browseActionRef = useRef<HTMLButtonElement | null>(null)
   const actionsRef = useRef<HTMLDivElement | null>(null)
+  const actionsUnavailable = isAdding || actionsDisabled
   const { primaryAction, secondaryActions } = getAddRepoLocalStartActions({
     isSshLikely,
     onBrowse,
@@ -111,16 +114,13 @@ export function AddRepoLocalStartStep({
   // it follows keyboard focus so Enter always activates the highlighted action. Browse is
   // autofocused on open, so it starts selected; Tab and ↑/↓ move the highlight.
   const [selectedKind, setSelectedKind] = useState<string | null>(primaryAction.kind)
+  const visibleSelectedKind = actionsUnavailable ? null : selectedKind
 
   useEffect(() => {
-    if (isAdding) {
-      setSelectedKind(null)
-      return
-    }
-    if (!isAdding) {
+    if (!actionsUnavailable) {
       browseActionRef.current?.focus()
     }
-  }, [isAdding])
+  }, [actionsUnavailable])
 
   // ↑/↓ rove focus across the action buttons in visual order; focus drives the selection.
   const handleArrowNavigation = (event: React.KeyboardEvent<HTMLDivElement>): void => {
@@ -177,8 +177,8 @@ export function AddRepoLocalStartStep({
           icon={primaryAction.icon}
           title={primaryAction.title}
           description={primaryAction.description}
-          disabled={isAdding}
-          selected={selectedKind === primaryAction.kind}
+          disabled={actionsUnavailable}
+          selected={visibleSelectedKind === primaryAction.kind}
           buttonRef={browseActionRef}
           onClick={primaryAction.onClick}
           onFocus={() => setSelectedKind(primaryAction.kind)}
@@ -199,8 +199,8 @@ export function AddRepoLocalStartStep({
                 icon={action.icon}
                 title={action.title}
                 description={action.description}
-                disabled={isAdding || Boolean(action.disabled)}
-                selected={selectedKind === action.kind}
+                disabled={actionsUnavailable || Boolean(action.disabled)}
+                selected={visibleSelectedKind === action.kind}
                 onClick={action.onClick}
                 onFocus={() => setSelectedKind(action.kind)}
                 className={cn(
diff --git a/src/renderer/src/components/sidebar/WorktreeList.tsx b/src/renderer/src/components/sidebar/WorktreeList.tsx
index 2b6f3e9ee24..be462b94bf0 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeList.tsx
@@ -104,12 +104,18 @@ import {
   getVirtualRowTransform,
   pruneStaleVirtualRowElementCache,
   shouldUseHeaderTopSpacing,
+  WORKTREE_SIDEBAR_VIRTUAL_ROW_GAP,
   type RenderRow
 } from './worktree-list-virtual-rows'
 import {
   revealElementInScrollContainer,
   WORKTREE_SIDEBAR_REVEAL_TOP_INSET
 } from './worktree-sidebar-reveal'
+import {
+  createPendingRevealScroll,
+  isRevealScrollSettling,
+  type PendingRevealScroll
+} from './worktree-sidebar-reveal-scroll-settle'
 import {
   getWorkspaceStatus,
   getWorkspaceStatusFromGroupKey,
@@ -246,6 +252,7 @@ import { keybindingMatchesAction } from '../../../../shared/keybindings'
 import { ProjectGroupNameDialog } from './ProjectGroupNameDialog'
 import { ProjectGroupDeleteDialog } from './ProjectGroupDeleteDialog'
 import { selectProjectGroupRemovalTargets } from '@/store/slices/project-group-removal-targets'
+import { findRepoForHost } from '@/store/slices/repo-host-identity'
 import { isGitRepoKind } from '../../../../shared/repo-kind'
 import {
   effectiveExternalWorktreeVisibility,
@@ -493,7 +500,8 @@ function revealMountedWorktreeElement(
   container: HTMLElement,
   worktreeId: string,
   behavior: ScrollBehavior,
-  optionId?: string
+  optionId?: string,
+  onScrollIssued?: (targetTop: number) => void
 ): HTMLElement | null {
   const element = optionId
     ? document.getElementById(optionId)
@@ -501,19 +509,24 @@ function revealMountedWorktreeElement(
   if (!element || !container.contains(element)) {
     return null
   }
-  return revealElementInScrollContainer(container, element, behavior) ? element : null
+  return revealElementInScrollContainer(container, element, behavior, onScrollIssued)
+    ? element
+    : null
 }
 
 function revealMountedSidebarRowElement(
   container: HTMLElement,
   rowKey: string,
-  behavior: ScrollBehavior
+  behavior: ScrollBehavior,
+  onScrollIssued?: (targetTop: number) => void
 ): HTMLElement | null {
   const element = document.getElementById(getWorktreeOptionId(rowKey))
   if (!element || !container.contains(element)) {
     return null
   }
-  return revealElementInScrollContainer(container, element, behavior) ? element : null
+  return revealElementInScrollContainer(container, element, behavior, onScrollIssued)
+    ? element
+    : null
 }
 
 function getRenderRowSidebarKey(row: RenderRow): string | null {
@@ -651,7 +664,7 @@ type VirtualizedWorktreeViewportProps = {
   collapsedGroups: Set<string>
   handleCreateForRepo: (projectId: string) => void
   handleOpenRepoSettings: (projectId: string, sectionId?: string) => void
-  handleOpenWorktreeVisibility: (projectId: string) => void
+  handleOpenWorktreeVisibility: (repo: Repo) => void
   handleShowImportedWorktrees: (projectId: string) => void
   handleKeepImportedWorktreesHidden: (projectId: string) => void
   importedWorktreeCardActionState: ReadonlyMap<string, ImportedWorktreeCardActionState>
@@ -1410,6 +1423,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
   const pendingRevealRetryRef = useRef<{ worktreeId: string; count: number } | null>(null)
   const pendingRowRevealRetryRef = useRef<{ rowKey: string; count: number } | null>(null)
   const pendingRevealFrameIdsRef = useRef<Set<number>>(new Set())
+  const pendingRevealScrollRef = useRef<PendingRevealScroll | null>(null)
   const revealHighlightFrameIdRef = useRef<number | null>(null)
   const revealHighlightTimeoutRef = useRef<number | null>(null)
   const cancelPendingRevealFrames = useCallback(() => {
@@ -1612,6 +1626,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
         groupIds: group.worktreeIds,
         draggedIds: args.draggedIds,
         draggingWorktreeId: args.draggingWorktreeId,
+        fallbackGap: WORKTREE_SIDEBAR_VIRTUAL_ROW_GAP,
         grab: args.grab,
         anchor: args.anchor
       })
@@ -2050,10 +2065,26 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
     () => window.performance.now() < directScrollInputUntilRef.current,
     []
   )
+  const markRevealScroll = useCallback((targetTop: number) => {
+    pendingRevealScrollRef.current = createPendingRevealScroll(targetTop, window.performance.now())
+  }, [])
+  const isRevealScrollSettlingNow = useCallback(() => {
+    const settling = isRevealScrollSettling({
+      now: window.performance.now(),
+      pending: pendingRevealScrollRef.current,
+      scrollTop: scrollRef.current?.scrollTop ?? 0
+    })
+    if (!settling) {
+      pendingRevealScrollRef.current = null
+    }
+    return settling
+  }, [])
   // Why: programmatic scrolls keep measurement correction quiet, but only direct input blocks anchor-restore retries.
+  // A reveal's smooth scroll is the exception: restoring the anchor mid-animation cancels it a few pixels in.
   const shouldSkipScrollAnchorRestore = useCallback(
-    () => window.performance.now() < directScrollInputUntilRef.current,
-    []
+    () =>
+      window.performance.now() < directScrollInputUntilRef.current || isRevealScrollSettlingNow(),
+    [isRevealScrollSettlingNow]
   )
 
   const virtualizer = useVirtualizer({
@@ -2080,7 +2111,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
       [stickyHeaderIndexes]
     ),
     overscan: 10,
-    gap: 6,
+    gap: WORKTREE_SIDEBAR_VIRTUAL_ROW_GAP,
     // Why: the sticky group header lives inside the virtual list, so scroll math needs the same top inset as the DOM reveal.
     scrollPaddingStart: WORKTREE_SIDEBAR_REVEAL_TOP_INSET,
     isScrollingResetDelay: USER_SCROLL_MEASUREMENT_ADJUSTMENT_SUPPRESS_MS,
@@ -2219,7 +2250,8 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
               container,
               pendingRevealWorktree.worktreeId,
               pendingRevealWorktree.behavior,
-              getRenderRowOptionId(targetRow, pendingRevealWorktree.worktreeId)
+              getRenderRowOptionId(targetRow, pendingRevealWorktree.worktreeId),
+              markRevealScroll
             )
           : null
         if (revealedOption) {
@@ -2291,6 +2323,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
     projectGroups,
     pendingRevealRetryTick,
     flashRevealedRow,
+    markRevealScroll,
     setRenamingWorktreeId,
     schedulePendingRevealFrame,
     cancelPendingRevealFrames
@@ -2379,7 +2412,8 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
         ? revealMountedSidebarRowElement(
             container,
             pendingRevealSidebarRow.rowKey,
-            pendingRevealSidebarRow.behavior
+            pendingRevealSidebarRow.behavior,
+            markRevealScroll
           )
         : null
       if (revealedElement) {
@@ -2414,6 +2448,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
     virtualizer,
     pendingRevealRetryTick,
     flashRevealedRow,
+    markRevealScroll,
     clearPendingRevealSidebarRow,
     schedulePendingRevealFrame,
     cancelPendingRevealFrames
@@ -4598,7 +4633,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
                               <DropdownMenuItem
                                 onSelect={() => {
                                   if (row.repo) {
-                                    handleOpenWorktreeVisibility(row.repo.id)
+                                    handleOpenWorktreeVisibility(row.repo)
                                   }
                                 }}
                               >
@@ -6019,8 +6054,11 @@ const WorktreeList = React.memo(function WorktreeList({
   )
 
   const handleOpenWorktreeVisibility = useCallback(
-    (projectId: string) => {
-      openModal('worktree-visibility', { repoId: projectId })
+    (repo: Repo) => {
+      openModal('worktree-visibility', {
+        repoId: repo.id,
+        hostId: getRepoExecutionHostId(repo)
+      })
     },
     [openModal]
   )
@@ -6787,9 +6825,11 @@ const WorktreeList = React.memo(function WorktreeList({
           if (!suppressExternalWorktreeInboxRepoId) {
             return
           }
-          const projectId = suppressExternalWorktreeInboxRepoId
+          const repo = findRepoForHost(repos, suppressExternalWorktreeInboxRepoId, { settings })
           setSuppressExternalWorktreeInboxRepoId(null)
-          handleOpenWorktreeVisibility(projectId)
+          if (repo) {
+            handleOpenWorktreeVisibility(repo)
+          }
         }}
       />
       <ProjectGroupDeleteDialog
diff --git a/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.test.tsx b/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.test.tsx
new file mode 100644
index 00000000000..470d02dc3d1
--- /dev/null
+++ b/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.test.tsx
@@ -0,0 +1,540 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import type { ReactNode } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { DetectedWorktree, DetectedWorktreeListResult, Repo } from '../../../../shared/types'
+
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
+
+const SCRATCH_PATH = '/repo/.claude/worktrees/scratch-1'
+
+const mocks = vi.hoisted(() => ({
+  state: {
+    activeModal: 'worktree-visibility' as string | null,
+    modalData: { repoId: 'repo-1' } as Record<string, unknown>,
+    closeModal: vi.fn(),
+    repos: [] as unknown[],
+    updateRepo: vi.fn(),
+    fetchWorktrees: vi.fn(),
+    detectedWorktreesByRepo: {} as Record<string, unknown>
+  }
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: Object.assign(
+    (selector: (state: typeof mocks.state) => unknown) => selector(mocks.state),
+    { getState: () => mocks.state }
+  )
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({ open, children }: { open: boolean; children: ReactNode }) =>
+    open ? <div>{children}</div> : null,
+  DialogContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DialogDescription: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <div>{children}</div>
+}))
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string, values?: Record<string, unknown>) =>
+    values
+      ? fallback.replace(/\{\{(\w+)\}\}/g, (_match, name: string) => String(values[name] ?? ''))
+      : fallback
+}))
+
+vi.mock('@tanstack/react-virtual', () => ({
+  useVirtualizer: ({ count }: { count: number }) => ({
+    getTotalSize: () => count * 56,
+    getVirtualItems: () =>
+      Array.from({ length: Math.min(count, 10) }, (_, index) => ({
+        index,
+        key: index,
+        start: index * 56,
+        size: 56,
+        end: (index + 1) * 56,
+        lane: 0
+      })),
+    measureElement: vi.fn()
+  })
+}))
+
+function makeRepo(overrides: Partial<Repo> = {}): Repo {
+  return {
+    id: 'repo-1',
+    path: '/repo',
+    displayName: 'orca',
+    badgeColor: '#000000',
+    addedAt: Date.UTC(2026, 4, 24),
+    externalWorktreeVisibility: 'hide',
+    externalWorktreeVisibilityPromptDismissedAt: 1,
+    // Why: the inbox already stopped announcing this path; recovery must not depend on it.
+    externalWorktreeInboxBaselinePaths: [SCRATCH_PATH],
+    ...overrides
+  }
+}
+
+function makeWorktree(overrides: Partial<DetectedWorktree> = {}): DetectedWorktree {
+  return {
+    id: `repo-1::${overrides.path ?? SCRATCH_PATH}`,
+    repoId: 'repo-1',
+    path: SCRATCH_PATH,
+    displayName: 'scratch-1',
+    branch: 'refs/heads/scratch-1',
+    head: 'abc123',
+    isBare: false,
+    isMainWorktree: false,
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    ownership: 'agent-scratch',
+    selectedCheckout: false,
+    visible: false,
+    ...overrides
+  } as DetectedWorktree
+}
+
+function makeDetected(
+  worktrees: DetectedWorktree[] = [makeWorktree()],
+  overrides: Partial<DetectedWorktreeListResult> = {}
+): DetectedWorktreeListResult {
+  return {
+    repoId: 'repo-1',
+    authoritative: true,
+    source: 'git',
+    worktrees,
+    ...overrides
+  }
+}
+
+let container: HTMLDivElement
+let root: Root
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.state.activeModal = 'worktree-visibility'
+  mocks.state.modalData = { repoId: 'repo-1' }
+  mocks.state.repos = [makeRepo()]
+  mocks.state.detectedWorktreesByRepo = { 'repo-1': makeDetected() }
+  mocks.state.updateRepo.mockResolvedValue(true)
+  mocks.state.fetchWorktrees.mockResolvedValue(true)
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(() => {
+  act(() => {
+    root.unmount()
+  })
+  container.remove()
+  document.body.innerHTML = ''
+  vi.resetModules()
+})
+
+async function renderDialog(): Promise<void> {
+  const { default: WorktreeVisibilityDialog } = await import('./WorktreeVisibilityDialog')
+  await act(async () => {
+    root.render(<WorktreeVisibilityDialog />)
+  })
+}
+
+function deferred<T>(): {
+  promise: Promise<T>
+  resolve: (value: T) => void
+} {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise
+  })
+  return { promise, resolve }
+}
+
+function buttonWithText(text: string): HTMLButtonElement {
+  const button = [...document.querySelectorAll('button')].find(
+    (candidate) => (candidate.textContent ?? '').trim() === text
+  )
+  if (!button) {
+    throw new Error(`No button with text "${text}"`)
+  }
+  return button as HTMLButtonElement
+}
+
+function alwaysShowSwitch(): HTMLButtonElement {
+  const control = document.querySelector('[role="switch"]')
+  if (!control) {
+    throw new Error('No Always show switch')
+  }
+  return control as HTMLButtonElement
+}
+
+async function click(element: HTMLElement): Promise<void> {
+  await act(async () => {
+    element.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true }))
+  })
+}
+
+describe('WorktreeVisibilityDialog', () => {
+  it('lists a hidden agent worktree with a repo-relative path', async () => {
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('Hidden worktrees (1)')
+    expect(document.body.textContent).toContain(
+      'Choose which hidden worktrees to show individually.'
+    )
+    expect(document.body.textContent).toContain('scratch-1')
+    expect(document.body.textContent).toContain('.claude/worktrees/scratch-1')
+    expect(document.body.textContent).not.toContain('/repo/.claude')
+    expect(
+      document.querySelector('button[aria-label="Which worktrees are hidden by default?"]')
+    ).not.toBeNull()
+  })
+
+  it('bounds rendered rows for repositories with many hidden worktrees', async () => {
+    const worktrees = Array.from({ length: 500 }, (_, index) =>
+      makeWorktree({
+        id: `hidden-${index}`,
+        path: `/repo/.claude/worktrees/scratch-${index}`,
+        displayName: `scratch-${index}`
+      })
+    )
+    mocks.state.detectedWorktreesByRepo = { 'repo-1': makeDetected(worktrees) }
+
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('Hidden worktrees (500)')
+    expect(document.querySelectorAll('ul > li').length).toBeLessThan(20)
+  })
+
+  it('recovers a hidden worktree per path through the existing import exception', async () => {
+    // Why: individual recovery remains available while the repo-wide policy is off.
+    await renderDialog()
+
+    await click(buttonWithText('Show'))
+
+    expect(mocks.state.updateRepo).toHaveBeenCalledWith('repo-1', {
+      importedExternalWorktreePaths: [SCRATCH_PATH],
+      externalWorktreeInboxBaselinePaths: [SCRATCH_PATH]
+    })
+    expect(mocks.state.fetchWorktrees).toHaveBeenCalledWith('repo-1', {
+      requireAuthoritative: true
+    })
+    expect(mocks.state.closeModal).not.toHaveBeenCalled()
+  })
+
+  it('omits the hidden list when nothing is recoverable', async () => {
+    mocks.state.detectedWorktreesByRepo = { 'repo-1': makeDetected([]) }
+    await renderDialog()
+
+    expect(document.body.textContent).not.toContain('Hidden worktrees')
+  })
+
+  it('says it is checking instead of claiming nothing is hidden on a fallback snapshot', async () => {
+    mocks.state.detectedWorktreesByRepo = {
+      'repo-1': makeDetected([makeWorktree()], { authoritative: false, source: 'session-fallback' })
+    }
+    mocks.state.fetchWorktrees.mockImplementation(() => new Promise(() => {}))
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('Checking…')
+    expect(document.body.textContent).not.toContain('Hidden worktrees')
+    expect(mocks.state.fetchWorktrees).toHaveBeenCalledWith('repo-1', {
+      requireAuthoritative: true
+    })
+  })
+
+  it('offers a retry instead of a dead end when the list cannot be read', async () => {
+    mocks.state.detectedWorktreesByRepo = {
+      'repo-1': makeDetected([makeWorktree()], { authoritative: false, source: 'session-fallback' })
+    }
+    mocks.state.fetchWorktrees.mockResolvedValue(false)
+    await renderDialog()
+
+    expect(document.querySelector('[role="alert"]')?.textContent).toContain(
+      "Could not list this repo's worktrees."
+    )
+
+    // Why: a successful authoritative refetch also writes the trusted snapshot.
+    mocks.state.fetchWorktrees.mockImplementation(async () => {
+      mocks.state.detectedWorktreesByRepo = { 'repo-1': makeDetected() }
+      return true
+    })
+    await click(buttonWithText('Try again'))
+
+    expect(document.querySelector('[role="alert"]')).toBeNull()
+    expect(document.body.textContent).toContain('Hidden worktrees')
+  })
+
+  it('keeps rows visible but not actionable until the open-time scan settles', async () => {
+    // Why: a Show clicked mid-scan could join the pre-write refetch and read
+    // success off a list computed before the import landed — a silent no-op.
+    mocks.state.fetchWorktrees.mockImplementation(() => new Promise(() => {}))
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('scratch-1')
+    expect(buttonWithText('Show').disabled).toBe(true)
+    expect(document.body.textContent).toContain('Checking…')
+  })
+
+  it('locks the repo-wide toggle until the open-time scan settles', async () => {
+    // Why: its post-write refresh must not coalesce onto a list started before the visibility write.
+    mocks.state.fetchWorktrees.mockImplementation(() => new Promise(() => {}))
+    await renderDialog()
+
+    expect(alwaysShowSwitch().disabled).toBe(true)
+  })
+
+  it('reports a failed refresh even while an older trusted snapshot is on screen', async () => {
+    // Why: a warm snapshot must not present stale rows as current with no
+    // failure indication when the host has since become unreachable.
+    mocks.state.fetchWorktrees.mockResolvedValue(false)
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('scratch-1')
+    expect(document.querySelector('[role="alert"]')?.textContent).toContain(
+      "Could not list this repo's worktrees."
+    )
+  })
+
+  it('locks retry while a row import is in flight, so it cannot race the write', async () => {
+    // Why: a retry scan started before the import's write lands can absorb the
+    // import's own refetch and report success off a pre-import list.
+    mocks.state.fetchWorktrees.mockResolvedValue(false)
+    mocks.state.updateRepo.mockImplementation(() => new Promise(() => {}))
+    await renderDialog()
+
+    await click(buttonWithText('Show'))
+
+    expect(buttonWithText('Try again').disabled).toBe(true)
+  })
+
+  it('locks the repo-wide toggle while a row import is in flight', async () => {
+    mocks.state.fetchWorktrees.mockResolvedValue(false)
+    mocks.state.updateRepo.mockImplementation(() => new Promise(() => {}))
+    await renderDialog()
+
+    await click(buttonWithText('Show'))
+
+    expect(alwaysShowSwitch().disabled).toBe(true)
+  })
+
+  it('locks row actions and retry while the repo-wide toggle is in flight', async () => {
+    mocks.state.fetchWorktrees.mockResolvedValueOnce(false)
+    mocks.state.updateRepo.mockImplementation(() => new Promise(() => {}))
+    await renderDialog()
+
+    await click(alwaysShowSwitch())
+
+    expect(buttonWithText('Show').disabled).toBe(true)
+    expect(buttonWithText('Try again').disabled).toBe(true)
+  })
+
+  it('clears a stale failure once a row import refreshes the list successfully', async () => {
+    mocks.state.fetchWorktrees.mockResolvedValueOnce(false)
+    await renderDialog()
+    expect(document.querySelector('[role="alert"]')).not.toBeNull()
+
+    mocks.state.fetchWorktrees.mockResolvedValue(true)
+    await click(buttonWithText('Show'))
+
+    expect(document.querySelector('[role="alert"]')).toBeNull()
+  })
+
+  it('does not leak an old repo action failure into a newly opened repo', async () => {
+    const update = deferred<boolean>()
+    mocks.state.updateRepo.mockReturnValueOnce(update.promise)
+    await renderDialog()
+    await click(buttonWithText('Show'))
+
+    mocks.state.modalData = { repoId: 'repo-2' }
+    mocks.state.repos = [makeRepo({ id: 'repo-2', path: '/repo-2', displayName: 'other' })]
+    mocks.state.detectedWorktreesByRepo = { 'repo-2': makeDetected([], { repoId: 'repo-2' }) }
+    await renderDialog()
+
+    update.resolve(false)
+    await act(async () => update.promise)
+
+    expect(document.querySelector('[role="alert"]')).toBeNull()
+  })
+
+  it('keeps a remounted repo locked until its earlier row action settles', async () => {
+    const update = deferred<boolean>()
+    mocks.state.updateRepo.mockReturnValueOnce(update.promise)
+    await renderDialog()
+    mocks.state.fetchWorktrees.mockClear()
+    await click(buttonWithText('Show'))
+
+    await act(async () => root.render(null))
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('Hidden worktrees (1)')
+    expect(buttonWithText('Showing…').disabled).toBe(true)
+    expect(mocks.state.fetchWorktrees).not.toHaveBeenCalled()
+
+    await act(async () => {
+      update.resolve(false)
+      await update.promise
+      await Promise.resolve()
+    })
+    expect(buttonWithText('Show').disabled).toBe(false)
+  })
+
+  it('keeps a remounted repo locked until its earlier toggle settles', async () => {
+    const update = deferred<boolean>()
+    mocks.state.updateRepo.mockReturnValueOnce(update.promise)
+    await renderDialog()
+    mocks.state.fetchWorktrees.mockClear()
+    await click(alwaysShowSwitch())
+
+    await act(async () => root.render(null))
+    await renderDialog()
+
+    expect(alwaysShowSwitch().disabled).toBe(true)
+    expect(buttonWithText('Show').disabled).toBe(true)
+    expect(mocks.state.fetchWorktrees).not.toHaveBeenCalled()
+
+    await act(async () => {
+      update.resolve(false)
+      await update.promise
+      await Promise.resolve()
+    })
+    expect(alwaysShowSwitch().disabled).toBe(false)
+  })
+
+  it('does not carry a mutation fence across same-id repos on different hosts', async () => {
+    const update = deferred<boolean>()
+    const localWorktree = makeWorktree({ hostId: 'local' })
+    const remotePath = '/srv/repo/.claude/worktrees/remote-scratch'
+    const remoteWorktree = makeWorktree({
+      id: `repo-1::${remotePath}`,
+      path: remotePath,
+      displayName: 'remote-scratch',
+      hostId: 'runtime:env-1'
+    })
+    mocks.state.modalData = { repoId: 'repo-1', hostId: 'local' }
+    mocks.state.repos = [
+      makeRepo(),
+      makeRepo({ path: '/srv/repo', displayName: 'remote', executionHostId: 'runtime:env-1' })
+    ]
+    mocks.state.detectedWorktreesByRepo = {
+      'repo-1': makeDetected([localWorktree, remoteWorktree])
+    }
+    mocks.state.updateRepo.mockReturnValueOnce(update.promise)
+    await renderDialog()
+    await click(buttonWithText('Show'))
+
+    await act(async () => root.render(null))
+    mocks.state.modalData = { repoId: 'repo-1', hostId: 'runtime:env-1' }
+    mocks.state.fetchWorktrees.mockClear()
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('remote-scratch')
+    expect(document.body.textContent).not.toContain('scratch-1')
+    expect(buttonWithText('Show').disabled).toBe(false)
+    expect(mocks.state.fetchWorktrees).toHaveBeenCalledWith('repo-1', {
+      requireAuthoritative: true,
+      executionHostId: 'runtime:env-1'
+    })
+
+    await click(buttonWithText('Show'))
+    expect(mocks.state.updateRepo).toHaveBeenLastCalledWith(
+      'repo-1',
+      {
+        importedExternalWorktreePaths: [remotePath],
+        externalWorktreeInboxBaselinePaths: [SCRATCH_PATH, remotePath]
+      },
+      { hostId: 'runtime:env-1' }
+    )
+
+    await act(async () => {
+      update.resolve(false)
+      await update.promise
+    })
+  })
+
+  it('reports a failed persistent visibility update without starting a refresh', async () => {
+    mocks.state.updateRepo.mockResolvedValue(false)
+    await renderDialog()
+    mocks.state.fetchWorktrees.mockClear()
+
+    await click(alwaysShowSwitch())
+
+    expect(document.querySelector('[role="alert"]')?.textContent).toContain(
+      'Could not update worktree visibility. Try again.'
+    )
+    expect(mocks.state.fetchWorktrees).not.toHaveBeenCalled()
+  })
+
+  it('reports a failed authoritative refresh after updating persistent visibility', async () => {
+    await renderDialog()
+    mocks.state.fetchWorktrees.mockResolvedValue(false)
+
+    await click(alwaysShowSwitch())
+
+    expect(mocks.state.fetchWorktrees).toHaveBeenLastCalledWith('repo-1', {
+      requireAuthoritative: true
+    })
+    expect(document.querySelector('[role="alert"]')?.textContent).toContain(
+      "Could not list this repo's worktrees."
+    )
+  })
+
+  it('enables the persistent policy for regular and agent worktrees', async () => {
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('Always show')
+    expect(document.body.textContent).toContain('1 worktree currently hidden')
+    expect(alwaysShowSwitch().getAttribute('aria-checked')).toBe('false')
+
+    await click(alwaysShowSwitch())
+
+    expect(mocks.state.updateRepo).toHaveBeenCalledWith('repo-1', {
+      externalWorktreeVisibility: 'show',
+      agentWorktreeVisibility: 'show',
+      externalWorktreeDiscoverySuppressedAt: null
+    })
+    expect(mocks.state.closeModal).not.toHaveBeenCalled()
+  })
+
+  it('keeps the combined switch off until the agent policy is explicitly enabled', async () => {
+    mocks.state.repos = [makeRepo({ externalWorktreeVisibility: 'show' })]
+    await renderDialog()
+
+    expect(alwaysShowSwitch().getAttribute('aria-checked')).toBe('false')
+    expect(document.body.textContent).toContain('scratch-1')
+
+    await click(alwaysShowSwitch())
+
+    expect(mocks.state.updateRepo).toHaveBeenCalledWith('repo-1', {
+      externalWorktreeVisibility: 'show',
+      agentWorktreeVisibility: 'show',
+      externalWorktreeDiscoverySuppressedAt: null
+    })
+  })
+
+  it('turns the persistent policy off without closing the dialog', async () => {
+    mocks.state.repos = [
+      makeRepo({ externalWorktreeVisibility: 'show', agentWorktreeVisibility: 'show' })
+    ]
+    await renderDialog()
+
+    expect(document.body.textContent).toContain('0 worktrees currently shown')
+    expect(alwaysShowSwitch().getAttribute('aria-checked')).toBe('true')
+
+    await click(alwaysShowSwitch())
+
+    expect(mocks.state.updateRepo).toHaveBeenCalledWith('repo-1', {
+      externalWorktreeVisibility: 'hide',
+      agentWorktreeVisibility: 'hide'
+    })
+    expect(mocks.state.closeModal).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx b/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
index 5cad24b5ec7..9badad39b41 100644
--- a/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
@@ -1,5 +1,6 @@
-import React, { useCallback } from 'react'
+import React, { useCallback, useEffect, useId, useLayoutEffect, useRef, useState } from 'react'
 import { Eye, EyeOff } from 'lucide-react'
+import { useVirtualizer } from '@tanstack/react-virtual'
 import { useAppStore } from '@/store'
 import {
   Dialog,
@@ -9,16 +10,37 @@ import {
   DialogTitle
 } from '@/components/ui/dialog'
 import { Button } from '@/components/ui/button'
+import { Label } from '@/components/ui/label'
+import { Switch } from '@/components/ui/switch'
 import {
-  getHiddenExternalWorktrees,
-  getVisibleExternalWorktrees
+  getHiddenImportableExternalWorktrees,
+  getVisibleNonOrcaWorktrees
 } from '../../../../shared/external-worktree-inbox'
 import { isGitRepoKind } from '../../../../shared/repo-kind'
+import { relativePathInsideRoot } from '../../../../shared/cross-platform-path'
 import {
+  effectiveAgentWorktreeVisibility,
   effectiveExternalWorktreeVisibility,
   isLegacyRepoForExternalWorktreeVisibility
 } from '../../../../shared/worktree-ownership'
 import { translate } from '@/i18n/i18n'
+import {
+  importNewExternalWorktreeInboxPaths,
+  type NewExternalWorktreesInboxActionState
+} from './new-external-worktrees-inbox-actions'
+import WorktreeVisibilityHelpPopover from './WorktreeVisibilityHelpPopover'
+import { getRepoHostIdentity } from '@/store/slices/repo-host-identity'
+import {
+  resolveWorktreeVisibilityHostTarget,
+  useWorktreeVisibilityHostActions
+} from './worktree-visibility-host-target'
+import {
+  finishVisibilityMutation,
+  getActiveVisibilityMutation,
+  startVisibilityMutation,
+  type ActiveVisibilityMutation,
+  useVisibilityMutationFence
+} from './worktree-visibility-mutation-fence'
 
 export default function WorktreeVisibilityDialog(): React.JSX.Element | null {
   const activeModal = useAppStore((s) => s.activeModal)
@@ -28,59 +50,216 @@ export default function WorktreeVisibilityDialog(): React.JSX.Element | null {
   const updateRepo = useAppStore((s) => s.updateRepo)
   const fetchWorktrees = useAppStore((s) => s.fetchWorktrees)
   const detectedWorktreesByRepo = useAppStore((s) => s.detectedWorktreesByRepo)
+  const settings = useAppStore((s) => s.settings)
+  const [actionState, setActionState] = useState<NewExternalWorktreesInboxActionState | null>(null)
+  const [busyPath, setBusyPath] = useState<string | null>(null)
+  const [isToggling, setIsToggling] = useState(false)
+  const [listState, setListState] = useState<'checking' | 'ready' | 'failed'>('checking')
+  const alwaysShowSwitchId = useId()
+  const hiddenListHeadingId = useId()
+  const hiddenListRef = useRef<HTMLDivElement>(null)
 
+  const isOpen = activeModal === 'worktree-visibility'
   const repoId = typeof modalData.repoId === 'string' ? modalData.repoId : ''
-  const repo = repos.find((candidate) => candidate.id === repoId) ?? null
-  const detected = repoId ? detectedWorktreesByRepo[repoId] : undefined
+  const {
+    detected,
+    repo,
+    requestedHostId,
+    scope: mutationScope
+  } = resolveWorktreeVisibilityHostTarget(
+    { repos, settings, detectedWorktreesByRepo },
+    repoId,
+    modalData.hostId
+  )
+  const currentMutationScopeRef = useRef(mutationScope)
+  const activeMutation = getActiveVisibilityMutation(mutationScope)
+  const effectiveBusyPath =
+    busyPath ?? (activeMutation?.kind === 'row' ? activeMutation.path : null)
+  const effectivelyToggling = isToggling || activeMutation?.kind === 'toggle'
   const showOther = repo
     ? effectiveExternalWorktreeVisibility(repo, isLegacyRepoForExternalWorktreeVisibility(repo)) ===
       'show'
     : false
-  const hiddenCount = getHiddenExternalWorktrees(detected).length
-  const otherCount = getVisibleExternalWorktrees(detected).length
+  const showAgentScratch = repo ? effectiveAgentWorktreeVisibility(repo) === 'show' : false
+  const alwaysShow = showOther && showAgentScratch
+  const hiddenImportable = getHiddenImportableExternalWorktrees(detected)
+  const hiddenCount = hiddenImportable.length
+  const otherCount = getVisibleNonOrcaWorktrees(detected).length
   const hiddenWorktreeLabel = `${hiddenCount} ${hiddenCount === 1 ? 'worktree' : 'worktrees'}`
   const shownWorktreeLabel = `${otherCount} ${otherCount === 1 ? 'worktree' : 'worktrees'}`
+  const hiddenListVirtualizer = useVirtualizer({
+    count: hiddenImportable.length,
+    getScrollElement: () => hiddenListRef.current,
+    estimateSize: () => 56,
+    getItemKey: (index) => hiddenImportable[index]?.id ?? index,
+    overscan: 3,
+    initialRect: { width: 480, height: 224 }
+  })
 
-  const handleToggle = useCallback(async () => {
+  useLayoutEffect(() => {
+    currentMutationScopeRef.current = mutationScope
+  }, [mutationScope])
+
+  const { refreshTargetRepo, updateTargetRepo } = useWorktreeVisibilityHostActions(
+    fetchWorktrees,
+    updateRepo,
+    requestedHostId
+  )
+
+  useVisibilityMutationFence({
+    scope: mutationScope,
+    repoId,
+    currentScopeRef: currentMutationScopeRef,
+    refresh: refreshTargetRepo,
+    setActionState,
+    setBusyPath,
+    setIsToggling,
+    setListState
+  })
+
+  // Why: recovery must not trust a stale or fallback snapshot — an empty one
+  // would read as "nothing hidden" for a worktree that is sitting on disk (#10324).
+  useEffect(() => {
+    if (!isOpen || !repoId) {
+      return
+    }
+    // Why: reopening mid-write must not start a scan that can absorb the mutation's confirmation refresh.
+    if (getActiveVisibilityMutation(mutationScope)) {
+      return
+    }
+    let cancelled = false
+    setListState('checking')
+    void refreshTargetRepo(repoId, { requireAuthoritative: true }).then((refreshed) => {
+      if (!cancelled) {
+        setListState(refreshed ? 'ready' : 'failed')
+      }
+    })
+    return () => {
+      cancelled = true
+    }
+  }, [isOpen, mutationScope, refreshTargetRepo, repoId])
+
+  const handleRetryList = useCallback(async () => {
     if (!repoId) {
       return
     }
-    await updateRepo(repoId, {
-      externalWorktreeVisibility: showOther ? 'hide' : 'show',
-      // Why: showing hidden externals again should re-enable the inbox if the
-      // user previously opted out of discovery prompts for this repo.
-      // Why: null is the transport sentinel for clearing on remote runtime paths
-      // where `undefined` is stripped before persistence.
-      ...(!showOther ? { externalWorktreeDiscoverySuppressedAt: null } : {})
-    })
-    await fetchWorktrees(repoId)
-    closeModal()
-  }, [closeModal, fetchWorktrees, repoId, showOther, updateRepo])
+    setListState('checking')
+    const refreshed = await refreshTargetRepo(repoId, { requireAuthoritative: true })
+    if (currentMutationScopeRef.current === mutationScope) {
+      setListState(refreshed ? 'ready' : 'failed')
+    }
+  }, [mutationScope, refreshTargetRepo, repoId])
 
-  if (activeModal !== 'worktree-visibility' || !repo || !isGitRepoKind(repo)) {
+  const handleShowWorktree = useCallback(
+    async (worktreePath: string) => {
+      if (!repo) {
+        return
+      }
+      const mutation: ActiveVisibilityMutation = { kind: 'row', path: worktreePath }
+      const targetMutationScope = getRepoHostIdentity(repo)
+      startVisibilityMutation(targetMutationScope, mutation)
+      setBusyPath(worktreePath)
+      try {
+        await importNewExternalWorktreeInboxPaths({
+          projectId: repo.id,
+          repo,
+          worktreePaths: [worktreePath],
+          updateRepo: updateTargetRepo,
+          fetchWorktrees: refreshTargetRepo,
+          setInboxState: (_projectId, state) => {
+            if (currentMutationScopeRef.current !== targetMutationScope) {
+              return
+            }
+            setActionState(state)
+            // Why: a null state is only reachable after a successful authoritative
+            // refetch, which supersedes an earlier failed open-time scan.
+            if (state === null) {
+              setListState('ready')
+            }
+          }
+        })
+      } finally {
+        finishVisibilityMutation(targetMutationScope, mutation)
+        if (currentMutationScopeRef.current === targetMutationScope) {
+          setBusyPath(null)
+        }
+      }
+    },
+    [refreshTargetRepo, repo, updateTargetRepo]
+  )
+
+  const handleAlwaysShowChange = useCallback(
+    async (checked: boolean) => {
+      if (!repoId || checked === alwaysShow) {
+        return
+      }
+      const mutation: ActiveVisibilityMutation = { kind: 'toggle' }
+      startVisibilityMutation(mutationScope, mutation)
+      setActionState(null)
+      setIsToggling(true)
+      try {
+        const updated = await updateTargetRepo(repoId, {
+          externalWorktreeVisibility: checked ? 'show' : 'hide',
+          agentWorktreeVisibility: checked ? 'show' : 'hide',
+          // Why: showing hidden externals again should re-enable the inbox if the
+          // user previously opted out of discovery prompts for this repo.
+          // Why: null is the transport sentinel for clearing on remote runtime paths
+          // where `undefined` is stripped before persistence.
+          ...(checked ? { externalWorktreeDiscoverySuppressedAt: null } : {})
+        })
+        if (!updated) {
+          if (currentMutationScopeRef.current === mutationScope) {
+            setActionState({
+              pending: false,
+              error: translate(
+                'auto.components.sidebar.WorktreeVisibilityDialog.d40d436fc2',
+                'Could not update worktree visibility. Try again.'
+              )
+            })
+          }
+          return
+        }
+        const refreshed = await refreshTargetRepo(repoId, { requireAuthoritative: true })
+        if (currentMutationScopeRef.current === mutationScope) {
+          setListState(refreshed ? 'ready' : 'failed')
+        }
+      } finally {
+        finishVisibilityMutation(mutationScope, mutation)
+        if (currentMutationScopeRef.current === mutationScope) {
+          setIsToggling(false)
+        }
+      }
+    },
+    [alwaysShow, mutationScope, refreshTargetRepo, repoId, updateTargetRepo]
+  )
+
+  if (!isOpen || !repo || !isGitRepoKind(repo)) {
     return null
   }
 
   return (
     <Dialog open onOpenChange={(open) => !open && closeModal()}>
-      <DialogContent className="sm:max-w-md">
+      <DialogContent className="sm:max-w-lg">
         <DialogHeader>
-          <DialogTitle>
-            {translate(
-              'auto.components.sidebar.WorktreeVisibilityDialog.83a5ba8dd1',
-              'Non-Orca worktrees'
-            )}
-          </DialogTitle>
+          <div className="flex items-center gap-1.5">
+            <DialogTitle>
+              {translate(
+                'auto.components.sidebar.WorktreeVisibilityDialog.83a5ba8dd1',
+                'Non-Orca worktrees'
+              )}
+            </DialogTitle>
+            <WorktreeVisibilityHelpPopover />
+          </div>
           <DialogDescription>{repo.displayName}</DialogDescription>
         </DialogHeader>
 
         <div className="flex items-center gap-3 rounded-lg border border-border bg-muted/30 p-3">
           <div className="flex size-8 shrink-0 items-center justify-center rounded-md bg-background text-muted-foreground">
-            {showOther ? <Eye className="size-4" /> : <EyeOff className="size-4" />}
+            {alwaysShow ? <Eye className="size-4" /> : <EyeOff className="size-4" />}
           </div>
           <div className="min-w-0 flex-1">
             <div className="text-sm font-medium">
-              {showOther
+              {alwaysShow
                 ? translate(
                     'auto.components.sidebar.WorktreeVisibilityDialog.3e045d4cb8',
                     'Shown in sidebar'
@@ -91,7 +270,7 @@ export default function WorktreeVisibilityDialog(): React.JSX.Element | null {
                   )}
             </div>
             <div className="text-xs text-muted-foreground">
-              {showOther
+              {alwaysShow
                 ? translate(
                     'auto.components.sidebar.WorktreeVisibilityDialog.8372e4bbd9',
                     '{{value0}} currently shown',
@@ -99,21 +278,145 @@ export default function WorktreeVisibilityDialog(): React.JSX.Element | null {
                   )
                 : translate(
                     'auto.components.sidebar.WorktreeVisibilityDialog.25ddf19920',
-                    '{{value0}} available to import',
+                    '{{value0}} currently hidden',
                     { value0: hiddenWorktreeLabel }
                   )}
             </div>
           </div>
-          <Button
-            type="button"
-            variant={showOther ? 'secondary' : 'outline'}
-            onClick={handleToggle}
-          >
-            {showOther
-              ? translate('auto.components.sidebar.WorktreeVisibilityDialog.759371df43', 'Hide')
-              : translate('auto.components.sidebar.WorktreeVisibilityDialog.f1f71b9f02', 'Import')}
-          </Button>
+          <Label htmlFor={alwaysShowSwitchId} className="shrink-0 gap-2">
+            {translate(
+              'auto.components.sidebar.WorktreeVisibilityDialog.f1f71b9f02',
+              'Always show'
+            )}
+            <Switch
+              id={alwaysShowSwitchId}
+              checked={alwaysShow}
+              disabled={
+                effectiveBusyPath !== null || effectivelyToggling || listState === 'checking'
+              }
+              onCheckedChange={(checked) => void handleAlwaysShowChange(checked)}
+            />
+          </Label>
         </div>
+
+        {listState === 'checking' ? (
+          <p aria-live="polite" className="text-xs text-muted-foreground">
+            {translate('auto.components.sidebar.WorktreeVisibilityDialog.a3f19c07d2', 'Checking…')}
+          </p>
+        ) : null}
+
+        {listState === 'failed' ? (
+          <div className="flex min-w-0 items-center gap-3" role="alert">
+            <p className="min-w-0 flex-1 text-xs text-destructive">
+              {translate(
+                'auto.components.sidebar.WorktreeVisibilityDialog.b8d24e61f5',
+                "Could not list this repo's worktrees."
+              )}
+            </p>
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              disabled={effectiveBusyPath !== null || effectivelyToggling}
+              onClick={handleRetryList}
+            >
+              {translate(
+                'auto.components.sidebar.WorktreeVisibilityDialog.c5e70a93b1',
+                'Try again'
+              )}
+            </Button>
+          </div>
+        ) : null}
+
+        {hiddenImportable.length > 0 ? (
+          <div className="grid min-w-0 gap-2">
+            <div>
+              <h3 id={hiddenListHeadingId} className="text-sm font-medium">
+                {translate(
+                  'auto.components.sidebar.WorktreeVisibilityDialog.7d21c5e848',
+                  'Hidden worktrees ({{value0}})',
+                  { value0: hiddenImportable.length }
+                )}
+              </h3>
+              <p className="text-xs text-muted-foreground">
+                {translate(
+                  'auto.components.sidebar.WorktreeVisibilityDialog.9b53f7a160',
+                  'Choose which hidden worktrees to show individually.'
+                )}
+              </p>
+            </div>
+            <div
+              ref={hiddenListRef}
+              aria-labelledby={hiddenListHeadingId}
+              className="scrollbar-sleek max-h-56 min-w-0 overflow-y-auto"
+              tabIndex={0}
+              style={{
+                height: `${Math.min(hiddenListVirtualizer.getTotalSize(), 224)}px`
+              }}
+            >
+              <ul
+                className="relative min-w-0"
+                style={{ height: `${hiddenListVirtualizer.getTotalSize()}px` }}
+              >
+                {hiddenListVirtualizer.getVirtualItems().map((virtualRow) => {
+                  const worktree = hiddenImportable[virtualRow.index]
+                  if (!worktree) {
+                    return null
+                  }
+                  const displayPath =
+                    relativePathInsideRoot(repo.path, worktree.path) || worktree.path
+                  return (
+                    <li
+                      key={worktree.id}
+                      ref={hiddenListVirtualizer.measureElement}
+                      data-index={virtualRow.index}
+                      className="absolute left-0 top-0 w-full pb-1"
+                      style={{ transform: `translateY(${virtualRow.start}px)` }}
+                      aria-posinset={virtualRow.index + 1}
+                      aria-setsize={hiddenImportable.length}
+                    >
+                      <div className="flex min-w-0 items-center gap-3 rounded-md border border-border px-3 py-2">
+                        <div className="min-w-0 flex-1">
+                          <div className="truncate text-sm">{worktree.displayName}</div>
+                          <div className="truncate text-xs text-muted-foreground">
+                            {displayPath}
+                          </div>
+                        </div>
+                        <Button
+                          type="button"
+                          variant="outline"
+                          size="sm"
+                          disabled={
+                            effectiveBusyPath !== null ||
+                            effectivelyToggling ||
+                            listState === 'checking'
+                          }
+                          onClick={() => void handleShowWorktree(worktree.path)}
+                        >
+                          {effectiveBusyPath === worktree.path
+                            ? translate(
+                                'auto.components.sidebar.WorktreeVisibilityDialog.2f80cd4b97',
+                                'Showing…'
+                              )
+                            : translate(
+                                'auto.components.sidebar.WorktreeVisibilityDialog.e64b81d3a9',
+                                'Show'
+                              )}
+                        </Button>
+                      </div>
+                    </li>
+                  )
+                })}
+              </ul>
+            </div>
+          </div>
+        ) : null}
+
+        {actionState?.error ? (
+          <p className="text-xs text-destructive" role="alert">
+            {actionState.error}
+          </p>
+        ) : null}
       </DialogContent>
     </Dialog>
   )
diff --git a/src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.test.tsx b/src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.test.tsx
new file mode 100644
index 00000000000..3822753ad2c
--- /dev/null
+++ b/src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.test.tsx
@@ -0,0 +1,123 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string) => fallback
+}))
+
+let container: HTMLDivElement
+let root: Root
+
+beforeEach(() => {
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(() => {
+  act(() => root.unmount())
+  container.remove()
+  document.body.innerHTML = ''
+})
+
+async function renderPopover(): Promise<HTMLButtonElement> {
+  const { default: WorktreeVisibilityHelpPopover } = await import('./WorktreeVisibilityHelpPopover')
+  await act(async () => root.render(<WorktreeVisibilityHelpPopover />))
+  const trigger = document.querySelector<HTMLButtonElement>(
+    'button[aria-label="Which worktrees are hidden by default?"]'
+  )
+  if (!trigger) {
+    throw new Error('Missing worktree visibility help trigger')
+  }
+  return trigger
+}
+
+function content(): HTMLElement | null {
+  return document.querySelector('[data-slot="popover-content"]')
+}
+
+async function dispatch(target: EventTarget, event: Event): Promise<void> {
+  await act(async () => target.dispatchEvent(event))
+}
+
+describe('WorktreeVisibilityHelpPopover', () => {
+  it('stays closed when the trigger receives initial dialog focus', async () => {
+    const trigger = await renderPopover()
+
+    await act(async () => trigger.focus())
+
+    expect(trigger.getAttribute('aria-expanded')).toBe('false')
+    expect(content()).toBeNull()
+  })
+
+  it('opens on pointer hover and closes when the pointer leaves', async () => {
+    const trigger = await renderPopover()
+    const hoverTarget = trigger.parentElement
+    expect(hoverTarget).not.toBeNull()
+
+    await dispatch(
+      hoverTarget!,
+      new PointerEvent('pointerover', { bubbles: true, pointerType: 'mouse' })
+    )
+
+    expect(trigger.getAttribute('aria-expanded')).toBe('true')
+    expect(content()?.getAttribute('aria-label')).toBe('Which worktrees are hidden by default?')
+    expect(content()?.textContent).toContain('current and future non-Orca worktrees')
+    expect(content()?.textContent).toContain('.claude/worktrees/*')
+    expect(content()?.textContent).toContain('.gsd-workspaces/*')
+
+    await dispatch(
+      hoverTarget!,
+      new PointerEvent('pointerout', {
+        bubbles: true,
+        pointerType: 'mouse',
+        relatedTarget: document.body
+      })
+    )
+
+    expect(trigger.getAttribute('aria-expanded')).toBe('false')
+    expect(content()).toBeNull()
+  })
+
+  it('opens without moving focus and dismisses with Escape', async () => {
+    const trigger = await renderPopover()
+    trigger.focus()
+
+    await dispatch(trigger, new MouseEvent('click', { bubbles: true, cancelable: true }))
+
+    expect(trigger.getAttribute('aria-expanded')).toBe('true')
+    expect(document.activeElement).toBe(trigger)
+
+    await dispatch(
+      document,
+      new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true })
+    )
+
+    expect(trigger.getAttribute('aria-expanded')).toBe('false')
+    expect(document.activeElement).toBe(trigger)
+  })
+
+  it('dismisses when the user clicks outside', async () => {
+    const trigger = await renderPopover()
+    await dispatch(trigger, new MouseEvent('click', { bubbles: true, cancelable: true }))
+    expect(trigger.getAttribute('aria-expanded')).toBe('true')
+    await act(async () => new Promise((resolve) => setTimeout(resolve, 0)))
+
+    await act(async () => {
+      document.body.dispatchEvent(
+        new PointerEvent('pointerdown', { bubbles: true, pointerType: 'mouse' })
+      )
+      document.body.dispatchEvent(
+        new PointerEvent('pointerup', { bubbles: true, pointerType: 'mouse' })
+      )
+      document.body.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+
+    expect(trigger.getAttribute('aria-expanded')).toBe('false')
+  })
+})
diff --git a/src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.tsx b/src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.tsx
new file mode 100644
index 00000000000..bcb96c79e84
--- /dev/null
+++ b/src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.tsx
@@ -0,0 +1,68 @@
+import React, { useState } from 'react'
+import { CircleHelp } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import { translate } from '@/i18n/i18n'
+
+export default function WorktreeVisibilityHelpPopover(): React.JSX.Element {
+  const [open, setOpen] = useState(false)
+  const title = translate(
+    'auto.components.sidebar.WorktreeVisibilityHelpPopover.c41f2d7e90',
+    'Which worktrees are hidden by default?'
+  )
+
+  return (
+    <div
+      className="inline-flex"
+      onPointerEnter={() => setOpen(true)}
+      onPointerLeave={() => setOpen(false)}
+    >
+      <Popover open={open} onOpenChange={setOpen}>
+        <PopoverTrigger asChild>
+          <Button
+            type="button"
+            variant="ghost"
+            size="icon-xs"
+            className="size-5 text-muted-foreground hover:bg-transparent hover:text-foreground dark:hover:bg-transparent"
+            aria-label={title}
+            aria-expanded={open}
+            title={title}
+            onClick={() => setOpen(true)}
+          >
+            <CircleHelp className="size-3.5" />
+          </Button>
+        </PopoverTrigger>
+        <PopoverContent
+          aria-label={title}
+          align="start"
+          side="bottom"
+          sideOffset={6}
+          className="w-80 p-3"
+          onOpenAutoFocus={(event) => event.preventDefault()}
+        >
+          <div className="text-sm font-medium">{title}</div>
+          <ul className="mt-2 grid list-disc gap-2 pl-4 text-xs leading-5 text-muted-foreground text-pretty">
+            <li>
+              {translate(
+                'auto.components.sidebar.WorktreeVisibilityHelpPopover.8db4e19a26',
+                'This setting never hides worktrees created through Orca.'
+              )}
+            </li>
+            <li>
+              {translate(
+                'auto.components.sidebar.WorktreeVisibilityHelpPopover.54a7c2f183',
+                'For newly added repositories, worktrees created manually or by another tool are hidden by default to avoid unexpected sidebar clutter.'
+              )}
+            </li>
+            <li>
+              {translate(
+                'auto.components.sidebar.WorktreeVisibilityHelpPopover.b9e0d43675',
+                'Always show includes current and future non-Orca worktrees, including agent worktrees under .claude/worktrees/* and .gsd-workspaces/*. When it is off, use Show below to add one individually.'
+              )}
+            </li>
+          </ul>
+        </PopoverContent>
+      </Popover>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/add-remote-host-ssh-actions.ts b/src/renderer/src/components/sidebar/add-remote-host-ssh-actions.ts
index 7ad8c6f5f86..6b585156749 100644
--- a/src/renderer/src/components/sidebar/add-remote-host-ssh-actions.ts
+++ b/src/renderer/src/components/sidebar/add-remote-host-ssh-actions.ts
@@ -43,7 +43,7 @@ export async function saveNewSshHostFromForm({
 }: {
   form: EditingTarget
   ssh: SshApi
-  recordSshRepoReadoptions: (readoptions: SshRepoReadoption[]) => void
+  recordSshRepoReadoptions: (readoptions: readonly SshRepoReadoption[]) => void
   setSshTargetsMetadata: (targets: SshTarget[]) => void
   recordFeatureInteraction: (feature: 'ssh') => void
 }): Promise<'saved' | 'validation-failed' | 'failed'> {
@@ -170,7 +170,7 @@ export async function addAllSshConfigHostsToOrca({
   recordFeatureInteraction
 }: {
   ssh: SshApi
-  recordSshRepoReadoptions: (readoptions: SshRepoReadoption[]) => void
+  recordSshRepoReadoptions: (readoptions: readonly SshRepoReadoption[]) => void
   setSshTargetsMetadata: (targets: SshTarget[]) => void
   recordFeatureInteraction: (feature: 'ssh') => void
 }): Promise<{ kind: 'added'; count: number } | { kind: 'already-synced' } | { kind: 'failed' }> {
diff --git a/src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts b/src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts
new file mode 100644
index 00000000000..35ce05a2244
--- /dev/null
+++ b/src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from 'vitest'
+import { parseExecutionHostId } from '../../../../shared/execution-host'
+import { routeAddRepoBrowse } from './add-repo-browse-authority'
+
+describe('routeAddRepoBrowse', () => {
+  it('opens paired host browsing without invoking native pickFolders', () => {
+    const pickFolders = vi.fn()
+    const browseRuntime = vi.fn()
+
+    routeAddRepoBrowse(parseExecutionHostId('runtime:paired-host'), {
+      browseLocal: pickFolders,
+      browseRuntime,
+      browseSsh: vi.fn()
+    })
+
+    expect(browseRuntime).toHaveBeenCalledOnce()
+    expect(pickFolders).not.toHaveBeenCalled()
+  })
+
+  it('preserves native folder browsing for desktop local hosts', () => {
+    const pickFolders = vi.fn()
+
+    routeAddRepoBrowse(parseExecutionHostId('local'), {
+      browseLocal: pickFolders,
+      browseRuntime: vi.fn(),
+      browseSsh: vi.fn()
+    })
+
+    expect(pickFolders).toHaveBeenCalledOnce()
+  })
+
+  it('preserves SSH host browsing', () => {
+    const browseSsh = vi.fn()
+
+    routeAddRepoBrowse(parseExecutionHostId('ssh:builder'), {
+      browseLocal: vi.fn(),
+      browseRuntime: vi.fn(),
+      browseSsh
+    })
+
+    expect(browseSsh).toHaveBeenCalledWith('builder')
+  })
+})
diff --git a/src/renderer/src/components/sidebar/add-repo-browse-authority.ts b/src/renderer/src/components/sidebar/add-repo-browse-authority.ts
new file mode 100644
index 00000000000..364e21201e4
--- /dev/null
+++ b/src/renderer/src/components/sidebar/add-repo-browse-authority.ts
@@ -0,0 +1,24 @@
+import type { ParsedExecutionHost } from '../../../../shared/execution-host'
+
+export type AddRepoBrowseAuthorityActions = {
+  browseLocal: () => void
+  browseRuntime: () => void
+  browseSsh: (targetId: string) => void
+}
+
+export function routeAddRepoBrowse(
+  host: ParsedExecutionHost | null,
+  actions: AddRepoBrowseAuthorityActions
+): void {
+  if (host?.kind === 'runtime') {
+    actions.browseRuntime()
+    return
+  }
+  if (host?.kind === 'ssh') {
+    actions.browseSsh(host.targetId)
+    return
+  }
+  if (host?.kind === 'local') {
+    actions.browseLocal()
+  }
+}
diff --git a/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts b/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
index 4161f3bb6f9..7c9c69357ce 100644
--- a/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
+++ b/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
@@ -3,7 +3,7 @@ import { isDefaultBranchWorkspace } from './visible-worktrees'
 
 export type AddRepoSkipFinalizationState = {
   activeRepoId: string | null
-  filterRepoIds: string[]
+  filterRepoIds: readonly string[]
   showActiveOnly: boolean
   hideDefaultBranchWorkspace: boolean
   showSleepingWorkspaces: boolean
diff --git a/src/renderer/src/components/sidebar/smart-attention.test.ts b/src/renderer/src/components/sidebar/smart-attention.test.ts
index 2c4324938cd..8723cf937fc 100644
--- a/src/renderer/src/components/sidebar/smart-attention.test.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.test.ts
@@ -195,6 +195,70 @@ describe('resolveAttention', () => {
     })
   })
 
+  it('drops a done pane out of Class 2 once the completion itself ages out', () => {
+    const justInside = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      stateStartedAt: NOW - AGENT_STATUS_STALE_AFTER_MS,
+      updatedAt: NOW - 1_000
+    })
+    expect(resolveAttention([hookPane(justInside)], NOW)).toEqual({
+      cls: 2,
+      attentionTimestamp: NOW - AGENT_STATUS_STALE_AFTER_MS
+    })
+
+    const justOutside = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      stateStartedAt: NOW - AGENT_STATUS_STALE_AFTER_MS - 1,
+      updatedAt: NOW - 1_000
+    })
+    expect(resolveAttention([hookPane(justOutside)], NOW)).toEqual(IDLE)
+  })
+
+  it('does not let same-state done writes extend Class 2 eligibility', () => {
+    // The captured regression: updatedAt was 3m04s newer than the completion, keeping a 32m-old
+    // "done" row above two spinners.
+    const entry = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      stateStartedAt: NOW - 32 * 60_000,
+      updatedAt: NOW - 29 * 60_000
+    })
+    expect(resolveAttention([hookPane(entry)], NOW)).toEqual(IDLE)
+  })
+
+  it('keeps an expired done pane from masking a live working sibling', () => {
+    const expiredDone = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      stateStartedAt: NOW - AGENT_STATUS_STALE_AFTER_MS - 60_000,
+      updatedAt: NOW - 1_000
+    })
+    const working = makeEntry({
+      paneKey: 't:2',
+      state: 'working',
+      stateStartedAt: NOW - 10_000,
+      updatedAt: NOW - 1_000
+    })
+    expect(resolveAttention(hookPanes([expiredDone, working]), NOW)).toEqual({
+      cls: 3,
+      attentionTimestamp: NOW - 10_000
+    })
+  })
+
+  it('ages out a session-boundary completion from its real completion time', () => {
+    const boundary = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      sessionBoundary: true,
+      stateStartedAt: NOW - 1_000,
+      updatedAt: NOW - 500,
+      stateHistory: [makeHistory('done', NOW - AGENT_STATUS_STALE_AFTER_MS - 1)]
+    })
+    expect(resolveAttention([hookPane(boundary)], NOW)).toEqual(IDLE)
+  })
+
   it('classifies a working pane with prior done as Class 3 with the prior timestamp', () => {
     const entry = makeEntry({
       paneKey: 't:1',
diff --git a/src/renderer/src/components/sidebar/smart-attention.ts b/src/renderer/src/components/sidebar/smart-attention.ts
index d1a182cb224..5238a9091eb 100644
--- a/src/renderer/src/components/sidebar/smart-attention.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.ts
@@ -1,4 +1,5 @@
 import { classifyTitleActivity, isExplicitAgentStatusFresh } from '@/lib/pane-agent-evidence'
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import { migrationUnsupportedToAgentStatusEntry } from '@/lib/migration-unsupported-agent-entry'
 import { tabHasLivePty } from '@/lib/tab-has-live-pty'
 import { resolveRuntimePaneTitleLeafId } from '@/lib/runtime-pane-title-leaf-id'
@@ -15,9 +16,9 @@ import { parsePaneKey } from '../../../../shared/stable-pane-id'
 /**
  * Ordinal class for the "Smart" sort. Lower number = more attention-demanding.
  *   1 — Needs you (`blocked` / `waiting`)
- *   2 — Done (`done`, not interrupted)
+ *   2 — Done (`done`, not interrupted, completed within AGENT_STATUS_STALE_AFTER_MS)
  *   3 — Working (`working`)
- *   4 — Idle (no live entry, stale entry, or interrupted `done`)
+ *   4 — Idle (no live entry, stale entry, interrupted `done`, or an aged-out completion)
  *
  * Primary sort key; ties fall back to the attention timestamp. See docs/smart-worktree-order-redesign.md.
  */
@@ -34,7 +35,7 @@ export type AttentionCause = 'blocked' | 'waiting' | 'title-heuristic'
  * Per-worktree resolution computed once before sorting.
  *
  * `attentionTimestamp` by class:
- *   - Class 1 / 2: `stateStartedAt` of the current entry.
+ *   - Class 1: `stateStartedAt` of the current entry. Class 2: the entry's completion time.
  *   - Class 3: `stateStartedAt` of the most recent prior `done`/`blocked`/`waiting` entry,
  *     falling back to the current `working` `stateStartedAt`.
  *   - Class 4: `0` — comparator drops to `effectiveRecentActivity` for idle ordering.
@@ -98,21 +99,6 @@ export function mostRecentAttentionInHistory(history: AgentStateHistoryEntry[]):
   return max > 0 ? max : null
 }
 
-function mostRecentCompletedTurnInHistory(history: AgentStateHistoryEntry[]): number | null {
-  let max = 0
-  for (const entry of history) {
-    if (
-      entry.state === 'done' &&
-      entry.interrupted !== true &&
-      Number.isFinite(entry.startedAt) &&
-      entry.startedAt > max
-    ) {
-      max = entry.startedAt
-    }
-  }
-  return max > 0 ? max : null
-}
-
 /**
  * One pane's contribution to a worktree's attention class. Fresh hook entries win; hookless
  * panes fall back to the title heuristic (design doc Edge case 9). Authority is per-pane, not per-worktree.
@@ -152,21 +138,19 @@ export function resolveAttention(panes: PaneInput[], now: number): WorktreeAtten
         ts = entry.stateStartedAt
         cause = entry.state
       } else if (entry.state === 'done') {
-        // Why: interrupted `done` (Ctrl+C) means the user is done with the turn; treat as idle, not Class 2.
-        if (entry.interrupted) {
+        // Why: null covers interrupted `done` (Ctrl+C — user is finished with it) and idle session
+        // boundaries; neither is attention.
+        const completedAt = agentEntryCompletionAt(entry)
+        if (completedAt === null) {
+          continue
+        }
+        // Why: same-state `done` writes advance updatedAt without moving the completion, so the hook
+        // freshness gate alone can keep a row in Class 2 long after the UI shows it aged out.
+        if (now - completedAt > AGENT_STATUS_STALE_AFTER_MS) {
           continue
         }
         cls = 2
-        if (entry.sessionBoundary) {
-          // Why: idle connect is not new attention; only preserve a real completion it displaced.
-          const completedAt = mostRecentCompletedTurnInHistory(entry.stateHistory)
-          if (completedAt === null) {
-            continue
-          }
-          ts = completedAt
-        } else {
-          ts = entry.stateStartedAt
-        }
+        ts = completedAt
       } else {
         // working
         cls = 3
diff --git a/src/renderer/src/components/sidebar/smart-sort.test.ts b/src/renderer/src/components/sidebar/smart-sort.test.ts
index 47c437f5199..75af8fae1cc 100644
--- a/src/renderer/src/components/sidebar/smart-sort.test.ts
+++ b/src/renderer/src/components/sidebar/smart-sort.test.ts
@@ -109,7 +109,8 @@ function ptyMapForTabs(tabsByWorktree: Record<string, TerminalTab[]>): Record<st
  * Sort helper: builds the attention map and runs the smart comparator. Mirrors
  * what callers do in production (visible-worktrees, WorktreeList).
  */
-function sortSmart(
+function sortSmartAt(
+  now: number,
   worktrees: Worktree[],
   tabsByWorktree: Record<string, TerminalTab[]>,
   agentStatusByPaneKey: Record<string, AgentStatusEntry>
@@ -120,9 +121,17 @@ function sortSmart(
     agentStatusByPaneKey,
     {},
     ptyMapForTabs(tabsByWorktree),
-    NOW
+    now
   )
-  return [...worktrees].sort(buildWorktreeComparator('smart', repoMap, NOW, attention))
+  return [...worktrees].sort(buildWorktreeComparator('smart', repoMap, now, attention))
+}
+
+function sortSmart(
+  worktrees: Worktree[],
+  tabsByWorktree: Record<string, TerminalTab[]>,
+  agentStatusByPaneKey: Record<string, AgentStatusEntry>
+): Worktree[] {
+  return sortSmartAt(NOW, worktrees, tabsByWorktree, agentStatusByPaneKey)
 }
 
 describe('smart sort — class invariants', () => {
@@ -354,6 +363,62 @@ describe('smart sort — interrupted and stale handling', () => {
   })
 })
 
+describe('smart sort — completed-agent eligibility clock', () => {
+  // Captured regression (docs/smart-sort-agent-activity-findings.md): a `done` row whose
+  // updatedAt was 3m04s newer than its completion outranked two live spinners.
+  const SCREENSHOT_AT = new Date('2026-03-27T21:44:39.000Z').getTime()
+  const at = (hhmmss: string): number => new Date(`2026-03-27T${hhmmss}.000Z`).getTime()
+
+  function capturedFixture(workingUpdatedAt = at('21:44:30')) {
+    const done = makeWorktree({ id: 'fix-linear-persistent', displayName: 'fix-linear-persistent' })
+    const workingA = makeWorktree({ id: 'allow-editing', displayName: 'allow-editing' })
+    const workingB = makeWorktree({ id: 'resume-terminal', displayName: 'resume-terminal' })
+    const tabs = {
+      [done.id]: [makeTab({ id: 'tab-done', worktreeId: done.id })],
+      [workingA.id]: [makeTab({ id: 'tab-a', worktreeId: workingA.id })],
+      [workingB.id]: [makeTab({ id: 'tab-b', worktreeId: workingB.id })]
+    }
+    const entries = {
+      [paneKey('tab-done', '1')]: makeEntry({
+        paneKey: paneKey('tab-done', '1'),
+        state: 'done',
+        stateStartedAt: at('21:12:09'),
+        // Same-state `done` writes pushed updatedAt 3m04s past the completion.
+        updatedAt: at('21:15:13')
+      }),
+      [paneKey('tab-a', '1')]: makeEntry({
+        paneKey: paneKey('tab-a', '1'),
+        state: 'working',
+        stateStartedAt: workingUpdatedAt - 68_000,
+        updatedAt: workingUpdatedAt
+      }),
+      [paneKey('tab-b', '1')]: makeEntry({
+        paneKey: paneKey('tab-b', '1'),
+        state: 'working',
+        stateStartedAt: workingUpdatedAt - 145_000,
+        updatedAt: workingUpdatedAt - 5_000
+      })
+    }
+    return { worktrees: [done, workingA, workingB], tabs, entries }
+  }
+
+  it('ranks the two spinners above the 32-minute-old completion', () => {
+    const { worktrees, tabs, entries } = capturedFixture()
+    const sorted = sortSmartAt(SCREENSHOT_AT, worktrees, tabs, entries)
+    expect(sorted.map((w) => w.id)).toEqual([
+      'allow-editing',
+      'resume-terminal',
+      'fix-linear-persistent'
+    ])
+  })
+
+  it('still ranks that completion above the spinners inside its own window', () => {
+    const { worktrees, tabs, entries } = capturedFixture(at('21:39:50'))
+    const sorted = sortSmartAt(at('21:40:00'), worktrees, tabs, entries)
+    expect(sorted[0].id).toBe('fix-linear-persistent')
+  })
+})
+
 describe('smart sort — Class 4 ordering', () => {
   it('breaks ties on effectiveRecentActivity, then displayName', () => {
     const recentlyActive = makeWorktree({
diff --git a/src/renderer/src/components/sidebar/use-add-repo-host-change-reset.ts b/src/renderer/src/components/sidebar/use-add-repo-host-change-reset.ts
index effec4b5192..52a77a3b581 100644
--- a/src/renderer/src/components/sidebar/use-add-repo-host-change-reset.ts
+++ b/src/renderer/src/components/sidebar/use-add-repo-host-change-reset.ts
@@ -7,7 +7,7 @@ export function useAddRepoHostChangeReset({
   onResetHostScopedState
 }: {
   isOpen: boolean
-  selectedHostId: string
+  selectedHostId: string | null
   onResetClosed: () => void
   onResetHostScopedState: () => void
 }) {
diff --git a/src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts b/src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts
index b9a77b2e9bd..90ee6d9df50 100644
--- a/src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts
+++ b/src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts
@@ -17,7 +17,8 @@ const mocks = vi.hoisted(() => ({
     runtimeEnvironments: [] as { id: string; name: string; source?: 'manual' | 'ephemeral-vm' }[]
   },
   sshConnect: vi.fn(),
-  sshGetState: vi.fn()
+  sshGetState: vi.fn(),
+  isWebClient: false
 }))
 
 vi.mock('react', async (importOriginal) => {
@@ -64,6 +65,10 @@ vi.mock('./use-sidebar-host-scope-options', () => ({
   useSidebarHostScopeOptions: () => ({ hostOptions: mocks.hostOptions })
 }))
 
+vi.mock('@/lib/web-client-location', () => ({
+  isWebClientLocation: () => mocks.isWebClient
+}))
+
 describe('useAddRepoHostSelection', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -103,6 +108,7 @@ describe('useAddRepoHostSelection', () => {
     mocks.storeState.runtimeEnvironments = []
     mocks.sshConnect.mockReset()
     mocks.sshGetState.mockReset()
+    mocks.isWebClient = false
     vi.stubGlobal('window', {
       api: {
         ssh: {
@@ -137,6 +143,56 @@ describe('useAddRepoHostSelection', () => {
     expect(setStep).toHaveBeenCalledWith('add')
   })
 
+  it('uses the paired runtime as the only local filesystem authority in web clients', async () => {
+    mocks.isWebClient = true
+    mocks.stateValues = ['local', false]
+    const { useAddRepoHostSelection } = await import('./use-add-repo-host-selection')
+
+    const result = useAddRepoHostSelection({ isOpen: true, setStep: vi.fn() })
+
+    expect(result.hostOptions.map((host) => host.id)).toEqual(['ssh:ssh-1', 'runtime:env-1'])
+    expect(result.selectedHostId).toBe('runtime:env-1')
+    expect(result.selectedParsedHost).toMatchObject({
+      kind: 'runtime',
+      environmentId: 'env-1'
+    })
+  })
+
+  it('has no local fallback while a paired web runtime is loading', async () => {
+    mocks.isWebClient = true
+    mocks.stateValues = ['local', false]
+    mocks.hostOptions = [mocks.hostOptions[0]]
+    const { useAddRepoHostSelection } = await import('./use-add-repo-host-selection')
+
+    const result = useAddRepoHostSelection({ isOpen: true, setStep: vi.fn() })
+
+    expect(result.hostOptions).toEqual([])
+    expect(result.selectedHostId).toBeNull()
+    expect(result.selectedParsedHost).toBeNull()
+    expect(mocks.stateSetters[0]).not.toHaveBeenCalledWith('local')
+  })
+
+  it.each(['error', 'blocked'] as const)(
+    'has no paired-web fallback when the only host is %s',
+    async (health) => {
+      mocks.isWebClient = true
+      mocks.stateValues = ['runtime:env-1', false]
+      mocks.hostOptions = [
+        {
+          ...mocks.hostOptions[2],
+          health
+        }
+      ]
+      const { useAddRepoHostSelection } = await import('./use-add-repo-host-selection')
+
+      const result = useAddRepoHostSelection({ isOpen: true, setStep: vi.fn() })
+
+      expect(result.hostOptions).toHaveLength(1)
+      expect(result.selectedHostId).toBeNull()
+      expect(result.selectedParsedHost).toBeNull()
+    }
+  )
+
   it('selects a local or SSH host without changing the durable active server', async () => {
     mocks.stateValues = ['runtime:env-1', false]
     mocks.storeState.settings = { activeRuntimeEnvironmentId: 'env-1' }
diff --git a/src/renderer/src/components/sidebar/use-add-repo-host-selection.ts b/src/renderer/src/components/sidebar/use-add-repo-host-selection.ts
index 684fa75d78b..8f729a5ef66 100644
--- a/src/renderer/src/components/sidebar/use-add-repo-host-selection.ts
+++ b/src/renderer/src/components/sidebar/use-add-repo-host-selection.ts
@@ -13,6 +13,7 @@ import type { AddRepoDialogStep } from './add-repo-dialog-types'
 import { useSidebarHostScopeOptions } from './use-sidebar-host-scope-options'
 import { canSelectAddRepoHost } from './add-repo-host-availability'
 import { translate } from '@/i18n/i18n'
+import { isWebClientLocation } from '@/lib/web-client-location'
 
 export function useAddRepoHostSelection({
   isOpen,
@@ -22,7 +23,7 @@ export function useAddRepoHostSelection({
   setStep: (step: AddRepoDialogStep) => void
 }): {
   hostOptions: ReturnType<typeof useSidebarHostScopeOptions>['hostOptions']
-  selectedHostId: ExecutionHostId
+  selectedHostId: ExecutionHostId | null
   selectedParsedHost: ReturnType<typeof parseExecutionHostId>
   selectedSshTargetId: string | null
   hostSelectorOpen: boolean
@@ -35,6 +36,7 @@ export function useAddRepoHostSelection({
   const sshConnectionStates = useAppStore((s) => s.sshConnectionStates)
   const runtimeEnvironments = useAppStore((s) => s.runtimeEnvironments)
   const { hostOptions } = useSidebarHostScopeOptions()
+  const isWebClient = isWebClientLocation()
   const ephemeralRuntimeEnvironmentIds = useMemo(
     () =>
       new Set(
@@ -49,26 +51,30 @@ export function useAddRepoHostSelection({
       hostOptions.filter((host) => {
         const parsed = parseExecutionHostId(host.id)
         return (
-          parsed?.kind !== 'runtime' || !ephemeralRuntimeEnvironmentIds.has(parsed.environmentId)
+          !(isWebClient && parsed?.kind === 'local') &&
+          (parsed?.kind !== 'runtime' || !ephemeralRuntimeEnvironmentIds.has(parsed.environmentId))
         )
       }),
-    [ephemeralRuntimeEnvironmentIds, hostOptions]
+    [ephemeralRuntimeEnvironmentIds, hostOptions, isWebClient]
   )
   const [selectedAddProjectHostId, setSelectedAddProjectHostId] =
     useState<ExecutionHostId>(LOCAL_EXECUTION_HOST_ID)
   const [hostSelectorOpen, setHostSelectorOpen] = useState(false)
   const previousOpenRef = useRef(false)
+  const pairedWebRuntimeHost = isWebClient
+    ? selectableHostOptions.find((host) => host.kind === 'runtime' && canSelectAddRepoHost(host))
+    : undefined
 
   const selectedHost =
     selectableHostOptions.find(
       (host) => host.id === selectedAddProjectHostId && canSelectAddRepoHost(host)
     ) ??
+    pairedWebRuntimeHost ??
     selectableHostOptions.find(
       (host) => host.id === LOCAL_EXECUTION_HOST_ID && canSelectAddRepoHost(host)
     ) ??
-    selectableHostOptions.find((host) => canSelectAddRepoHost(host)) ??
-    selectableHostOptions[0]
-  const selectedHostId = selectedHost?.id ?? LOCAL_EXECUTION_HOST_ID
+    selectableHostOptions.find((host) => canSelectAddRepoHost(host))
+  const selectedHostId = selectedHost?.id ?? (isWebClient ? null : LOCAL_EXECUTION_HOST_ID)
   const selectedParsedHost = parseExecutionHostId(selectedHostId)
   const selectedSshTargetId =
     selectedParsedHost?.kind === 'ssh' ? selectedParsedHost.targetId : null
@@ -80,14 +86,16 @@ export function useAddRepoHostSelection({
         (host) => host.id === focusedHostId && canSelectAddRepoHost(host)
       )
         ? focusedHostId
-        : LOCAL_EXECUTION_HOST_ID
-      setSelectedAddProjectHostId(nextHostId)
+        : (pairedWebRuntimeHost?.id ?? (isWebClient ? null : LOCAL_EXECUTION_HOST_ID))
+      if (nextHostId) {
+        setSelectedAddProjectHostId(nextHostId)
+      }
     }
     if (!isOpen) {
       setHostSelectorOpen(false)
     }
     previousOpenRef.current = isOpen
-  }, [isOpen, selectableHostOptions, settings])
+  }, [isOpen, isWebClient, pairedWebRuntimeHost?.id, selectableHostOptions, settings])
 
   const handleSelectAddProjectHost = useCallback(
     async (hostId: ExecutionHostId): Promise<void> => {
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-controller.ts b/src/renderer/src/components/sidebar/use-worktree-card-controller.ts
index e4668bb0a4c..6a116991023 100644
--- a/src/renderer/src/components/sidebar/use-worktree-card-controller.ts
+++ b/src/renderer/src/components/sidebar/use-worktree-card-controller.ts
@@ -135,7 +135,8 @@ export function useWorktreeCardController(props: ResolvedWorktreeCardProps) {
     agentActivityDisplayMode: foundation.agentActivityDisplayMode,
     workspacePorts: foundation.workspacePorts,
     openTaskPage: foundation.openTaskPage,
-    updateWorktreeMeta: foundation.updateWorktreeMeta
+    updateWorktreeMeta: foundation.updateWorktreeMeta,
+    settings: foundation.settings
   })
 
   return {
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx b/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx
new file mode 100644
index 00000000000..693dba8f412
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx
@@ -0,0 +1,168 @@
+// @vitest-environment happy-dom
+
+import { act, type ReactNode } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it } from 'vitest'
+import { useAppStore } from '@/store'
+import { readStoreListenerCount } from '@/store/store-listener-census'
+import type { GlobalSettings, Worktree } from '../../../../shared/types'
+import { usePromptCacheCountdownStartedAt } from './CacheTimer'
+import { useWorktreeCardSecondaryDetails } from './use-worktree-card-secondary-details'
+import { useWorktreeAgentRows } from './useWorktreeAgentRows'
+
+const WORKTREE_ID = 'repo-1::/repo/worktrees/card'
+const originalState = useAppStore.getState()
+
+let root: Root | null = null
+let container: HTMLDivElement | null = null
+
+function mount(node: ReactNode): void {
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  act(() => root?.render(node))
+}
+
+function unmount(): void {
+  if (root) {
+    act(() => root?.unmount())
+  }
+  root = null
+  container?.remove()
+  container = null
+}
+
+function listenerCount(): number {
+  const count = readStoreListenerCount()
+  if (count === null) {
+    throw new Error('store listener census unavailable')
+  }
+  return count
+}
+
+function makeWorktree(): Worktree {
+  return {
+    id: WORKTREE_ID,
+    repoId: 'repo-1',
+    path: '/repo/worktrees/card',
+    displayName: 'Card',
+    branch: 'feature/card',
+    head: 'abc123',
+    isBare: false,
+    isMainWorktree: false,
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 1
+  }
+}
+
+function makeSettings(promptCacheTtlMs: number): GlobalSettings {
+  return { promptCacheTimerEnabled: true, promptCacheTtlMs } as GlobalSettings
+}
+
+function secondaryDetailsArgs(settings: GlobalSettings) {
+  return {
+    worktree: makeWorktree(),
+    repo: undefined,
+    statusPrDisplay: null,
+    showStatus: false,
+    showIssue: false,
+    showLinearIssue: false,
+    showJiraIssue: false,
+    showPR: false,
+    showAutomation: false,
+    showCli: false,
+    showComment: false,
+    showPorts: false,
+    issueDisplay: null,
+    linearIssue: null,
+    linearIssueDisplay: null,
+    jiraIssueDisplay: null,
+    prDisplay: null,
+    linkedGitLabMR: null,
+    linkedBitbucketPR: null,
+    linkedAzureDevOpsPR: null,
+    linkedGiteaPR: null,
+    cardProps: [] as never,
+    newCardStyle: false,
+    compactCards: false,
+    agentActivityDisplayMode: 'compact' as const,
+    workspacePorts: [],
+    openTaskPage: (() => {}) as never,
+    updateWorktreeMeta: (() => {}) as never,
+    settings
+  }
+}
+
+afterEach(() => {
+  unmount()
+  useAppStore.setState(originalState, true)
+})
+
+describe('useWorktreeCardSecondaryDetails store subscriptions', () => {
+  it('adds no store listener of its own beyond the hooks it composes', () => {
+    const settings = makeSettings(300_000)
+
+    // Baseline: the two hooks it composes, mounted on their own.
+    const composedBaseline = listenerCount()
+    function ComposedProbe(): null {
+      useWorktreeAgentRows(WORKTREE_ID, false)
+      usePromptCacheCountdownStartedAt(WORKTREE_ID, true)
+      return null
+    }
+    mount(<ComposedProbe />)
+    const composedListeners = listenerCount() - composedBaseline
+    unmount()
+
+    const baseline = listenerCount()
+    function Probe(): null {
+      useWorktreeCardSecondaryDetails(secondaryDetailsArgs(settings))
+      return null
+    }
+    mount(<Probe />)
+
+    // Why: promptCacheTtlMs comes from the settings the card already subscribes to,
+    // so this hook must not open a third subscription for the same field.
+    expect(listenerCount() - baseline).toBe(composedListeners)
+
+    unmount()
+    expect(listenerCount()).toBe(baseline)
+  })
+
+  it('reads the cache TTL from the passed settings', () => {
+    let cacheTtlMs = -1
+    function Probe({ ttl }: { ttl: number }): null {
+      cacheTtlMs = useWorktreeCardSecondaryDetails(
+        secondaryDetailsArgs(makeSettings(ttl))
+      ).cacheTtlMs
+      return null
+    }
+
+    mount(<Probe ttl={300_000} />)
+    expect(cacheTtlMs).toBe(300_000)
+
+    act(() => root?.render(<Probe ttl={120_000} />))
+    expect(cacheTtlMs).toBe(120_000)
+  })
+
+  it('reports no TTL while the aggregate cache timer is suppressed', () => {
+    let cacheTtlMs = -1
+    function Probe(): null {
+      // compactCards suppresses the aggregate timer row.
+      cacheTtlMs = useWorktreeCardSecondaryDetails({
+        ...secondaryDetailsArgs(makeSettings(300_000)),
+        compactCards: true
+      }).cacheTtlMs
+      return null
+    }
+
+    mount(<Probe />)
+    expect(cacheTtlMs).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.ts b/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.ts
index b5a8a6292ba..ebc7cf483c8 100644
--- a/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.ts
+++ b/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.ts
@@ -1,7 +1,6 @@
 import React, { useCallback } from 'react'
 
 import type { GitHubWorkItem } from '../../../../shared/types'
-import { useAppStore } from '@/store'
 import { hasWorktreeCardDetails } from './WorktreeCardMeta'
 import { usePromptCacheCountdownStartedAt } from './CacheTimer'
 import { useWorktreeAgentRows } from './useWorktreeAgentRows'
@@ -42,7 +41,8 @@ export function useWorktreeCardSecondaryDetails({
   agentActivityDisplayMode,
   workspacePorts,
   openTaskPage,
-  updateWorktreeMeta
+  updateWorktreeMeta,
+  settings
 }: Pick<WorktreeCardProps, 'worktree' | 'repo' | 'statusPrDisplay'> &
   Pick<
     Foundation,
@@ -53,6 +53,7 @@ export function useWorktreeCardSecondaryDetails({
     | 'workspacePorts'
     | 'openTaskPage'
     | 'updateWorktreeMeta'
+    | 'settings'
   > &
   Pick<LinkedDetails, 'issueDisplay' | 'linearIssue' | 'linearIssueDisplay' | 'jiraIssueDisplay'> &
   Pick<
@@ -190,9 +191,9 @@ export function useWorktreeCardSecondaryDetails({
   })
   const hasPorts = showPorts && workspacePorts.length > 0
   const cacheStartedAt = usePromptCacheCountdownStartedAt(worktree.id, showAggregateCacheTimer)
-  const cacheTtlMs = useAppStore((s) =>
-    showAggregateCacheTimer ? (s.settings?.promptCacheTtlMs ?? 0) : 0
-  )
+  // Why: derived from the settings the card already subscribes to — a third store
+  // subscription for this one field costs a listener per card on every store write.
+  const cacheTtlMs = showAggregateCacheTimer ? (settings?.promptCacheTtlMs ?? 0) : 0
 
   return {
     showUnreadEmphasis,
diff --git a/src/renderer/src/components/sidebar/visible-worktrees.ts b/src/renderer/src/components/sidebar/visible-worktrees.ts
index f85083db406..206d81dbe38 100644
--- a/src/renderer/src/components/sidebar/visible-worktrees.ts
+++ b/src/renderer/src/components/sidebar/visible-worktrees.ts
@@ -186,7 +186,7 @@ export function computeVisibleWorktreeIds(
   worktreesByRepo: Record<string, Worktree[]>,
   sortedIds: string[],
   opts: {
-    filterRepoIds: string[]
+    filterRepoIds: readonly string[]
     showSleepingWorkspaces: boolean
     tabsByWorktree: Record<string, Pick<TerminalTab, 'id'>[]> | null
     ptyIdsByTabId: Record<string, string[]> | null
diff --git a/src/renderer/src/components/sidebar/worktree-drag-preview-offsets.ts b/src/renderer/src/components/sidebar/worktree-drag-preview-offsets.ts
index cf97cad8958..86bf48a9b0a 100644
--- a/src/renderer/src/components/sidebar/worktree-drag-preview-offsets.ts
+++ b/src/renderer/src/components/sidebar/worktree-drag-preview-offsets.ts
@@ -11,28 +11,37 @@ function arraysEqual(a: readonly string[], b: readonly string[]): boolean {
   return a.length === b.length && a.every((value, index) => value === b[index])
 }
 
-function getFallbackStride(rects: readonly WorktreeDragPreviewRect[]): number {
+function getFallbackStride(rects: readonly WorktreeDragPreviewRect[], defaultGap: number): number {
   const sortedRects = [...rects].sort((a, b) => a.groupIndex - b.groupIndex)
   const strides: number[] = []
   for (let index = 1; index < sortedRects.length; index++) {
-    strides.push(sortedRects[index]!.top - sortedRects[index - 1]!.top)
+    const previous = sortedRects[index - 1]!
+    const current = sortedRects[index]!
+    const indexDelta = current.groupIndex - previous.groupIndex
+    if (indexDelta > 0) {
+      strides.push((current.top - previous.top) / indexDelta)
+    }
   }
   if (strides.length > 0) {
     strides.sort((a, b) => a - b)
     return strides[Math.floor(strides.length / 2)]!
   }
   const firstRect = sortedRects[0]
-  return firstRect ? firstRect.bottom - firstRect.top : 0
+  return firstRect ? firstRect.bottom - firstRect.top + defaultGap : 0
 }
 
-function getFallbackGap(rects: readonly WorktreeDragPreviewRect[]): number {
+function getFallbackGap(rects: readonly WorktreeDragPreviewRect[], defaultGap: number): number {
   const sortedRects = [...rects].sort((a, b) => a.groupIndex - b.groupIndex)
   const gaps: number[] = []
   for (let index = 1; index < sortedRects.length; index++) {
-    gaps.push(Math.max(0, sortedRects[index]!.top - sortedRects[index - 1]!.bottom))
+    const previous = sortedRects[index - 1]!
+    const current = sortedRects[index]!
+    if (current.groupIndex === previous.groupIndex + 1) {
+      gaps.push(Math.max(0, current.top - previous.bottom))
+    }
   }
   if (gaps.length === 0) {
-    return 0
+    return defaultGap
   }
   gaps.sort((a, b) => a - b)
   return gaps[Math.floor(gaps.length / 2)]!
@@ -70,6 +79,8 @@ export function buildWorktreeDragPreviewOffsets(args: {
   groupIds: readonly string[]
   draggedIds: readonly string[]
   draggingWorktreeId?: string | null
+  draggedPreviewHeight?: number | null
+  fallbackGap?: number
   dropIndex: number
   rects: readonly WorktreeDragPreviewRect[]
 }): WorktreeDragPreviewLayout {
@@ -106,13 +117,18 @@ export function buildWorktreeDragPreviewOffsets(args: {
     }
   }
 
-  const fallbackStride = getFallbackStride(args.rects)
-  const fallbackGap = getFallbackGap(args.rects)
+  const defaultGap =
+    typeof args.fallbackGap === 'number' &&
+    Number.isFinite(args.fallbackGap) &&
+    args.fallbackGap >= 0
+      ? args.fallbackGap
+      : 0
+  const fallbackStride = getFallbackStride(args.rects, defaultGap)
+  const fallbackGap = getFallbackGap(args.rects, defaultGap)
   const groupRects = args.groupIds.flatMap((id) => {
     const rect = rectById.get(id)
     return rect ? [rect] : []
   })
-  const baseTop = groupRects[0]?.top ?? 0
   const fallbackHeight = Math.max(0, fallbackStride - fallbackGap)
   const gapAfterById = new Map<string, number>()
   for (let index = 0; index < groupRects.length; index++) {
@@ -120,19 +136,51 @@ export function buildWorktreeDragPreviewOffsets(args: {
     const nextRect = groupRects[index + 1]
     gapAfterById.set(
       rect.worktreeId,
-      nextRect ? Math.max(0, nextRect.top - rect.bottom) : fallbackGap
+      nextRect?.groupIndex === rect.groupIndex + 1
+        ? Math.max(0, nextRect.top - rect.bottom)
+        : fallbackGap
     )
   }
 
+  const previewDraggedId = layoutDraggedIds[0] ?? null
+  const draggedPreviewHeight =
+    previewDraggedId === args.draggingWorktreeId &&
+    typeof args.draggedPreviewHeight === 'number' &&
+    Number.isFinite(args.draggedPreviewHeight) &&
+    args.draggedPreviewHeight > 0
+      ? args.draggedPreviewHeight
+      : null
+  const getHeight = (id: string): number => {
+    const rect = rectById.get(id)
+    if (rect) {
+      return rect.bottom - rect.top
+    }
+    return id === previewDraggedId && draggedPreviewHeight !== null
+      ? draggedPreviewHeight
+      : fallbackHeight
+  }
+  const getStride = (id: string): number => getHeight(id) + (gapAfterById.get(id) ?? fallbackGap)
+
+  const firstGroupRect = groupRects[0]
+  let baseTop = firstGroupRect?.top ?? 0
+  if (firstGroupRect) {
+    // Why: virtualized leading rows are absent from rects, so derive the full
+    // list origin from the first mounted row before replaying its order.
+    for (let index = 0; index < firstGroupRect.groupIndex; index++) {
+      const id = args.groupIds[index]
+      if (id) {
+        baseTop -= getStride(id)
+      }
+    }
+  }
+
   const targetTopById = new Map<string, number>()
   let nextTop = baseTop
   // Why: lineage drag units can be much taller than ordinary cards, so replay
   // layout with measured heights instead of mapping indexes to old slot tops.
   for (const id of nextIds) {
     targetTopById.set(id, nextTop)
-    const rect = rectById.get(id)
-    const height = rect ? rect.bottom - rect.top : fallbackHeight
-    nextTop += height + (gapAfterById.get(id) ?? fallbackGap)
+    nextTop += getStride(id)
   }
 
   const offsets = new Map<string, number>()
diff --git a/src/renderer/src/components/sidebar/worktree-lineage-projection.ts b/src/renderer/src/components/sidebar/worktree-lineage-projection.ts
index 38c8584c064..040a40eb737 100644
--- a/src/renderer/src/components/sidebar/worktree-lineage-projection.ts
+++ b/src/renderer/src/components/sidebar/worktree-lineage-projection.ts
@@ -15,7 +15,7 @@ export function getProjectedWorktreeLineage(
   worktree: Worktree,
   lineageById: Readonly<Record<string, WorktreeLineage>>
 ): WorktreeLineage | null | undefined {
-  if (Object.prototype.hasOwnProperty.call(lineageById, worktree.id)) {
+  if (Object.hasOwn(lineageById, worktree.id)) {
     return lineageById[worktree.id]
   }
   return (worktree as WorktreeWithResolvedLineage).lineage
diff --git a/src/renderer/src/components/sidebar/worktree-list-groups.ts b/src/renderer/src/components/sidebar/worktree-list-groups.ts
index 777e9fcfbe6..a154eea8263 100644
--- a/src/renderer/src/components/sidebar/worktree-list-groups.ts
+++ b/src/renderer/src/components/sidebar/worktree-list-groups.ts
@@ -1006,9 +1006,7 @@ export function buildRows(
   workspaceStatuses: readonly WorkspaceStatusDefinition[] = cloneDefaultWorkspaceStatuses(),
   projectOrderBy: ProjectOrderBy = 'manual',
   lineageById: Record<string, WorktreeLineage> = {},
-  worktreeMap: Map<string, Worktree> = new Map(
-    worktrees.map((worktree) => [worktree.id, worktree])
-  ),
+  worktreeMap = new Map<string, Worktree>(worktrees.map((worktree) => [worktree.id, worktree])),
   nestLineage = false,
   settings?: AppState['settings'],
   projectGroups: readonly ProjectGroup[] = [],
diff --git a/src/renderer/src/components/sidebar/worktree-list-virtual-rows.ts b/src/renderer/src/components/sidebar/worktree-list-virtual-rows.ts
index 69b8c71c010..4d6b0b7162c 100644
--- a/src/renderer/src/components/sidebar/worktree-list-virtual-rows.ts
+++ b/src/renderer/src/components/sidebar/worktree-list-virtual-rows.ts
@@ -5,6 +5,7 @@ import { getLineageGroupKey, PINNED_GROUP_KEY } from './worktree-list-groups'
 
 export const GROUP_HEADER_ROW_HEIGHT = 28
 export const HOST_HEADER_ROW_HEIGHT = 32
+export const WORKTREE_SIDEBAR_VIRTUAL_ROW_GAP = 6
 const SECONDARY_GROUP_HEADER_TOP_MARGIN = 4
 const IMPORTED_WORKTREES_LINE_ROW_HEIGHT = 36
 const PENDING_CREATION_ROW_HEIGHT = 56
diff --git a/src/renderer/src/components/sidebar/worktree-manual-order.test.ts b/src/renderer/src/components/sidebar/worktree-manual-order.test.ts
index 47e728e1cb6..5d7839956c5 100644
--- a/src/renderer/src/components/sidebar/worktree-manual-order.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-manual-order.test.ts
@@ -87,6 +87,28 @@ describe('buildWorktreeDragPreviewOffsets', () => {
     ])
   })
 
+  it('keeps downward offsets stable after virtualization unmounts the leading rows', () => {
+    const { offsets, placeholderTop } = buildWorktreeDragPreviewOffsets({
+      groupIds: ['a', 'b', 'c', 'd', 'e', 'f'],
+      draggedIds: ['a'],
+      draggingWorktreeId: 'a',
+      draggedPreviewHeight: 50,
+      dropIndex: 6,
+      rects: [
+        { worktreeId: 'd', groupIndex: 3, top: 168, bottom: 218 },
+        { worktreeId: 'e', groupIndex: 4, top: 224, bottom: 274 },
+        { worktreeId: 'f', groupIndex: 5, top: 280, bottom: 330 }
+      ]
+    })
+
+    expect(Array.from(offsets)).toEqual([
+      ['d', -56],
+      ['e', -56],
+      ['f', -56]
+    ])
+    expect(placeholderTop).toBe(280)
+  })
+
   it('slides intervening rows down while dragging a row up', () => {
     const { offsets } = buildWorktreeDragPreviewOffsets({
       groupIds: ['a', 'b', 'c'],
diff --git a/src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx b/src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx
index 7ca741d4ced..2be58e1bff5 100644
--- a/src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx
+++ b/src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx
@@ -44,4 +44,85 @@ describe('ReviewIcon', () => {
     expect(blocked).not.toContain('text-emerald-500/80')
     expect(blocked).not.toBe(passing)
   })
+
+  // Why: #13088 — a draft with failing checks used the same glyph as every other
+  // review and was painted red, so it was indistinguishable from a closed PR.
+  it('gives a draft its own glyph and never paints it with a check tone', () => {
+    const draft = renderToStaticMarkup(
+      <ReviewIcon
+        review={{
+          provider: 'github',
+          number: 1,
+          title: 'Draft',
+          state: 'draft',
+          status: 'failure'
+        }}
+        className="size-3"
+        variant="generic"
+      />
+    )
+    const closed = renderToStaticMarkup(
+      <ReviewIcon
+        review={{ provider: 'github', number: 1, title: 'Closed', state: 'closed' }}
+        className="size-3"
+        variant="generic"
+      />
+    )
+
+    expect(draft).toContain('lucide-git-pull-request-draft')
+    expect(draft).not.toContain('text-rose-500/85')
+    expect(closed).toContain('lucide-git-pull-request-closed')
+    expect(draft).not.toBe(closed)
+  })
+
+  it('keeps check tones on open reviews so failing checks still stand out', () => {
+    const failing = renderToStaticMarkup(
+      <ReviewIcon
+        review={{ provider: 'github', number: 1, title: 'Open', state: 'open', status: 'failure' }}
+        className="size-3"
+        variant="generic"
+      />
+    )
+
+    expect(failing).toContain('text-rose-500/85')
+  })
+
+  it('renders merged reviews with the merge glyph', () => {
+    const merged = renderToStaticMarkup(
+      <ReviewIcon
+        review={{ provider: 'github', number: 1, title: 'Merged', state: 'merged' }}
+        className="size-3"
+        variant="generic"
+      />
+    )
+
+    expect(merged).toContain('lucide-git-merge')
+  })
+
+  // Why: a closed MR used to render the merge glyph, which read as "already merged".
+  it('overrides the GitLab provider glyph for closed merge requests', () => {
+    const closed = renderToStaticMarkup(
+      <ReviewIcon review={{ ...gitlabReview, state: 'closed' }} className="size-3" />
+    )
+
+    expect(closed).toContain('lucide-git-pull-request-closed')
+    expect(closed).not.toContain('lucide-git-merge')
+  })
+
+  // Why: folder cards render a stateless row while a linked review loads or its
+  // details fail. There is no state glyph to contradict, so problems must still be
+  // visible — but a tone-less row must not be promoted to a passing green.
+  it('flags problems on a stateless row without ever claiming success', () => {
+    const stateless = (status: 'failure' | 'pending' | 'success') =>
+      renderToStaticMarkup(
+        <ReviewIcon
+          review={{ provider: 'github', number: 1, title: 'Loading PR...', status }}
+          className="size-3"
+        />
+      )
+
+    expect(stateless('failure')).toContain('text-rose-500/85')
+    expect(stateless('pending')).toContain('text-amber-500/85')
+    expect(stateless('success')).not.toContain('text-emerald-500/80')
+  })
 })
diff --git a/src/renderer/src/components/sidebar/worktree-review-helpers.tsx b/src/renderer/src/components/sidebar/worktree-review-helpers.tsx
index 7f096a954dc..96e64fb4423 100644
--- a/src/renderer/src/components/sidebar/worktree-review-helpers.tsx
+++ b/src/renderer/src/components/sidebar/worktree-review-helpers.tsx
@@ -1,4 +1,4 @@
-import { GitMerge } from 'lucide-react'
+import { GitMerge, GitPullRequestClosed, GitPullRequestDraft } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { PullRequestIcon } from './WorktreeCardHelpers'
 import type { WorktreeCardPrDisplay } from './worktree-card-pr-display'
@@ -23,6 +23,60 @@ export function getProviderName(review: WorktreeCardPrDisplay): string {
   return 'GitHub'
 }
 
+// Why: the glyph must carry review state — tone alone made a draft with failing
+// checks render as a red PR icon, which reads as closed.
+function getStateIcon(
+  state: WorktreeCardPrDisplay['state']
+): React.ComponentType<{ className?: string }> | null {
+  if (state === 'merged') {
+    return GitMerge
+  }
+  if (state === 'closed') {
+    return GitPullRequestClosed
+  }
+  if (state === 'draft') {
+    return GitPullRequestDraft
+  }
+  return null
+}
+
+// Why: checks only gate a review that is actually open; draft/closed/merged keep
+// their state tone so the glyph agrees with its tooltip. A stateless row (folder
+// cards render one while a linked review is loading or its details failed) has no
+// state glyph to contradict, so it still flags problems — but never claims success,
+// since emerald would assert an open review we have not confirmed.
+function getCheckTone(review: WorktreeCardPrDisplay): string | null {
+  if (review.state && review.state !== 'open') {
+    return null
+  }
+  if (review.status === 'failure') {
+    return 'text-rose-500/85'
+  }
+  if (review.status === 'pending') {
+    return 'text-amber-500/85'
+  }
+  if (review.state === 'open' && review.status === 'success') {
+    return 'text-emerald-500/80'
+  }
+  return null
+}
+
+function getStateTone(state: WorktreeCardPrDisplay['state']): string {
+  if (state === 'merged') {
+    return 'text-purple-600/70 dark:text-purple-400/70'
+  }
+  if (state === 'open') {
+    return 'text-emerald-500/80'
+  }
+  if (state === 'closed') {
+    return 'text-muted-foreground/60'
+  }
+  if (state === 'draft') {
+    return 'text-muted-foreground/50'
+  }
+  return 'text-muted-foreground opacity-70'
+}
+
 export function ReviewIcon({
   review,
   className,
@@ -32,28 +86,8 @@ export function ReviewIcon({
   className?: string
   variant?: 'provider' | 'generic'
 }): React.JSX.Element {
-  const Icon = variant === 'provider' && review.provider === 'gitlab' ? GitMerge : PullRequestIcon
-  const checkTone =
-    review.state !== 'merged' && review.status === 'failure'
-      ? 'text-rose-500/85'
-      : review.state !== 'merged' && review.status === 'pending'
-        ? 'text-amber-500/85'
-        : review.state === 'open' && review.status === 'success'
-          ? 'text-emerald-500/80'
-          : null
-  return (
-    <Icon
-      className={cn(
-        className,
-        checkTone,
-        review.state === 'merged' && 'text-purple-600/70 dark:text-purple-400/70',
-        !checkTone && review.state === 'open' && 'text-emerald-500/80',
-        !checkTone && review.state === 'closed' && 'text-muted-foreground/60',
-        !checkTone && review.state === 'draft' && 'text-muted-foreground/50',
-        !checkTone &&
-          (!review.state || !['merged', 'open', 'closed', 'draft'].includes(review.state)) &&
-          'text-muted-foreground opacity-70'
-      )}
-    />
-  )
+  const providerIcon =
+    variant === 'provider' && review.provider === 'gitlab' ? GitMerge : PullRequestIcon
+  const Icon = getStateIcon(review.state) ?? providerIcon
+  return <Icon className={cn(className, getCheckTone(review) ?? getStateTone(review.state))} />
 }
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.test.ts b/src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.test.ts
index 1f44a94f7fa..2a1d9652713 100644
--- a/src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.test.ts
@@ -159,20 +159,20 @@ describe('worktree sidebar drag geometry under mid-drag card growth', () => {
       scrollTop: 0
     }
 
-    expect(resolveWorktreeSidebarDropAnchorIndex({ anchor, rects: COLLAPSED })).toBeNull()
+    expect(resolveWorktreeSidebarDropAnchorIndex({ anchor, groupIds: GROUP_IDS })).toBeNull()
     expect(
       resolveWorktreeSidebarDropAnchorIndex({
         anchor: { beforeWorktreeId: 'c', pointerY: 0, scrollTop: 0 },
-        rects: COLLAPSED
+        groupIds: GROUP_IDS
       })
     ).toBe(2)
     // A null anchor id means end-of-group, which survives any row count change.
     expect(
       resolveWorktreeSidebarDropAnchorIndex({
         anchor: { beforeWorktreeId: null, pointerY: 0, scrollTop: 0 },
-        rects: COLLAPSED
+        groupIds: GROUP_IDS
       })
-    ).toBe(COLLAPSED.length)
+    ).toBe(GROUP_IDS.length)
   })
 
   it('keeps one live coordinate space across a session refresh', () => {
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.ts b/src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.ts
index c903868b7ca..691bd7ab67e 100644
--- a/src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.ts
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.ts
@@ -70,25 +70,25 @@ export function shouldReevaluateWorktreeSidebarDropAnchor(args: {
 
 /**
  * Resolve a held anchor back to a drop index in the current layout. Returns null
- * when the anchored card is gone (deleted, filtered, or unmounted by
- * virtualization), so the caller falls back to a fresh geometric decision.
+ * when the anchored card is gone (deleted or filtered), so the caller falls
+ * back to a fresh geometric decision.
  */
 export function resolveWorktreeSidebarDropAnchorIndex(args: {
   anchor: WorktreeSidebarDropAnchor
-  rects: readonly WorktreeSidebarDragRect[]
+  groupIds: readonly string[]
 }): number | null {
   if (args.anchor.beforeWorktreeId === null) {
-    return args.rects.length
+    return args.groupIds.length
   }
-  const target = args.rects.find((rect) => rect.worktreeId === args.anchor.beforeWorktreeId)
-  return target ? target.groupIndex : null
+  const targetIndex = args.groupIds.indexOf(args.anchor.beforeWorktreeId)
+  return targetIndex !== -1 ? targetIndex : null
 }
 
 export function getWorktreeSidebarDropAnchorId(args: {
-  rects: readonly WorktreeSidebarDragRect[]
+  groupIds: readonly string[]
   dropIndex: number
 }): string | null {
-  return args.rects.find((rect) => rect.groupIndex === args.dropIndex)?.worktreeId ?? null
+  return args.groupIds[args.dropIndex] ?? null
 }
 
 /**
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.test.ts b/src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.test.ts
index ef6147458a1..e1f1b870287 100644
--- a/src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.test.ts
@@ -174,6 +174,80 @@ describe('computeWorktreeSidebarDropPreview', () => {
 
     expect(new Set(dropIndexes).size).toBe(1)
   })
+
+  it('keeps a downward end drop stable when leading rows are virtualized', () => {
+    const groupIds = ['a', 'b', 'c', 'd', 'e', 'f']
+    const mountedRects = [
+      { worktreeId: 'd', groupIndex: 3, top: 168, bottom: 218 },
+      { worktreeId: 'e', groupIndex: 4, top: 224, bottom: 274 },
+      { worktreeId: 'f', groupIndex: 5, top: 280, bottom: 330 }
+    ]
+    const input = {
+      pointerY: 320,
+      containerTop: 0,
+      scrollTop: 0,
+      rects: mountedRects,
+      groupIds,
+      draggedIds: ['a'],
+      draggingWorktreeId: 'a',
+      grab: { offsetY: 25, height: 50 }
+    }
+
+    const first = computeWorktreeSidebarDropPreview(input)!
+    const held = computeWorktreeSidebarDropPreview({
+      ...input,
+      anchor: { beforeWorktreeId: first.dropAnchorId, pointerY: 320, scrollTop: 0 }
+    })!
+
+    for (const preview of [first, held]) {
+      expect(preview).toMatchObject({
+        dropIndex: 6,
+        dropIndicatorY: 277,
+        dropAnchorId: null
+      })
+      expect(Array.from(preview.previewOffsetsByWorktreeId)).toEqual([
+        ['d', -56],
+        ['e', -56],
+        ['f', -56]
+      ])
+    }
+  })
+
+  it('uses the full group index when the dragged row is outside the mounted window', () => {
+    const preview = computeWorktreeSidebarDropPreview({
+      pointerY: 193,
+      containerTop: 0,
+      scrollTop: 0,
+      rects: [
+        { worktreeId: 'd', groupIndex: 3, top: 168, bottom: 218 },
+        { worktreeId: 'e', groupIndex: 4, top: 224, bottom: 274 },
+        { worktreeId: 'f', groupIndex: 5, top: 280, bottom: 330 }
+      ],
+      groupIds: ['a', 'b', 'c', 'd', 'e', 'f'],
+      draggedIds: ['e'],
+      draggingWorktreeId: 'e',
+      grab: { offsetY: 25, height: 50 }
+    })
+
+    expect(preview?.dropIndex).toBe(3)
+  })
+
+  it('preserves the virtual row gap when only one row remains mounted', () => {
+    const preview = computeWorktreeSidebarDropPreview({
+      pointerY: 305,
+      containerTop: 0,
+      scrollTop: 0,
+      rects: [{ worktreeId: 'f', groupIndex: 5, top: 280, bottom: 330 }],
+      groupIds: ['a', 'b', 'c', 'd', 'e', 'f'],
+      draggedIds: ['a'],
+      draggingWorktreeId: 'a',
+      fallbackGap: 6,
+      grab: { offsetY: 25, height: 50 }
+    })
+
+    expect(preview).toMatchObject({ dropIndex: 6, dropIndicatorY: 277 })
+    expect(Array.from(preview?.previewOffsetsByWorktreeId ?? [])).toEqual([['f', -56]])
+  })
 })
 
 describe('resolveWorktreeSidebarStatusDropCommitTarget', () => {
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.ts b/src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.ts
index e25f2dd2b37..c2d5012a9be 100644
--- a/src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.ts
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.ts
@@ -178,6 +178,7 @@ export function computeWorktreeSidebarDropPreview(args: {
   groupIds: readonly string[]
   draggedIds: readonly string[]
   draggingWorktreeId?: string | null
+  fallbackGap?: number
   // Where the card was grabbed, so the drop follows the card rather than the bare
   // pointer. Omitted for native HTML5 drags, which have no reliable grab offset.
   grab?: WorktreeSidebarDragGrab | null
@@ -194,10 +195,13 @@ export function computeWorktreeSidebarDropPreview(args: {
   }
 
   const localY = args.pointerY - args.containerTop + args.scrollTop
-  const activeIndex = args.draggingWorktreeId
-    ? rects.findIndex((rect) => rect.worktreeId === args.draggingWorktreeId)
+  const activeGroupIndex = args.draggingWorktreeId
+    ? args.groupIds.indexOf(args.draggingWorktreeId)
     : -1
-  const activeRect = activeIndex >= 0 ? rects[activeIndex]! : null
+  const activeRect =
+    activeGroupIndex >= 0
+      ? (rects.find((rect) => rect.worktreeId === args.draggingWorktreeId) ?? null)
+      : null
   const referenceY = getWorktreeSidebarDragReferenceY({
     localY,
     grab: args.grab ?? null,
@@ -217,15 +221,19 @@ export function computeWorktreeSidebarDropPreview(args: {
   }
 
   const heldIndex = args.anchor
-    ? resolveWorktreeSidebarDropAnchorIndex({ anchor: args.anchor, rects })
+    ? resolveWorktreeSidebarDropAnchorIndex({ anchor: args.anchor, groupIds: args.groupIds })
     : null
   let dropIndex: number
   if (heldIndex !== null) {
     dropIndex = heldIndex
   } else if (boundaryDrop.kind === 'drop') {
     dropIndex = boundaryDrop.dropIndex
-  } else if (activeRect) {
-    dropIndex = getWorktreeSidebarClosestCenterDropIndex({ referenceY, rects, activeIndex })
+  } else if (activeGroupIndex >= 0) {
+    dropIndex = getWorktreeSidebarClosestCenterDropIndex({
+      referenceY,
+      rects,
+      activeIndex: activeGroupIndex
+    })
   } else {
     dropIndex = getWorktreeSidebarPointerDropIndex({ referenceY, rects })
   }
@@ -234,6 +242,8 @@ export function computeWorktreeSidebarDropPreview(args: {
     groupIds: args.groupIds,
     draggedIds: args.draggedIds,
     draggingWorktreeId: args.draggingWorktreeId,
+    draggedPreviewHeight: args.grab?.height,
+    fallbackGap: args.fallbackGap,
     dropIndex,
     rects
   })
@@ -246,6 +256,6 @@ export function computeWorktreeSidebarDropPreview(args: {
       activeRect
     }),
     previewOffsetsByWorktreeId: offsets,
-    dropAnchorId: getWorktreeSidebarDropAnchorId({ rects, dropIndex })
+    dropAnchorId: getWorktreeSidebarDropAnchorId({ groupIds: args.groupIds, dropIndex })
   }
 }
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts b/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts
new file mode 100644
index 00000000000..9ba2cd592d0
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts
@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createPendingRevealScroll,
+  isRevealScrollSettling,
+  REVEAL_SCROLL_SETTLE_TIMEOUT_MS
+} from './worktree-sidebar-reveal-scroll-settle'
+
+describe('isRevealScrollSettling', () => {
+  it('is not settling without a reveal scroll in flight', () => {
+    expect(isRevealScrollSettling({ now: 0, pending: null, scrollTop: 120 })).toBe(false)
+  })
+
+  it('stays settling while a smooth reveal scroll is still animating', () => {
+    // Regression: the anchor restore wrote scrollTop two frames into the animation and
+    // cancelled it after a couple of pixels, so revealing took several button clicks.
+    const pending = createPendingRevealScroll(387, 0)
+    expect(isRevealScrollSettling({ now: 16, pending, scrollTop: 2 })).toBe(true)
+    expect(isRevealScrollSettling({ now: 200, pending, scrollTop: 260 })).toBe(true)
+  })
+
+  it('stops settling once the scroll reaches its target', () => {
+    const pending = createPendingRevealScroll(387, 0)
+    expect(isRevealScrollSettling({ now: 300, pending, scrollTop: 387 })).toBe(false)
+    // Sub-pixel landings still count as arrived.
+    expect(isRevealScrollSettling({ now: 300, pending, scrollTop: 386.5 })).toBe(false)
+  })
+
+  it('stops settling after the timeout so an unreachable target cannot pin the guard open', () => {
+    const pending = createPendingRevealScroll(387, 0)
+    expect(
+      isRevealScrollSettling({ now: REVEAL_SCROLL_SETTLE_TIMEOUT_MS, pending, scrollTop: 40 })
+    ).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.ts b/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.ts
new file mode 100644
index 00000000000..6f0d5d878f6
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.ts
@@ -0,0 +1,36 @@
+/**
+ * Tracks a smooth reveal scroll the sidebar issued itself.
+ *
+ * A smooth scroll animates across many frames, and any other scrollTop write
+ * during that window silently cancels it. The sidebar's scroll-anchor restore
+ * writes exactly that, so without this the reveal stops a couple of pixels in
+ * and the user has to click the reveal button repeatedly.
+ */
+export type PendingRevealScroll = {
+  targetTop: number
+  expiresAt: number
+}
+
+/** Ceiling for a browser smooth-scroll animation; also the escape hatch when the target turns out to be unreachable. */
+export const REVEAL_SCROLL_SETTLE_TIMEOUT_MS = 1000
+
+const SETTLED_TOLERANCE_PX = 1
+
+export function createPendingRevealScroll(targetTop: number, now: number): PendingRevealScroll {
+  return { targetTop, expiresAt: now + REVEAL_SCROLL_SETTLE_TIMEOUT_MS }
+}
+
+export function isRevealScrollSettling({
+  now,
+  pending,
+  scrollTop
+}: {
+  now: number
+  pending: PendingRevealScroll | null
+  scrollTop: number
+}): boolean {
+  if (!pending || now >= pending.expiresAt) {
+    return false
+  }
+  return Math.abs(scrollTop - pending.targetTop) > SETTLED_TOLERANCE_PX
+}
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts b/src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts
new file mode 100644
index 00000000000..8218c0e0144
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it, vi } from 'vitest'
+import { revealElementInScrollContainer } from './worktree-sidebar-reveal'
+
+function makeContainer(scrollTop: number, clientHeight: number) {
+  const scrollTo = vi.fn()
+  const container = {
+    clientHeight,
+    scrollTop,
+    contains: () => true,
+    getBoundingClientRect: () => ({ top: 0, bottom: clientHeight }) as DOMRect,
+    scrollTo
+  }
+  return { container: container as unknown as HTMLElement, scrollTo }
+}
+
+function makeElement(top: number, bottom: number): Element {
+  return {
+    getBoundingClientRect: () => ({ top, bottom }) as DOMRect
+  } as unknown as Element
+}
+
+describe('revealElementInScrollContainer', () => {
+  it('reports the scroll target it issues so callers can guard the animation', () => {
+    const { container, scrollTo } = makeContainer(0, 673)
+    const onScrollIssued = vi.fn()
+
+    // A card mounted below the fold: reveal scrolls until its bottom is in view.
+    const revealed = revealElementInScrollContainer(
+      container,
+      makeElement(1005, 1060),
+      'smooth',
+      onScrollIssued
+    )
+
+    expect(revealed).toBe(true)
+    expect(scrollTo).toHaveBeenCalledWith({ top: 387, behavior: 'smooth' })
+    expect(onScrollIssued).toHaveBeenCalledWith(387)
+  })
+
+  it('does not report a scroll when the element is already in view', () => {
+    const { container, scrollTo } = makeContainer(0, 673)
+    const onScrollIssued = vi.fn()
+
+    const revealed = revealElementInScrollContainer(
+      container,
+      makeElement(200, 260),
+      'smooth',
+      onScrollIssued
+    )
+
+    expect(revealed).toBe(true)
+    expect(scrollTo).not.toHaveBeenCalled()
+    expect(onScrollIssued).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-reveal.ts b/src/renderer/src/components/sidebar/worktree-sidebar-reveal.ts
index 38b158532af..ffc8bd7f8df 100644
--- a/src/renderer/src/components/sidebar/worktree-sidebar-reveal.ts
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-reveal.ts
@@ -38,7 +38,10 @@ export function getScrollTopToRevealBounds(
 export function revealElementInScrollContainer(
   container: HTMLElement,
   element: Element,
-  behavior: ScrollBehavior
+  behavior: ScrollBehavior,
+  // Why: any other scrollTop write cancels the scroll issued here mid-animation;
+  // callers use this to stand their scroll-position guards down until it lands.
+  onScrollIssued?: (targetTop: number) => void
 ): boolean {
   if (!container.contains(element)) {
     return false
@@ -59,6 +62,8 @@ export function revealElementInScrollContainer(
     window.matchMedia?.('(prefers-reduced-motion: reduce)').matches === true
   const resolvedBehavior: ScrollBehavior =
     behavior === 'smooth' && prefersReducedMotion ? 'auto' : behavior
-  container.scrollTo({ top: Math.max(0, nextScrollTop), behavior: resolvedBehavior })
+  const targetTop = Math.max(0, nextScrollTop)
+  onScrollIssued?.(targetTop)
+  container.scrollTo({ top: targetTop, behavior: resolvedBehavior })
   return true
 }
diff --git a/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts b/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts
index f20ace97b4f..44c3e7f2639 100644
--- a/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts
@@ -331,6 +331,22 @@ describe('buildTitleDerivedAgentRows', () => {
     }
   })
 
+  // Why: the native marker is the only signal a hookless OpenCode pane emits, so
+  // without it the sidebar showed no row for a running session.
+  it('rows an OpenCode pane from its undecorated native session title', () => {
+    const rows = buildWorktreeAgentRows({
+      tabs: [makeTab('tab-1')],
+      entries: [],
+      retained: [],
+      runtimePaneTitlesByTabId: { 'tab-1': { 1: 'OC | Ad hoc build' } },
+      ptyIdsByTabId: { 'tab-1': ['pty-opencode'] },
+      terminalLayoutsByTabId: { 'tab-1': makeSingleLayout(LEAF_ID_1) },
+      now: 2000
+    })
+
+    expect(rows.map((row) => [row.agentType, row.state])).toEqual([['opencode', 'idle']])
+  })
+
   it('still resolves Claude from a title that presents Claude, owner or not', () => {
     const rowsFor = (title: string, launchAgent?: TuiAgent) =>
       buildWorktreeAgentRows({
diff --git a/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts b/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts
index ceba63d3e07..9224fe2cba3 100644
--- a/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts
+++ b/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts
@@ -285,7 +285,7 @@ function resolveLeafIdForTitleFallback(args: {
   }
 
   const paneIndex = args.paneTitleEntries.findIndex(([paneId]) => Number(paneId) === args.paneId)
-  return paneIndex >= 0 ? (leafIds[paneIndex] ?? null) : null
+  return paneIndex !== -1 ? (leafIds[paneIndex] ?? null) : null
 }
 
 function collectLeafIds(node: TerminalPaneLayoutNode | null): string[] {
diff --git a/src/renderer/src/components/sidebar/worktree-visibility-host-target.ts b/src/renderer/src/components/sidebar/worktree-visibility-host-target.ts
new file mode 100644
index 00000000000..b507241b847
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-visibility-host-target.ts
@@ -0,0 +1,56 @@
+import { useCallback } from 'react'
+import type { AppState } from '@/store/types'
+import { findRepoForHost, getRepoHostIdentity } from '@/store/slices/repo-host-identity'
+import {
+  getWorktreeExecutionHostId,
+  parseExecutionHostId,
+  type ExecutionHostId
+} from '../../../../shared/execution-host'
+
+export function resolveWorktreeVisibilityHostTarget(
+  state: Pick<AppState, 'repos' | 'settings' | 'detectedWorktreesByRepo'>,
+  repoId: string,
+  modalHostId: unknown
+) {
+  const requestedHostId =
+    typeof modalHostId === 'string' ? parseExecutionHostId(modalHostId)?.id : undefined
+  const repo = findRepoForHost(state.repos, repoId, {
+    hostId: requestedHostId,
+    settings: state.settings
+  })
+  const detectedForRepo = repoId ? state.detectedWorktreesByRepo[repoId] : undefined
+  const detected =
+    detectedForRepo && repo && requestedHostId
+      ? {
+          ...detectedForRepo,
+          worktrees: detectedForRepo.worktrees.filter(
+            (worktree) => getWorktreeExecutionHostId(worktree, repo) === requestedHostId
+          )
+        }
+      : detectedForRepo
+  const scope = repo ? getRepoHostIdentity(repo) : `${requestedHostId ?? ''}\0${repoId}`
+  return { detected, repo, requestedHostId, scope }
+}
+
+export function useWorktreeVisibilityHostActions(
+  fetchWorktrees: AppState['fetchWorktrees'],
+  updateRepo: AppState['updateRepo'],
+  requestedHostId: ExecutionHostId | undefined
+) {
+  const refreshTargetRepo = useCallback(
+    (repoId: string, options?: { requireAuthoritative?: boolean }) =>
+      fetchWorktrees(repoId, {
+        ...options,
+        ...(requestedHostId ? { executionHostId: requestedHostId } : {})
+      }),
+    [fetchWorktrees, requestedHostId]
+  )
+  const updateTargetRepo = useCallback(
+    (repoId: string, updates: Parameters<AppState['updateRepo']>[1]) =>
+      requestedHostId
+        ? updateRepo(repoId, updates, { hostId: requestedHostId })
+        : updateRepo(repoId, updates),
+    [requestedHostId, updateRepo]
+  )
+  return { refreshTargetRepo, updateTargetRepo }
+}
diff --git a/src/renderer/src/components/sidebar/worktree-visibility-mutation-fence.ts b/src/renderer/src/components/sidebar/worktree-visibility-mutation-fence.ts
new file mode 100644
index 00000000000..ef18ac08f17
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-visibility-mutation-fence.ts
@@ -0,0 +1,92 @@
+import { useEffect, type Dispatch, type MutableRefObject, type SetStateAction } from 'react'
+
+export type ActiveVisibilityMutation = { kind: 'row'; path: string } | { kind: 'toggle' }
+type VisibilityListState = 'checking' | 'ready' | 'failed'
+
+// Why: the modal unmounts on close, but its persistence request survives dismissal.
+const activeMutations = new Map<string, ActiveVisibilityMutation>()
+const mutationListeners = new Map<string, Set<() => void>>()
+
+export function getActiveVisibilityMutation(scope: string): ActiveVisibilityMutation | undefined {
+  return activeMutations.get(scope)
+}
+
+export function startVisibilityMutation(scope: string, mutation: ActiveVisibilityMutation): void {
+  activeMutations.set(scope, mutation)
+}
+
+export function subscribeToVisibilityMutation(scope: string, listener: () => void): () => void {
+  const listeners = mutationListeners.get(scope) ?? new Set()
+  listeners.add(listener)
+  mutationListeners.set(scope, listeners)
+  return () => {
+    listeners.delete(listener)
+    if (listeners.size === 0) {
+      mutationListeners.delete(scope)
+    }
+  }
+}
+
+export function finishVisibilityMutation(scope: string, mutation: ActiveVisibilityMutation): void {
+  if (activeMutations.get(scope) !== mutation) {
+    return
+  }
+  activeMutations.delete(scope)
+  mutationListeners.get(scope)?.forEach((listener) => listener())
+}
+
+export function useVisibilityMutationFence<T>(args: {
+  scope: string
+  repoId: string
+  currentScopeRef: MutableRefObject<string>
+  refresh: (repoId: string, options: { requireAuthoritative: true }) => Promise<boolean>
+  setActionState: Dispatch<SetStateAction<T | null>>
+  setBusyPath: Dispatch<SetStateAction<string | null>>
+  setIsToggling: Dispatch<SetStateAction<boolean>>
+  setListState: Dispatch<SetStateAction<VisibilityListState>>
+}): void {
+  const {
+    currentScopeRef,
+    refresh,
+    repoId,
+    scope,
+    setActionState,
+    setBusyPath,
+    setIsToggling,
+    setListState
+  } = args
+  useEffect(() => {
+    const activeMutation = getActiveVisibilityMutation(scope)
+    setActionState(null)
+    setBusyPath(activeMutation?.kind === 'row' ? activeMutation.path : null)
+    setIsToggling(activeMutation?.kind === 'toggle')
+    if (!activeMutation) {
+      return
+    }
+    let cancelled = false
+    let unsubscribe = (): void => undefined
+    unsubscribe = subscribeToVisibilityMutation(scope, () => {
+      unsubscribe()
+      void refresh(repoId, { requireAuthoritative: true }).then((refreshed) => {
+        if (!cancelled && currentScopeRef.current === scope) {
+          setListState(refreshed ? 'ready' : 'failed')
+          setBusyPath(null)
+          setIsToggling(false)
+        }
+      })
+    })
+    return () => {
+      cancelled = true
+      unsubscribe()
+    }
+  }, [
+    currentScopeRef,
+    refresh,
+    repoId,
+    scope,
+    setActionState,
+    setBusyPath,
+    setIsToggling,
+    setListState
+  ])
+}
diff --git a/src/renderer/src/components/skills/SkillsPage.tsx b/src/renderer/src/components/skills/SkillsPage.tsx
index 70b7795912b..8bb3c6fef9d 100644
--- a/src/renderer/src/components/skills/SkillsPage.tsx
+++ b/src/renderer/src/components/skills/SkillsPage.tsx
@@ -85,36 +85,44 @@ export default function SkillsPage(): React.JSX.Element {
   const mountedRef = useMountedRef()
   const scanGenerationRef = useRef(0)
 
-  const loadSkills = useCallback(async (): Promise<void> => {
-    setLoading(true)
-    // Why: a cold local scan walks every skill root, so switching runtimes can
-    // land a stale result after a newer one. Only the newest scan may write.
-    const scanGeneration = ++scanGenerationRef.current
-    const isCurrentScan = (): boolean =>
-      mountedRef.current && scanGeneration === scanGenerationRef.current
-    if (!runtimeTarget) {
-      // Why: keep scanning until the owning runtime is known, rather than
-      // showing the client's skills to someone whose skills live remotely.
-      return
-    }
-    try {
-      const nextResult = await discoverSkillsForRuntimeTarget(runtimeTarget)
-      if (isCurrentScan()) {
-        setResult(nextResult)
+  // `refresh` bypasses the host's shared scans; only an explicit user re-scan does
+  // that, so opening the page rides the same cached roots every other surface uses.
+  const loadSkills = useCallback(
+    async (refresh = false): Promise<void> => {
+      setLoading(true)
+      // Why: a cold local scan walks every skill root, so switching runtimes can
+      // land a stale result after a newer one. Only the newest scan may write.
+      const scanGeneration = ++scanGenerationRef.current
+      const isCurrentScan = (): boolean =>
+        mountedRef.current && scanGeneration === scanGenerationRef.current
+      if (!runtimeTarget) {
+        // Why: keep scanning until the owning runtime is known, rather than
+        // showing the client's skills to someone whose skills live remotely.
+        return
       }
-    } catch (error) {
-      console.error('Failed to discover skills:', error)
-      if (isCurrentScan()) {
-        toast.error(
-          translate('auto.components.skills.SkillsPage.ea72d6185b', 'Could not scan skills')
+      try {
+        const nextResult = await discoverSkillsForRuntimeTarget(
+          runtimeTarget,
+          refresh ? { refresh: true } : undefined
         )
+        if (isCurrentScan()) {
+          setResult(nextResult)
+        }
+      } catch (error) {
+        console.error('Failed to discover skills:', error)
+        if (isCurrentScan()) {
+          toast.error(
+            translate('auto.components.skills.SkillsPage.ea72d6185b', 'Could not scan skills')
+          )
+        }
+      } finally {
+        if (isCurrentScan()) {
+          setLoading(false)
+        }
       }
-    } finally {
-      if (isCurrentScan()) {
-        setLoading(false)
-      }
-    }
-  }, [mountedRef, runtimeTarget])
+    },
+    [mountedRef, runtimeTarget]
+  )
 
   useEffect(() => {
     void loadSkills()
@@ -274,7 +282,7 @@ export default function SkillsPage(): React.JSX.Element {
               className="h-8"
               disabled={loading}
               onClick={() => {
-                void loadSkills()
+                void loadSkills(true)
               }}
             >
               <RefreshCw className={cn('size-4', loading && 'animate-spin')} />
@@ -302,7 +310,7 @@ export default function SkillsPage(): React.JSX.Element {
           <EmptyState
             loading={loading}
             hasSkills={skills.length > 0}
-            onRefresh={() => void loadSkills()}
+            onRefresh={() => void loadSkills(true)}
           />
         )}
       </section>
diff --git a/src/renderer/src/components/source-control/SourceControlActionVariableChips.tsx b/src/renderer/src/components/source-control/SourceControlActionVariableChips.tsx
index 7a99c800eb1..cd853cf42a5 100644
--- a/src/renderer/src/components/source-control/SourceControlActionVariableChips.tsx
+++ b/src/renderer/src/components/source-control/SourceControlActionVariableChips.tsx
@@ -23,7 +23,7 @@ function hasVariablePreview(
 ): boolean {
   return Boolean(
     variablePreviews &&
-    Object.prototype.hasOwnProperty.call(variablePreviews, variable) &&
+    Object.hasOwn(variablePreviews, variable) &&
     variablePreviews[variable] !== undefined &&
     variablePreviews[variable] !== null
   )
diff --git a/src/renderer/src/components/status-bar/mergeSnapshotAndSessions.ts b/src/renderer/src/components/status-bar/mergeSnapshotAndSessions.ts
index d02588001b9..baf9c189fde 100644
--- a/src/renderer/src/components/status-bar/mergeSnapshotAndSessions.ts
+++ b/src/renderer/src/components/status-bar/mergeSnapshotAndSessions.ts
@@ -69,7 +69,7 @@ function resolveSnapshotSessionLabel(
   if (parsed) {
     const tabs = ctx.tabsByWorktree[worktreeId] ?? []
     const tabIndex = tabs.findIndex((t) => t.id === parsed.tabId)
-    const tab = tabIndex >= 0 ? tabs[tabIndex] : undefined
+    const tab = tabIndex !== -1 ? tabs[tabIndex] : undefined
     if (tab) {
       const custom = tab.customTitle?.trim()
       if (custom) {
@@ -94,7 +94,7 @@ function resolveDaemonSessionLabel(
   if (tabId && resolvedWorktreeId) {
     const tabs = ctx.tabsByWorktree[resolvedWorktreeId] ?? []
     const tabIndex = tabs.findIndex((t) => t.id === tabId)
-    const tab = tabIndex >= 0 ? tabs[tabIndex] : undefined
+    const tab = tabIndex !== -1 ? tabs[tabIndex] : undefined
     if (tab) {
       const custom = tab.customTitle?.trim()
       if (custom) {
diff --git a/src/renderer/src/components/tab-bar/BrowserTab.tsx b/src/renderer/src/components/tab-bar/BrowserTab.tsx
index 87a268f75f9..e0ecca579d2 100644
--- a/src/renderer/src/components/tab-bar/BrowserTab.tsx
+++ b/src/renderer/src/components/tab-bar/BrowserTab.tsx
@@ -142,7 +142,7 @@ export default function BrowserTab({
   onCloseOthers: () => void
   onCloseToRight: () => void
   onCloseToLeft: () => void
-  onDuplicate: () => void
+  onDuplicate?: () => void
   onTogglePin: () => void
   dragData: TabDragItemData
   dropIndicator?: DropIndicator
@@ -307,11 +307,15 @@ export default function BrowserTab({
             groupId={dragData.groupId}
             trailingSeparator
           />
-          <DropdownMenuItem onSelect={onDuplicate}>
-            <Copy className="size-3.5" />
-            {translate('auto.components.tab.bar.BrowserTab.5d6e89891f', 'Duplicate Tab')}
-          </DropdownMenuItem>
-          <DropdownMenuSeparator />
+          {onDuplicate ? (
+            <>
+              <DropdownMenuItem onSelect={onDuplicate}>
+                <Copy className="size-3.5" />
+                {translate('auto.components.tab.bar.BrowserTab.5d6e89891f', 'Duplicate Tab')}
+              </DropdownMenuItem>
+              <DropdownMenuSeparator />
+            </>
+          ) : null}
           <DropdownMenuItem onSelect={onTogglePin}>
             {isPinned ? <PinOff className="size-3.5" /> : <Pin className="size-3.5" />}
             {isPinned
diff --git a/src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts b/src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts
index 7b3e18d0a18..c8c940c865f 100644
--- a/src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts
+++ b/src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts
@@ -497,6 +497,26 @@ describe('TabBar context menu wiring', () => {
     expect(menuLabels[3]).toContain('New Browser Tab')
   })
 
+  it('omits impossible paired-web actions while keeping terminal and markdown', async () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const element = await renderTabBar({
+      tabs: [TERMINAL_TAB],
+      onNewFileTab: () => {},
+      onOpenFileTab: () => {},
+      onNewSimulatorTab: () => {}
+    })
+
+    const menuLabels = findChildrenByType(element, 'DropdownMenuItem').map((item) =>
+      extractText(item.props.children)
+    )
+
+    expect(menuLabels.some((label) => label.includes('New Terminal'))).toBe(true)
+    expect(menuLabels.some((label) => label.includes('New Markdown'))).toBe(true)
+    expect(menuLabels.some((label) => label.includes('Open Markdown...'))).toBe(true)
+    expect(menuLabels.some((label) => label.includes('Browser'))).toBe(false)
+    expect(menuLabels.some((label) => label.includes('Mobile Emulator'))).toBe(false)
+  })
+
   it('turns New Mobile Emulator into a go-to action when the workspace already has one', async () => {
     const onNewSimulatorTab = vi.fn()
     appStoreSnapshot.unifiedTabsByWorktree = {
diff --git a/src/renderer/src/components/tab-bar/TabBar.tsx b/src/renderer/src/components/tab-bar/TabBar.tsx
index 43f3255676a..42aab95c37e 100644
--- a/src/renderer/src/components/tab-bar/TabBar.tsx
+++ b/src/renderer/src/components/tab-bar/TabBar.tsx
@@ -27,6 +27,8 @@ function TabBarInner(props: TabBarProps): React.JSX.Element {
     resolvedGroupId: runtime.resolvedGroupId,
     terminalOnly,
     mobileEmulatorEnabled: runtime.mobileEmulatorEnabled,
+    managedBrowserCreationEnabled: runtime.managedBrowserCreationEnabled,
+    mobileEmulatorCreationEnabled: runtime.mobileEmulatorCreationEnabled,
     workspaceHasSimulatorTab: runtime.workspaceHasSimulatorTab,
     showWindowsShellMenu: runtime.showWindowsShellMenu,
     projectRuntimeShellMenuMode: runtime.projectRuntimeShellMenuMode,
diff --git a/src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts b/src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts
index 34ed3da7c09..32d74d051c6 100644
--- a/src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts
+++ b/src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts
@@ -35,8 +35,11 @@ const appStoreSnapshot: {
   unifiedTabsByWorktree: Record<string, unknown[]>
   activeGroupIdByWorktree: Record<string, string>
   detectedAgentIds: string[] | null
+  localDetectedAgentIdsByContext: Record<string, string[] | null>
   remoteDetectedAgentIds: Record<string, string[]>
   isDetectingAgents: boolean
+  isDetectingLocalAgentsByContext: Record<string, boolean>
+  isRefreshingLocalAgentsByContext: Record<string, boolean>
   isDetectingRemoteAgents: Record<string, boolean>
 } = {
   activeRepoId: null,
@@ -51,8 +54,11 @@ const appStoreSnapshot: {
   unifiedTabsByWorktree: {},
   activeGroupIdByWorktree: {},
   detectedAgentIds: null,
+  localDetectedAgentIdsByContext: {},
   remoteDetectedAgentIds: {},
   isDetectingAgents: false,
+  isDetectingLocalAgentsByContext: {},
+  isRefreshingLocalAgentsByContext: {},
   isDetectingRemoteAgents: {}
 }
 const pinTabMock: (tabId: string) => void = vi.fn()
@@ -73,8 +79,11 @@ const useAppStoreMock = vi.fn(
       unifiedTabsByWorktree: Record<string, unknown[]>
       activeGroupIdByWorktree: Record<string, string>
       detectedAgentIds: string[] | null
+      localDetectedAgentIdsByContext: Record<string, string[] | null>
       remoteDetectedAgentIds: Record<string, string[]>
       isDetectingAgents: boolean
+      isDetectingLocalAgentsByContext: Record<string, boolean>
+      isRefreshingLocalAgentsByContext: Record<string, boolean>
       isDetectingRemoteAgents: Record<string, boolean>
       pinTab: typeof pinTabMock
       unpinTab: typeof unpinTabMock
@@ -99,8 +108,11 @@ const useAppStoreMock = vi.fn(
       unifiedTabsByWorktree: appStoreSnapshot.unifiedTabsByWorktree,
       activeGroupIdByWorktree: appStoreSnapshot.activeGroupIdByWorktree,
       detectedAgentIds: appStoreSnapshot.detectedAgentIds,
+      localDetectedAgentIdsByContext: appStoreSnapshot.localDetectedAgentIdsByContext,
       remoteDetectedAgentIds: appStoreSnapshot.remoteDetectedAgentIds,
       isDetectingAgents: appStoreSnapshot.isDetectingAgents,
+      isDetectingLocalAgentsByContext: appStoreSnapshot.isDetectingLocalAgentsByContext,
+      isRefreshingLocalAgentsByContext: appStoreSnapshot.isRefreshingLocalAgentsByContext,
       isDetectingRemoteAgents: appStoreSnapshot.isDetectingRemoteAgents,
       pinTab: pinTabMock,
       unpinTab: unpinTabMock,
@@ -168,8 +180,11 @@ useAppStoreExport.getState = vi.fn(() => ({
   unifiedTabsByWorktree: appStoreSnapshot.unifiedTabsByWorktree,
   activeGroupIdByWorktree: appStoreSnapshot.activeGroupIdByWorktree,
   detectedAgentIds: appStoreSnapshot.detectedAgentIds,
+  localDetectedAgentIdsByContext: appStoreSnapshot.localDetectedAgentIdsByContext,
   remoteDetectedAgentIds: appStoreSnapshot.remoteDetectedAgentIds,
   isDetectingAgents: appStoreSnapshot.isDetectingAgents,
+  isDetectingLocalAgentsByContext: appStoreSnapshot.isDetectingLocalAgentsByContext,
+  isRefreshingLocalAgentsByContext: appStoreSnapshot.isRefreshingLocalAgentsByContext,
   isDetectingRemoteAgents: appStoreSnapshot.isDetectingRemoteAgents,
   pinTab: pinTabMock,
   unpinTab: unpinTabMock,
@@ -348,6 +363,9 @@ describe('TabBar PowerShell launch wiring', () => {
     appStoreSnapshot.worktreesByRepo = {}
     appStoreSnapshot.unifiedTabsByWorktree = {}
     appStoreSnapshot.activeGroupIdByWorktree = {}
+    appStoreSnapshot.localDetectedAgentIdsByContext = {}
+    appStoreSnapshot.isDetectingLocalAgentsByContext = {}
+    appStoreSnapshot.isRefreshingLocalAgentsByContext = {}
     vi.stubGlobal('navigator', { userAgent: 'Windows' })
   })
 
diff --git a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
index b67ce3b000a..de672c549a4 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
@@ -149,7 +149,11 @@ export function renderTabBarItems({
           onCloseOthers={() => onCloseOthers(item.id)}
           onCloseToRight={() => onCloseToRight(item.id)}
           onCloseToLeft={() => onCloseToLeft(item.id)}
-          onDuplicate={() => onDuplicateBrowserTab?.(item.id)}
+          onDuplicate={
+            runtime.managedBrowserCreationEnabled
+              ? () => onDuplicateBrowserTab?.(item.id)
+              : undefined
+          }
           onTogglePin={() => togglePinned(item)}
           dragData={dragData}
           dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-static-create-menu.tsx b/src/renderer/src/components/tab-bar/tab-bar-static-create-menu.tsx
index 9d68808ad94..9a7a19a9186 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-static-create-menu.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-static-create-menu.tsx
@@ -16,6 +16,8 @@ import { resolveWindowsShellLaunchTarget } from './windows-shell-launch'
 export function renderTabBarStaticCreateMenu({
   terminalOnly,
   mobileEmulatorEnabled,
+  managedBrowserCreationEnabled,
+  mobileEmulatorCreationEnabled,
   workspaceHasSimulatorTab,
   showMobileEmulatorIntroCallout,
   props,
@@ -32,6 +34,8 @@ export function renderTabBarStaticCreateMenu({
   props: TabBarProps
   terminalOnly: boolean
   mobileEmulatorEnabled: boolean
+  managedBrowserCreationEnabled: boolean
+  mobileEmulatorCreationEnabled: boolean
   workspaceHasSimulatorTab: boolean
   showMobileEmulatorIntroCallout: boolean
   windowsShellEntries: WindowsShellMenuEntry[] | undefined
@@ -97,18 +101,19 @@ export function renderTabBarStaticCreateMenu({
         <DropdownMenuShortcut>{newTerminalShortcut}</DropdownMenuShortcut>
       </DropdownMenuItem>
     )
-  const newBrowserMenuItem = !terminalOnly ? (
-    <DropdownMenuItem
-      onSelect={onNewBrowserTab}
-      className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-    >
-      <Globe className="size-4 text-muted-foreground" />
-      {translate('auto.components.tab.bar.TabBar.4833fb2cbe', 'New Browser Tab')}
-      <DropdownMenuShortcut>{newBrowserShortcut}</DropdownMenuShortcut>
-    </DropdownMenuItem>
-  ) : null
+  const newBrowserMenuItem =
+    !terminalOnly && managedBrowserCreationEnabled ? (
+      <DropdownMenuItem
+        onSelect={onNewBrowserTab}
+        className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
+      >
+        <Globe className="size-4 text-muted-foreground" />
+        {translate('auto.components.tab.bar.TabBar.4833fb2cbe', 'New Browser Tab')}
+        <DropdownMenuShortcut>{newBrowserShortcut}</DropdownMenuShortcut>
+      </DropdownMenuItem>
+    ) : null
   const newSimulatorMenuItem =
-    !terminalOnly && mobileEmulatorEnabled && onNewSimulatorTab ? (
+    !terminalOnly && mobileEmulatorEnabled && mobileEmulatorCreationEnabled && onNewSimulatorTab ? (
       workspaceHasSimulatorTab ? (
         <Tooltip>
           <TooltipTrigger asChild>
@@ -168,6 +173,7 @@ export function renderTabBarStaticCreateMenu({
     !terminalOnly &&
     isMacOs &&
     mobileEmulatorEnabled &&
+    mobileEmulatorCreationEnabled &&
     onNewSimulatorTab ? (
       <MobileEmulatorTabIntroCallout />
     ) : null
diff --git a/src/renderer/src/components/tab-bar/tab-bar-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
index d3b18ee5820..6e1c49ddc94 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
@@ -52,6 +52,8 @@ export function renderTabBarSurface({
   const {
     resolvedGroupId,
     mobileEmulatorEnabled,
+    managedBrowserCreationEnabled,
+    mobileEmulatorCreationEnabled,
     workspaceHasSimulatorTab,
     showMobileEmulatorIntroCallout,
     windowsTerminalCapabilities,
@@ -93,6 +95,8 @@ export function renderTabBarSurface({
     props,
     terminalOnly,
     mobileEmulatorEnabled,
+    managedBrowserCreationEnabled,
+    mobileEmulatorCreationEnabled,
     workspaceHasSimulatorTab,
     showMobileEmulatorIntroCallout,
     windowsShellEntries,
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts b/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts
index b321dc87f88..67194fbecbf 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts
@@ -58,8 +58,8 @@ function splitHostCandidate(query: string): { host: string; port: string | null
     return null
   }
   const colonIndex = query.indexOf(':')
-  const host = colonIndex < 0 ? query : query.slice(0, colonIndex)
-  const port = colonIndex < 0 ? null : query.slice(colonIndex + 1)
+  const host = colonIndex === -1 ? query : query.slice(0, colonIndex)
+  const port = colonIndex === -1 ? null : query.slice(colonIndex + 1)
   const extension = host.split('.').pop()?.toLowerCase() ?? ''
   if (HOST_FILE_EXTENSIONS.has(extension)) {
     return null
@@ -94,7 +94,7 @@ function isPrivateIpv4(host: string): boolean {
 
 function hasSourceExtensionBeforeColon(query: string): boolean {
   const colonIndex = query.indexOf(':')
-  if (colonIndex < 0) {
+  if (colonIndex === -1) {
     return false
   }
   const extension = query.slice(0, colonIndex).split('.').pop()?.toLowerCase() ?? ''
diff --git a/src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts b/src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts
index 42ed5f2abf1..d11662c880b 100644
--- a/src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts
@@ -53,6 +53,25 @@ describe('tab create menu options', () => {
     ).toEqual(['new-browser'])
   })
 
+  it('keeps terminal and markdown results when client-impossible actions are omitted', () => {
+    const options = buildTabCreateMenuOptions({
+      terminalOnly: false,
+      hasNewBrowser: false,
+      hasNewMarkdown: true,
+      hasOpenMarkdown: true,
+      hasSimulator: false,
+      simulatorIsGoTo: false
+    })
+
+    expect(options.map((option) => option.kind)).toEqual([
+      'new-terminal',
+      'new-markdown',
+      'open-markdown'
+    ])
+    expect(findMatchingTabCreateMenuOptions('browser', options)).toEqual([])
+    expect(findMatchingTabCreateMenuOptions('mobile emulator', options)).toEqual([])
+  })
+
   it('preserves default Windows shell order for tied terminal matches', () => {
     const options = buildTabCreateMenuOptions({
       terminalOnly: false,
diff --git a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
index 26525128517..abdcc584881 100644
--- a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
+++ b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
@@ -223,8 +223,8 @@ export function terminalTabHasUnreadActivity({
   unreadAgentCompletionPanes
 }: {
   terminalTabId: string
-  unreadTerminalTabs: Record<string, true | boolean | undefined>
-  unreadAgentCompletionPanes: Record<string, true | boolean | undefined>
+  unreadTerminalTabs: Record<string, boolean | undefined>
+  unreadAgentCompletionPanes: Record<string, boolean | undefined>
 }): boolean {
   return (
     unreadTerminalTabs[terminalTabId] === true ||
@@ -234,7 +234,7 @@ export function terminalTabHasUnreadActivity({
 
 /** Match pane-level unread completion markers to their owning terminal tab. */
 export function hasUnreadAgentCompletionForTerminalTab(
-  unreadAgentCompletionPanes: Record<string, true | boolean | undefined> | undefined,
+  unreadAgentCompletionPanes: Record<string, boolean | undefined> | undefined,
   tabId: string
 ): boolean {
   for (const [paneKey, unread] of Object.entries(unreadAgentCompletionPanes ?? {})) {
diff --git a/src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts b/src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts
index be4a56788db..7eb28f2bcc8 100644
--- a/src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts
+++ b/src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts
@@ -42,6 +42,8 @@ export function useTabBarCreateMenuController({
   resolvedGroupId,
   terminalOnly,
   mobileEmulatorEnabled,
+  managedBrowserCreationEnabled,
+  mobileEmulatorCreationEnabled,
   workspaceHasSimulatorTab,
   showWindowsShellMenu,
   projectRuntimeShellMenuMode,
@@ -60,6 +62,8 @@ export function useTabBarCreateMenuController({
   resolvedGroupId: string
   terminalOnly: boolean
   mobileEmulatorEnabled: boolean
+  managedBrowserCreationEnabled: boolean
+  mobileEmulatorCreationEnabled: boolean
   workspaceHasSimulatorTab: boolean
   showWindowsShellMenu: boolean
   projectRuntimeShellMenuMode: ReturnType<typeof getProjectRuntimeShellMenuMode>
@@ -155,14 +159,20 @@ export function useTabBarCreateMenuController({
       buildTabCreateMenuOptions({
         terminalOnly,
         windowsShellEntries,
-        hasNewBrowser: !terminalOnly,
+        hasNewBrowser: !terminalOnly && managedBrowserCreationEnabled,
         hasNewMarkdown: !terminalOnly && Boolean(onNewFileTab),
         hasOpenMarkdown: !terminalOnly && Boolean(onOpenFileTab),
-        hasSimulator: !terminalOnly && mobileEmulatorEnabled && Boolean(onNewSimulatorTab),
+        hasSimulator:
+          !terminalOnly &&
+          mobileEmulatorEnabled &&
+          mobileEmulatorCreationEnabled &&
+          Boolean(onNewSimulatorTab),
         simulatorIsGoTo: workspaceHasSimulatorTab
       }),
     [
       mobileEmulatorEnabled,
+      managedBrowserCreationEnabled,
+      mobileEmulatorCreationEnabled,
       onNewFileTab,
       onNewSimulatorTab,
       onOpenFileTab,
diff --git a/src/renderer/src/components/tab-bar/use-tab-bar-runtime-model.ts b/src/renderer/src/components/tab-bar/use-tab-bar-runtime-model.ts
index e56534cc3a1..4515de2a071 100644
--- a/src/renderer/src/components/tab-bar/use-tab-bar-runtime-model.ts
+++ b/src/renderer/src/components/tab-bar/use-tab-bar-runtime-model.ts
@@ -26,6 +26,7 @@ import { buildTabAgentLaunchOptions, orderTabLaunchAgents } from './tab-agent-la
 import type { TabAgentLaunchOption } from './tab-agent-launch-options'
 import { shouldShowWindowsShellMenu } from './windows-shell-menu-visibility'
 import { createUnifiedTabLookup } from './tab-bar-item-model'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 const isWindows = navigator.userAgent.includes('Windows')
 export const isMacOs = navigator.userAgent.includes('Mac')
@@ -77,6 +78,8 @@ export type TabBarRuntimeModel = {
   workspaceHasSimulatorTab: boolean
   toggleTabViewMode: (tabId: string) => void
   nativeChatTranscriptIsLocalReadable: boolean
+  managedBrowserCreationEnabled: boolean
+  mobileEmulatorCreationEnabled: boolean
 } & TabBarAgentProjections
 
 export function useTabBarRuntimeModel({
@@ -221,6 +224,15 @@ export function useTabBarRuntimeModel({
     () => unifiedTabs.some((tab) => tab.contentType === 'simulator'),
     [unifiedTabs]
   )
+  const [managedBrowserCreationEnabled, mobileEmulatorCreationEnabled] = useAppStore(
+    useShallow((state) => {
+      const policy = getClientCreationActionPolicy(state, worktreeId)
+      return [
+        policy['managed-browser'].state === 'enabled',
+        policy['mobile-emulator'].state === 'enabled'
+      ] as const
+    })
+  )
   // Why: tab-wide launch/title hints are safe only before split; gate the view-mode toggle to the active leaf's agent.
   const toggleTabViewMode = useAppStore((s) => s.toggleTabViewMode)
   // Why: every retained TabBar observes the same hot maps; one feature-gated selector shares their projections.
@@ -256,6 +268,8 @@ export function useTabBarRuntimeModel({
     nativeChatEnabled,
     tabAgentTypesByTabId,
     nativeChatTabWideFallbackUnsafeTabsById,
-    nativeChatTranscriptIsLocalReadable
+    nativeChatTranscriptIsLocalReadable,
+    managedBrowserCreationEnabled,
+    mobileEmulatorCreationEnabled
   }
 }
diff --git a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts
index f493f2e5807..d2dcdcb965b 100644
--- a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts
@@ -1,5 +1,6 @@
 /* eslint-disable max-lines -- Why: keeps group-scoped activation, close, split, and tab-order rules together with the TabGroupPanel surface. */
 import { useCallback, useMemo } from 'react'
+import { toast } from 'sonner'
 import { useShallow } from 'zustand/react/shallow'
 import type { OpenFile } from '@/store/slices/editor'
 import type {
@@ -28,6 +29,7 @@ import { ensureSimulatorTab, getSimulatorTabForWorktree } from '@/lib/ensure-sim
 import { buildDuplicatedBrowserTabOptions } from '@/lib/duplicate-browser-tab-options'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { browserWorkspaceHasRemoteOwner } from '@/runtime/remote-browser-tab-ownership'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export function recordTerminalTabGroupSplit(createdTerminal: TerminalTab | null | undefined): void {
   if (!createdTerminal) {
@@ -585,7 +587,9 @@ export function useTabGroupWorkspaceModel({
       closeToLeft,
       createSplitGroup,
       newBrowserTab: () => {
-        void openNewBrowserTabInActiveWorkspace(groupId)
+        void openNewBrowserTabInActiveWorkspace(groupId).catch((error) => {
+          toast.error(error instanceof Error ? error.message : String(error))
+        })
       },
       newSimulatorTab: worktreeState.mobileEmulatorEnabled
         ? () => {
@@ -597,6 +601,8 @@ export function useTabGroupWorkspaceModel({
             void openMobileEmulatorTab(worktreeId, {
               placement: 'rightSplit',
               targetGroupId: groupId
+            }).catch((error) => {
+              toast.error(error instanceof Error ? error.message : String(error))
             })
           }
         : undefined,
@@ -612,23 +618,36 @@ export function useTabGroupWorkspaceModel({
             return
           }
           const runtimeEnvironmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+          const browserAvailability = getClientCreationActionPolicy(state, worktreeId)[
+            'managed-browser'
+          ]
+          if (browserAvailability.state !== 'enabled') {
+            throw new Error(browserAvailability.reason)
+          }
           if (
-            browserWorkspaceHasRemoteOwner(state, source.id, runtimeEnvironmentId) &&
-            (await createWebRuntimeSessionBrowserTab({
+            browserAvailability.provider === 'paired-runtime' &&
+            browserWorkspaceHasRemoteOwner(state, source.id, runtimeEnvironmentId)
+          ) {
+            const created = await createWebRuntimeSessionBrowserTab({
               worktreeId,
               environmentId: runtimeEnvironmentId,
               url: source.url,
               profileId: source.sessionProfileId,
               targetGroupId: groupId
-            }))
-          ) {
-            return
+            })
+            if (created) {
+              return
+            }
+            throw new Error('The paired runtime could not duplicate the managed browser tab.')
           }
           createBrowserTab(worktreeId, source.url, {
             ...buildDuplicatedBrowserTabOptions(source),
+            ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {}),
             targetGroupId: groupId
           })
-        })()
+        })().catch((error) => {
+          toast.error(error instanceof Error ? error.message : String(error))
+        })
       },
       // Why: target the owning group explicitly; the "+" menu can fire from an unfocused panel without updating global group focus.
       newFileTab: async () => {
diff --git a/src/renderer/src/components/task-page-cache-selectors.ts b/src/renderer/src/components/task-page-cache-selectors.ts
index 5256701003f..525fa51a336 100644
--- a/src/renderer/src/components/task-page-cache-selectors.ts
+++ b/src/renderer/src/components/task-page-cache-selectors.ts
@@ -43,7 +43,7 @@ export type TaskPageWorkItemsFetchOptions = {
   noCache: boolean
 }
 
-type WorkItemsCache = Record<string, CacheEntry<GitHubWorkItem[]>>
+type WorkItemsCache = Record<string, CacheEntry<readonly GitHubWorkItem[]>>
 export type TaskPageWorkItemPages = readonly (GitHubWorkItem[] | null)[]
 
 export function deriveTaskPageGitHubWorkItemsFetchOptions(
@@ -61,7 +61,7 @@ export function selectTaskPageWorkItemsCacheEntries(
   repos: readonly TaskPageRepoCacheInput[],
   limit: number,
   query: string
-): (CacheEntry<GitHubWorkItem[]> | undefined)[] {
+): (CacheEntry<readonly GitHubWorkItem[]> | undefined)[] {
   return repos.map(
     (repo) =>
       workItemsCache[
@@ -72,7 +72,7 @@ export function selectTaskPageWorkItemsCacheEntries(
 
 export function buildTaskPageRepoSourceState(
   repos: readonly TaskPageRepoCacheInput[],
-  entries: readonly (CacheEntry<GitHubWorkItem[]> | undefined)[]
+  entries: readonly (CacheEntry<readonly GitHubWorkItem[]> | undefined)[]
 ): TaskPageRepoSourceState[] {
   return repos.map((repo, index) => {
     const entry = entries[index]
@@ -126,7 +126,7 @@ function taskPageWorkItemCacheKey(item: GitHubWorkItem): string {
 
 export function reconcileTaskPagePagesWithWorkItemsCache(
   pages: TaskPageWorkItemPages,
-  entries: readonly (CacheEntry<GitHubWorkItem[]> | undefined)[]
+  entries: readonly (CacheEntry<readonly GitHubWorkItem[]> | undefined)[]
 ): (GitHubWorkItem[] | null)[] {
   const cachedItems = new Map<string, GitHubWorkItem>()
   for (const entry of entries) {
diff --git a/src/renderer/src/components/task-page-github-work-item-authority-refresh.ts b/src/renderer/src/components/task-page-github-work-item-authority-refresh.ts
index 6a047760195..3f11b3b93b1 100644
--- a/src/renderer/src/components/task-page-github-work-item-authority-refresh.ts
+++ b/src/renderer/src/components/task-page-github-work-item-authority-refresh.ts
@@ -50,7 +50,7 @@ export function getTaskPageGitHubRevalidatableAuthorityItemKeys(
   const quiet = getQuietRevalidateState(queryKey)
   for (const itemKey of getTaskPageGitHubConfirmedAuthorityItemKeys()) {
     const separator = itemKey.indexOf('\0')
-    if (separator < 0) {
+    if (separator === -1) {
       continue
     }
     const repoId = itemKey.slice(0, separator)
diff --git a/src/renderer/src/components/task-page-github-work-item-mutation-composition.ts b/src/renderer/src/components/task-page-github-work-item-mutation-composition.ts
index 970e777ecd3..25616c3c059 100644
--- a/src/renderer/src/components/task-page-github-work-item-mutation-composition.ts
+++ b/src/renderer/src/components/task-page-github-work-item-mutation-composition.ts
@@ -53,7 +53,7 @@ export function pendingListOpsForFamily(
       }
       const login = pending.listOp.logins[0]
       const lastIndex = acc.findIndex((op) => op.logins.length === 1 && op.logins[0] === login)
-      if (lastIndex >= 0) {
+      if (lastIndex !== -1) {
         acc[lastIndex] = pending.listOp
       } else {
         acc.push(pending.listOp)
diff --git a/src/renderer/src/components/task-page-github-work-item-mutation-registry.ts b/src/renderer/src/components/task-page-github-work-item-mutation-registry.ts
index 58428e8746e..bfd575ea4ab 100644
--- a/src/renderer/src/components/task-page-github-work-item-mutation-registry.ts
+++ b/src/renderer/src/components/task-page-github-work-item-mutation-registry.ts
@@ -65,7 +65,7 @@ export function getTaskPageGitHubConfirmedAuthorityItemKeys(): ReadonlySet<strin
   for (const itemKey of itemSourceScopeByItemKey.keys()) {
     const separator = itemKey.indexOf('\0')
     if (
-      separator >= 0 &&
+      separator !== -1 &&
       hasConfirmedAuthorityForItem(itemKey.slice(0, separator), itemKey.slice(separator + 1))
     ) {
       keys.add(itemKey)
diff --git a/src/renderer/src/components/task-page-github-work-item-quiet-revalidate.ts b/src/renderer/src/components/task-page-github-work-item-quiet-revalidate.ts
index 6c33605b569..5895eb28f85 100644
--- a/src/renderer/src/components/task-page-github-work-item-quiet-revalidate.ts
+++ b/src/renderer/src/components/task-page-github-work-item-quiet-revalidate.ts
@@ -99,7 +99,7 @@ export function settleQuietSearchRevalidate(args: {
     }
     const separator = itemKey.indexOf('\0')
     if (
-      separator >= 0 &&
+      separator !== -1 &&
       !hasPendingTaskPageGitHubOpsForItem(itemKey.slice(0, separator), itemKey.slice(separator + 1))
     ) {
       clearConfirmedAuthorityForItem(itemKey.slice(0, separator), itemKey.slice(separator + 1))
@@ -111,7 +111,7 @@ export function settleQuietSearchRevalidate(args: {
       continue
     }
     const sep = itemKey.indexOf('\0')
-    if (sep < 0) {
+    if (sep === -1) {
       continue
     }
     const repoId = itemKey.slice(0, sep)
@@ -134,7 +134,7 @@ export function settleQuietSearchRevalidate(args: {
       continue
     }
     const sep = itemKey.indexOf('\0')
-    if (sep < 0) {
+    if (sep === -1) {
       continue
     }
     if (
diff --git a/src/renderer/src/components/task-page-linear-in-orca-issues.ts b/src/renderer/src/components/task-page-linear-in-orca-issues.ts
index 3db29f31846..38f1dbe4802 100644
--- a/src/renderer/src/components/task-page-linear-in-orca-issues.ts
+++ b/src/renderer/src/components/task-page-linear-in-orca-issues.ts
@@ -101,7 +101,7 @@ export function collectLinkedLinearIssueRefsFromWorktrees(
         (candidate.sourceContext ? getTaskSourceCacheScope(candidate.sourceContext) : '') ===
           sourceScope
     )
-    if ((workspaceId || organizationUrlKey) && unscopedIndex >= 0) {
+    if ((workspaceId || organizationUrlKey) && unscopedIndex !== -1) {
       existing[unscopedIndex] = ref
     } else if (!workspaceId && !organizationUrlKey) {
       const hasSameSourceScope = existing.some(
diff --git a/src/renderer/src/components/terminal-pane/TerminalPane.tsx b/src/renderer/src/components/terminal-pane/TerminalPane.tsx
index 4498dbe6bef..adcc8541f1a 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPane.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPane.tsx
@@ -190,7 +190,7 @@ import { scheduleImagePasteWebglAtlasRecovery } from './terminal-webgl-atlas-rec
 import { restoreTerminalFitToDesktop, restoreTerminalFitsToDesktop } from './terminal-fit-restore'
 import { useVisibleTerminalTabClaim } from './use-visible-terminal-tab-claim'
 import { TerminalSshReconnectOverlay } from './TerminalSshReconnectOverlay'
-import { TerminalRemoteRuntimeReconnectBanner } from './TerminalRemoteRuntimeReconnectBanner'
+import { TerminalPaneDisconnectedBanner } from './TerminalPaneDisconnectedBanner'
 import { selectTerminalTabAgentTypesByLeaf } from './terminal-tab-agent-type-index'
 import { canContinueAgentSessionInNewSession } from './terminal-agent-session-continuation'
 import {
@@ -1562,6 +1562,7 @@ function TerminalPane(
         worktreeId,
         cwd,
         startup: CODEX_ACCOUNT_RESTART_STARTUP,
+        mountFollowsTerminalPark: false,
         paneTransportsRef,
         paneMode2031Ref,
         paneKittyKeyboardModesRef,
@@ -2914,6 +2915,10 @@ function TerminalPane(
     resolveAgentForLeaf(contextMenuLeafId)
   )
   // Each toggle gates on its own leaf (header=active, menu=opened-over), so mixed splits show it only where chat can render.
+  // The pane-level disconnected card owns the bottom strip while it is up; see the error toast below.
+  const activePaneShowsUnreachableCard = Boolean(
+    activePane && ptyRecoveryStatesByPaneId[activePane.id]?.unreachablePane
+  )
   const activePaneCanToggleChat = canToggleChatForLeaf(activePane?.leafId ?? null)
   const contextMenuCanToggleChat = canToggleChatForLeaf(contextMenuLeafId)
   return (
@@ -2981,8 +2986,12 @@ function TerminalPane(
         )
       })}
       {/* Why: the reconnect banner already owns SSH recovery UX; the z-50 error
-          toast was painting over it (same bottom strip) with the raw ssh:connect failure. */}
-      {terminalError && isActive && !showSshReconnectOverlay ? (
+          toast was painting over it (same bottom strip) with the raw ssh:connect failure.
+          The pane's own disconnected card owns the same strip and the same story, and the toast
+          outranks it at z-50 — so it covered BOTH of its actions and made the affordance
+          unclickable. Naming only the connection overlay here was the gap: the card is raised for
+          a per-pane failure that leaves the connection up, which is exactly when this fires. */}
+      {terminalError && isActive && !showSshReconnectOverlay && !activePaneShowsUnreachableCard ? (
         <TerminalErrorToast
           error={terminalError}
           onDismiss={dismissTerminalError}
@@ -3197,12 +3206,20 @@ function TerminalPane(
               return null
             }
             return createPortal(
-              <TerminalRemoteRuntimeReconnectBanner
+              <TerminalPaneDisconnectedBanner
                 key={`remote-runtime-reconnect-${pane.id}-${recoveryState.epoch}`}
                 phase={recoveryState.phase}
+                variant={recoveryState.unreachablePane ? 'ssh-pane' : 'remote-runtime'}
                 onReconnect={() => {
+                  const unreachable = recoveryState.unreachablePane
+                  if (unreachable) {
+                    unreachable.onRetry()
+                    return
+                  }
                   paneTransportsRef.current.get(pane.id)?.retryRecovery?.()
                 }}
+                onStartNewTerminal={recoveryState.unreachablePane?.onStartNewTerminal}
+                onRestoreTerminalFocus={() => pane.terminal.focus()}
               />,
               pane.container,
               `remote-runtime-reconnect-${pane.id}`
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx
new file mode 100644
index 00000000000..a8229c9594e
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.test.tsx
@@ -0,0 +1,164 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+import { cleanup, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { TerminalPaneDisconnectedBanner } from './TerminalPaneDisconnectedBanner'
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string) => fallback
+}))
+
+afterEach(cleanup)
+
+function renderBanner(banner: React.ReactNode): ReturnType<typeof render> {
+  return render(<TooltipProvider>{banner}</TooltipProvider>)
+}
+
+describe('TerminalPaneDisconnectedBanner', () => {
+  it('shows quiet bounded automatic recovery without a manual action', () => {
+    renderBanner(
+      <TerminalPaneDisconnectedBanner
+        phase="backoff"
+        onReconnect={vi.fn()}
+        onRestoreTerminalFocus={vi.fn()}
+      />
+    )
+
+    expect(screen.getByText('Reconnecting to remote runtime')).toBeInTheDocument()
+    expect(screen.getByText(/retry for up to one minute/)).toBeInTheDocument()
+    expect(screen.queryByRole('button')).not.toBeInTheDocument()
+  })
+
+  it('offers one explicit reconnect action after automatic recovery stops', async () => {
+    const onReconnect = vi.fn()
+    const user = userEvent.setup()
+    renderBanner(
+      <TerminalPaneDisconnectedBanner
+        phase="disconnected"
+        onReconnect={onReconnect}
+        onRestoreTerminalFocus={vi.fn()}
+      />
+    )
+
+    expect(screen.getByText('Remote runtime disconnected')).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Reconnect' }))
+    expect(onReconnect).toHaveBeenCalledOnce()
+  })
+})
+
+/**
+ * STA-3077 step E-0. A reattach that fails without proving the shell is gone used to either
+ * respawn silently — resuming the same agent a second time into one transcript — or leave the pane
+ * frozen behind a raw error toast. It now renders here, with the two actions the design approved.
+ */
+describe('TerminalPaneDisconnectedBanner, unreachable SSH pane', () => {
+  function renderUnreachable() {
+    const onReconnect = vi.fn()
+    const onStartNewTerminal = vi.fn()
+    const onRestoreTerminalFocus = vi.fn()
+    renderBanner(
+      <TerminalPaneDisconnectedBanner
+        phase="disconnected"
+        variant="ssh-pane"
+        onReconnect={onReconnect}
+        onStartNewTerminal={onStartNewTerminal}
+        onRestoreTerminalFocus={onRestoreTerminalFocus}
+      />
+    )
+    return { onReconnect, onStartNewTerminal, onRestoreTerminalFocus }
+  }
+
+  it('offers exactly the two approved actions', async () => {
+    const user = userEvent.setup()
+    const { onReconnect, onStartNewTerminal } = renderUnreachable()
+
+    const buttons = screen.getAllByRole('button')
+    expect(buttons.map((button) => button.textContent)).toEqual([
+      'Try again',
+      'Start a new terminal'
+    ])
+
+    await user.click(screen.getByRole('button', { name: 'Try again' }))
+    expect(onReconnect).toHaveBeenCalledOnce()
+    await user.click(screen.getByRole('button', { name: 'Start a new terminal' }))
+    expect(onStartNewTerminal).toHaveBeenCalledOnce()
+  })
+
+  it('returns keyboard focus to this terminal after either action', async () => {
+    const user = userEvent.setup()
+    const onReconnect = vi.fn()
+    const onStartNewTerminal = vi.fn()
+    renderBanner(
+      <>
+        <textarea aria-label="Terminal input" />
+        <TerminalPaneDisconnectedBanner
+          phase="disconnected"
+          variant="ssh-pane"
+          onReconnect={onReconnect}
+          onStartNewTerminal={onStartNewTerminal}
+          onRestoreTerminalFocus={() =>
+            screen.getByRole('textbox', { name: 'Terminal input' }).focus()
+          }
+        />
+      </>
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Try again' }))
+    expect(onReconnect).toHaveBeenCalledOnce()
+    expect(screen.getByRole('textbox', { name: 'Terminal input' })).toHaveFocus()
+
+    await user.click(screen.getByRole('button', { name: 'Start a new terminal' }))
+    expect(onStartNewTerminal).toHaveBeenCalledOnce()
+    expect(screen.getByRole('textbox', { name: 'Terminal input' })).toHaveFocus()
+  })
+
+  it('keeps both actions inside the clipped pane at its supported narrow width', () => {
+    renderUnreachable()
+    const card = screen.getByRole('status')
+    const banner = card.parentElement
+    const buttons = screen.getAllByRole('button')
+
+    expect(banner).toHaveAttribute('data-terminal-pane-disconnected-variant', 'ssh-pane')
+    expect(banner).toHaveClass('@container/disconnected-banner', 'inset-x-0')
+    expect(card).toHaveClass('max-h-full', 'overflow-y-auto')
+    expect(buttons[0].parentElement).toHaveClass('@max-[240px]/disconnected-banner:justify-center')
+    for (const button of buttons) {
+      expect(button).toHaveAttribute('data-size', 'icon-xs')
+    }
+  })
+
+  // The copy constraint as an oracle. Nothing here observed the process, so the UI may not claim
+  // it died — and STYLEGUIDE.md forbids result verbs without result data either way.
+  it('never asserts the shell is dead', () => {
+    renderUnreachable()
+
+    const banner = screen.getByRole('status')
+    expect(banner.textContent).not.toMatch(/exit(ed)?|died|dead|terminated|killed|crashed|lost/i)
+    expect(banner.textContent).toMatch(/may still be running/i)
+  })
+
+  // Replaces the deleted `describeReattachFailure` clause: wire tokens must not reach the pane.
+  it('shows no wire token or raw error string', () => {
+    renderUnreachable()
+
+    const banner = screen.getByRole('status')
+    expect(banner.textContent).not.toMatch(/SSH_|PTY "|ECONNRESET|pty-\d/)
+  })
+
+  // Guards the two-action clause from a banner that always renders the second button: the
+  // remote-runtime variant has no record to retire, so it must keep exactly one action.
+  it('keeps the remote-runtime variant single-action', () => {
+    renderBanner(
+      <TerminalPaneDisconnectedBanner
+        phase="disconnected"
+        onReconnect={vi.fn()}
+        onRestoreTerminalFocus={vi.fn()}
+      />
+    )
+
+    expect(screen.getAllByRole('button')).toHaveLength(1)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.tsx
new file mode 100644
index 00000000000..82292d66381
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneDisconnectedBanner.tsx
@@ -0,0 +1,206 @@
+import { useLayoutEffect, useRef, useState } from 'react'
+import { Loader2, RefreshCw, ServerOff, SquareTerminal } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import type { PtyTransportRecoveryState } from './pty-transport-types'
+
+type VisibleRecoveryPhase = Extract<
+  PtyTransportRecoveryState['phase'],
+  'recovering' | 'backoff' | 'disconnected'
+>
+
+/** `ssh-pane` copy may never say the shell exited: a failed attach does not prove it did. */
+type DisconnectedBannerVariant = 'remote-runtime' | 'ssh-pane'
+
+const COMPACT_ACTIONS_MAX_WIDTH_PX = 240
+
+function useCompactDisconnectedBannerActions(): {
+  bannerRef: React.RefObject<HTMLDivElement | null>
+  compactActions: boolean
+} {
+  const bannerRef = useRef<HTMLDivElement>(null)
+  const [compactActions, setCompactActions] = useState(false)
+
+  useLayoutEffect(() => {
+    const pane = bannerRef.current?.parentElement
+    if (!pane) {
+      return
+    }
+    const sync = (): void => {
+      setCompactActions(pane.getBoundingClientRect().width < COMPACT_ACTIONS_MAX_WIDTH_PX)
+    }
+    sync()
+    if (typeof ResizeObserver === 'undefined') {
+      window.addEventListener('resize', sync)
+      return () => window.removeEventListener('resize', sync)
+    }
+    const observer = new ResizeObserver(sync)
+    observer.observe(pane)
+    return () => observer.disconnect()
+  }, [])
+
+  return { bannerRef, compactActions }
+}
+
+export function TerminalPaneDisconnectedBanner({
+  phase,
+  variant = 'remote-runtime',
+  onReconnect,
+  onStartNewTerminal,
+  onRestoreTerminalFocus
+}: {
+  phase: VisibleRecoveryPhase
+  variant?: DisconnectedBannerVariant
+  onReconnect: () => void
+  onStartNewTerminal?: () => void
+  onRestoreTerminalFocus: () => void
+}): React.JSX.Element {
+  const retrying = phase !== 'disconnected'
+  const sshPane = variant === 'ssh-pane'
+  const { bannerRef, compactActions } = useCompactDisconnectedBannerActions()
+
+  const title = sshPane
+    ? translate(
+        'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.sshPaneTitle',
+        'Terminal disconnected'
+      )
+    : retrying
+      ? translate(
+          'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.retryingTitle',
+          'Reconnecting to remote runtime'
+        )
+      : translate(
+          'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.disconnectedTitle',
+          'Remote runtime disconnected'
+        )
+
+  const body = sshPane
+    ? translate(
+        'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.sshPaneBody',
+        'Orca cannot reach this terminal right now. Its shell may still be running, so starting a new one leaves it alone.'
+      )
+    : retrying
+      ? translate(
+          'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.retryingBody',
+          'Orca will retry for up to one minute. This terminal will resume if the connection returns.'
+        )
+      : translate(
+          'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.disconnectedBody',
+          'Automatic retries stopped. Reconnect to resume this terminal session.'
+        )
+
+  const runRecoveryAction = (action: () => void): void => {
+    try {
+      action()
+    } finally {
+      onRestoreTerminalFocus()
+    }
+  }
+
+  const reconnectLabel = sshPane
+    ? translate(
+        'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.tryAgainButton',
+        'Try again'
+      )
+    : translate(
+        'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.reconnectButton',
+        'Reconnect'
+      )
+  const startNewTerminalLabel = translate(
+    'auto.components.terminal.pane.TerminalPaneDisconnectedBanner.startNewTerminalButton',
+    'Start a new terminal'
+  )
+  const reconnectButton = (
+    <Button
+      size={compactActions ? 'icon-xs' : 'sm'}
+      aria-label={reconnectLabel}
+      onClick={() => runRecoveryAction(onReconnect)}
+    >
+      {compactActions ? (
+        <>
+          <RefreshCw />
+          <span className="sr-only">{reconnectLabel}</span>
+        </>
+      ) : (
+        reconnectLabel
+      )}
+    </Button>
+  )
+  const startNewTerminalButton = onStartNewTerminal ? (
+    <Button
+      size={compactActions ? 'icon-xs' : 'sm'}
+      variant="outline"
+      aria-label={startNewTerminalLabel}
+      onClick={() => runRecoveryAction(onStartNewTerminal)}
+    >
+      {compactActions ? (
+        <>
+          <SquareTerminal />
+          <span className="sr-only">{startNewTerminalLabel}</span>
+        </>
+      ) : (
+        startNewTerminalLabel
+      )}
+    </Button>
+  ) : null
+
+  return (
+    <div
+      ref={bannerRef}
+      className="@container/disconnected-banner pointer-events-none absolute inset-x-0 top-3 bottom-3 z-30 flex items-end justify-center"
+      data-terminal-remote-runtime-reconnect-banner={phase}
+      data-terminal-pane-disconnected-variant={variant}
+    >
+      <div
+        className="scrollbar-sleek pointer-events-auto flex max-h-full w-[calc(100%-1.5rem)] max-w-xl items-center gap-3 overflow-y-auto rounded-md border border-border bg-card/95 px-3 py-3 text-card-foreground shadow-xs backdrop-blur-[1px] @max-[360px]/disconnected-banner:flex-col @max-[360px]/disconnected-banner:items-stretch @max-[240px]/disconnected-banner:w-auto @max-[240px]/disconnected-banner:gap-0 @max-[240px]/disconnected-banner:p-0"
+        role="status"
+        aria-live="polite"
+      >
+        <div
+          className={`flex size-8 shrink-0 items-center justify-center rounded-md border border-border bg-muted text-muted-foreground ${
+            retrying
+              ? '@max-[240px]/disconnected-banner:size-6'
+              : '@max-[240px]/disconnected-banner:hidden'
+          }`}
+        >
+          {retrying ? (
+            <Loader2 className="size-4 animate-spin" />
+          ) : (
+            <ServerOff className="size-4" />
+          )}
+        </div>
+        <div className="min-w-0 flex-1 @max-[240px]/disconnected-banner:sr-only">
+          <div className="text-sm font-semibold">{title}</div>
+          <div className="mt-0.5 text-xs leading-5 text-muted-foreground">{body}</div>
+        </div>
+        {!retrying ? (
+          <div className="flex shrink-0 items-center gap-2 @max-[360px]/disconnected-banner:w-full @max-[360px]/disconnected-banner:flex-wrap @max-[360px]/disconnected-banner:justify-end @max-[240px]/disconnected-banner:justify-center @max-[240px]/disconnected-banner:gap-0">
+            {compactActions ? (
+              <Tooltip>
+                <TooltipTrigger asChild>{reconnectButton}</TooltipTrigger>
+                <TooltipContent side="top" sideOffset={4}>
+                  {reconnectLabel}
+                </TooltipContent>
+              </Tooltip>
+            ) : (
+              reconnectButton
+            )}
+            {/* Not `destructive`: the remote shell keeps running, so styling this as a loss would
+                itself overclaim. */}
+            {compactActions && startNewTerminalButton ? (
+              <Tooltip>
+                <TooltipTrigger asChild>{startNewTerminalButton}</TooltipTrigger>
+                <TooltipContent side="top" sideOffset={4}>
+                  {startNewTerminalLabel}
+                </TooltipContent>
+              </Tooltip>
+            ) : (
+              startNewTerminalButton
+            )}
+          </div>
+        ) : null}
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
index 5dbc1482af9..2196f7ed094 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
@@ -100,11 +100,24 @@ const TerminalPaneOverlayLayer = memo(function TerminalPaneOverlayLayer({
     return entries
   }, [groupActiveTabById, unifiedTabs])
 
+  const activeTerminalTabId = useMemo(() => {
+    if (!activeGroupId) {
+      return null
+    }
+    for (const [terminalTabId, assignment] of assignments) {
+      if (assignment.groupId === activeGroupId && assignment.isActiveInGroup) {
+        return terminalTabId
+      }
+    }
+    return null
+  }, [activeGroupId, assignments])
+
   const parkedTerminalTabIds = useTerminalTabColdParking({
     worktreeId,
     terminalTabs,
     assignments,
     isWorktreeActive,
+    activeTerminalTabId,
     coldParkTerminalPanes,
     isForceParked,
     shouldMeasureHiddenWorktree,
diff --git a/src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx b/src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx
deleted file mode 100644
index 70341d7a4f6..00000000000
--- a/src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx
+++ /dev/null
@@ -1,33 +0,0 @@
-// @vitest-environment happy-dom
-
-import '@testing-library/jest-dom/vitest'
-import { cleanup, render, screen } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { TerminalRemoteRuntimeReconnectBanner } from './TerminalRemoteRuntimeReconnectBanner'
-
-vi.mock('@/i18n/i18n', () => ({
-  translate: (_key: string, fallback: string) => fallback
-}))
-
-afterEach(cleanup)
-
-describe('TerminalRemoteRuntimeReconnectBanner', () => {
-  it('shows quiet bounded automatic recovery without a manual action', () => {
-    render(<TerminalRemoteRuntimeReconnectBanner phase="backoff" onReconnect={vi.fn()} />)
-
-    expect(screen.getByText('Reconnecting to remote runtime')).toBeInTheDocument()
-    expect(screen.getByText(/retry for up to one minute/)).toBeInTheDocument()
-    expect(screen.queryByRole('button')).not.toBeInTheDocument()
-  })
-
-  it('offers one explicit reconnect action after automatic recovery stops', async () => {
-    const onReconnect = vi.fn()
-    const user = userEvent.setup()
-    render(<TerminalRemoteRuntimeReconnectBanner phase="disconnected" onReconnect={onReconnect} />)
-
-    expect(screen.getByText('Remote runtime disconnected')).toBeInTheDocument()
-    await user.click(screen.getByRole('button', { name: 'Reconnect' }))
-    expect(onReconnect).toHaveBeenCalledOnce()
-  })
-})
diff --git a/src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.tsx b/src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.tsx
deleted file mode 100644
index c629fa71a36..00000000000
--- a/src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.tsx
+++ /dev/null
@@ -1,72 +0,0 @@
-import { Loader2, ServerOff } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import { translate } from '@/i18n/i18n'
-import type { PtyTransportRecoveryState } from './pty-transport-types'
-
-type VisibleRecoveryPhase = Extract<
-  PtyTransportRecoveryState['phase'],
-  'recovering' | 'backoff' | 'disconnected'
->
-
-export function TerminalRemoteRuntimeReconnectBanner({
-  phase,
-  onReconnect
-}: {
-  phase: VisibleRecoveryPhase
-  onReconnect: () => void
-}): React.JSX.Element {
-  const retrying = phase !== 'disconnected'
-
-  return (
-    <div
-      className="pointer-events-none absolute inset-x-3 bottom-3 z-30 flex justify-center"
-      data-terminal-remote-runtime-reconnect-banner={phase}
-    >
-      <div
-        className="pointer-events-auto flex w-full max-w-xl items-center gap-3 rounded-md border border-border bg-card/95 px-3 py-3 text-card-foreground shadow-xs backdrop-blur-[1px]"
-        role="status"
-        aria-live="polite"
-      >
-        <div className="flex size-8 shrink-0 items-center justify-center rounded-md border border-border bg-muted text-muted-foreground">
-          {retrying ? (
-            <Loader2 className="size-4 animate-spin" />
-          ) : (
-            <ServerOff className="size-4" />
-          )}
-        </div>
-        <div className="min-w-0 flex-1">
-          <div className="text-sm font-semibold">
-            {retrying
-              ? translate(
-                  'auto.components.terminal.pane.TerminalRemoteRuntimeReconnectBanner.retryingTitle',
-                  'Reconnecting to remote runtime'
-                )
-              : translate(
-                  'auto.components.terminal.pane.TerminalRemoteRuntimeReconnectBanner.disconnectedTitle',
-                  'Remote runtime disconnected'
-                )}
-          </div>
-          <div className="mt-0.5 text-xs leading-5 text-muted-foreground">
-            {retrying
-              ? translate(
-                  'auto.components.terminal.pane.TerminalRemoteRuntimeReconnectBanner.retryingBody',
-                  'Orca will retry for up to one minute. This terminal will resume if the connection returns.'
-                )
-              : translate(
-                  'auto.components.terminal.pane.TerminalRemoteRuntimeReconnectBanner.disconnectedBody',
-                  'Automatic retries stopped. Reconnect to resume this terminal session.'
-                )}
-          </div>
-        </div>
-        {!retrying ? (
-          <Button size="sm" onClick={onReconnect}>
-            {translate(
-              'auto.components.terminal.pane.TerminalRemoteRuntimeReconnectBanner.reconnectButton',
-              'Reconnect'
-            )}
-          </Button>
-        ) : null}
-      </div>
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/terminal-pane/agent-process-inspection-queue.ts b/src/renderer/src/components/terminal-pane/agent-process-inspection-queue.ts
index 797407b69a3..5c581ddc652 100644
--- a/src/renderer/src/components/terminal-pane/agent-process-inspection-queue.ts
+++ b/src/renderer/src/components/terminal-pane/agent-process-inspection-queue.ts
@@ -45,7 +45,7 @@ function pumpInspectionQueue(): void {
 
   const priorityIndex = inspectionQueue.findIndex((task) => task.priority === 'pending-title')
   const next =
-    priorityIndex >= 0 ? inspectionQueue.splice(priorityIndex, 1)[0] : inspectionQueue.shift()
+    priorityIndex !== -1 ? inspectionQueue.splice(priorityIndex, 1)[0] : inspectionQueue.shift()
   if (!next) {
     return
   }
diff --git a/src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts b/src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts
new file mode 100644
index 00000000000..b3b949addbe
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts
@@ -0,0 +1,608 @@
+/**
+ * Real-fish regression for #9993: Orca must never write `CSI ?997;Nn` into a PTY
+ * because fish armed DECSET 2031 around a prompt.
+ *
+ * fish toggles `?2031h ... ?2031l` in tty_handoff.rs every time it paints a prompt and
+ * withdraws before handing the tty to a child, so the arm window is ~1ms — shorter than
+ * a renderer IPC hop. Any reply lands after the withdrawal and is read by whatever owns
+ * the tty next: it paints as literal `?997;1n` at the prompt, or is swallowed by a child
+ * that reads stdin (npx / brew confirm prompts).
+ *
+ * The assertion is therefore about what a CHILD PROCESS READS, not what renders: a
+ * screen-level check passes while the child's stdin is still corrupted.
+ *
+ * Real production code under test: connectPanePty's live mode-2031 chunk observer. The
+ * mock transport writes whatever the renderer sends straight into the real fish PTY, so a
+ * reply-on-subscribe reaches the child exactly as it does in the app. DA1/CPR/OSC-10/11
+ * probes are answered by the harness because no real xterm is attached here — without
+ * them fish stalls ~10s on its DA1 wait and every timing claim becomes meaningless.
+ */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import type * as React from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  fishRequirementViolation,
+  resolveFishBinary
+} from '../../../../shared/fish-binary-requirement'
+
+// Why a version floor and not just presence: DECSET 2031 arming lives in the Rust
+// tty_handoff introduced by the fish 4.0 rewrite. An older fish cannot produce the
+// subscribe at all, so the test would pass vacuously instead of guarding anything.
+const FISH = resolveFishBinary(4)
+const FISH_BIN = FISH.path
+const itWithFish = FISH.available ? it : it.skip
+
+const PROMPT_MARK = 'ORCA997> '
+const COLOR_SCHEME_REPORT_PREFIX = '\x1b[?997'
+const ARM_2031 = '\x1b[?2031h'
+const WITHDRAW_2031 = '\x1b[?2031l'
+const LEAF_1 = '11111111-1111-4111-8111-111111111111'
+const DA1_REPLY = '\x1b[?62;4;6;22c'
+const DSR_REPLY = '\x1b[1;1R'
+const OSC_10_REPLY = '\x1b]10;rgb:eeee/eeee/eeee\x1b\\'
+const OSC_11_REPLY = '\x1b]11;rgb:1e1e/1e1e/1e1e\x1b\\'
+const TERMINAL_QUERY_REPLIES: readonly (readonly [string, string])[] = [
+  ['\x1b[0c', DA1_REPLY],
+  ['\x1b[c', DA1_REPLY],
+  ['\x1b[6n', DSR_REPLY],
+  ['\x1b]10;?\x07', OSC_10_REPLY],
+  ['\x1b]10;?\x1b\\', OSC_10_REPLY],
+  ['\x1b]11;?\x07', OSC_11_REPLY],
+  ['\x1b]11;?\x1b\\', OSC_11_REPLY]
+]
+const QUERY_CARRY_LENGTH = Math.max(...TERMINAL_QUERY_REPLIES.map(([query]) => query.length)) - 1
+
+type MutableState = Record<string, unknown>
+let mockStoreState: MutableState = {}
+let storeSubscribers: ((state: MutableState) => void)[] = []
+let transportFactoryQueue: unknown[] = []
+
+vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
+vi.mock('./terminal-webgl-atlas-recovery', () => ({
+  scheduleTerminalWebglAtlasRecovery: vi.fn()
+}))
+vi.mock('@/lib/codex-stale-pane-sweep', () => ({ notifyCodexPaneBoundForStaleSweep: vi.fn() }))
+vi.mock('sonner', () => ({ toast: { info: vi.fn() } }))
+vi.mock('./cache-timer-seeding', () => ({ shouldSeedCacheTimerOnInitialTitle: vi.fn(() => false) }))
+vi.mock('@/store', () => ({
+  useAppStore: {
+    getState: () => mockStoreState,
+    subscribe: (listener: (state: MutableState) => void) => {
+      storeSubscribers.push(listener)
+      return () => {
+        storeSubscribers = storeSubscribers.filter((candidate) => candidate !== listener)
+      }
+    }
+  }
+}))
+// Why: connectPanePty calls useNotificationDispatch's useCallback outside React.
+vi.mock('react', async (importOriginal) => ({
+  ...(await importOriginal<typeof React>()),
+  useCallback: <T>(fn: T): T => fn
+}))
+vi.mock('./pty-transport', () => ({
+  createIpcPtyTransport: vi.fn(() => {
+    const next = transportFactoryQueue.shift()
+    if (!next) {
+      throw new Error('No mock transport queued')
+    }
+    return next
+  })
+}))
+
+type ConnectCallbacks = { onData?: (data: string) => void }
+
+/** Mock transport whose renderer→PTY writes land in the real fish master fd. */
+function createPtyBackedTransport(write: (data: string) => void): {
+  transport: Record<string, unknown>
+  sent: string[]
+  emit: (data: string) => void
+} {
+  const sent: string[] = []
+  const captured: { current: ((data: string) => void) | null } = { current: null }
+  const send = (data: string): boolean => {
+    sent.push(data)
+    write(data)
+    return true
+  }
+  const transport = {
+    attach: vi.fn(),
+    connect: vi.fn(async ({ callbacks }: { callbacks?: ConnectCallbacks }) => {
+      captured.current = callbacks?.onData ?? null
+      return 'fish-pty'
+    }),
+    disconnect: vi.fn(),
+    sendInput: vi.fn(send),
+    sendInputImmediate: vi.fn(send),
+    sendInputAccepted: vi.fn(async (data: string) => send(data)),
+    isConnected: vi.fn(() => true),
+    claimViewport: vi.fn(() => true),
+    resize: vi.fn(() => true),
+    getPtyId: vi.fn(() => 'fish-pty'),
+    getConnectionId: vi.fn(() => null)
+  }
+  return { transport, sent, emit: (data: string) => captured.current?.(data) }
+}
+
+function createPane(paneId: number): Record<string, unknown> {
+  const activeBuffer = { type: 'normal' as const, viewportY: 0, baseY: 0, cursorY: 0, cursorX: 0 }
+  const container = new EventTarget()
+  Object.defineProperty(container, 'dataset', { configurable: true, value: {} })
+  return {
+    id: paneId,
+    leafId: LEAF_1,
+    stablePaneId: LEAF_1,
+    container,
+    fitAddon: { fit: vi.fn(), proposeDimensions: vi.fn(() => ({ cols: 120, rows: 30 })) },
+    terminal: {
+      cols: 120,
+      rows: 30,
+      element: {},
+      buffer: { active: activeBuffer },
+      modes: { bracketedPasteMode: false, sendFocusMode: false },
+      options: { scrollback: 5_000, theme: { foreground: '#eeeeee', background: '#111111' } },
+      write: vi.fn(),
+      resize: vi.fn(),
+      clear: vi.fn(),
+      scrollToBottom: vi.fn(),
+      paste: vi.fn(),
+      onData: vi.fn(() => ({ dispose: vi.fn() })),
+      onResize: vi.fn(() => ({ dispose: vi.fn() })),
+      onRender: vi.fn(() => ({ dispose: vi.fn() })),
+      onTitleChange: vi.fn(() => ({ dispose: vi.fn() })),
+      hasSelection: vi.fn(() => false),
+      parser: {
+        registerCsiHandler: vi.fn(() => ({ dispose: vi.fn() })),
+        registerOscHandler: vi.fn(() => ({ dispose: vi.fn() }))
+      }
+    }
+  }
+}
+
+function createDeps(): Record<string, unknown> {
+  return {
+    tabId: 'tab-1',
+    worktreeId: 'wt-1',
+    cwd: '/tmp/wt-1',
+    startup: null,
+    restoredLeafId: null,
+    restoredPtyIdByLeafId: {},
+    paneTransportsRef: { current: new Map() },
+    paneMode2031Ref: { current: new Map<number, boolean>() },
+    paneKittyKeyboardModesRef: { current: new Map() },
+    paneLastThemeModeRef: { current: new Map<number, 'dark' | 'light'>() },
+    replayingPanesRef: { current: new Map() },
+    isActiveRef: { current: true },
+    isVisibleRef: { current: true },
+    onPtyExitRef: { current: vi.fn() },
+    onAgentExitedRef: { current: vi.fn() },
+    onPtyErrorRef: { current: vi.fn() },
+    clearTabPtyId: vi.fn(),
+    consumeSuppressedPtyExit: vi.fn(() => false),
+    isPtyShutdownPending: vi.fn(() => false),
+    updateTabTitle: vi.fn(),
+    setRuntimePaneTitle: vi.fn(),
+    clearRuntimePaneTitle: vi.fn(),
+    updateTabPtyId: vi.fn(),
+    markWorktreeUnread: vi.fn(),
+    markTerminalTabUnread: vi.fn(),
+    markTerminalPaneUnread: vi.fn(),
+    clearWorktreeUnread: vi.fn(),
+    clearTerminalTabUnread: vi.fn(),
+    clearTerminalPaneUnread: vi.fn(),
+    dispatchNotification: vi.fn(),
+    onShowSessionRestoredBanner: vi.fn(),
+    setCacheTimerStartedAt: vi.fn(),
+    syncPanePtyLayoutBinding: vi.fn(),
+    clearExitedPanePtyLayoutBinding: vi.fn()
+  }
+}
+
+function createManager(pane: Record<string, unknown>): Record<string, unknown> {
+  return {
+    setPaneGpuRendering: vi.fn(),
+    markPaneHasComplexScriptOutput: vi.fn(),
+    rebuildPaneWebgl: vi.fn(),
+    hasWebglRenderer: vi.fn(() => false),
+    getPanes: vi.fn(() => [pane]),
+    closePane: vi.fn(),
+    getActivePane: vi.fn(() => pane),
+    getNumericIdForLeaf: vi.fn(() => 1),
+    setActivePane: vi.fn()
+  }
+}
+
+const sleep = (msValue: number): Promise<void> =>
+  new Promise((resolve) => setTimeout(resolve, msValue))
+
+const countOf = (haystack: string, needle: string): number => haystack.split(needle).length - 1
+
+async function waitUntil(predicate: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    if (predicate()) {
+      return true
+    }
+    await sleep(10)
+  }
+  return false
+}
+
+function createTerminalQueryResponder(write: (reply: string) => void): {
+  accept: (chunk: string) => void
+  getCarryLength: () => number
+} {
+  let carry = ''
+  return {
+    accept: (chunk) => {
+      const carriedLength = carry.length
+      const scan = carry + chunk
+      carry = scan.slice(-QUERY_CARRY_LENGTH)
+      for (let at = 0; at < scan.length; at += 1) {
+        for (const [query, reply] of TERMINAL_QUERY_REPLIES) {
+          if (!scan.startsWith(query, at)) {
+            continue
+          }
+          if (at + query.length > carriedLength) {
+            write(reply)
+          }
+          at += query.length - 1
+          break
+        }
+      }
+    },
+    getCarryLength: () => carry.length
+  }
+}
+
+function allChunkPartitions(input: string): string[][] {
+  if (input.length === 0) {
+    return [[]]
+  }
+  const partitions: string[][] = []
+  for (let end = 1; end <= input.length; end += 1) {
+    for (const suffix of allChunkPartitions(input.slice(end))) {
+      partitions.push([input.slice(0, end), ...suffix])
+    }
+  }
+  return partitions
+}
+
+function collectTerminalQueryReplies(chunks: readonly string[]): string[] {
+  const replies: string[] = []
+  const responder = createTerminalQueryResponder((reply) => replies.push(reply))
+  chunks.forEach(responder.accept)
+  return replies
+}
+
+describe('terminal query responder', () => {
+  it.each([
+    ['OSC 10 BEL', '\x1b]10;?\x07', OSC_10_REPLY],
+    ['OSC 10 ST', '\x1b]10;?\x1b\\', OSC_10_REPLY],
+    ['OSC 11 BEL', '\x1b]11;?\x07', OSC_11_REPLY],
+    ['OSC 11 ST', '\x1b]11;?\x1b\\', OSC_11_REPLY]
+  ])('answers each complete %s query once across every partition', (_label, query, reply) => {
+    for (const chunks of allChunkPartitions(query)) {
+      expect(collectTerminalQueryReplies(chunks)).toEqual([reply])
+    }
+  })
+
+  it.each([
+    ['DA1 with omitted parameter', '\x1b[c', DA1_REPLY],
+    ['DA1 with zero parameter', '\x1b[0c', DA1_REPLY],
+    ['DSR cursor position', '\x1b[6n', DSR_REPLY]
+  ])('preserves %s across every partition', (_label, query, reply) => {
+    for (const chunks of allChunkPartitions(query)) {
+      expect(collectTerminalQueryReplies(chunks)).toEqual([reply])
+    }
+  })
+
+  it.each([
+    ['unterminated OSC 10', '\x1b]10;?'],
+    ['unterminated OSC 11 ST', '\x1b]11;?\x1b'],
+    ['OSC 10 extra query marker', '\x1b]10;??\x07'],
+    ['OSC 11 stacked query', '\x1b]11;?;?\x07'],
+    ['OSC 10 malformed body', '\x1b]10;?x\x07'],
+    ['OSC 11 malformed ST body', '\x1b]11;?x\x1b\\'],
+    ['OSC slot lookalike', '\x1b]110;?\x07']
+  ])('rejects %s across every partition', (_label, input) => {
+    for (const chunks of allChunkPartitions(input)) {
+      expect(collectTerminalQueryReplies(chunks)).toEqual([])
+    }
+  })
+
+  it('answers concatenated queries once each in source order across every partition', () => {
+    const input = '\x1b]10;?\x07\x1b]11;?\x07'
+    for (const chunks of allChunkPartitions(input)) {
+      expect(collectTerminalQueryReplies(chunks)).toEqual([OSC_10_REPLY, OSC_11_REPLY])
+    }
+  })
+
+  it('bounds carry while rejecting a long unterminated query lookalike', () => {
+    const replies: string[] = []
+    const responder = createTerminalQueryResponder((reply) => replies.push(reply))
+    let maxCarryLength = 0
+    for (const fragment of `\x1b]10;?${'x'.repeat(10_000)}`) {
+      responder.accept(fragment)
+      maxCarryLength = Math.max(maxCarryLength, responder.getCarryLength())
+    }
+    for (const fragment of '\x1b]10;?\x07') {
+      responder.accept(fragment)
+    }
+
+    expect(maxCarryLength).toBe(QUERY_CARRY_LENGTH)
+    expect(responder.getCarryLength()).toBeLessThanOrEqual(QUERY_CARRY_LENGTH)
+    expect(replies).toEqual([OSC_10_REPLY])
+  })
+})
+
+describe('fish never receives a color-scheme report it did not query (#9993)', () => {
+  let configHome: string | null = null
+
+  // Always runs, so the CI lane cannot report green with the regression below skipped.
+  it('has the fish this suite needs when CI requires one', () => {
+    expect(fishRequirementViolation(FISH)).toBeNull()
+  })
+
+  beforeEach(() => {
+    vi.resetModules()
+    vi.clearAllMocks()
+    transportFactoryQueue = []
+    storeSubscribers = []
+    mockStoreState = {
+      activeWorktreeId: 'wt-1',
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: 'fish-pty' }] },
+      ptyIdsByTabId: { 'tab-1': ['fish-pty'] },
+      terminalLayoutsByTabId: {
+        'tab-1': {
+          root: { type: 'leaf', leafId: LEAF_1 },
+          activeLeafId: LEAF_1,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [LEAF_1]: 'fish-pty' }
+        }
+      },
+      unreadTerminalTabs: {},
+      deleteStateByWorktreeId: {},
+      worktreesByRepo: { repo1: [{ id: 'wt-1', repoId: 'repo1', path: '/tmp/wt-1' }] },
+      runtimeStatusByEnvironmentId: new Map(),
+      repos: [{ id: 'repo1', connectionId: null }],
+      projects: [],
+      sshConnectionStates: new Map(),
+      transientClearedAgentStatusConnectionIds: {},
+      cacheTimerByKey: {},
+      // Dark app mode: a pre-fix reply is `CSI ?997;1n`, the exact payload issue #9993 reports.
+      settings: {
+        theme: 'dark',
+        promptCacheTimerEnabled: true,
+        terminalMainSideEffectAuthority: false
+      },
+      codexRestartNoticeByPtyId: {},
+      deferredSshReconnectTargets: [],
+      deferredSshSessionIdsByTabId: {},
+      removeDeferredSshReconnectTarget: vi.fn(),
+      removeDeferredSshSessionId: vi.fn(),
+      consumePendingColdRestore: vi.fn(() => null),
+      consumePendingSnapshot: vi.fn(() => null),
+      runtimePaneTitlesByTabId: {},
+      agentStatusByPaneKey: {},
+      retainedAgentsByPaneKey: {},
+      paneForegroundAgentByPaneKey: {},
+      sleepingAgentSessionsByPaneKey: {},
+      suppressedPtyExitIds: {},
+      agentLaunchConfigByPaneKey: {},
+      getAgentLaunchConfigForStatusEntry: vi.fn(),
+      getAgentLaunchConfigForStatusMetadata: vi.fn(),
+      clearSleepingAgentSession: vi.fn(),
+      registerAgentLaunchConfig: vi.fn(),
+      clearAgentLaunchConfig: vi.fn(),
+      markWorktreeUnread: vi.fn(),
+      observeTerminalGitHubPullRequestLink: vi.fn(),
+      recordTerminalInput: vi.fn(),
+      setAgentStatus: vi.fn(),
+      removeAgentStatus: vi.fn(),
+      dropAgentStatus: vi.fn(),
+      retireAgentPaneAuthority: vi.fn(),
+      setPaneForegroundAgent: vi.fn(),
+      clearPaneForegroundAgent: vi.fn(),
+      markTerminalTabUnread: vi.fn(),
+      markTerminalPaneUnread: vi.fn(),
+      markAgentCompletionPaneUnread: vi.fn()
+    }
+    ;(globalThis as unknown as { window: unknown }).window = {
+      api: {
+        pty: {
+          kill: vi.fn(),
+          signal: vi.fn(),
+          listSessions: vi.fn().mockResolvedValue([]),
+          hasPty: vi.fn().mockResolvedValue(true),
+          getSize: vi.fn().mockResolvedValue(null),
+          reportGeometry: vi.fn(),
+          getMainBufferSnapshot: vi.fn().mockResolvedValue(null),
+          getForegroundProcess: vi.fn().mockResolvedValue(null),
+          inspectProcess: vi.fn().mockResolvedValue(null),
+          confirmForegroundProcess: vi.fn().mockResolvedValue(null),
+          hasChildProcesses: vi.fn().mockResolvedValue(false),
+          write: vi.fn(),
+          writeAccepted: vi.fn().mockResolvedValue(true),
+          setHiddenRendererPty: vi.fn(),
+          setPtyDeliveryInterest: vi.fn(),
+          ackColdRestore: vi.fn(),
+          onClearBufferRequest: vi.fn(() => vi.fn()),
+          onSerializeBufferRequest: vi.fn(() => vi.fn()),
+          sendSerializedBuffer: vi.fn(),
+          declarePendingPaneSerializer: vi.fn().mockResolvedValue(1),
+          settlePaneSerializer: vi.fn().mockResolvedValue(undefined),
+          clearPendingPaneSerializer: vi.fn().mockResolvedValue(undefined),
+          reportRendererSerializerReady: vi.fn().mockResolvedValue(undefined)
+        },
+        platform: { get: vi.fn(() => ({ platform: process.platform, osRelease: '' })) },
+        notifications: {
+          dispatch: vi.fn().mockResolvedValue({ delivered: true }),
+          playSound: vi.fn().mockResolvedValue({ played: true })
+        },
+        runtime: { restoreTerminalFit: vi.fn().mockResolvedValue({ restored: true }) },
+        agentStatus: { inferInterrupt: vi.fn().mockResolvedValue(false) }
+      },
+      dispatchEvent: vi.fn(),
+      addEventListener: vi.fn(),
+      removeEventListener: vi.fn()
+    }
+    globalThis.requestAnimationFrame = vi.fn((callback: FrameRequestCallback) => {
+      callback(0)
+      return 1
+    })
+    globalThis.cancelAnimationFrame = vi.fn()
+  })
+
+  afterEach(() => {
+    delete (globalThis as { requestAnimationFrame?: unknown }).requestAnimationFrame
+    delete (globalThis as { cancelAnimationFrame?: unknown }).cancelAnimationFrame
+    delete (globalThis as { window?: unknown }).window
+    if (configHome) {
+      rmSync(configHome, { recursive: true, force: true })
+      configHome = null
+    }
+  })
+
+  itWithFish(
+    'writes no CSI 997 while fish arms mode 2031 around its prompt, so a child reads clean stdin',
+    async () => {
+      const { connectPanePty } = await import('./pty-connection')
+      const nodePty = await import('node-pty')
+
+      configHome = mkdtempSync(path.join(tmpdir(), 'orca-fish-2031-'))
+      mkdirSync(path.join(configHome, 'fish'), { recursive: true })
+      // Plain prompt, no user config: fish core toggles DEC 2031 regardless of the prompt.
+      writeFileSync(
+        path.join(configHome, 'fish/config.fish'),
+        [
+          'set -g fish_greeting ""',
+          `function fish_prompt; printf '${PROMPT_MARK}'; end`,
+          'function fish_right_prompt; end',
+          ''
+        ].join('\n')
+      )
+      // Echoes the first stdin LINE back escaped, so leaked control bytes are visible on
+      // screen. Why a line and not the first chunk: leaked replies carry no newline, so a
+      // once('data') child reports them alone whenever they arrive in their own read —
+      // which is what the issue's own `sys.stdin.readline()` repro measures.
+      const childScript = path.join(configHome, 'read-stdin.mjs')
+      writeFileSync(
+        childScript,
+        "let buffered = ''\n" +
+          "process.stdin.on('data', (d) => {\n" +
+          "  buffered += d.toString('utf8')\n" +
+          "  if (!buffered.includes('\\n')) return\n" +
+          "  process.stdout.write('CHILD-READ:' + JSON.stringify(buffered) + '\\n')\n" +
+          '  process.exit(0)\n' +
+          '})\n' +
+          "process.stdout.write('CHILD-READY\\n')\n"
+      )
+
+      const term = nodePty.spawn(FISH_BIN as string, ['-l', '-i'], {
+        name: 'xterm-256color',
+        cols: 120,
+        rows: 30,
+        cwd: configHome,
+        env: {
+          PATH: process.env.PATH ?? '/usr/bin:/bin',
+          HOME: configHome,
+          TERM: 'xterm-256color',
+          COLORTERM: 'truecolor',
+          LANG: 'en_US.UTF-8',
+          XDG_CONFIG_HOME: configHome,
+          XDG_DATA_HOME: path.join(configHome, 'data'),
+          ORCA_NODE_BIN: process.execPath,
+          ORCA_CHILD_SCRIPT: childScript
+        }
+      })
+
+      let rendered = ''
+      const { transport, sent, emit } = createPtyBackedTransport((data) => term.write(data))
+      const answerTerminalQueries = createTerminalQueryResponder((reply) => term.write(reply))
+      transportFactoryQueue.push(transport)
+
+      // Why answered here: no real xterm is attached, and fish blocks its first prompt ~10s
+      // on DA1 and re-probes every prompt. These are harness bytes, never renderer output.
+      term.onData((chunk) => {
+        rendered += chunk
+        // Maximal fragmentation keeps query handling independent of node-pty chunk boundaries.
+        for (const fragment of chunk) {
+          answerTerminalQueries.accept(fragment)
+        }
+        emit(chunk)
+      })
+
+      let exited = false
+      term.onExit(() => {
+        exited = true
+      })
+
+      try {
+        const pane = createPane(1)
+        const deps = createDeps()
+        const binding = connectPanePty(pane as never, createManager(pane) as never, deps as never)
+
+        expect(await waitUntil(() => rendered.includes(PROMPT_MARK), 15_000)).toBe(true)
+        // The arm is the settle signal.
+        expect(await waitUntil(() => rendered.includes(ARM_2031), 5_000)).toBe(true)
+        // Vacuity guard: the renderer observer must actually have seen the subscribe,
+        // otherwise "sent nothing" is trivially true. Checked here and not at the end,
+        // because the last decision races between fish's subscribe and its withdrawal.
+        const paneMode2031 = (deps as { paneMode2031Ref: { current: Map<number, boolean> } })
+          .paneMode2031Ref.current
+        expect(await waitUntil(() => paneMode2031.get(1) === true, 5_000)).toBe(true)
+
+        // Type-ahead is the deterministic leak shape: queue the child command while an
+        // external command still owns the tty, so fish repaints the prompt (`?2031h`) and
+        // consumes the buffered line in the same breath — handoff lands sub-millisecond
+        // after the subscribe, inside any reply's flight time.
+        term.write('sleep 0.4\r')
+        // Withdrawal #1: `sleep` owns the tty now, so the next line is typed ahead.
+        expect(await waitUntil(() => countOf(rendered, WITHDRAW_2031) >= 1, 5_000)).toBe(true)
+        term.write('"$ORCA_NODE_BIN" "$ORCA_CHILD_SCRIPT"\r')
+        // Withdrawal #2: fish re-armed for the prompt and accepted the child command.
+        expect(await waitUntil(() => countOf(rendered, WITHDRAW_2031) >= 2, 5_000)).toBe(true)
+        // DECSET withdrawal precedes fish's child spawn; the child's marker is the ownership signal.
+        expect(await waitUntil(() => rendered.includes('CHILD-READY'), 5_000)).toBe(true)
+
+        const renderedBeforeChildInput = rendered.length
+        // Canonical mode buffers this in the tty, so it queues behind anything already
+        // written there — including a reply the renderer sent during the handoff.
+        term.write('hello\r')
+        expect(
+          await waitUntil(
+            () => rendered.slice(renderedBeforeChildInput).includes('CHILD-READ:'),
+            10_000
+          )
+        ).toBe(true)
+
+        const childRead =
+          rendered.slice(renderedBeforeChildInput).match(/CHILD-READ:[^\r\n]*/)?.[0] ?? ''
+        // The merge-blocking assertion: the child's STDIN, not the screen. A rendered-output
+        // check passes while npx/brew confirm prompts still eat the bytes.
+        // Scope note: the harness' own DA1/CPR/OSC-11 answers can still land here — that is
+        // the separate probe-reply family (fish asks for those; nobody asked for 997).
+        expect(childRead).not.toContain('997')
+        expect(childRead).toContain('hello')
+        // Nothing the renderer sent was a color-scheme report, on any path.
+        expect(sent.filter((data) => data.includes(COLOR_SCHEME_REPORT_PREFIX))).toEqual([])
+        // And fish never echoed one back as literal prompt text.
+        expect(rendered).not.toContain('997;1n')
+
+        binding.dispose()
+      } finally {
+        term.write('exit\r')
+        await waitUntil(() => exited, 3_000)
+        try {
+          term.kill()
+        } catch {
+          // already gone
+        }
+      }
+    },
+    30_000
+  )
+})
diff --git a/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts b/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts
index 93349254955..1a9653d15c8 100644
--- a/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts
+++ b/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts
@@ -108,19 +108,19 @@ describe('startParkedTerminalByteWatcher', () => {
 
   async function startWatcher(
     overrides: Partial<ParkedTerminalByteWatcherOptions> = {}
-  ): Promise<{ dispose: () => void; sendInput: ReturnType<typeof vi.fn> }> {
+  ): Promise<{ dispose: () => void; ptyWrite: ReturnType<typeof vi.fn> }> {
     const { startParkedTerminalByteWatcher } = await import('./parked-terminal-byte-watcher')
-    const sendInput = vi.fn()
+    const ptyWrite = vi.fn()
+    ;(window as unknown as { api: { pty: Record<string, unknown> } }).api.pty.write = ptyWrite
     const dispose = startParkedTerminalByteWatcher({
       ptyId: PTY_ID,
       tabId: TAB_ID,
       worktreeId: WORKTREE_ID,
       leafId: LEAF_ID,
       paneId: PANE_ID,
-      sendInput,
       ...overrides
     })
-    return { dispose, sendInput }
+    return { dispose, ptyWrite }
   }
 
   beforeEach(() => {
@@ -360,31 +360,20 @@ describe('startParkedTerminalByteWatcher', () => {
     dispose()
   })
 
-  it('answers a DECSET 2031 subscribe split across chunks via sendInput', async () => {
-    const { dispose, sendInput } = await startWatcher()
+  // Regression pin (#9993): DECSET 2031 subscribes to future color changes — it is not a
+  // query (that is CSI ?996n). A parked tab has no view to answer with and any reply lands
+  // after fish withdrew the mode, painting `?997;1n` at the prompt.
+  it('never writes a color-scheme reply for a DECSET 2031 subscribe', async () => {
+    const { dispose, ptyWrite } = await startWatcher()
 
     emit('\x1b[?20')
-    expect(sendInput).not.toHaveBeenCalled()
-
     emit('31h')
-    expect(sendInput).toHaveBeenCalledTimes(1)
-    // theme=system + prefers-dark → dark reply per terminal-color-scheme-protocol.
-    expect(sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
-
     emit('\x1b[?2031l')
-    expect(sendInput).toHaveBeenCalledTimes(1)
+
+    expect(ptyWrite).not.toHaveBeenCalled()
     dispose()
   })
 
-  it('stops answering DECSET 2031 after dispose', async () => {
-    const { dispose, sendInput } = await startWatcher()
-
-    dispose()
-    emit('\x1b[?2031h')
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
   it('observes GitHub PR links across chunk boundaries', async () => {
     const { dispose } = await startWatcher()
 
@@ -608,8 +597,7 @@ describe('startParkedTerminalByteWatcher', () => {
   //
   // With the kill switch on, the watcher must not register byte parsers —
   // main is the single byte parser and the watcher's policy block consumes
-  // pty:sideEffect facts instead. The byte sidecar stays ONLY for the 2031
-  // reply (query authority never moves to main); PR links arrive as facts.
+  // pty:sideEffect facts instead; PR links arrive as facts.
   describe('with main side-effect authority on', () => {
     function enableMainAuthority(): void {
       mockStoreState.settings = {
@@ -875,19 +863,15 @@ describe('startParkedTerminalByteWatcher', () => {
       dispose()
     })
 
-    it('answers DECSET 2031 from the main 2031-subscribe fact, never the byte scan', async () => {
-      // Why: with the hidden-delivery gate on (default), parked PTY bytes are
-      // dropped in main — the fact is the only 2031 signal, and the byte
-      // sidecar must NOT exist (its registration would re-enable delivery).
+    it('stays silent on a main 2031-subscribe fact', async () => {
+      // Regression pin (#9993): the fact records a subscription for theme-flip
+      // pushes; a parked watcher must never answer it.
       enableMainAuthority()
-      const { dispose, sendInput } = await startWatcher()
+      const { dispose, ptyWrite } = await startWatcher()
 
       emit('\x1b[?2031h')
-      expect(sendInput).not.toHaveBeenCalled()
-
       await dispatchFacts([{ kind: '2031-subscribe' }])
-      expect(sendInput).toHaveBeenCalledTimes(1)
-      expect(sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
+      expect(ptyWrite).not.toHaveBeenCalled()
 
       // Why: pr-link facts arrive on the channel; byte-scanning here too
       // would observe every link twice.
@@ -912,7 +896,7 @@ describe('startParkedTerminalByteWatcher', () => {
       expect(setHiddenRendererPty).toHaveBeenLastCalledWith(PTY_ID, false)
     })
 
-    it('keeps the byte 2031 responder and no hidden bit when the gate kill switch is off', async () => {
+    it('sets no hidden bit and stays silent on 2031 when the gate kill switch is off', async () => {
       enableMainAuthority()
       mockStoreState.settings = {
         ...mockStoreState.settings,
@@ -922,20 +906,14 @@ describe('startParkedTerminalByteWatcher', () => {
       ;(
         window as unknown as { api: { pty: Record<string, unknown> } }
       ).api.pty.setHiddenRendererPty = setHiddenRendererPty
-      const { dispose, sendInput } = await startWatcher()
+      const { dispose, ptyWrite } = await startWatcher()
 
-      // Gate off — bytes keep flowing, so the split-chunk byte scan answers.
+      // Gate off — bytes keep flowing, and they still elicit nothing (#9993).
       emit('\x1b[?20')
-      expect(sendInput).not.toHaveBeenCalled()
       emit('31h')
-      expect(sendInput).toHaveBeenCalledTimes(1)
-      expect(sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
-
-      // Why: a 2031-subscribe fact must not double-fire the reply in byte
-      // mode — exactly one responder owns the answer at any time.
       await dispatchFacts([{ kind: '2031-subscribe' }])
-      expect(sendInput).toHaveBeenCalledTimes(1)
 
+      expect(ptyWrite).not.toHaveBeenCalled()
       expect(setHiddenRendererPty).not.toHaveBeenCalled()
       dispose()
     })
diff --git a/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts b/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts
index 42dff141d34..8d24cfca7f7 100644
--- a/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts
+++ b/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts
@@ -5,12 +5,7 @@
 import { isClaudeAgent } from '../../../../shared/agent-detection'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { useAppStore } from '@/store'
-import {
-  mode2031SequenceFor,
-  resolveTerminalColorSchemeMode
-} from '../../../../shared/terminal-color-scheme-protocol'
 import { createTerminalGitHubPRLinkDetector } from '../../../../shared/terminal-github-pr-link-detector'
-import { getSystemPrefersDark } from '@/lib/terminal-theme'
 import {
   AGENT_TASK_COMPLETE_NOTIFICATION_GRACE_MS,
   isAgentTaskCompleteOsNotificationEnabledFromState,
@@ -22,7 +17,6 @@ import {
   createParkedTerminalCommandStatusPolicy,
   readInFlightCommandCodeTurn
 } from './parked-terminal-command-status'
-import { startParkedTerminalMode2031Responder } from './parked-terminal-mode2031-responder'
 import { subscribeToPtyData } from './pty-data-sidecar-subscriptions'
 import { createPtyOutputProcessor } from './pty-transport'
 import { isRendererHiddenPtyDeliveryGateEnabled } from './terminal-hidden-delivery-gate'
@@ -61,8 +55,6 @@ export type ParkedTerminalByteWatcherOptions = {
   initialTitle?: string
   /** Pull main's title-only snapshot when a watcher starts before its pane ever mounted (ordinary park cycles already have a title). */
   restoreTitleOnRegister?: boolean
-  /** Out-of-band reply channel to the PTY (mode-2031 color-scheme answers). */
-  sendInput: (data: string) => void
 }
 
 const parkedWatcherDisposersByPtyId = new Map<string, () => void>()
@@ -70,7 +62,7 @@ const parkedWatcherDisposersByPtyId = new Map<string, () => void>()
 export function startParkedTerminalByteWatcher(
   options: ParkedTerminalByteWatcherOptions
 ): () => void {
-  const { ptyId, tabId, worktreeId, paneId, sendInput } = options
+  const { ptyId, tabId, worktreeId, paneId } = options
   const remoteRuntimePty = isRemoteRuntimePtyId(ptyId)
   const drivesTabTitle = options.drivesTabTitle ?? true
   const paneKey = makePaneKey(tabId, options.leafId)
@@ -213,16 +205,9 @@ export function startParkedTerminalByteWatcher(
       runtimeEnvironmentId: null
     })
   const factSideEffectAuthority = mainSideEffectAuthority || remoteRuntimePty
-  // Why: decided once at watcher start — it picks which 2031 responder (byte sidecar vs fact reply) exists, so it must never flip per chunk.
   const hiddenDeliveryGateActive =
     mainSideEffectAuthority &&
     isRendererHiddenPtyDeliveryGateEnabled(useAppStore.getState().settings)
-  const factOwnsMode2031 = hiddenDeliveryGateActive || remoteRuntimePty
-
-  const sendMode2031Reply = (): void => {
-    const settings = useAppStore.getState().settings
-    sendInput(mode2031SequenceFor(resolveTerminalColorSchemeMode(settings, getSystemPrefersDark())))
-  }
 
   // Why (byte-parser mode only): reuse the transport's output processor to keep exact live-path parsing semantics.
   // initialAgentTitle: an agent already working at park time still produces a working→idle transition.
@@ -261,20 +246,13 @@ export function startParkedTerminalByteWatcher(
           onCommandCodeWorking: commandStatusPolicy.onCommandCodeWorking,
           onCommandCodeDone: commandStatusPolicy.onCommandCodeDone,
           onPrLink: (link) =>
-            useAppStore.getState().observeTerminalGitHubPullRequestLink(worktreeId, link),
-          // Why (gate mode only): the 2031 subscribe arrives as a fact, but the reply stays here — query authority stays with the view/watcher (invariant 6).
-          ...(factOwnsMode2031 ? { onMode2031Subscribe: sendMode2031Reply } : {})
+            useAppStore.getState().observeTerminalGitHubPullRequestLink(worktreeId, link)
         },
         // Why: activation-deferred tabs can start a watcher before any pane restored the title; ordinary parked tabs avoid this IPC.
         restoreTitleOnRegister: options.restoreTitleOnRegister === true
       })
     : null
 
-  // Why: no xterm answers DECSET 2031 while parked; with the gate ON, the responder's sidecar would force-feed bytes to the gated PTY, so skip it.
-  const stopMode2031Responder = factOwnsMode2031
-    ? null
-    : startParkedTerminalMode2031Responder({ ptyId, sendInput })
-
   // Why: parked tabs are the canonical hidden view — mark the PTY gated so main stops renderer byte delivery.
   const releaseHiddenDeliveryClaim = hiddenDeliveryGateActive
     ? acquireHiddenRendererPtyDeliveryClaim(ptyId)
@@ -308,7 +286,6 @@ export function startParkedTerminalByteWatcher(
     processor?.disposePendingSideEffectGauge()
     // Why: unhide BEFORE the reveal remount registers pane handlers, so main resumes delivery and emits the restore marker the pane consumes.
     releaseHiddenDeliveryClaim?.()
-    stopMode2031Responder?.()
     unsubscribeByteParsers?.()
     unregisterFactConsumer?.()
     // Why: clears tracker/timer/detector state so the watcher can't fire after the revealed pane's live parsers take over.
diff --git a/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.test.ts b/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.test.ts
deleted file mode 100644
index c619790fdb1..00000000000
--- a/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.test.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-// Why: a parked tab has no xterm, so this byte sidecar is the only thing that
-// answers DECSET 2031. fish toggles 2031 on and off around every prompt, so
-// answering the sticky "an h appeared" flag writes `?997;1n` into a shell that
-// already handed the tty to a child (#9993).
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const ESC = '\x1b'
-const PTY_ID = 'pty-parked-2031'
-
-// One fish prompt cycle: subscribe, paint, hand off the tty.
-const FISH_PROMPT_HANDOFF = `${ESC}[?2031h${ESC}[0m~/orca ${ESC}[32m❯${ESC}[0m ${ESC}[?2031l`
-
-let sidecarWatcher: ((data: string) => void) | null = null
-const unsubscribe = vi.fn()
-
-vi.mock('./pty-data-sidecar-subscriptions', () => ({
-  subscribeToPtyData: (_ptyId: string, watcher: (data: string) => void) => {
-    sidecarWatcher = watcher
-    return unsubscribe
-  }
-}))
-
-vi.mock('@/store', () => ({
-  useAppStore: {
-    getState: () => ({ settings: { theme: 'dark' as const } })
-  }
-}))
-
-vi.mock('@/lib/terminal-theme', () => ({
-  getSystemPrefersDark: () => true
-}))
-
-const { startParkedTerminalMode2031Responder } =
-  await import('./parked-terminal-mode2031-responder')
-
-function startResponder(): { sendInput: ReturnType<typeof vi.fn>; feed: (data: string) => void } {
-  const sendInput = vi.fn()
-  startParkedTerminalMode2031Responder({ ptyId: PTY_ID, sendInput })
-  return {
-    sendInput,
-    feed: (data: string) => sidecarWatcher?.(data)
-  }
-}
-
-beforeEach(() => {
-  sidecarWatcher = null
-  vi.clearAllMocks()
-})
-
-describe('parked-tab DECSET 2031 responder honors the chunk-final state (#9993)', () => {
-  it('does not reply to a subscribe the same chunk withdrew', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(FISH_PROMPT_HANDOFF)
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
-  it('replies once to a TUI that subscribes and keeps listening', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?2031h`)
-
-    expect(sendInput).toHaveBeenCalledTimes(1)
-    expect(sendInput).toHaveBeenCalledWith(`${ESC}[?997;1n`)
-  })
-
-  it('stays silent across a run of fish prompts', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(FISH_PROMPT_HANDOFF)
-    feed(FISH_PROMPT_HANDOFF)
-    feed(FISH_PROMPT_HANDOFF)
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
-  it('replies when a TUI subscribes after a prompt cycle in the same chunk', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${FISH_PROMPT_HANDOFF}${ESC}[?2031h`)
-
-    expect(sendInput).toHaveBeenCalledTimes(1)
-  })
-
-  it('still answers a subscribe split across two chunks', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?20`)
-    feed('31h')
-
-    expect(sendInput).toHaveBeenCalledTimes(1)
-  })
-
-  it('does not reply when the withdrawal is split across two chunks', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?2031h prompt ${ESC}[?20`)
-    expect(sendInput).not.toHaveBeenCalled()
-    feed('31l')
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
-  it('does not reply when an unrelated private mode appends a split withdrawal', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?2031h prompt ${ESC}[?25`)
-    expect(sendInput).not.toHaveBeenCalled()
-    feed(';2031l')
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
-  it('replies after an ambiguous tail resolves to another mode', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?2031h drawing ${ESC}[?20`)
-    expect(sendInput).not.toHaveBeenCalled()
-    feed('25h')
-
-    expect(sendInput).toHaveBeenCalledTimes(1)
-  })
-})
diff --git a/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.ts b/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.ts
deleted file mode 100644
index 4c2ca568de9..00000000000
--- a/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-/**
- * DECSET 2031 color-scheme responder for parked terminals (byte-scan mode).
- *
- * Why a dedicated byte sidecar: no xterm exists while a tab is parked, so
- * nothing answers a TUI's mode-2031 theme subscription. Query authority stays
- * with the view/watcher (model/view contract invariant 6), so this reply can
- * never move to main. Phase 4: this subscribeToPtyData registration doubles
- * as a delivery-interest signal, so it is only used while the hidden-delivery
- * gate is OFF — gated parked PTYs answer from the main tracker's
- * '2031-subscribe' fact instead (parked-terminal-byte-watcher.ts).
- *
- * Survives Phase 6 (skip-grammar deletion): mounted switch-off hidden panes
- * answer 2031 from xterm once the background queue drains, but a PARKED tab
- * has no xterm in any switch-off mode, and the '2031-subscribe' fact is only
- * consumed while the gate is ON — this sidecar stays the only answerer here.
- */
-import {
-  INITIAL_MODE_2031_REPLY_SCAN_STATE,
-  mode2031SequenceFor,
-  resolveTerminalColorSchemeMode,
-  scanMode2031ReplyDecision
-} from '../../../../shared/terminal-color-scheme-protocol'
-import { useAppStore } from '@/store'
-import { getSystemPrefersDark } from '@/lib/terminal-theme'
-import { subscribeToPtyData } from './pty-data-sidecar-subscriptions'
-
-export type ParkedTerminalMode2031ResponderOptions = {
-  ptyId: string
-  /** Out-of-band reply channel to the PTY (mode-2031 color-scheme answers). */
-  sendInput: (data: string) => void
-}
-
-export function startParkedTerminalMode2031Responder(
-  options: ParkedTerminalMode2031ResponderOptions
-): () => void {
-  const { ptyId, sendInput } = options
-  let scanState = INITIAL_MODE_2031_REPLY_SCAN_STATE
-  return subscribeToPtyData(ptyId, (data) => {
-    const result = scanMode2031ReplyDecision(scanState, data)
-    scanState = result.state
-    if (result.decision !== 'subscribed') {
-      return
-    }
-    // Why: reply with the resolved theme so TUIs that subscribe while parked
-    // still learn it before the pane is ever revealed.
-    const settings = useAppStore.getState().settings
-    sendInput(mode2031SequenceFor(resolveTerminalColorSchemeMode(settings, getSystemPrefersDark())))
-  })
-}
diff --git a/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts b/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
index c32ea0aafaf..8fc1df0985c 100644
--- a/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
+++ b/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
@@ -16,6 +16,10 @@ export type SerializedBuffer = {
   rows: number
   seq?: number
   lastTitle?: string
+  /** Kitty flags this pane's mirror could PROVE at `seq`. Published only from
+   *  the tracker's snapshotFlags, so an old host's unknown state is never
+   *  republished as a known `0`. */
+  kittyKeyboardFlags?: number
 }
 
 export type SerializeFn = (
@@ -152,6 +156,11 @@ function ensureSerializerListener(): void {
         if (result.seq !== undefined) {
           payload.seq = result.seq
         }
+        // Why gated on seq: flags describe a boundary, and an unsequenced
+        // snapshot has none for a consumer to reconcile live bytes against.
+        if (result.seq !== undefined && result.kittyKeyboardFlags !== undefined) {
+          payload.kittyKeyboardFlags = result.kittyKeyboardFlags
+        }
         if (lastTitle !== undefined) {
           payload.lastTitle = lastTitle
         } else if (result.lastTitle !== undefined) {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-types.ts b/src/renderer/src/components/terminal-pane/pty-connection-types.ts
index 9c2f717b8a6..b2b5163ac93 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-types.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-types.ts
@@ -48,6 +48,9 @@ export type PtyConnectionDeps = {
   } | null
   restoredLeafId?: string | null
   restoredPtyIdByLeafId?: Record<string, string>
+  /** Park intent sampled at render time, before the host disposes the tab's
+   *  watchers; consumed once the restored layout has been replayed. */
+  mountFollowsTerminalPark: boolean
   paneTransportsRef: React.RefObject<Map<number, PtyTransport>>
   paneMode2031Ref: React.RefObject<Map<number, boolean>>
   /** Per-pane mirror of the kitty keyboard flags the pane's application
@@ -99,10 +102,8 @@ export type PtyConnectionDeps = {
   syncPanePtyLayoutBinding: (paneId: number, ptyId: string | null) => void
   clearExitedPanePtyLayoutBinding: (paneId: number, exitedPtyId: string) => void
   deferPtyInput?: (paneId: number, data: string, forward: (data: string) => void) => void
-  /** Records a DECSET 2031 subscription answered from main's
-   *  '2031-subscribe' fact, mirroring the xterm CSI handler's registry write
-   *  (paneMode2031 + last replied theme) so later theme flips push CSI 997.
-   *  The reply itself is sent by the fact handler — query authority stays
-   *  with the view (model/view contract invariant 6). */
-  recordPaneMode2031Subscription?: (paneId: number, repliedMode: 'dark' | 'light') => void
+  /** Records a DECSET 2031 subscription seen through main's '2031-subscribe'
+   *  fact (paneMode2031 + the mode at subscribe time) so later theme flips push
+   *  CSI 997. Subscribing itself is silent — see #9993. */
+  recordPaneMode2031Subscription?: (paneId: number, subscribedMode: 'dark' | 'light') => void
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection.test.ts b/src/renderer/src/components/terminal-pane/pty-connection.test.ts
index c78ac18274b..5ae88131d13 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection.test.ts
@@ -19,12 +19,17 @@ import { resolveWindowsShiftEnterEncodingForPane } from './terminal-windows-shif
 import type * as UseNotificationDispatchModule from './use-notification-dispatch'
 import { getEagerPtyBufferHandle } from './pty-dispatcher'
 import type { AgentType } from '../../../../shared/agent-status-types'
+import {
+  isResumableTuiAgent,
+  normalizeAgentProviderSession
+} from '../../../../shared/agent-session-resume'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { toAppSshPtyId } from '../../../../shared/ssh-pty-id'
 import type { SshConnectionState } from '../../../../shared/ssh-types'
 import type { TerminalLayoutSnapshot, TuiAgent } from '../../../../shared/types'
 import { YOLO_TUI_AGENT_ARGS } from '../../../../shared/tui-agent-permissions'
 import { SETUP_AGENT_SEQUENCE_STARTUP_COMMAND_ENV } from '../../../../shared/setup-agent-sequencing'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import {
   beginAgentStartupDeliveryAttempt,
   resetAgentStartupDelayedDeliveryForTests
@@ -62,18 +67,6 @@ async function drainFakeTimerWork(limit = 20): Promise<void> {
   vi.clearAllTimers()
 }
 
-// Why: a reveal remount reads the still-live park watcher entry at connect time to
-// tell itself apart from an in-place reattach; the host disposes it a beat later.
-async function parkTabForReveal(tabId: string, ptyId: string, worktreeId = 'wt-1'): Promise<void> {
-  const { parkedWatchersByTabId } = await import('./terminal-parked-watcher-registry')
-  parkedWatchersByTabId.set(tabId, {
-    worktreeId,
-    tabPtyId: ptyId,
-    paneIdByPtyId: new Map([[ptyId, 1]]),
-    disposersByPtyId: new Map([[ptyId, () => {}]])
-  })
-}
-
 async function drainPendingTimeouts(pendingTimeouts: (() => void)[], limit = 100): Promise<void> {
   let iterations = 0
   while (pendingTimeouts.length > 0) {
@@ -338,6 +331,7 @@ type MockTransport = {
   getPtyId: ReturnType<typeof vi.fn>
   getConnectionId: ReturnType<typeof vi.fn>
   serializeBuffer?: ReturnType<typeof vi.fn>
+  serializeBufferOutcome?: ReturnType<typeof vi.fn>
 }
 
 const scheduleRuntimeGraphSync = vi.fn()
@@ -616,6 +610,12 @@ function createManager(paneCount = 1, initialActivePaneId: number | null = null)
   }
 }
 
+// Structural subset of PtyTransportRecoveryState: enough to pin the disconnected/unreachable pane.
+type RecoveryStateProbe = {
+  phase: string
+  unreachablePane?: { onRetry: () => void; onStartNewTerminal: () => void }
+} | null
+
 function createDeps(overrides: Record<string, unknown> = {}) {
   return {
     tabId: 'tab-1',
@@ -624,6 +624,7 @@ function createDeps(overrides: Record<string, unknown> = {}) {
     startup: null,
     restoredLeafId: null,
     restoredPtyIdByLeafId: {},
+    mountFollowsTerminalPark: false,
     paneTransportsRef: { current: new Map() },
     paneMode2031Ref: { current: new Map() },
     paneKittyKeyboardModesRef: { current: new Map() },
@@ -2338,6 +2339,53 @@ describe('connectPanePty', () => {
     expect(createdTransportOptions[0]?.projectRuntime).toBeUndefined()
   })
 
+  it('spawns a Floating agent on native Windows beside an active WSL project', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const { createRemoteRuntimePtyTransport } = await import('./remote-runtime-pty-transport')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      activeWorktreeId: 'wt-1',
+      tabsByWorktree: {
+        ...mockStoreState.tabsByWorktree,
+        [FLOATING_TERMINAL_WORKTREE_ID]: [
+          { id: 'tab-floating-agent', ptyId: null, launchAgent: 'codex' }
+        ]
+      },
+      projects: [{ id: 'repo1', localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' } }],
+      settings: {
+        ...mockStoreState.settings,
+        terminalWindowsShell: 'wsl.exe',
+        terminalWindowsWslDistro: 'Ubuntu',
+        localWindowsRuntimeDefault: { kind: 'wsl', distro: 'Ubuntu' }
+      }
+    }
+
+    connectPanePty(
+      createPane(1) as never,
+      createManager(1) as never,
+      createDeps({
+        tabId: 'tab-floating-agent',
+        worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+        cwd: 'C:\\Users\\alice',
+        startup: { launchAgent: 'codex' }
+      }) as never
+    )
+    await flushAsyncTicks()
+
+    expect(createIpcPtyTransport).toHaveBeenCalledOnce()
+    expect(createRemoteRuntimePtyTransport).not.toHaveBeenCalled()
+    expect(createdTransportOptions[0]).toMatchObject({
+      worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+      executionHostId: 'local',
+      connectionId: null,
+      launchAgent: 'codex'
+    })
+    expect(createdTransportOptions[0]?.projectRuntime).toBeUndefined()
+  })
+
   it('observes live terminal GitHub PR URLs before agent completion', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport()
@@ -3148,6 +3196,39 @@ describe('connectPanePty', () => {
     expect(pane.terminal.write).toHaveBeenCalledWith(redraw, expect.any(Function))
   })
 
+  it('routes terminal input through deferPtyInput so the host can withhold it', async () => {
+    // Regression: inlining forwardPtyInput into onData dropped this hop, silently disabling link-click mouse suppression.
+    const { connectPanePty } = await import('./pty-connection')
+    const pane = createPane(1)
+    const transport = createMockTransport('pty-1')
+    transportFactoryQueue.push(transport)
+    const deferPtyInput = vi.fn()
+
+    connectPanePty(pane as never, createManager(1) as never, createDeps({ deferPtyInput }) as never)
+    await flushAsyncTicks()
+    sendTerminalInputThroughPane(pane, 'a')
+
+    expect(deferPtyInput).toHaveBeenCalledWith(1, 'a', expect.any(Function))
+    expect(transport.sendInput).not.toHaveBeenCalled()
+
+    const forward = deferPtyInput.mock.calls[0]?.[2] as (data: string) => void
+    forward('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a')
+  })
+
+  it('forwards terminal input directly when the host supplies no deferPtyInput', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const pane = createPane(1)
+    const transport = createMockTransport('pty-1')
+    transportFactoryQueue.push(transport)
+
+    connectPanePty(pane as never, createManager(1) as never, createDeps() as never)
+    await flushAsyncTicks()
+    sendTerminalInputThroughPane(pane, 'a')
+
+    expect(transport.sendInput).toHaveBeenCalledWith('a')
+  })
+
   it('does not let OpenTUI-style small ANSI redraw bursts monopolize foreground writes', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const pane = createPane(1)
@@ -4297,7 +4378,7 @@ describe('connectPanePty', () => {
     )
   })
 
-  it('delivers terminal-paste startup commands through xterm before submitting', async () => {
+  it('keeps SSH terminal-paste startup commands renderer-owned', async () => {
     const pendingTimeouts: (() => void)[] = []
     const originalSetTimeout = globalThis.setTimeout
     globalThis.setTimeout = vi.fn((fn: () => void) => {
@@ -4313,7 +4394,7 @@ describe('connectPanePty', () => {
       transport.connect.mockImplementation(
         async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
           capturedDataCallback.current = callbacks.onData ?? null
-          return 'pty-local-paste'
+          return 'pty-ssh-paste'
         }
       )
       transportFactoryQueue.push(transport)
@@ -4321,7 +4402,8 @@ describe('connectPanePty', () => {
       mockStoreState = {
         ...mockStoreState,
         tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: null }] },
-        repos: [{ id: 'repo1', connectionId: null }]
+        repos: [{ id: 'repo1', connectionId: 'ssh-conn-1' }],
+        sshConnectionStates: new Map([['ssh-conn-1', { status: 'connected' }]])
       }
 
       const pane = createPane(1)
@@ -4335,6 +4417,7 @@ describe('connectPanePty', () => {
 
       connectPanePty(pane as never, manager as never, deps as never)
       expect(createdTransportOptions[0]?.command).toBeUndefined()
+      expect(createdTransportOptions[0]?.commandDelivery).toBeUndefined()
       expect(capturedDataCallback.current).not.toBeNull()
 
       capturedDataCallback.current?.('user@host $ ')
@@ -6429,121 +6512,77 @@ describe('connectPanePty', () => {
     expect(transport.sendInput).not.toHaveBeenCalled()
   })
 
-  it('waits for shell-ready before unhinted SSH startup commands', async () => {
-    // Capture the setTimeout callback directly so we can fire it without vi.useFakeTimers() (which would also replace beforeEach's rAF mock).
-    const pendingTimeouts: (() => void)[] = []
-    const originalSetTimeout = globalThis.setTimeout
-    globalThis.setTimeout = vi.fn((fn: () => void) => {
-      pendingTimeouts.push(fn)
-      return 999 as unknown as ReturnType<typeof setTimeout>
-    }) as unknown as typeof setTimeout
-
-    try {
-      const { connectPanePty } = await import('./pty-connection')
-
-      const capturedDataCallback: { current: ((data: string) => void) | null } = {
-        current: null
-      }
-      const transport = createMockTransport('pty-id')
-      transport.connect.mockImplementation(
-        async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
-          capturedDataCallback.current = callbacks.onData ?? null
-          return 'pty-ssh-1'
-        }
-      )
-      transportFactoryQueue.push(transport)
-
-      // SSH connection: the relay gets command metadata while the renderer owns delivery.
-      mockStoreState = {
-        ...mockStoreState,
-        tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: null }] },
-        repos: [{ id: 'repo1', connectionId: 'ssh-conn-1' }],
-        // Why: startup delivery assumes a live connection; a disconnected target routes through the deferred-connect gate instead of spawning synchronously.
-        sshConnectionStates: new Map([['ssh-conn-1', { status: 'connected' }]])
-      }
-
-      const pane = createPane(1)
-      const manager = createManager(1)
-      const deps = createDeps({ startup: { command: "claude 'say test'" } })
-
-      connectPanePty(pane as never, manager as never, deps as never)
-      expect(capturedDataCallback.current).not.toBeNull()
-
-      capturedDataCallback.current?.('user@remote $ ')
-      expect(transport.sendInput).not.toHaveBeenCalled()
-
-      capturedDataCallback.current?.('\x1b]777;orca-shell-ready\x07user@remote $ ')
-      for (const fn of pendingTimeouts.splice(0)) {
-        fn()
-      }
-
-      expect(createdTransportOptions[0]).toEqual(
-        expect.objectContaining({ startupCommandDelivery: 'shell-ready' })
-      )
-      expect(transport.sendInput).toHaveBeenCalledWith("claude 'say test'\r")
-    } finally {
-      globalThis.setTimeout = originalSetTimeout
+  it('delegates ordinary SSH startup delivery to the provider without a renderer duplicate', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
+    const transport = createMockTransport('pty-id')
+    transport.connect.mockImplementation(async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
+      capturedDataCallback.current = callbacks.onData ?? null
+      return 'pty-ssh-1'
+    })
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: null }] },
+      repos: [{ id: 'repo1', connectionId: 'ssh-conn-1' }],
+      sshConnectionStates: new Map([['ssh-conn-1', { status: 'connected' }]])
     }
+
+    connectPanePty(
+      createPane(1) as never,
+      createManager(1) as never,
+      createDeps({ startup: { command: "claude 'say test'" } }) as never
+    )
+    await flushAsyncTicks()
+    capturedDataCallback.current?.('\x1b]777;orca-shell-ready\x07user@remote $ ')
+
+    expect(createdTransportOptions[0]).toEqual(
+      expect.objectContaining({
+        command: "claude 'say test'",
+        commandDelivery: 'provider',
+        startupCommandDelivery: 'shell-ready'
+      })
+    )
+    expect(transport.sendInput).not.toHaveBeenCalledWith("claude 'say test'\r")
   })
 
-  it('waits for the SSH shell-ready marker before sending hinted startup commands', async () => {
-    const pendingTimeouts: (() => void)[] = []
-    const originalSetTimeout = globalThis.setTimeout
-    globalThis.setTimeout = vi.fn((fn: () => void) => {
-      pendingTimeouts.push(fn)
-      return 999 as unknown as ReturnType<typeof setTimeout>
-    }) as unknown as typeof setTimeout
-
-    try {
-      const { connectPanePty } = await import('./pty-connection')
-
-      const capturedDataCallback: { current: ((data: string) => void) | null } = {
-        current: null
-      }
-      const transport = createMockTransport('pty-id')
-      transport.connect.mockImplementation(
-        async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
-          capturedDataCallback.current = callbacks.onData ?? null
-          return 'pty-ssh-1'
-        }
-      )
-      transportFactoryQueue.push(transport)
-
-      mockStoreState = {
-        ...mockStoreState,
-        tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: null }] },
-        repos: [{ id: 'repo1', connectionId: 'ssh-conn-1' }],
-        // Why: startup delivery assumes a live connection; a disconnected target routes through the deferred-connect gate instead of spawning synchronously.
-        sshConnectionStates: new Map([['ssh-conn-1', { status: 'connected' }]])
-      }
-
-      const pane = createPane(1)
-      const manager = createManager(1)
-      const deps = createDeps({
-        startup: {
-          command: "codex 'linked issue context'",
-          startupCommandDelivery: 'shell-ready'
-        }
-      })
-
-      connectPanePty(pane as never, manager as never, deps as never)
-      expect(capturedDataCallback.current).not.toBeNull()
-
-      capturedDataCallback.current?.('user@remote $ ')
-      for (const fn of pendingTimeouts.splice(0)) {
-        fn()
-      }
-      expect(transport.sendInput).not.toHaveBeenCalled()
-
-      capturedDataCallback.current?.('\x1b]777;orca-shell-ready\x07user@remote $ ')
-      for (const fn of pendingTimeouts.splice(0)) {
-        fn()
-      }
-
-      expect(transport.sendInput).toHaveBeenCalledWith("codex 'linked issue context'\r")
-    } finally {
-      globalThis.setTimeout = originalSetTimeout
+  it('arms draft observation after a provider-owned SSH startup succeeds', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
+    const transport = createMockTransport('pty-codex')
+    transport.connect.mockImplementation(async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
+      capturedDataCallback.current = callbacks.onData ?? null
+      return 'pty-ssh-codex'
+    })
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: null }] },
+      repos: [{ id: 'repo1', connectionId: 'ssh-conn-1' }],
+      sshConnectionStates: new Map([['ssh-conn-1', { status: 'connected' }]])
     }
+    const prompt = 'https://linear.app/stably/issue/STA-4067'
+
+    connectPanePty(
+      createPane(1) as never,
+      createManager(1) as never,
+      createDeps({
+        startup: {
+          command: 'codex',
+          launchAgent: 'codex',
+          launchConfig: { agentArgs: '', agentEnv: {} },
+          launchToken: 'launch-token-ssh',
+          draftPrompt: prompt
+        }
+      }) as never
+    )
+    await flushAsyncTicks()
+    capturedDataCallback.current?.('\x1b[?2004h\x1b[2K› ')
+    await flushAsyncTicks()
+
+    expect(createdTransportOptions[0]?.commandDelivery).toBe('provider')
+    expect(transport.sendInput).not.toHaveBeenCalledWith('codex\r')
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith(`\x1b[200~${prompt}\x1b[201~`)
   })
 
   it('orders a startup draft behind existing user input when Codex renders its composer', async () => {
@@ -6712,7 +6751,7 @@ describe('connectPanePty', () => {
     ).toBe(true)
   })
 
-  it('falls back for SSH shell-ready startup commands when no marker arrives', async () => {
+  it('does not fall back to renderer delivery when provider-owned SSH output has no marker', async () => {
     const pendingTimeouts: (() => void)[] = []
     const originalSetTimeout = globalThis.setTimeout
     globalThis.setTimeout = vi.fn((fn: () => void) => {
@@ -6763,13 +6802,14 @@ describe('connectPanePty', () => {
         fn()
       }
 
-      expect(transport.sendInput).toHaveBeenCalledWith("codex 'linked issue context'\r")
+      expect(createdTransportOptions[0]?.commandDelivery).toBe('provider')
+      expect(transport.sendInput).not.toHaveBeenCalledWith("codex 'linked issue context'\r")
     } finally {
       globalThis.setTimeout = originalSetTimeout
     }
   })
 
-  it('falls back for quiet SSH shell-ready startup commands with no output', async () => {
+  it('does not duplicate a quiet provider-owned SSH startup command', async () => {
     const pendingTimeouts: (() => void)[] = []
     const originalSetTimeout = globalThis.setTimeout
     globalThis.setTimeout = vi.fn((fn: () => void) => {
@@ -6821,13 +6861,14 @@ describe('connectPanePty', () => {
         fn()
       }
 
-      expect(transport.sendInput).toHaveBeenCalledWith("codex 'linked issue context'\r")
+      expect(createdTransportOptions[0]?.commandDelivery).toBe('provider')
+      expect(transport.sendInput).not.toHaveBeenCalledWith("codex 'linked issue context'\r")
     } finally {
       globalThis.setTimeout = originalSetTimeout
     }
   })
 
-  it('waits for shell-ready for SSH Codex native prefill commands without an explicit hint', async () => {
+  it('uses provider delivery for SSH Codex native prefill commands without an explicit hint', async () => {
     const pendingTimeouts: (() => void)[] = []
     const originalSetTimeout = globalThis.setTimeout
     globalThis.setTimeout = vi.fn((fn: () => void) => {
@@ -6875,13 +6916,16 @@ describe('connectPanePty', () => {
         fn()
       }
 
-      expect(transport.sendInput).toHaveBeenCalledWith("codex --prefill 'linked issue context'\r")
+      expect(createdTransportOptions[0]?.commandDelivery).toBe('provider')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(
+        "codex --prefill 'linked issue context'\r"
+      )
     } finally {
       globalThis.setTimeout = originalSetTimeout
     }
   })
 
-  it('uses the sequenced startup command hint for SSH shell-ready detection', async () => {
+  it('keeps sequenced SSH startup wrappers provider-owned', async () => {
     const pendingTimeouts: (() => void)[] = []
     const originalSetTimeout = globalThis.setTimeout
     globalThis.setTimeout = vi.fn((fn: () => void) => {
@@ -6935,7 +6979,8 @@ describe('connectPanePty', () => {
         fn()
       }
 
-      expect(transport.sendInput).toHaveBeenCalledWith(`${wrapperCommand}\r`)
+      expect(createdTransportOptions[0]?.commandDelivery).toBe('provider')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(`${wrapperCommand}\r`)
     } finally {
       globalThis.setTimeout = originalSetTimeout
     }
@@ -8174,7 +8219,11 @@ describe('connectPanePty', () => {
     expect(deps.onPtyErrorRef.current).not.toHaveBeenCalled()
   })
 
-  it('spawns a fresh PTY when a non-deferred SSH reattach reports expired via onError', async () => {
+  // STA-3077. `SSH_SESSION_EXPIRED` is produced by the relay's not-found mapping, which also
+  // answers for shells still running under a relay process it replaced — so it is not proof the
+  // shell exited. Respawning here would `--resume` a second agent onto one transcript, so the pane
+  // surfaces as disconnected and the user chooses.
+  it('surfaces a disconnected pane when a non-deferred SSH reattach reports expired via onError', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport()
     transport.connect.mockImplementation(
@@ -8199,23 +8248,36 @@ describe('connectPanePty', () => {
     } as StoreState
     const pane = createPane(2)
     const manager = createManager(2)
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
     const deps = createDeps({
       restoredLeafId: LEAF_2,
-      restoredPtyIdByLeafId: { [LEAF_2]: 'restored-session' }
+      restoredPtyIdByLeafId: { [LEAF_2]: 'restored-session' },
+      onPtyRecoveryStateRef: { current: onPtyRecoveryState }
     })
 
     connectPanePty(pane as never, manager as never, deps as never)
     await flushAsyncTicks(10)
 
+    // Producer pin: the reattach must actually have been attempted and reported expired, or the
+    // no-respawn clauses below would pass for the wrong reason.
+    expect(transport.connect.mock.calls[0]?.[0]?.sessionId).toBe('restored-session')
     expect(deps.onPtyErrorRef.current).not.toHaveBeenCalled()
-    expect(transport.connect).toHaveBeenCalledTimes(2)
-    expect(deps.clearExitedPanePtyLayoutBinding).toHaveBeenCalledWith(2, 'restored-session')
-    expect(deps.clearTabPtyId).toHaveBeenCalledWith('tab-1', 'restored-session')
-    expect(deps.syncPanePtyLayoutBinding).toHaveBeenCalledWith(2, 'fresh-ssh-pty')
-    expect(deps.updateTabPtyId).toHaveBeenCalledWith('tab-1', 'fresh-ssh-pty')
+    expect(transport.connect).toHaveBeenCalledTimes(1)
+    expect(
+      onPtyRecoveryState.mock.calls.find(
+        ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+      )?.[1]?.unreachablePane
+    ).toBeDefined()
+    expect(deps.clearExitedPanePtyLayoutBinding).not.toHaveBeenCalled()
+    expect(deps.clearTabPtyId).not.toHaveBeenCalled()
+    expect(deps.syncPanePtyLayoutBinding).not.toHaveBeenCalledWith(2, 'fresh-ssh-pty')
+    expect(deps.updateTabPtyId).not.toHaveBeenCalled()
   })
 
-  it('submits a cold-restore resume command after SSH expired-session fallback', async () => {
+  // STA-3077. The resume this used to assert IS the duplicate-transcript defect: an expired report
+  // is the relay's not-found mapping, not proof the shell exited, so `codex ... resume <session>`
+  // would put a second agent process on the transcript the first one is still writing.
+  it('never resumes a cold-restore agent when an SSH reattach reports expired', async () => {
     const pendingTimeouts: (() => void)[] = []
     const originalSetTimeout = globalThis.setTimeout
     globalThis.setTimeout = vi.fn((fn: () => void) => {
@@ -8266,11 +8328,20 @@ describe('connectPanePty', () => {
           }
         }
       } as StoreState
+      // Fixture pin: the resume is genuinely buildable from this record, so "no resume" below
+      // cannot pass because the builder bailed out early for an unrelated reason.
+      expect(isResumableTuiAgent('codex')).toBe(true)
+      expect(
+        normalizeAgentProviderSession({ key: 'session_id', id: 'codex-session-1' })
+      ).not.toBeNull()
+
       const pane = createPane(2)
       const manager = createManager(2)
+      const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
       const deps = createDeps({
         restoredLeafId: LEAF_2,
-        restoredPtyIdByLeafId: { [LEAF_2]: 'restored-session' }
+        restoredPtyIdByLeafId: { [LEAF_2]: 'restored-session' },
+        onPtyRecoveryStateRef: { current: onPtyRecoveryState }
       })
 
       connectPanePty(pane as never, manager as never, deps as never)
@@ -8283,24 +8354,23 @@ describe('connectPanePty', () => {
         fn()
       }
 
-      expect(transport.connect).toHaveBeenCalledTimes(2)
-      expect(transport.connect).toHaveBeenNthCalledWith(
-        2,
-        expect.objectContaining({
-          command: "codex '--dangerously-bypass-approvals-and-sandbox' 'resume' 'codex-session-1'",
-          startupCommandDelivery: 'shell-ready',
-          env: expect.objectContaining({
-            ORCA_PANE_KEY: paneKey,
-            ORCA_TAB_ID: 'tab-1',
-            ORCA_WORKTREE_ID: 'wt-1',
-            ORCA_WORKSPACE_ID: 'wt-1',
-            ORCA_AGENT_LAUNCH_TOKEN: expect.stringMatching(new RegExp(`^${UUID_RE}$`))
-          })
-        })
-      )
-      expect(transport.sendInput).toHaveBeenCalledWith(
+      // Producer pin: the reattach ran and reported expired.
+      expect(transport.connect.mock.calls[0]?.[0]?.sessionId).toBe('restored-session')
+      expect(transport.connect).toHaveBeenCalledTimes(1)
+      // No replacement connection was ever opened, so no shell exists to type a resume into.
+      expect(capturedDataCallback.current).toBeNull()
+      expect(
+        onPtyRecoveryState.mock.calls.find(
+          ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+        )?.[1]?.unreachablePane
+      ).toBeDefined()
+      // The resume path claims the launch config before spawning; nothing claimed one.
+      expect(mockStoreState.registerAgentLaunchConfig).not.toHaveBeenCalled()
+      expect(transport.sendInput).not.toHaveBeenCalledWith(
         "codex '--dangerously-bypass-approvals-and-sandbox' 'resume' 'codex-session-1'\r"
       )
+      expect(deps.clearExitedPanePtyLayoutBinding).not.toHaveBeenCalled()
+      expect(deps.clearTabPtyId).not.toHaveBeenCalled()
     } finally {
       globalThis.setTimeout = originalSetTimeout
     }
@@ -8758,7 +8828,7 @@ describe('connectPanePty', () => {
     expect(writes.join('')).not.toContain('ALT-FRAME-BODY')
   })
 
-  it('drops a live daemon alt frame until a hidden pane has a final grid', async () => {
+  it('keeps a daemon alt frame at its capture grid while the target grid is unknown', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('tab-pty')
     transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) =>
@@ -8796,7 +8866,8 @@ describe('connectPanePty', () => {
 
     const writes = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0])
     expect(writes.join('')).toContain('PREFIX-SCROLLBACK')
-    expect(writes.join('')).not.toContain('ALT-FRAME-BODY')
+    expect(writes.join('')).toContain('ALT-FRAME-BODY')
+    expect(writes.filter((write) => write.includes('ALT-FRAME-BODY'))).toHaveLength(1)
   })
 
   it('falls back to the merged daemon snapshot when split metadata is incomplete', async () => {
@@ -9278,8 +9349,16 @@ describe('connectPanePty', () => {
     expect(transport.sendInput).not.toHaveBeenCalledWith('\x1b[I')
   })
 
+  // STA-3077 moved the replacement behind the disconnected banner: an expired report is the
+  // relay's not-found mapping, not proof the shell exited, so the user starts the new terminal.
+  // The subject here is unchanged — the old connection's callbacks must be fenced off once a
+  // replacement PTY exists, whatever route created it.
   it('drops stale callbacks but delivers fresh replacement output after an old replay clear', async () => {
     const { connectPanePty } = await import('./pty-connection')
+    mockStoreState = {
+      ...mockStoreState,
+      repos: [{ id: 'repo1', connectionId: 'target-a', displayName: 'orca' }]
+    } as StoreState
     const { getTerminalScrollIntentKind, markTerminalPinnedViewport } =
       await import('@/lib/pane-manager/terminal-scroll-intent')
     const transport = createMockTransport('tab-pty')
@@ -9305,9 +9384,11 @@ describe('connectPanePty', () => {
     pane.terminal.buffer.active.baseY = 100
     markTerminalPinnedViewport(pane.terminal)
     const { writes, parseCallbacks } = captureCallbackTerminalWrites(pane)
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
     const deps = createDeps({
       restoredLeafId: LEAF_1,
-      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' },
+      onPtyRecoveryStateRef: { current: onPtyRecoveryState }
     })
 
     connectPanePty(pane as never, createManager(1) as never, deps as never)
@@ -9319,6 +9400,16 @@ describe('connectPanePty', () => {
     oldCallbacks.current?.onError?.('SSH_SESSION_EXPIRED: tab-pty')
     oldResult.resolve(undefined)
     await flushAsyncTicks(20)
+
+    // The expiry no longer respawns on its own; the banner's action is now the route to a
+    // replacement PTY, so drive it to reach this test's subject.
+    expect(connectCount).toBe(1)
+    const published = onPtyRecoveryState.mock.calls.find(
+      ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+    )?.[1]?.unreachablePane
+    expect(published).toBeDefined()
+    published!.onStartNewTerminal()
+    await flushAsyncTicks(20)
     expect(replacementCallbacks.current).not.toBeNull()
 
     replacementCallbacks.current?.onData?.('B-PROMPT')
@@ -9517,6 +9608,11 @@ describe('connectPanePty', () => {
     })
     transportFactoryQueue.push(transport)
     setReattachPaneTitle('Cursor Agent')
+    // After setReattachPaneTitle: it rewrites mockStoreState and would drop this.
+    mockStoreState = {
+      ...mockStoreState,
+      repos: [{ id: 'repo1', connectionId: 'target-a', displayName: 'orca' }]
+    } as StoreState
 
     const pane = createPane(1)
     const textarea = {} as HTMLTextAreaElement
@@ -9590,13 +9686,19 @@ describe('connectPanePty', () => {
     // Why: main can answer a *spawn* with an adopted session, so the reattach handler
     // is reachable by a second door that skips the restored-session path entirely. The
     // cold-restore signal has to survive that door too, or #12101 returns on it.
+    //
+    // Vehicle changed for STA-3077: reaching that door used to be automatic — a restore that threw
+    // `PTY "tab-pty" not found` counted as proof the session was gone and respawned itself. No
+    // reattach failure proves that any more (a replaced relay reports not-found for shells still
+    // running under its predecessor), so the pane surfaces as disconnected and the *user* opens the
+    // same door via "Start a new terminal". The #12101 assertions below are unchanged.
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('tab-pty')
-    let activePtyId = 'tab-pty'
+    let activePtyId: string | null = 'tab-pty'
     transport.getPtyId.mockImplementation(() => activePtyId)
     transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) => {
       if (sessionId) {
-        throw new Error('restored session is gone')
+        throw new Error('PTY "tab-pty" not found')
       }
       // Main answered the spawn by adopting a durable session instead.
       activePtyId = 'adopted-pty'
@@ -9612,22 +9714,44 @@ describe('connectPanePty', () => {
     })
     transportFactoryQueue.push(transport)
     setReattachPaneTitle('Cursor Agent')
+    // SSH repo: the disconnected card is SSH-only, and setReattachPaneTitle rewrites
+    // mockStoreState, so this must come after it.
+    mockStoreState = {
+      ...mockStoreState,
+      repos: [{ id: 'repo1', connectionId: 'target-a', displayName: 'orca' }]
+    } as StoreState
 
     const pane = createPane(1)
     const textarea = {} as HTMLTextAreaElement
     configureTerminalFocusMode(pane, textarea)
     await withMockedDocumentActiveElement(textarea, async () => {
       const manager = createManager(1)
+      const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
       const deps = createDeps({
         restoredLeafId: LEAF_1,
-        restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+        restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' },
+        onPtyRecoveryStateRef: { current: onPtyRecoveryState }
       })
 
       connectPanePty(pane as never, manager as never, deps as never)
       await flushAsyncTicks(30)
 
-      expect(transport.connect).toHaveBeenCalledTimes(2)
+      // The unproven failure parks the pane instead of respawning it.
+      expect(transport.connect).toHaveBeenCalledTimes(1)
       expect(transport.connect.mock.calls[0]?.[0]?.sessionId).toBe('tab-pty')
+      const unreachable = onPtyRecoveryState.mock.calls.find(
+        ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+      )?.[1]?.unreachablePane
+      expect(unreachable).toBeDefined()
+      expect(deps.clearTabPtyId).not.toHaveBeenCalled()
+
+      // The user opens the spawn door; main answers that spawn by adopting a session.
+      unreachable?.onStartNewTerminal()
+      await flushAsyncTicks(30)
+
+      expect(deps.clearExitedPanePtyLayoutBinding).toHaveBeenCalledWith(pane.id, 'tab-pty')
+      expect(deps.clearTabPtyId).toHaveBeenCalledWith('tab-1', 'tab-pty')
+      expect(transport.connect).toHaveBeenCalledTimes(2)
       expect(transport.connect.mock.calls[1]?.[0]?.sessionId).toBeUndefined()
       const writes = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map(
         ([data]) => data as string
@@ -9642,6 +9766,273 @@ describe('connectPanePty', () => {
     })
   })
 
+  // STA-3077 / RC2. The relay answers "not found" for any id it cannot hand back — including for
+  // shells still running under a relay process it replaced. Respawning there starts a second
+  // `--resume` against the same agent session and both processes append to one transcript. This is
+  // the last route to that defect, and it is the reason this pane surfaces as disconnected instead.
+  // The reattach can also FULFIL with a result that says the session expired, or with no usable
+  // pty id at all. Both trace back to the same relay not-found, so neither proves the shell exited —
+  // and both used to clear the binding and cold-restore resume the agent, which is the duplicate
+  // transcript this pane exists to prevent. SSH only: a daemon/local provider is authoritative
+  // about its own ptys and keeps replacing in place.
+  it.each([
+    ['a result flagged sessionExpired', { id: 'tab-pty', sessionExpired: true }],
+    ['a result carrying no pty id', {}]
+  ])('surfaces the pane instead of resuming when an SSH reattach returns %s', async (_l, res) => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('tab-pty')
+    transport.getPtyId.mockImplementation(() => null)
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) =>
+      sessionId ? res : { id: 'respawned-pty' }
+    )
+    transportFactoryQueue.push(transport)
+
+    // connectionId resolves from the store's repo list, not from deps — an SSH-owned repo is what
+    // makes this pane SSH, and the branch under test is SSH-only by design.
+    mockStoreState = {
+      ...mockStoreState,
+      repos: [{ id: 'repo1', connectionId: 'target-a', displayName: 'orca' }]
+    } as StoreState
+    const pane = createPane(1)
+    const manager = createManager(1)
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' },
+      onPtyRecoveryStateRef: { current: onPtyRecoveryState }
+    })
+
+    connectPanePty(pane as never, manager as never, deps as never)
+    await flushAsyncTicks(30)
+
+    // Producer pin: the restore ran and returned this shape, or the clauses below are vacuous.
+    expect(transport.connect.mock.calls[0]?.[0]?.sessionId).toBe('tab-pty')
+    expect(
+      onPtyRecoveryState.mock.calls.find(
+        ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+      )?.[1]?.unreachablePane
+    ).toBeDefined()
+    expect(transport.connect).toHaveBeenCalledTimes(1)
+    expect(deps.clearTabPtyId).not.toHaveBeenCalled()
+  })
+
+  it('does not respawn a pane whose restore was answered with a not-found', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    // SSH repo: these are SSH reattach scenarios, and the disconnected card is SSH-only by design.
+    // Without this the fixture has no connectionId and the pane is not SSH at all.
+    mockStoreState = {
+      ...mockStoreState,
+      repos: [{ id: 'repo1', connectionId: 'target-a', displayName: 'orca' }]
+    } as StoreState
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) => {
+      if (sessionId) {
+        throw new Error('PTY "tab-pty" not found')
+      }
+      return { id: 'respawned-pty' }
+    })
+    transportFactoryQueue.push(transport)
+
+    const pane = createPane(1)
+    const manager = createManager(1)
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' },
+      onPtyRecoveryStateRef: { current: onPtyRecoveryState }
+    })
+
+    connectPanePty(pane as never, manager as never, deps as never)
+    await flushAsyncTicks(30)
+
+    // Producer pin: the restore must actually have been attempted and failed, or the
+    // no-respawn clause below would pass for the wrong reason.
+    expect(transport.connect.mock.calls[0]?.[0]?.sessionId).toBe('tab-pty')
+    expect(transport.connect).toHaveBeenCalledTimes(1)
+    // Branch pin: the not-found reached the unproven arm specifically. Without this, any earlier
+    // bail-out (an obsolete-reattach reject, a generation mismatch) would satisfy the clauses below.
+    expect(
+      onPtyRecoveryState.mock.calls.find(
+        ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+      )?.[1]?.unreachablePane
+    ).toBeDefined()
+    expect(deps.clearTabPtyId).not.toHaveBeenCalled()
+    expect(deps.clearExitedPanePtyLayoutBinding).not.toHaveBeenCalled()
+  })
+
+  // The mirror of the clause above, and the reason the diversion REPORTS whether it took the
+  // failure instead of silently doing nothing. This fixture has no connectionId, so there is no
+  // connection for the pane to be unreachable on and no card to show. An earlier revision paired
+  // that silent no-op with an unconditional `return`, which left a local pane with no shell, no
+  // card and no error — strictly worse than the toast the card replaced. A local provider is
+  // authoritative about its own ptys, so this pane must replace in place, as it did before.
+  it('replaces a local pane in place when its restore fails, rather than stranding it', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) => {
+      if (sessionId) {
+        throw new Error('PTY "tab-pty" not found')
+      }
+      return { id: 'respawned-pty' }
+    })
+    transportFactoryQueue.push(transport)
+
+    const pane = createPane(1)
+    const manager = createManager(1)
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' },
+      onPtyRecoveryStateRef: { current: onPtyRecoveryState }
+    })
+
+    connectPanePty(pane as never, manager as never, deps as never)
+    await flushAsyncTicks(30)
+
+    // Producer pin: the restore was attempted and failed, or every clause below is vacuous.
+    expect(transport.connect.mock.calls[0]?.[0]?.sessionId).toBe('tab-pty')
+    // Not divertible, so no card — the SSH-only surface must not appear here.
+    expect(
+      onPtyRecoveryState.mock.calls.find(
+        ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+      )?.[1]?.unreachablePane
+    ).toBeUndefined()
+    // ...and precisely because no card appeared, the pane must have been replaced in place.
+    expect(deps.clearTabPtyId).toHaveBeenCalledWith('tab-1', 'tab-pty')
+    expect(transport.connect.mock.calls.some(([opts]) => !opts?.sessionId)).toBe(true)
+  })
+
+  // The banner's second action must start a NEW shell. The automatic respawn it replaced passed the
+  // cold-restore startup, which carries the agent's providerSession — correct when it only ran on
+  // proof the shell was gone, but here the shell is probably alive, so resuming would put a second
+  // agent process on one transcript. That is the very defect this pane exists to prevent.
+  it('starts a fresh shell rather than resuming the agent when the user starts a new terminal', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    // SSH repo: these are SSH reattach scenarios, and the disconnected card is SSH-only by design.
+    // Without this the fixture has no connectionId and the pane is not SSH at all.
+    mockStoreState = {
+      ...mockStoreState,
+      repos: [{ id: 'repo1', connectionId: 'target-a', displayName: 'orca' }]
+    } as StoreState
+    const transport = createMockTransport('tab-pty')
+    const spawnOptions: Record<string, unknown>[] = []
+    transport.connect.mockImplementation(async (options: { sessionId?: string }) => {
+      if (options.sessionId) {
+        throw new Error('PTY "tab-pty" not found')
+      }
+      spawnOptions.push(options)
+      return { id: 'fresh-pty' }
+    })
+    transportFactoryQueue.push(transport)
+
+    // Fixture pin: with no resumable agent + provider session seeded, the resume builder returns
+    // null early and both branches spawn identically — every clause below would pass vacuously.
+    const paneKey = makePaneKey('tab-1', LEAF_1)
+    const providerSession = { key: 'session_id', id: 'codex-session-1' }
+    expect(isResumableTuiAgent('codex')).toBe(true)
+    expect(normalizeAgentProviderSession(providerSession)).not.toBeNull()
+    mockStoreState = {
+      ...mockStoreState,
+      settings: { ...mockStoreState.settings, agentCmdOverrides: {} },
+      agentStatusByPaneKey: {
+        [paneKey]: {
+          paneKey,
+          state: 'working',
+          prompt: 'finish the task',
+          agentType: 'codex',
+          providerSession,
+          updatedAt: 1,
+          stateStartedAt: 1,
+          stateHistory: []
+        }
+      }
+    } as StoreState
+
+    const pane = createPane(1)
+    const manager = createManager(1)
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' },
+      onPtyRecoveryStateRef: { current: onPtyRecoveryState }
+    })
+
+    connectPanePty(pane as never, manager as never, deps as never)
+    await flushAsyncTicks(30)
+
+    const published = onPtyRecoveryState.mock.calls.find(
+      ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+    )?.[1]?.unreachablePane
+    expect(published).toBeDefined()
+
+    onPtyRecoveryState.mockClear()
+    published!.onStartNewTerminal()
+    await flushAsyncTicks(30)
+
+    // Nothing else retracts the card, so the action must clear it or it sits over a live shell.
+    expect(onPtyRecoveryState).toHaveBeenCalledWith(pane.id, null)
+    expect(deps.clearTabPtyId).toHaveBeenCalledWith('tab-1', 'tab-pty')
+    // The transport falls back to the startup it was CONSTRUCTED with whenever a per-call field is
+    // absent, so omitting them is not enough — a "fresh" shell would resume the saved session. This
+    // asserts the explicit suppression, which is the only thing that actually closes it. Asserting
+    // the absence of per-call fields cannot: on a mock it passes either way.
+    expect(spawnOptions[0]).toMatchObject({ suppressSavedStartup: true })
+    // The resume path claims the launch config before spawning; a fresh shell has none to claim.
+    expect(mockStoreState.registerAgentLaunchConfig).not.toHaveBeenCalled()
+    expect(spawnOptions).toHaveLength(1)
+    // No `codex resume <session>` argv, and none of the resume metadata main keys off it.
+    expect(spawnOptions[0]).not.toHaveProperty('command')
+    expect(spawnOptions[0]).not.toHaveProperty('resumeProviderSession')
+    expect(spawnOptions[0]).not.toHaveProperty('launchAgent')
+    expect(spawnOptions[0]).not.toHaveProperty('launchConfig')
+  })
+
+  // The pane's durable binding still names the old shell while the card is up — deliberately, so a
+  // failed replacement can put the card back. Main resolves a stable pane's owner from that binding,
+  // so if the shell answers again between the failed reattach and this click, the spawn ADOPTS it
+  // and hands back its id. Nothing was replaced. Clearing the binding then would unbind a live
+  // shell that is attached to this very pane, leaving it with no durable record of what it owns.
+  it('keeps the binding when the new-terminal spawn adopts the old shell instead of replacing it', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    mockStoreState = {
+      ...mockStoreState,
+      repos: [{ id: 'repo1', connectionId: 'target-a', displayName: 'orca' }]
+    } as StoreState
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async (options: { sessionId?: string }) => {
+      if (options.sessionId) {
+        throw new Error('PTY "tab-pty" not found')
+      }
+      // Main adopted the pane's existing owner: same id back, no new shell.
+      return { id: 'tab-pty', isReattach: true }
+    })
+    transportFactoryQueue.push(transport)
+
+    const pane = createPane(1)
+    const manager = createManager(1)
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' },
+      onPtyRecoveryStateRef: { current: onPtyRecoveryState }
+    })
+
+    connectPanePty(pane as never, manager as never, deps as never)
+    await flushAsyncTicks(30)
+
+    const published = onPtyRecoveryState.mock.calls.find(
+      ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+    )?.[1]?.unreachablePane
+    // Producer pin: without the card there is no action to invoke and the clauses below are vacuous.
+    expect(published).toBeDefined()
+
+    published!.onStartNewTerminal()
+    await flushAsyncTicks(30)
+
+    expect(deps.clearTabPtyId).not.toHaveBeenCalled()
+    expect(deps.clearExitedPanePtyLayoutBinding).not.toHaveBeenCalled()
+  })
+
   it('keeps ?25h in the live agent reattach reset when the snapshot leaves the cursor visible', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('tab-pty')
@@ -12244,14 +12635,13 @@ describe('connectPanePty', () => {
       dataCallback('startup probe output\r\n')
       expect(setHiddenRendererPty).toHaveBeenCalledWith('pty-id', true)
 
-      // The fact stays the sole 2031 responder for gate-managed PTYs.
+      // The fact records the subscription for gate-managed PTYs; it never answers it (#9993).
       factsHandler._dispatchTerminalSideEffectBatchForTest({
         ptyId: 'pty-id',
         seq: 8,
         facts: [{ kind: '2031-subscribe' }]
       })
-      expect(transport.sendInput).toHaveBeenCalledTimes(1)
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     })
 
     it('latches model restore from the out-of-band marker and restores on reveal', async () => {
@@ -12287,7 +12677,8 @@ describe('connectPanePty', () => {
       )
     })
 
-    it('answers each 2031-subscribe fact exactly once, before any hidden mark exists', async () => {
+    it('never answers a 2031-subscribe fact, hidden or visible', async () => {
+      // Regression pin (#9993): a subscribe arms future notifications, it is not a query.
       enableMainAuthority()
       const deps = createDeps({ isVisibleRef: { current: false } })
       const { transport } = await connectHiddenPane(deps)
@@ -12298,27 +12689,23 @@ describe('connectPanePty', () => {
       transportOptions.onPtySpawn?.('pty-id')
       const factsHandler = await import('./terminal-side-effect-facts-handler')
 
-      // Why: the fact can outrun the hidden mark (codex startup race) and must still reply — ownership is structural, not mark-dependent.
       factsHandler._dispatchTerminalSideEffectBatchForTest({
         ptyId: 'pty-id',
         seq: 12,
         facts: [{ kind: '2031-subscribe' }]
       })
-      expect(transport.sendInput).toHaveBeenCalledTimes(1)
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
-
-      // Why: a visible gated pane still answers via the fact — the lifecycle suppresses xterm's CSI reply for gate-managed panes.
       ;(deps.isVisibleRef as { current: boolean }).current = true
       factsHandler._dispatchTerminalSideEffectBatchForTest({
         ptyId: 'pty-id',
         seq: 24,
         facts: [{ kind: '2031-subscribe' }]
       })
-      expect(transport.sendInput).toHaveBeenCalledTimes(2)
-      expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[?997;1n')
+
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
+      expect(transport.sendInputImmediate).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     })
 
-    it('registers the fact-answered 2031 subscription for later theme flips', async () => {
+    it('registers the fact-observed 2031 subscription for later theme flips', async () => {
       enableMainAuthority()
       const recordPaneMode2031Subscription = vi.fn()
       const deps = createDeps({
@@ -12338,16 +12725,16 @@ describe('connectPanePty', () => {
         facts: [{ kind: '2031-subscribe' }]
       })
 
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
       // Why: without the registry write, maybePushMode2031Flip won't push CSI 997 after a theme change, so the TUI keeps a stale theme.
       expect(recordPaneMode2031Subscription).toHaveBeenCalledWith(1, 'dark')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     })
 
     it('retires the fact-registered subscription when the TUI withdraws it', async () => {
       // The counterpart to the test above. A gated pane never sees the withdrawal bytes
-      // (main drops them) and both the chunk scanner and xterm's CSI handler are disabled
-      // for it, so this fact is the only observer that can retire the subscription. Left
-      // registered, the next theme flip pushes CSI 997 at the shell that replaced the TUI.
+      // (main drops them) and the chunk scanner is disabled for it, so this fact is the only
+      // observer that can retire the subscription. Left registered, the next theme flip
+      // pushes CSI 997 at the shell that replaced the TUI.
       enableMainAuthority()
       const paneMode2031Ref = { current: new Map<number, boolean>() }
       const paneLastThemeModeRef = { current: new Map<number, 'dark' | 'light'>() }
@@ -12356,9 +12743,9 @@ describe('connectPanePty', () => {
         paneMode2031Ref,
         paneLastThemeModeRef,
         // Exactly what use-terminal-pane-lifecycle wires up for this callback.
-        recordPaneMode2031Subscription: (paneId: number, repliedMode: 'dark' | 'light') => {
+        recordPaneMode2031Subscription: (paneId: number, subscribedMode: 'dark' | 'light') => {
           paneMode2031Ref.current.set(paneId, true)
-          paneLastThemeModeRef.current.set(paneId, repliedMode)
+          paneLastThemeModeRef.current.set(paneId, subscribedMode)
         }
       })
       await connectHiddenPane(deps)
@@ -12385,8 +12772,7 @@ describe('connectPanePty', () => {
     })
 
     it('leaves the chunk scanner silent on a gate-managed PTY', async () => {
-      // Main's '2031-subscribe' fact already answers these; a chunk-boundary reply here
-      // would answer the same subscribe a second time.
+      // Main's '2031-subscribe' fact already records these; nothing on this path replies.
       enableMainAuthority()
       const deps = createDeps({ isVisibleRef: { current: false } })
       const { transport, dataCallback } = await connectHiddenPane(deps)
@@ -12746,6 +13132,7 @@ describe('connectPanePty', () => {
         dataCallback: (data: string, meta?: { seq?: number; rawLength?: number }) => void
         getMainBufferSnapshot: ReturnType<typeof vi.fn>
         transport: MockTransport
+        deps: ReturnType<typeof createDeps>
       }> {
         enableMainAuthority()
         const deps = createDeps({ isVisibleRef: { current: true } })
@@ -12777,7 +13164,7 @@ describe('connectPanePty', () => {
           expect.any(Function)
         )
         pane.terminal.write.mockClear()
-        return { pane, dataCallback, getMainBufferSnapshot, transport }
+        return { pane, dataCallback, getMainBufferSnapshot, transport, deps }
       }
 
       function writtenData(pane: ReturnType<typeof createPane>): string {
@@ -12798,24 +13185,25 @@ describe('connectPanePty', () => {
         expect(writtenData(pane)).toContain('NEW')
       })
 
-      it('answers a 2031 subscribe on a chunk the restored snapshot drops as duplicate', async () => {
-        // Why the scan runs before reconciliation: the snapshot restore replays bytes
-        // into xterm without answering queries, so this live delivery is the only
-        // chance to reply. Dropping the chunk as a duplicate must not drop the query.
-        // Gate off so the chunk scanner (not main's fact) owns this pane's reply.
+      it('records a 2031 subscribe on a chunk the restored snapshot drops as duplicate', async () => {
+        // Why the scan runs before reconciliation: the snapshot restore replays bytes into
+        // xterm without tracking modes, so this live delivery is the only chance to observe
+        // the subscription. Dropping the chunk as a duplicate must not drop that.
+        // Gate off so the chunk scanner (not main's fact) owns this pane's registry.
         enableMainAuthority()
         mockStoreState.settings = {
           ...mockStoreState.settings,
           terminalHiddenDeliveryGate: false
         } as StoreState['settings']
-        const { pane, dataCallback, transport } = await restoreVisiblePaneToBaseline()
+        const { pane, dataCallback, transport, deps } = await restoreVisiblePaneToBaseline()
         transport.sendInput.mockClear()
 
         dataCallback(`SUB\x1b[?2031h`, { seq: 60, rawLength: 11 })
         await flushAsyncTicks(8)
 
         expect(writtenData(pane)).not.toContain('SUB')
-        expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
+        expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+        expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
       })
 
       it('slices a partial overlap when raw and clean lengths match', async () => {
@@ -13496,7 +13884,7 @@ describe('connectPanePty', () => {
     binding.dispose()
   })
 
-  it('answers a mode 2031 subscribe once, from the raw chunk boundary', async () => {
+  it('records a mode 2031 subscribe from the raw chunk boundary without answering', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -13526,8 +13914,8 @@ describe('connectPanePty', () => {
 
       // Why the scanner and not xterm's CSI handler: xterm batches PTY chunks into one
       // parse, so only this layer knows the chunk ended still subscribed (#9993).
-      expect(transport.sendInput).toHaveBeenCalledTimes(1)
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;2n')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
+      expect(transport.sendInputImmediate).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
       // The bytes still reach xterm so the emulator tracks the mode itself.
       expect(pane.terminal.write).toHaveBeenCalledWith('\x1b[?2031h')
     } finally {
@@ -13537,12 +13925,12 @@ describe('connectPanePty', () => {
     binding.dispose()
   })
 
-  // Why these three: fish 4.7.1 enables and disables 2031 around *every* prompt with no
-  // opt-out, so back-to-back chunks each carrying a toggle are the normal case, not an edge
-  // case. Each chunk owes exactly one decision, and xterm cannot make it — it parses several
-  // chunks in one synchronous batch, so a reply deferred to the parser is either dropped or
-  // answered against a subscription a later chunk already withdrew (#9993).
-  describe('mode 2031 replies are decided per raw PTY chunk', () => {
+  // Why: fish 4.7.1 enables and disables 2031 around *every* prompt with no opt-out, so
+  // back-to-back chunks each carrying a toggle are the normal case. Subscribing is never
+  // answered (#9993) — these pin that silence plus the per-chunk subscription bookkeeping
+  // that theme-flip pushes depend on. xterm cannot do that bookkeeping: it parses several
+  // chunks in one synchronous batch and only sees the net result.
+  describe('mode 2031 subscriptions are tracked per raw PTY chunk, never answered', () => {
     async function connectVisiblePane(): Promise<{
       transport: ReturnType<typeof createMockTransport>
       deps: ReturnType<typeof createDeps>
@@ -13581,56 +13969,60 @@ describe('connectPanePty', () => {
     const replies = (transport: { sendInput: { mock: { calls: unknown[][] } } }): unknown[] =>
       transport.sendInput.mock.calls.flat().filter((arg) => String(arg).includes('997'))
 
-    it('answers a chunk that ends subscribed even when the next chunk withdraws', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
-      // Two separate PTY chunks. xterm would parse both in one batch and see only the net
-      // result; the first chunk still owes a reply.
+    it('registers a chunk that ends subscribed, then retires it when the next withdraws', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
+      // Two separate PTY chunks. xterm would parse both in one batch and see only the net result.
       emit('\x1b[?2031h')
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
       emit('\x1b[?2031l')
-      expect(replies(transport)).toEqual(['\x1b[?997;2n'])
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('answers each chunk that ends subscribed', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('re-registers a chunk that withdraws and subscribes again', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit('\x1b[?2031h')
       emit('\x1b[?2031l\x1b[?2031h')
-      expect(replies(transport)).toHaveLength(2)
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('stays silent when one chunk both subscribes and withdraws', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
-      // The fish prompt case: the subscription is gone before the program could read a reply.
+    it('registers nothing when one chunk both subscribes and withdraws', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
+      // The fish prompt case: the subscription is gone before the program could read anything.
       emit('\x1b[?2031h prompt \x1b[?2031l')
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('stays silent when the withdrawal is split across two chunks', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('registers nothing when the withdrawal is split across two chunks', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit('\x1b[?2031h prompt \x1b[?20')
-      expect(replies(transport)).toEqual([])
       emit('31l')
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('stays silent when an unrelated private mode appends a split withdrawal', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('registers nothing when an unrelated private mode appends a split withdrawal', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit('\x1b[?2031h prompt \x1b[?25')
-      expect(replies(transport)).toEqual([])
       emit(';2031l')
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('answers after an ambiguous tail resolves to another mode', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('registers the subscription once an ambiguous tail resolves to another mode', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit('\x1b[?2031h drawing \x1b[?20')
-      expect(replies(transport)).toEqual([])
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       emit('25h')
-      expect(replies(transport)).toEqual(['\x1b[?997;2n'])
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
@@ -13654,19 +14046,21 @@ describe('connectPanePty', () => {
       dispose()
     })
 
-    it('answers once when a TUI subscribes at the end of a fish prompt chunk', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('registers a TUI that subscribes at the end of a fish prompt chunk', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit(`${FISH_PROMPT_HANDOFF}\x1b[?2031h`)
-      expect(replies(transport)).toHaveLength(1)
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('answers a subscribe whose withdrawal never arrives', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('keeps a subscription whose withdrawal never arrives', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       // A real TUI: subscribe now, unsubscribe minutes later on exit.
       emit('\x1b[?2031h')
       emit('painting the ui')
-      expect(replies(transport)).toHaveLength(1)
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
@@ -13683,7 +14077,7 @@ describe('connectPanePty', () => {
     })
 
     it('discards a half-read escape prefix when the pane swaps PTYs', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       // Why: the tail is a byte range from the old stream. Splicing it onto the first
       // chunk of a replacement PTY fabricates a subscribe no program ever sent.
       transport.serializeBuffer = vi.fn().mockResolvedValue(null)
@@ -13694,12 +14088,13 @@ describe('connectPanePty', () => {
 
       emit('31h')
 
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       expect(replies(transport)).toEqual([])
       dispose()
     })
   })
 
-  it('answers hidden Codex mode 2031 subscribes split across becoming visible', async () => {
+  it('records hidden Codex mode 2031 subscribes split across becoming visible', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -13734,8 +14129,9 @@ describe('connectPanePty', () => {
     isVisibleRef.current = true
     capturedDataCallback.current?.('31h')
 
-    expect(transport.sendInputImmediate).toHaveBeenCalledWith('\x1b[?997;2n')
+    expect(transport.sendInputImmediate).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     expect(paneMode2031Ref.current.get(1)).toBe(true)
+    // Seeded so the next appearance re-apply only pushes on a real color-mode flip.
     expect(paneLastThemeModeRef.current.get(1)).toBe('light')
     expect(pane.terminal.write).not.toHaveBeenCalledWith('31h', expect.any(Function))
 
@@ -14284,7 +14680,7 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(20)
 
       expect(getMainBufferSnapshot).toHaveBeenCalled()
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
       expect(pane.terminal.write).toHaveBeenCalledWith(
         expect.stringContaining('healed from snapshot'),
         expect.any(Function)
@@ -14982,7 +15378,8 @@ describe('connectPanePty', () => {
       undefined,
       { connectionId: null }
     )
-    expect(transport.sendInput).toHaveBeenCalledWith(expect.stringContaining('\x1b['))
+    // Remote gated panes record the subscription from the fact and answer nothing (#9993).
+    expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     expect(recordPaneMode2031Subscription).toHaveBeenCalledWith(1, expect.any(String))
     deps.paneMode2031Ref.current.set(1, true)
     deps.paneLastThemeModeRef.current.set(1, 'dark')
@@ -15140,6 +15537,63 @@ describe('connectPanePty', () => {
     disposable.dispose()
   })
 
+  it('preserves the painted normal buffer when a successful hidden restore has no image', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('remote:env-1@@terminal-1')
+    const capturedDataCallback: {
+      current: ((data: string, meta?: { seq?: number; rawLength?: number }) => void) | null
+    } = { current: null }
+    const hidden = 'x'.repeat(2 * 1024 * 1024 + 1)
+    const live = 'visible remote output\r\n'
+    transport.serializeBuffer = vi.fn()
+    transport.serializeBufferOutcome = vi.fn().mockResolvedValue({
+      availability: { kind: 'snapshot' },
+      snapshot: {
+        data: '',
+        scrollbackAnsi: '',
+        cols: 120,
+        rows: 40,
+        seq: hidden.length + live.length,
+        source: 'headless'
+      }
+    })
+    transport.connect.mockImplementation(async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
+      capturedDataCallback.current = callbacks.onData ?? null
+      return 'remote:env-1@@terminal-1'
+    })
+    transportFactoryQueue.push(transport)
+    const pane = createPane(1)
+    const deps = createDeps({ isVisibleRef: { current: false } })
+    const disposable = connectPanePty(pane as never, createManager(1) as never, deps as never)
+    await flushAsyncTicks(6)
+    const writeStart = pane.terminal.write.mock.calls.length
+
+    capturedDataCallback.current?.(hidden, { seq: hidden.length, rawLength: hidden.length })
+    ;(deps.isVisibleRef as { current: boolean }).current = true
+    capturedDataCallback.current?.(live, {
+      seq: hidden.length + live.length,
+      rawLength: live.length
+    })
+    await flushAsyncTicks(20)
+
+    const restoreWrites = pane.terminal.write.mock.calls
+      .slice(writeStart)
+      .map(([data]) => String(data))
+    const paintedFrame = Array.from({ length: 8 }, (_, index) => `painted-frame-${index + 1}`).join(
+      '\r\n'
+    )
+    const actual = await renderHeadlessTerminalState([paintedFrame, ...restoreWrites], 120, 4)
+    const expected = await renderHeadlessTerminalState(
+      [paintedFrame, ...restoreWrites.filter((data) => data === live)],
+      120,
+      4
+    )
+    expect(actual).toEqual(expected)
+    expect(transport.serializeBufferOutcome).toHaveBeenCalledTimes(1)
+    expect(transport.serializeBuffer).not.toHaveBeenCalled()
+    disposable.dispose()
+  })
+
   it('defers inactive split-pane plain hidden output restore until the pane returns', async () => {
     const { resetHiddenOutputRestoreSchedulerForTests } =
       await import('./hidden-output-restore-scheduler')
@@ -15440,9 +15894,8 @@ describe('connectPanePty', () => {
     disposable.dispose()
   })
 
-  it('pulses a skipped hidden alt frame when reveal keeps the snapshot grid', async () => {
+  it('keeps a hidden-output alt frame at the capture grid below the fit floor', async () => {
     const { connectPanePty } = await import('./pty-connection')
-    const { safeFit } = await import('@/lib/pane-manager/pane-tree-ops')
     const transport = createMockTransport('pty-id')
     let onData: ConnectCallbacks['onData']
     transport.connect.mockImplementation(async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
@@ -15464,41 +15917,36 @@ describe('connectPanePty', () => {
       scrollbackAnsi: 'preserved history'
     })
     const pane = createPane(1)
-    let paneRect = createRect(0, 0)
-    pane.container.getBoundingClientRect = vi.fn(() => paneRect)
-    let xtermContainerDisplay = 'none'
-    const xtermContainer = new EventTarget() as HTMLElement
-    Object.defineProperty(xtermContainer, 'parentElement', { value: null })
-    Object.defineProperty(xtermContainer, 'ownerDocument', {
-      value: { defaultView: { getComputedStyle: () => ({ display: xtermContainerDisplay }) } }
+    pane.terminal.cols = 80
+    pane.terminal.rows = 24
+    const writes: string[] = []
+    pane.terminal.write = vi.fn((data: string, callback?: () => void) => {
+      writes.push(data)
+      callback?.()
     })
-    ;(pane as { xtermContainer?: HTMLElement }).xtermContainer = xtermContainer
+    pane.container.getBoundingClientRect = vi.fn(() => createRect(4, 3))
     const deps = createDeps({ isVisibleRef: { current: false } })
-    const disposable = connectPanePty(pane as never, createManager(1) as never, deps as never)
+    const binding = connectPanePty(pane as never, createManager(1) as never, deps as never)
     await flushAsyncTicks(6)
     onData?.(hidden, { seq: hidden.length, rawLength: hidden.length })
+    const { _dispatchPtyModelRestoreNeededForTest } = await import('./pty-model-restore-channel')
+    _dispatchPtyModelRestoreNeededForTest({
+      id: 'pty-id',
+      reason: 'hidden-drop',
+      markerSeq: hidden.length + 1
+    })
     ;(deps.isVisibleRef as { current: boolean }).current = true
-    onData?.('x', { seq: hidden.length + 1, rawLength: 1 })
+    const { requestTerminalBacklogRecovery } =
+      await import('@/lib/pane-manager/pane-terminal-output-scheduler')
+    requestTerminalBacklogRecovery(pane.terminal as never)
     await flushAsyncTicks(20)
 
-    const writes = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map(
-      (call) => call[0]
-    )
-    expect(writes.join('')).not.toContain('TOO-WIDE-ALT-FRAME')
-    expect(writes.join('')).toContain('\x1b[?1004h\x1b[?25l')
+    expect(writes.join('')).toContain('TOO-WIDE-ALT-FRAME')
+    expect(writes.join('')).toContain('preserved history')
+    expect(writes.filter((write) => write.includes('TOO-WIDE-ALT-FRAME'))).toHaveLength(1)
+    expect(pane.terminal.resize).toHaveBeenCalledWith(120, 40)
     expect(transport.resize).not.toHaveBeenCalled()
-
-    xtermContainerDisplay = 'block'
-    paneRect = createRect(800, 600)
-    safeFit(pane as never)
-    await flushAsyncTicks(12)
-
-    const pulseStart = transport.resize.mock.calls.findIndex(
-      ([cols, rows]) => cols === 119 && rows === 40
-    )
-    expect(pulseStart).toBeGreaterThanOrEqual(0)
-    expect(transport.resize.mock.calls[pulseStart + 1]).toEqual([120, 40])
-    disposable.dispose()
+    binding.dispose()
   })
 
   it('drains foreground output after a renderer-sourced hidden-backlog snapshot without seq', async () => {
@@ -21395,7 +21843,6 @@ describe('connectPanePty', () => {
       alternateScreen: true,
       scrollbackAnsi: 'PARKED-SSH-SCROLLBACK\r\n'
     })
-    await parkTabForReveal('tab-1', sshPtyId)
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: sshPtyId }] },
@@ -21413,6 +21860,7 @@ describe('connectPanePty', () => {
       pane as never,
       createManager(1) as never,
       createDeps({
+        mountFollowsTerminalPark: true,
         restoredLeafId: LEAF_1,
         restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
       }) as never
@@ -21458,7 +21906,6 @@ describe('connectPanePty', () => {
     transportFactoryQueue.push(createMockTransport())
     vi.mocked(window.api.pty.getMainBufferSnapshot).mockReturnValue(snapshot.promise)
     vi.mocked(window.api.ssh.connect).mockReturnValue(sshConnect.promise)
-    await parkTabForReveal('tab-1', sshPtyId)
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: sshPtyId, generation: 7 }] },
@@ -21485,6 +21932,7 @@ describe('connectPanePty', () => {
       pane as never,
       createManager(1) as never,
       createDeps({
+        mountFollowsTerminalPark: true,
         restoredLeafId: LEAF_1,
         restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
       }) as never
@@ -21537,7 +21985,6 @@ describe('connectPanePty', () => {
       seq: 125,
       source: 'headless'
     })
-    await parkTabForReveal('tab-1', foreignPtyId)
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: foreignPtyId }] },
@@ -21554,6 +22001,7 @@ describe('connectPanePty', () => {
       pane as never,
       createManager(1) as never,
       createDeps({
+        mountFollowsTerminalPark: true,
         restoredLeafId: LEAF_1,
         restoredPtyIdByLeafId: { [LEAF_1]: foreignPtyId }
       }) as never
@@ -21567,6 +22015,10 @@ describe('connectPanePty', () => {
     await flushAsyncTicks(4)
   })
 
+  // STA-3077 moved the replacement behind the disconnected banner: an expired report is the
+  // relay's not-found mapping, not proof the shell exited, so the user starts the new terminal.
+  // The subject here is unchanged — a parked snapshot that resolves late must not paint over the
+  // replacement PTY, whatever route created it.
   it('does not paint a delayed parked snapshot over an expired-session replacement', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const sshPtyId = toAppSshPtyId('conn-1', 'relay-pty-expired')
@@ -21589,7 +22041,6 @@ describe('connectPanePty', () => {
     })
     transportFactoryQueue.push(transport)
     vi.mocked(window.api.pty.getMainBufferSnapshot).mockReturnValue(snapshot.promise)
-    await parkTabForReveal('tab-1', sshPtyId)
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: sshPtyId }] },
@@ -21602,16 +22053,31 @@ describe('connectPanePty', () => {
 
     const pane = createPane(1)
     const { writes } = captureCallbackTerminalWrites(pane)
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
     const binding = connectPanePty(
       pane as never,
       createManager(1) as never,
       createDeps({
+        mountFollowsTerminalPark: true,
         restoredLeafId: LEAF_1,
-        restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
+        restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId },
+        onPtyRecoveryStateRef: { current: onPtyRecoveryState }
       }) as never
     )
     await flushAsyncTicks(30)
+
+    // The expiry no longer respawns on its own; the banner's action is now the route to a
+    // replacement PTY, so drive it to reach this test's subject.
+    expect(transport.connect).toHaveBeenCalledTimes(1)
+    const published = onPtyRecoveryState.mock.calls.find(
+      ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+    )?.[1]?.unreachablePane
+    expect(published).toBeDefined()
+    published!.onStartNewTerminal()
+    await flushAsyncTicks(30)
     expect(transport.connect).toHaveBeenCalledTimes(2)
+    // A fresh spawn, not a second reattach — the replacement is `freshPtyId`.
+    expect(transport.connect.mock.calls[1]?.[0]?.sessionId).toBeUndefined()
 
     snapshot.resolve({
       data: 'EXPIRED-SESSION-SNAPSHOT\r\n',
@@ -21643,7 +22109,6 @@ describe('connectPanePty', () => {
       source: 'headless'
     })
     transportFactoryQueue.push(transport)
-    await parkTabForReveal('tab-1', remotePtyId)
     mockStoreState = {
       ...mockStoreState,
       runtimeStatusByEnvironmentId: new Map([
@@ -21659,7 +22124,7 @@ describe('connectPanePty', () => {
 
     const pane = createPane(1)
     const { parseCallbacks, writes } = captureCallbackTerminalWrites(pane)
-    const deps = createDeps()
+    const deps = createDeps({ mountFollowsTerminalPark: true })
 
     connectPanePty(pane as never, createManager(1) as never, deps as never)
     for (let step = 0; step < 30; step += 1) {
@@ -21674,7 +22139,7 @@ describe('connectPanePty', () => {
     expect(transport.getPtyId).toHaveReturnedWith(remotePtyId)
   })
 
-  it('restores a local main-model snapshot after a contentless park reattach', async () => {
+  it('keeps a parked main-model alt frame at its capture grid while hidden', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const localPtyId = 'global-floating-terminal@@terminal-1'
     const transport = createMockTransport(localPtyId)
@@ -21685,13 +22150,15 @@ describe('connectPanePty', () => {
     transportFactoryQueue.push(transport)
     const getMainBufferSnapshot = vi.mocked(window.api.pty.getMainBufferSnapshot)
     getMainBufferSnapshot.mockResolvedValue({
-      data: 'FLOATING-PARK-RESTORE-OK\r\n',
+      data: 'FLOATING-PARK-ALT-FRAME',
+      frameRestoreAnsi: '\x1b[?25l',
       cols: 113,
       rows: 32,
       seq: 558,
-      source: 'headless'
+      source: 'headless',
+      alternateScreen: true,
+      scrollbackAnsi: 'FLOATING-PARK-HISTORY\r\n'
     })
-    await parkTabForReveal('tab-1', localPtyId, 'global-floating-terminal')
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: {
@@ -21709,8 +22176,10 @@ describe('connectPanePty', () => {
     }
 
     const pane = createPane(1)
+    pane.container.getBoundingClientRect = vi.fn(() => createRect(0, 0))
     const { parseCallbacks, writes } = captureCallbackTerminalWrites(pane)
     const deps = createDeps({
+      mountFollowsTerminalPark: true,
       worktreeId: 'global-floating-terminal',
       restoredLeafId: LEAF_1,
       restoredPtyIdByLeafId: { [LEAF_1]: localPtyId }
@@ -21727,7 +22196,55 @@ describe('connectPanePty', () => {
       expect.objectContaining({ sessionId: localPtyId })
     )
     expect(deps.syncPanePtyLayoutBinding).toHaveBeenCalledWith(1, localPtyId)
-    expect(writes.join('')).toContain('FLOATING-PARK-RESTORE-OK')
+    expect(writes.join('')).toContain('FLOATING-PARK-HISTORY')
+    expect(writes.join('')).toContain('FLOATING-PARK-ALT-FRAME')
+    expect(writes.filter((write) => write.includes('FLOATING-PARK-ALT-FRAME'))).toHaveLength(1)
+    expect(pane.terminal.resize).toHaveBeenCalledWith(113, 32)
+  })
+
+  it('restores a parked SSH alt frame after StrictMode watcher disposal', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const sshPtyId = toAppSshPtyId('conn-1', 'relay-pty-static-alt')
+    const transport = createMockTransport(sshPtyId)
+    transport.connect.mockImplementation(async () => {
+      transport.getPtyId.mockReturnValue(sshPtyId)
+      return { id: sshPtyId, isReattach: true, replay: '' }
+    })
+    transportFactoryQueue.push(transport)
+    vi.mocked(window.api.pty.getMainBufferSnapshot).mockResolvedValue({
+      data: '\x1b[0m\x1b[?1049h\x1b[HSTATIC-SSH-ALT-FRAME',
+      frameRestoreAnsi: '\x1b[0m\x1b[?1049h\x1b[?6l\x1b[1;21H',
+      cols: 100,
+      rows: 30,
+      seq: 512,
+      source: 'headless',
+      alternateScreen: true,
+      scrollbackAnsi: 'PRESERVED-SSH-HISTORY\r\n'
+    })
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: null }] },
+      repos: [{ id: 'repo1', connectionId: 'conn-1' }],
+      deferredSshReconnectTargets: ['conn-1'],
+      deferredSshSessionIdsByTabId: { 'tab-1': sshPtyId }
+    }
+
+    const pane = createPane(1)
+    const { parseCallbacks, writes } = captureCallbackTerminalWrites(pane)
+    const deps = createDeps({
+      mountFollowsTerminalPark: true,
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
+    })
+    connectPanePty(pane as never, createManager(1) as never, deps as never)
+    for (let step = 0; step < 30; step += 1) {
+      parseCallbacks.shift()?.()
+      await flushAsyncTicks(2)
+    }
+
+    expect(window.api.pty.getMainBufferSnapshot).toHaveBeenCalledOnce()
+    expect(writes.join('')).toContain('PRESERVED-SSH-HISTORY')
+    expect(writes.filter((write) => write.includes('STATIC-SSH-ALT-FRAME'))).toHaveLength(1)
   })
 
   it('falls back to relay replay when the SSH model snapshot stalls', async () => {
@@ -21741,9 +22258,7 @@ describe('connectPanePty', () => {
     })
     transportFactoryQueue.push(transport)
     vi.mocked(window.api.pty.getMainBufferSnapshot).mockReturnValue(new Promise(() => {}))
-    // Why parked: only a reveal remount probes main's model — the pane reads the
-    // still-live park watcher entry at connect time to tell the two apart.
-    await parkTabForReveal('tab-1', sshPtyId)
+    // Why parked: only a reveal remount probes main's model.
 
     mockStoreState = {
       ...mockStoreState,
@@ -21756,6 +22271,7 @@ describe('connectPanePty', () => {
     const pane = createPane(1)
     const { writes } = captureCallbackTerminalWrites(pane)
     const deps = createDeps({
+      mountFollowsTerminalPark: true,
       restoredLeafId: LEAF_1,
       restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
     })
@@ -22043,7 +22559,10 @@ describe('connectPanePty', () => {
     expect(deps.onPtyErrorRef.current).not.toHaveBeenCalled()
   })
 
-  it('spawns a fresh PTY when a deferred SSH session expired', async () => {
+  // STA-3077, deferred-reconnect twin of the non-deferred onError case. `SSH_SESSION_EXPIRED` is
+  // the relay's not-found mapping and answers for shells still running under a relay process it
+  // replaced, so it is not proof the shell exited and may not authorize a respawn.
+  it('surfaces a disconnected pane when a deferred SSH session reports expired', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport()
     transport.connect.mockImplementation(async (opts) => {
@@ -22069,18 +22588,26 @@ describe('connectPanePty', () => {
 
     const pane = createPane(1)
     const manager = createManager(1)
-    const deps = createDeps()
+    const onPtyRecoveryState = vi.fn<(paneId: number, state: RecoveryStateProbe) => void>()
+    const deps = createDeps({ onPtyRecoveryStateRef: { current: onPtyRecoveryState } })
 
     connectPanePty(pane as never, manager as never, deps as never)
     await flushAsyncTicks(20)
 
+    // Producer pin: the deferred reattach ran and reported expired.
+    expect(transport.connect.mock.calls[0]?.[0]?.sessionId).toBe('expired-session')
     expect(deps.onPtyErrorRef.current).not.toHaveBeenCalled()
     expect(toastInfo).not.toHaveBeenCalled()
-    expect(transport.connect).toHaveBeenCalledTimes(2)
-    expect(deps.clearExitedPanePtyLayoutBinding).toHaveBeenCalledWith(1, 'expired-session')
-    expect(deps.clearTabPtyId).toHaveBeenCalledWith('tab-1', 'expired-session')
-    expect(deps.syncPanePtyLayoutBinding).toHaveBeenCalledWith(1, 'fresh-ssh-pty')
-    expect(deps.updateTabPtyId).toHaveBeenCalledWith('tab-1', 'fresh-ssh-pty')
+    expect(transport.connect).toHaveBeenCalledTimes(1)
+    expect(
+      onPtyRecoveryState.mock.calls.find(
+        ([paneId, state]) => paneId === pane.id && state?.phase === 'disconnected'
+      )?.[1]?.unreachablePane
+    ).toBeDefined()
+    expect(deps.clearExitedPanePtyLayoutBinding).not.toHaveBeenCalled()
+    expect(deps.clearTabPtyId).not.toHaveBeenCalled()
+    expect(deps.syncPanePtyLayoutBinding).not.toHaveBeenCalledWith(1, 'fresh-ssh-pty')
+    expect(deps.updateTabPtyId).not.toHaveBeenCalled()
   })
 
   it('clears the pending serializer when disposed before deferred SSH expiry resolves', async () => {
@@ -23081,6 +23608,159 @@ describe('connectPanePty', () => {
     }
   })
 
+  it('resets stale keyboard state when a batched done→working→done burst lands as one publication', async () => {
+    const restoreUserAgent = temporarilySetNavigatorUserAgent(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
+    )
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+
+    try {
+      const paneKey = makePaneKey('tab-1', LEAF_1)
+      const firstDoneAt = Date.now()
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'done',
+        prompt: 'first turn',
+        updatedAt: firstDoneAt,
+        stateStartedAt: firstDoneAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: [{ state: 'working', prompt: 'first turn', startedAt: firstDoneAt - 5_000 }]
+      }
+      const pane = createPane(1)
+      const manager = createManager(1)
+      const deps = createDeps()
+
+      connectPanePty(pane as never, manager as never, deps as never)
+      expect(pane.terminal.write).not.toHaveBeenCalled()
+
+      // The burst's intermediate `working` never publishes, so the entry stays `done` end-to-end;
+      // only the stateHistory row proves a second turn ran and re-armed the kitty protocol.
+      const secondDoneAt = firstDoneAt + 10_000
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'done',
+        prompt: 'second turn',
+        updatedAt: secondDoneAt,
+        stateStartedAt: secondDoneAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: [
+          { state: 'working', prompt: 'first turn', startedAt: firstDoneAt - 5_000 },
+          { state: 'done', prompt: 'first turn', startedAt: firstDoneAt },
+          { state: 'working', prompt: 'second turn', startedAt: secondDoneAt - 2_000 }
+        ]
+      }
+      notifyStoreSubscribers()
+
+      expect(pane.terminal.write).toHaveBeenCalledWith(
+        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        expect.any(Function)
+      )
+    } finally {
+      restoreUserAgent()
+    }
+  })
+
+  it('resets stale keyboard state when a batched burst ends on working after a completed turn', async () => {
+    const restoreUserAgent = temporarilySetNavigatorUserAgent(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
+    )
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+
+    try {
+      const paneKey = makePaneKey('tab-1', LEAF_1)
+      const startedAt = Date.now()
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'working',
+        prompt: 'ship it',
+        updatedAt: startedAt,
+        stateStartedAt: startedAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: []
+      }
+      const pane = createPane(1)
+      const manager = createManager(1)
+      const deps = createDeps()
+
+      connectPanePty(pane as never, manager as never, deps as never)
+      notifyStoreSubscribers()
+      expect(pane.terminal.write).not.toHaveBeenCalled()
+
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'working',
+        prompt: 'follow-up',
+        updatedAt: startedAt + 8_000,
+        stateStartedAt: startedAt + 8_000,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: [
+          { state: 'working', prompt: 'ship it', startedAt },
+          { state: 'done', prompt: 'ship it', startedAt: startedAt + 4_000 }
+        ]
+      }
+      notifyStoreSubscribers()
+
+      expect(pane.terminal.write).toHaveBeenCalledWith(
+        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        expect.any(Function)
+      )
+    } finally {
+      restoreUserAgent()
+    }
+  })
+
+  it('keeps native Windows same-turn done repaints from re-resetting keyboard state', async () => {
+    const restoreUserAgent = temporarilySetNavigatorUserAgent(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
+    )
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+
+    try {
+      const paneKey = makePaneKey('tab-1', LEAF_1)
+      const doneAt = Date.now()
+      const pane = createPane(1)
+      const manager = createManager(1)
+      const deps = createDeps()
+
+      connectPanePty(pane as never, manager as never, deps as never)
+
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'done',
+        prompt: 'ship it',
+        updatedAt: doneAt,
+        stateStartedAt: doneAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: []
+      }
+      notifyStoreSubscribers()
+      const writesAfterDone = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.length
+
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'done',
+        prompt: 'ship it',
+        updatedAt: doneAt + 1_000,
+        stateStartedAt: doneAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: []
+      }
+      notifyStoreSubscribers()
+
+      expect((pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.length).toBe(
+        writesAfterDone
+      )
+    } finally {
+      restoreUserAgent()
+    }
+  })
+
   it('drops native Windows Codex focus reports while a history resume is idle', async () => {
     const restoreUserAgent = temporarilySetNavigatorUserAgent(
       'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
diff --git a/src/renderer/src/components/terminal-pane/pty-connection.ts b/src/renderer/src/components/terminal-pane/pty-connection.ts
index 8c32b1e1984..9fbeee199e2 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection.ts
@@ -13,10 +13,12 @@ import { scheduleRuntimeGraphSync } from '@/runtime/sync-runtime-graph'
 import { useAppStore } from '@/store'
 import { getWorktreeMapFromState } from '@/store/selectors'
 import { parseWorkspaceKey } from '../../../../shared/workspace-scope'
+import { SSH_SESSION_EXPIRED_ERROR } from '../../../../shared/ssh-pty-failure-tokens'
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import { isEphemeralSetupTerminalWorktreeId } from '../../../../shared/ephemeral-setup-terminal-worktree-id'
 import { TERMINAL_PAIRED_PARKING_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
 import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import { parseTerminalKittyKeyboardFlags } from '../../../../shared/terminal-kitty-keyboard-flags'
 import { isRuntimeOwnedSshTargetId, parseExecutionHostId } from '../../../../shared/execution-host'
 import { createTerminalZeroDimensionsMessage } from '../../../../shared/terminal-zero-dimensions-diagnostic'
 import { isWorktreeRemovalFenceError } from '../../../../shared/worktree-removal-fence-error'
@@ -36,7 +38,7 @@ import {
 } from '@/lib/pane-manager/terminal-delivery-credit'
 import { serializeWithAbsoluteCursor } from '../../../../shared/terminal-serialize-absolute-cursor'
 import { isTerminalQueryReply } from '../../../../shared/terminal-query-reply'
-import type { PtyBufferSnapshot, PtyConnectResult } from './pty-transport'
+import type { PtyBufferSnapshot, PtyConnectResult, PtyReplayDataMeta } from './pty-transport'
 import type { IpcPtyTransportOptions, PtyTransportRecoveryState } from './pty-transport-types'
 import { createIpcPtyTransport } from './pty-transport'
 import { createRemoteRuntimePtyTransport } from './remote-runtime-pty-transport'
@@ -127,11 +129,9 @@ import {
   RESET_TERMINAL_CURSOR_STYLE
 } from '../../../../shared/terminal-mode-reset-profiles'
 import { buildFreshShellViewportBlankingSequence } from './terminal-restored-viewport'
-import { createShellReadyMarkerScanState, scanForShellReadyMarker } from './shell-ready-marker-scan'
 import { getSystemPrefersDark } from '@/lib/terminal-theme'
 import {
   INITIAL_MODE_2031_REPLY_SCAN_STATE,
-  mode2031SequenceFor,
   resolveTerminalColorSchemeMode,
   scanMode2031ReplyDecision
 } from '../../../../shared/terminal-color-scheme-protocol'
@@ -280,7 +280,6 @@ import {
   setCommandCodeDoneSettleExecutor
 } from './command-code-done-settle'
 import { canCommandCodeOutputOwnPane } from './command-code-output-ownership'
-import { isTerminalTabParked } from './terminal-parked-watcher-registry'
 import {
   getExecutionHostIdForWorktree,
   getSettingsForWorktreeRuntimeOwner
@@ -338,14 +337,14 @@ import {
 } from './renderer-owned-agent-status-registry'
 import type { DirectSshPaneRetryAttempt } from '@/store/slices/direct-ssh-terminal-recovery'
 import { directSshAuthoritiesEqual } from '@/store/slices/direct-ssh-terminal-authority-ledger'
+import { isProvenSshSessionGoneError } from './reattach-failure-classification'
 
 const pendingSpawnByPaneKey = new Map<string, Promise<string | null>>()
-const SSH_SESSION_EXPIRED_ERROR = 'SSH_SESSION_EXPIRED'
+
 // Why: relay requests expire at 30s; leave one second for their fallback before re-arming locally.
 const DIRECT_SSH_PANE_RETRY_SETTLEMENT_TIMEOUT_MS = 31_000
 const REMOTE_PTY_ID_PREFIX = 'remote:'
 const PTY_CONNECT_DIAG_LIMIT = 200
-const SSH_SHELL_READY_STARTUP_FALLBACK_MS = 1500
 const MANUAL_AGENT_COMMAND_MAX_CHARS = 4096
 const STARTUP_DRAFT_PASTE_QUIET_MS = 1500
 // Why: the notice deliberately omits the rejected path — saved cwds can
@@ -529,11 +528,10 @@ const e2eTerminalHiddenSnapshotOverrides = new Map<string, E2eTerminalHiddenSnap
 
 // Why: the per-chunk hidden-skip grammar is deleted (Phase 6) — hidden bytes
 // either never reach the renderer (delivery gate) or ride the background
-// scheduler queue. Only the mode-2031 fact-reply counter still has a producer.
+// scheduler queue.
 type E2eTerminalPtyOutputDebugSnapshot = {
   hiddenRendererSkipCount: number
   hiddenRendererSkippedChars: number
-  hiddenRendererMode2031ReplyCount: number
 }
 
 type E2eTerminalPtyOutputDebugApi = {
@@ -552,6 +550,12 @@ type PendingStartupCommand = {
 
 type FreshSpawnOptions = {
   forceBlankRestoredViewport?: boolean
+  /** Ignore the startup this transport was constructed with. Omitting the fields is not enough:
+   *  connect falls back to its constructor values, so a "fresh" shell would resume the saved agent
+   *  session — the duplicate transcript the disconnected pane exists to prevent. */
+  suppressSavedStartup?: boolean
+  /** Refuse adoption of the pane's recorded shell; see the unreachable-pane action. */
+  createFreshShellForUnreachablePane?: boolean
 }
 
 type ColdRestoreAgentResumeStartup = PendingStartupCommand & {
@@ -566,14 +570,12 @@ type ColdRestoreAgentResumeStartup = PendingStartupCommand & {
 
 const e2eTerminalPtyOutputDebugState: E2eTerminalPtyOutputDebugSnapshot = {
   hiddenRendererSkipCount: 0,
-  hiddenRendererSkippedChars: 0,
-  hiddenRendererMode2031ReplyCount: 0
+  hiddenRendererSkippedChars: 0
 }
 
 function resetE2eTerminalPtyOutputDebug(): void {
   e2eTerminalPtyOutputDebugState.hiddenRendererSkipCount = 0
   e2eTerminalPtyOutputDebugState.hiddenRendererSkippedChars = 0
-  e2eTerminalPtyOutputDebugState.hiddenRendererMode2031ReplyCount = 0
 }
 
 function exposeE2eTerminalPtyOutputDebug(): void {
@@ -596,14 +598,6 @@ function recordHiddenRendererSkip(chars: number): void {
   e2eTerminalPtyOutputDebugState.hiddenRendererSkippedChars += chars
 }
 
-function recordHiddenMode2031Reply(): void {
-  if (!e2eConfig.exposeStore) {
-    return
-  }
-  exposeE2eTerminalPtyOutputDebug()
-  e2eTerminalPtyOutputDebugState.hiddenRendererMode2031ReplyCount += 1
-}
-
 function exposeE2eTerminalPtyDataInjection(): void {
   if (!e2eConfig.exposeStore || typeof window === 'undefined') {
     return
@@ -1093,6 +1087,25 @@ function isSetupSplitGeometryReady(
   )
 }
 
+/** Start time of the newest completed turn, counting turns already folded into history.
+ *  Why: batched publications coalesce done→working→done into a single store notification,
+ *  so the done EDGE survives only in stateHistory; comparing `state` alone misses it. */
+function resolveLatestAgentDoneStartedAt(entry: AgentStatusEntry | undefined): number | undefined {
+  if (!entry) {
+    return undefined
+  }
+  if (entry.state === 'done') {
+    return entry.stateStartedAt
+  }
+  const history = entry.stateHistory ?? []
+  for (let index = history.length - 1; index >= 0; index -= 1) {
+    if (history[index].state === 'done') {
+      return history[index].startedAt
+    }
+  }
+  return undefined
+}
+
 /**
  * Establishes a binding between a terminal pane and its corresponding PTY stream,
  * managing input, output, title synchronization, and agent status tracking.
@@ -1107,10 +1120,7 @@ export function connectPanePty(
   // settles after remount must not remount its already-replaced successor.
   const terminalRecoveryGeneration = captureTerminalPaneRecoveryGeneration(deps.tabId)
   const terminalRecoveryInstance = registerTerminalPaneRecoveryInstance(deps.tabId)
-  // Why sampled here: the host disposes this tab's park watcher in the effect
-  // that follows this mount, so connect time is the only moment a pane can tell
-  // a reveal remount from an in-place reattach.
-  let mountFollowsTerminalPark = isTerminalTabParked(deps.tabId)
+  let mountFollowsTerminalPark = deps.mountFollowsTerminalPark
   let authoritativeReattachGeneration = 0
   exposeE2eTerminalPtyOutputDebug()
   let disposed = false
@@ -1133,7 +1143,6 @@ export function connectPanePty(
   let cleanupStartupDraftPasteTimers = (): void => {}
   let unregisterE2ePtyDataInjection = (): void => {}
   let startupInjectTimer: ReturnType<typeof setTimeout> | null = null
-  let sshShellReadyFallbackTimer: ReturnType<typeof setTimeout> | null = null
   let agentTaskCompleteNotificationGraceTimer: ReturnType<typeof setTimeout> | null = null
   let agentTaskCompleteNotificationMaxTimer: ReturnType<typeof setTimeout> | null = null
   let agentTaskCompleteStatusUnsubscribe: (() => void) | null = null
@@ -3610,10 +3619,10 @@ export function connectPanePty(
   const shouldApplyNativeWindowsRewriteRefresh = isNativeWindowsConpty
   const shouldApplyWindowsRendererUnicodeRefresh = CLIENT_PLATFORM === 'win32'
   const shouldProtectNativeWindowsSynchronizedOutput = isNativeWindowsConpty
-  let lastAgentStatusState = state.agentStatusByPaneKey[cacheKey]?.state
   let unsubscribeWindowsDoneTerminalModeReset: (() => void) | null = null
   if (isNativeWindowsConpty) {
     const initialAgentStatus = state.agentStatusByPaneKey[cacheKey]
+    let lastAgentDoneStartedAt = resolveLatestAgentDoneStartedAt(initialAgentStatus)
     if (
       !initialAgentStatus &&
       paneStartup?.telemetry?.launch_source === 'sidebar' &&
@@ -3632,13 +3641,18 @@ export function connectPanePty(
       const nextAgentStatusState = nextAgentStatus?.state
       if (nextAgentStatusState === 'done') {
         setFocusReportSuppressionForAgentCompletion(undefined, nextAgentStatus.agentType)
-        if (lastAgentStatusState !== 'done') {
-          queueAgentIdleTerminalModeReset()
-        }
       } else if (nextAgentStatusState) {
         suppressNativeWindowsIdleCodexFocusReports = false
       }
-      lastAgentStatusState = nextAgentStatusState
+      const nextAgentDoneStartedAt = resolveLatestAgentDoneStartedAt(nextAgentStatus)
+      // Why: a NEW completed turn — same-state `done` pings keep stateStartedAt, so they no-op.
+      if (
+        nextAgentDoneStartedAt !== undefined &&
+        nextAgentDoneStartedAt !== lastAgentDoneStartedAt
+      ) {
+        queueAgentIdleTerminalModeReset()
+      }
+      lastAgentDoneStartedAt = nextAgentDoneStartedAt
     })
   }
 
@@ -3721,13 +3735,13 @@ export function connectPanePty(
   })
   // Why: Phase-4 hidden-delivery gate — only meaningful under main authority
   // (renderer byte parsers need bytes otherwise). Decided once at pane
-  // creation: it picks the mode-2031 answer path (fact reply vs byte scan),
-  // which must have exactly one owner.
+  // creation: it picks which path records a mode-2031 subscription (main's
+  // fact vs the byte scan), which must have exactly one owner.
   const hiddenDeliveryGateActive =
     mainSideEffectAuthority && isRendererHiddenPtyDeliveryGateEnabled(state.settings)
   // Why: structural per-PTY gate predicate (authority on + gate on + bytes
   // transit local main, which implies snapshot-backed). Shared by the hidden
-  // mark sync and mode-2031 reply ownership so reply ownership can never
+  // mark sync and mode-2031 subscription recording so the recorder can never
   // disagree with what main may drop — and never depends on the racy hidden
   // mark (a fact can outrun the pty:data task that sets it).
   const isHiddenDeliveryGateManagedPty = (ptyId: string | null): ptyId is string =>
@@ -3747,6 +3761,8 @@ export function connectPanePty(
         onDone: scheduleCommandCodeOutputDoneStatus
       })
   const shouldDeliverStartupViaTerminalPaste = paneStartup?.delivery === 'terminal-paste'
+  const shouldUseProviderSshStartupDelivery =
+    Boolean(connectionId) && !shouldDeliverStartupViaTerminalPaste
   const hadExistingPaneTransportAtConnect = deps.paneTransportsRef.current.size > 0
   let lastTerminalInputAt = Number.NEGATIVE_INFINITY
   let hasReceivedPtyOutput = false
@@ -3800,6 +3816,7 @@ export function connectPanePty(
     env: paneEnv,
     ...(paneStartup?.envToDelete ? { envToDelete: paneStartup.envToDelete } : {}),
     command: shouldDeliverStartupViaTerminalPaste ? undefined : paneStartup?.command,
+    ...(shouldUseProviderSshStartupDelivery ? { commandDelivery: 'provider' as const } : {}),
     startupCommandDelivery: shouldDeliverStartupViaTerminalPaste
       ? undefined
       : connectionId && paneStartup?.command
@@ -3878,13 +3895,10 @@ export function connectPanePty(
   // desktop silent while the elected mobile xterm owns query replies.
   const sendDesktopQueryReplyImmediate = (data: string): boolean =>
     canSendDesktopQueryReply() && transport.sendInputImmediate(data)
-  // Why (gate mode only): for gate-managed PTYs this fact is the SOLE 2031
-  // responder — visible, hidden, marked or not. Conditioning the reply on the
-  // hidden mark double-fired (mark set + bytes delivered live via interest →
-  // fact AND xterm both replied) or dropped the reply entirely (fact outran
-  // the pty:data task that set the mark). The xterm-side CSI reply and the
-  // skipped-byte scan are disabled for these panes (same structural
-  // predicate), so exactly one reply goes out.
+  // Why (gate mode only): gate-managed PTYs never see the subscribe bytes, so this fact is
+  // their only cue to record the subscription — without the registry entry a later theme
+  // flip never pushes the CSI 997 update and the TUI keeps a stale theme after reveal.
+  // Record-only: a subscribe is not a query (see observeLiveMode2031Chunk, #9993).
   const handleHiddenMode2031SubscribeFact = (): void => {
     const ptyId = transport.getPtyId()
     if (disposed || (!isHiddenDeliveryGateManagedPty(ptyId) && remoteOutputGatedPtyId !== ptyId)) {
@@ -3894,22 +3908,14 @@ export function connectPanePty(
       useAppStore.getState().settings,
       getSystemPrefersDark()
     )
-    // Why immediate: a mode-2031 query reply must beat the remote input debounce
-    // or it can miss the querying program's read window (#7329).
-    sendDesktopQueryReplyImmediate(mode2031SequenceFor(mode))
-    // Why: register the subscription exactly like the xterm CSI handler
-    // would — without the registry entry, later theme flips never push the
-    // CSI 997 update and the TUI keeps a stale theme after reveal.
     deps.recordPaneMode2031Subscription?.(pane.id, mode)
-    recordHiddenMode2031Reply()
   }
   // Why (gate mode only): the counterpart to the subscribe fact. These panes never
-  // receive the withdrawal bytes — main drops them before delivery — and both the
-  // chunk scanner and the xterm CSI handler are disabled for them, so this fact is
-  // the ONLY observer that can retire the subscription. Without it a TUI that exits
-  // while hidden leaves paneMode2031 set, and the next theme flip pushes CSI 997
-  // into the shell that replaced it (#9993 via maybePushMode2031Flip). No reply is
-  // sent: a withdrawal is not a query.
+  // receive the withdrawal bytes — main drops them before delivery — and the chunk
+  // scanner is disabled for them, so this fact is the ONLY observer that can retire
+  // the subscription. Without it a TUI that exits while hidden leaves paneMode2031
+  // set, and the next theme flip pushes CSI 997 into the shell that replaced it
+  // (#9993 via maybePushMode2031Flip).
   const handleHiddenMode2031UnsubscribeFact = (): void => {
     const ptyId = transport.getPtyId()
     if (disposed || (!isHiddenDeliveryGateManagedPty(ptyId) && remoteOutputGatedPtyId !== ptyId)) {
@@ -4749,12 +4755,21 @@ export function connectPanePty(
                 : serializeWithAbsoluteCursor(pane.serializeAddon, pane.terminal, {
                     scrollback: opts?.scrollbackRows
                   })
+            const orderedSeq = rendererOrderedPtyId === ptyId ? rendererOrderedSeq : null
+            // Why snapshotFlags and not `flags`: this pane may itself have
+            // consumed an old-host snapshot that proved nothing, and its
+            // conservative `0` fallback must not be republished downstream as
+            // a host-proven inactive protocol.
+            const provenKittyFlags = kittyKeyboardModes.hasProvenBaseline
+              ? kittyKeyboardModes.snapshotFlags
+              : undefined
             return {
               data,
               cols: pane.terminal.cols,
               rows: pane.terminal.rows,
-              ...(rendererOrderedPtyId === ptyId && rendererOrderedSeq !== null
-                ? { seq: rendererOrderedSeq }
+              ...(orderedSeq !== null ? { seq: orderedSeq } : {}),
+              ...(orderedSeq !== null && provenKittyFlags !== undefined
+                ? { kittyKeyboardFlags: provenKittyFlags }
                 : {})
             }
           } catch {
@@ -4819,51 +4834,13 @@ export function connectPanePty(
         .catch(() => {})
     }
 
-    // Why: for ordinary local startup commands, the local PTY provider already
-    // writes via the shell-ready barrier. terminal-paste and SSH startup
-    // commands stay renderer-delivered so xterm/relay can apply their handling.
-    let pendingStartupCommand: PendingStartupCommand | null =
-      shouldDeliverStartupViaTerminalPaste || connectionId
-        ? paneStartup?.command
-          ? { command: paneStartup.command }
-          : null
+    // Why: local and ordinary SSH startup commands are provider-owned so delivery
+    // survives renderer replacement. Only explicit terminal-paste stays renderer-owned.
+    let pendingStartupCommand: PendingStartupCommand | null = shouldDeliverStartupViaTerminalPaste
+      ? paneStartup?.command
+        ? { command: paneStartup.command }
         : null
-    // Why: every renderer-delivered SSH command needs the relay's readiness marker;
-    // the existing fallback preserves shells that cannot emit it.
-    const shouldWaitForSshShellReady =
-      Boolean(connectionId) &&
-      Boolean(pendingStartupCommand) &&
-      !shouldDeliverStartupViaTerminalPaste
-    let sshShellReadyMarkerScan = shouldWaitForSshShellReady
-      ? createShellReadyMarkerScanState()
       : null
-    let sshStartupShellReady = !shouldWaitForSshShellReady
-    const armSshStartupShellReady = (): void => {
-      if (!connectionId || !pendingStartupCommand || shouldDeliverStartupViaTerminalPaste) {
-        return
-      }
-      if (startupInjectTimer !== null) {
-        clearTimeout(startupInjectTimer)
-        startupInjectTimer = null
-      }
-      if (sshShellReadyFallbackTimer !== null) {
-        clearTimeout(sshShellReadyFallbackTimer)
-        sshShellReadyFallbackTimer = null
-      }
-      sshShellReadyMarkerScan = createShellReadyMarkerScanState()
-      sshStartupShellReady = false
-    }
-    const markSshStartupShellReady = (): void => {
-      if (sshStartupShellReady) {
-        return
-      }
-      sshStartupShellReady = true
-      if (sshShellReadyFallbackTimer !== null) {
-        clearTimeout(sshShellReadyFallbackTimer)
-        sshShellReadyFallbackTimer = null
-      }
-      schedulePendingStartupCommandDelivery()
-    }
     const startupDraftReadyScanner = ownsStartupDraftPaste
       ? createDraftPasteReadyScanner(
           startupDraftAgentConfig?.draftPasteReadySignal ?? 'render-quiet-after-bracketed-paste'
@@ -5135,6 +5112,97 @@ export function connectPanePty(
       applyColdRestoreAgentResumeStartup(startup)
       return startFreshSpawn(startup, options)
     }
+    /**
+     * A reattach failed without proving the shell is gone. Show the pane as disconnected with two
+     * explicit actions instead of leaving it frozen behind a raw error toast — the user decides,
+     * because nothing here knows whether the shell died.
+     *
+     * Returns whether the caller may stop. False means this pane cannot be surfaced that way and
+     * the caller must run its own handling: a local/daemon/runtime pane has no connection to be
+     * unreachable ON, and its provider IS authoritative about its own ptys, so it keeps replacing
+     * in place. Reporting that is the whole point of the return value — an earlier revision guarded
+     * in here but returned void, so four callers paired a conditional publish with an unconditional
+     * `return` and left local panes with neither the card nor the replacement they had before.
+     */
+    const divertToUnreachableCard = (sessionId: string): boolean => {
+      // Guards live HERE, not at the eight call sites. They are identical at every one, and the
+      // review found three separate sites that had each forgotten a different one — a local pane
+      // shown an SSH-specific card it can never clear, and a disposed pane republishing state onto
+      // a reused numeric pane id. Centralising them makes the next call site correct by default.
+      if (disposed) {
+        // Stop, but not because the card is up: a disposed pane must not respawn or report either.
+        return true
+      }
+      if (!connectionId) {
+        return false
+      }
+      // Both actions clear the banner before acting: nothing else retracts it. The app-SSH
+      // transport does not publish recovery states, so a card left up would sit over a live shell
+      // with armed buttons.
+      const clearBanner = (): void => deps.onPtyRecoveryStateRef?.current?.(pane.id, null)
+      deps.onPtyRecoveryStateRef?.current?.(pane.id, {
+        phase: 'disconnected',
+        epoch: 0,
+        attempt: 0,
+        unreachablePane: {
+          onRetry: () => {
+            clearBanner()
+            // Put the card back if the remount never happens. A stale generation, a refused remount
+            // or a throw all return false without scheduling anything, and swallowing that leaves
+            // the pane with no shell AND no action surface — worse than the toast this replaced.
+            const republishIfDeclined = (scheduled: boolean): void => {
+              if (!scheduled) {
+                divertToUnreachableCard(sessionId)
+              }
+            }
+            // Why the generation and instance: a recovery declined by the cooldown only schedules
+            // a deferred retry when it can identify the generation to remount. Without them a
+            // second click inside the window is refused silently, which on a surface whose whole
+            // purpose is to let the user act reads as a dead button.
+            void requestTerminalPaneRecovery({
+              tabId: deps.tabId,
+              ptyId: sessionId,
+              reason: 'restore-blocked',
+              terminalRecoveryGeneration,
+              terminalRecoveryInstanceId: terminalRecoveryInstance.id
+            }).then(republishIfDeclined, () => republishIfDeclined(false))
+          },
+          onStartNewTerminal: () => {
+            clearBanner()
+            // A NEW shell, not a resumed one. The automatic respawn this replaced passed the
+            // cold-restore startup, which carries the agent's providerSession — correct there,
+            // because it only ran on proof the shell was gone. Here the shell is probably still
+            // alive, so resuming would put a second agent process on one transcript. `null` alone
+            // does not achieve that: connect falls back to the startup this transport was built
+            // with, so the suppression has to be explicit.
+            void startFreshSpawn(null, {
+              forceBlankRestoredViewport: true,
+              suppressSavedStartup: true,
+              // Refuse adoption. This pane's recorded shell is the one we could not reach, so
+              // attaching it first only fails again and creates nothing — which left this button
+              // doing nothing at all in the one state it is offered in.
+              createFreshShellForUnreachablePane: true
+            }).then((freshPtyId) => {
+              if (!freshPtyId) {
+                // The replacement never started. Keep the old binding and put the card back, or the
+                // pane is left blank and unbound with no way back to a shell that may still be up.
+                divertToUnreachableCard(sessionId)
+                return
+              }
+              if (freshPtyId === sessionId) {
+                // Same id, different shell: adoption is refused now, so this is a NEW shell that a
+                // reset relay happened to reissue the old id to. Main has already bound the pane to
+                // it, and clearing by that id below would unbind the very shell just created.
+                return
+              }
+              deps.clearExitedPanePtyLayoutBinding(pane.id, sessionId)
+              deps.clearTabPtyId(deps.tabId, sessionId)
+            })
+          }
+        }
+      })
+      return true
+    }
     // Why: the hibernation wake fires from noteVisibilityResume in the outer
     // connection scope, long after this deferred-connect closure has run.
     wakeHibernatedAgentPane = () => startFreshColdRestoreAgentResume()
@@ -5169,18 +5237,6 @@ export function connectPanePty(
       if (!startup) {
         return
       }
-      if (!sshStartupShellReady) {
-        if (sshShellReadyFallbackTimer === null) {
-          // Why: some SSH shells cannot emit Orca's ready marker. Prefer the
-          // marker when available, but fall back to the old renderer delivery
-          // behavior instead of dropping the startup command forever.
-          sshShellReadyFallbackTimer = setTimeout(() => {
-            sshShellReadyFallbackTimer = null
-            markSshStartupShellReady()
-          }, SSH_SHELL_READY_STARTUP_FALLBACK_MS)
-        }
-        return
-      }
       if (startupInjectTimer !== null) {
         clearTimeout(startupInjectTimer)
       }
@@ -5281,12 +5337,6 @@ export function connectPanePty(
       // a restart-in-place would leak the old TUI's flags into a fresh shell.
       kittyKeyboardModes.reset()
       prepareFreshShellViewportForSpawn(options)
-      if (connectionId && startupOverride?.command) {
-        // Why: SSH providers use `command` only as spawn metadata; the renderer
-        // must still submit the resume command to the fresh remote shell.
-        pendingStartupCommand = { command: startupOverride.command }
-      }
-      armSshStartupShellReady()
       const coldRestoreOverride =
         startupOverride && 'launchConfig' in startupOverride
           ? (startupOverride as ColdRestoreAgentResumeStartup)
@@ -5305,10 +5355,17 @@ export function connectPanePty(
       transportConnectInFlightSince = Date.now()
       const outputCallbacks = captureTransportOutputCallbacks(reportError)
       const spawnedRaw = transport.connect({
+        ...(options.suppressSavedStartup ? { suppressSavedStartup: true } : {}),
+        ...(options.createFreshShellForUnreachablePane
+          ? { createFreshShellForUnreachablePane: true }
+          : {}),
         url: '',
         cols,
         rows,
         ...(startupOverride?.command ? { command: startupOverride.command } : {}),
+        ...(connectionId && startupOverride?.command && !shouldDeliverStartupViaTerminalPaste
+          ? { commandDelivery: 'provider' as const }
+          : {}),
         ...(connectionId && startupOverride?.command
           ? { startupCommandDelivery: 'shell-ready' as const }
           : {}),
@@ -5438,6 +5495,12 @@ export function connectPanePty(
             void window.api.pty.clearPendingPaneSerializer(cacheKey, gen).catch(() => {})
           }
           if (resolvedPtyId && connectionId) {
+            if (
+              shouldUseProviderSshStartupDelivery &&
+              (startupOverride?.command || paneStartup?.command)
+            ) {
+              armStartupDraftReadinessObservation()
+            }
             schedulePendingStartupCommandDelivery()
           }
           finishReattachLiveDataDeferral(Boolean(resolvedPtyId), outputCallbacks.generation)
@@ -5646,6 +5709,8 @@ export function connectPanePty(
       generation: number
       streamGeneration: number
       pendingEscapeTailAnsi?: string
+      kittyKeyboardFlags?: number
+      snapshotSeq?: number
     }
 
     let pendingReplayData: PendingReplayData | null = null
@@ -5699,7 +5764,7 @@ export function connectPanePty(
         // negotiation; the mirror must re-arm from them after a reload. Replay
         // semantics: relay reconnects redeliver the same window, so pushes
         // apply as sets to keep the mirrored stack from accumulating frames.
-        kittyKeyboardModes.scanReplay(data)
+        applySnapshotKittyKeyboardModes(data, payload)
         await writeReplayDataAsync(data)
         if (!isCurrentPayload()) {
           continue
@@ -5775,7 +5840,7 @@ export function connectPanePty(
     }
     const replayDataCallback = (
       data: string,
-      meta: { clearBeforeReplay?: boolean; pendingEscapeTailAnsi?: string } = {},
+      meta: PtyReplayDataMeta = {},
       streamGeneration = transportStreamGeneration
     ): void => {
       pendingReplayData = {
@@ -5784,7 +5849,15 @@ export function connectPanePty(
         ptyId: transport.getPtyId(),
         generation: (replayPayloadGeneration += 1),
         streamGeneration,
-        ...(meta.pendingEscapeTailAnsi ? { pendingEscapeTailAnsi: meta.pendingEscapeTailAnsi } : {})
+        ...(meta.pendingEscapeTailAnsi
+          ? { pendingEscapeTailAnsi: meta.pendingEscapeTailAnsi }
+          : {}),
+        ...(meta.kittyKeyboardFlags !== undefined && meta.snapshotSeq !== undefined
+          ? {
+              kittyKeyboardFlags: meta.kittyKeyboardFlags,
+              snapshotSeq: meta.snapshotSeq
+            }
+          : {})
       }
       scheduleReplayDataDrain()
     }
@@ -5811,15 +5884,17 @@ export function connectPanePty(
               reportRemoteRendererSerializerReady()
             }
           },
+          onStreamRecovered: (): void => {
+            if (isCurrent()) {
+              markHiddenOutputRestoreNeeded()
+            }
+          },
           onData: (data: string, meta?: PtyDataMeta): void => {
             if (isCurrent()) {
               dataCallback(data, meta, generation)
             }
           },
-          onReplayData: (
-            data: string,
-            meta?: { clearBeforeReplay?: boolean; pendingEscapeTailAnsi?: string }
-          ): void => {
+          onReplayData: (data: string, meta?: PtyReplayDataMeta): void => {
             if (isCurrent()) {
               replayDataCallback(data, meta, generation)
             }
@@ -6351,14 +6426,14 @@ export function connectPanePty(
       }
     }
 
+    // Why record-only: DECSET 2031 subscribes to future color changes, it is not a query —
+    // the protocol's query is `CSI ?996n`. fish arms 2031 for the ~1ms it paints a prompt, so
+    // any reply lands after the withdrawal and paints `?997;1n` as literal text (#9993).
     // Why here and not in xterm's CSI handler: xterm batches several PTY chunks into one
-    // synchronous parse, so a handler cannot tell where a chunk ended. fish enables and
-    // disables 2031 around every prompt, so answering a subscribe the same chunk withdraws
-    // pushes `?997;1n` into the prompt or a child's stdin as literal text (#9993). One raw
-    // chunk in, one order-aware decision out.
+    // synchronous parse, so a handler cannot tell where a chunk ended. One raw chunk in,
+    // one order-aware final state out.
     function observeLiveMode2031Chunk(data: string): void {
-      // Main's '2031-subscribe' fact is the sole responder for gate-managed PTYs; a second
-      // reply from here would answer one subscribe twice.
+      // Gate-managed PTYs never see these bytes; main's '2031-subscribe' fact records them.
       if (isHiddenDeliveryGateManagedPty(transport.getPtyId())) {
         return
       }
@@ -6372,13 +6447,13 @@ export function connectPanePty(
         return
       }
       const settings = useAppStore.getState().settings
-      const mode = resolveTerminalColorSchemeMode(settings, getSystemPrefersDark())
-      // Why immediate: the reply must land inside the program's read window, and hidden
-      // snapshot-backed panes skip xterm.write for PTY bytes entirely.
+      // Why seed the mode: maybePushMode2031Flip only pushes on a change, so an unseeded
+      // subscription would read as a flip on the next unrelated appearance re-apply.
       deps.paneMode2031Ref.current.set(pane.id, true)
-      sendDesktopQueryReplyImmediate(mode2031SequenceFor(mode))
-      deps.paneLastThemeModeRef.current.set(pane.id, mode)
-      recordHiddenMode2031Reply()
+      deps.paneLastThemeModeRef.current.set(
+        pane.id,
+        resolveTerminalColorSchemeMode(settings, getSystemPrefersDark())
+      )
     }
 
     // Why installed here: the handler observes CSI 3 J inside xterm's parse, so a
@@ -6792,6 +6867,43 @@ export function connectPanePty(
       }
     }
 
+    /**
+     * Apply an authoritative snapshot to the pane's kitty mirror in the order:
+     * unproven reset, replay-semantics scan of the snapshot
+     * bytes (so screen selection lands first), then the owner's proven flags.
+     *
+     * Why the reset only happens when the owner proved something: an old host
+     * omits the field, and downgrading a mirror that is already tracking live
+     * output would lose correct state instead of preserving it.
+     */
+    function applySnapshotKittyKeyboardModes(
+      snapshotData: string,
+      snapshot: { kittyKeyboardFlags?: number; snapshotSeq?: number }
+    ): void {
+      const proven =
+        snapshot.snapshotSeq === undefined
+          ? undefined
+          : parseTerminalKittyKeyboardFlags(snapshot.kittyKeyboardFlags)
+      if (proven === undefined) {
+        // Why the demotion: a mirror grounded in this PTY's stream keeps its
+        // state, but a constructor-fresh tracker (window reload) holds a
+        // known-zero that was never proven for the reattached PTY — demote it
+        // so the serializer cannot republish it downstream as host-proven
+        // inactive.
+        if (!kittyKeyboardModes.hasProvenBaseline) {
+          kittyKeyboardModes.resetForSnapshot()
+        }
+        kittyKeyboardModes.scanReplay(snapshotData)
+        return
+      }
+      kittyKeyboardModes.resetForSnapshot()
+      kittyKeyboardModes.scanReplay(snapshotData)
+      kittyKeyboardModes.restoreSnapshotFlags(proven)
+      // Why in the same critical section: without the baseline a quiet pane
+      // could not publish a coherent snapshot until unrelated output arrived.
+      recordRendererOrderedSeq({ seq: snapshot.snapshotSeq })
+    }
+
     function recordRendererOrderedSeq(meta?: Pick<PtyDataMeta, 'seq'>): void {
       if (typeof meta?.seq !== 'number') {
         return
@@ -7208,6 +7320,7 @@ export function connectPanePty(
       alternateScreen?: boolean
       scrollbackAnsi?: string
       pendingEscapeTailAnsi?: string
+      kittyKeyboardFlags?: number
     }): Promise<void> {
       const restorePtyId = transport.getPtyId()
       const restoreGeneration = hiddenOutputRestoreGeneration
@@ -7258,19 +7371,29 @@ export function connectPanePty(
                 suppressStructuralReplayPtyResize = false
               }
             }
+            // Why here and not from the writes below: the mirror tracks what the
+            // APPLICATION negotiated, so it must see the snapshot's own bytes
+            // before adopting the flags main proved for this boundary.
+            applySnapshotKittyKeyboardModes(`${snapshot.scrollbackAnsi ?? ''}${snapshot.data}`, {
+              kittyKeyboardFlags: snapshot.kittyKeyboardFlags,
+              snapshotSeq: snapshot.seq
+            })
             // Why shared: the SSH reattach model paint inlines the same
             // choreography (coordinator nesting would deadlock there); one
             // builder keeps the alt-screen branches from drifting.
             skippedAltFrame =
               snapshot.alternateScreen === true &&
               snapshot.frameRestoreAnsi !== undefined &&
-              shouldSkipAltFrameForWidthMismatch(snapshot.cols, readProposedTerminalCols(pane), {
-                skipIfTargetUnknown: true
-              })
-            for (const replayChunk of buildMainModelSnapshotReplayWrites(snapshot, {
-              skipAltFrame: skippedAltFrame
-            })) {
-              writeReplayData(replayChunk)
+              shouldSkipAltFrameForWidthMismatch(snapshot.cols, readProposedTerminalCols(pane))
+            // Why: an imageless success is not proof the pane is empty; normal replay clears screen and scrollback.
+            const snapshotCarriesNoImage =
+              snapshot.alternateScreen !== true && snapshot.data === '' && !snapshot.scrollbackAnsi
+            if (!snapshotCarriesNoImage) {
+              for (const replayChunk of buildMainModelSnapshotReplayWrites(snapshot, {
+                skipAltFrame: skippedAltFrame
+              })) {
+                writeReplayData(replayChunk)
+              }
             }
             // Why: live agents own ?25l/?1004h; a forced ?1004l here would silence focus events until restart (agents enable focus reporting only at startup).
             writeReplayData(
@@ -7660,13 +7783,6 @@ export function connectPanePty(
         // Why: output is the agent-start signal that ends the relaxed no-evidence process-scan cadence (a starting agent always prints).
         agentCompletionCoordinator.observeOutputActivity()
       }
-      if (sshShellReadyMarkerScan) {
-        const scanned = scanForShellReadyMarker(sshShellReadyMarkerScan, data)
-        if (scanned.matched) {
-          markSshStartupShellReady()
-        }
-        data = scanned.output
-      }
       observeStartupDraftPasteReadiness(data)
       resetHiddenOutputRestoreIfPtyChanged()
       observeLiveMode2031Chunk(data)
@@ -7981,7 +8097,10 @@ export function connectPanePty(
                   suppressStructuralReplayPtyResize = false
                 }
               }
-              kittyKeyboardModes.scanReplay(modelData)
+              applySnapshotKittyKeyboardModes(modelData, {
+                kittyKeyboardFlags: snapshot.kittyKeyboardFlags,
+                snapshotSeq: snapshot.seq
+              })
               // Why keep a too-wide frame: preconnect SSH has no live repaint owner or post-restore fit.
               for (const replayChunk of buildMainModelSnapshotReplayWrites(snapshot)) {
                 writeReplayData(replayChunk)
@@ -8040,14 +8159,19 @@ export function connectPanePty(
           paneId: pane.id,
           ptyId: staleSessionId ?? null
         })
-        // Why: a stale restored session can fail reattach after mount; don't leave xterm alive without a backing PTY.
-        if (staleSessionId) {
-          deps.clearExitedPanePtyLayoutBinding(pane.id, staleSessionId)
-        } else {
-          deps.syncPanePtyLayoutBinding(pane.id, null)
+        // For an SSH pane a missing id says the reattach could not answer, not that the shell
+        // exited — a replaced relay reports that for shells still running under its predecessor —
+        // so surface it and let the user choose. A daemon/local pane is not ambiguous that way: its
+        // provider is authoritative about its own ptys, and it keeps replacing in place.
+        if (connectionId && staleSessionId) {
+          divertToUnreachableCard(staleSessionId)
+          return false
         }
         if (staleSessionId) {
+          deps.clearExitedPanePtyLayoutBinding(pane.id, staleSessionId)
           deps.clearTabPtyId(deps.tabId, staleSessionId)
+        } else {
+          deps.syncPanePtyLayoutBinding(pane.id, null)
         }
         startFreshColdRestoreAgentResume(coldRestoreStartup, {
           forceBlankRestoredViewport: true
@@ -8063,15 +8187,18 @@ export function connectPanePty(
             : {})
       })
       if (connectResult?.sessionExpired) {
+        // For SSH, `sessionExpired` traces back to the relay's not-found, which it also answers for
+        // shells still running under a relay process it replaced — not proof the shell exited.
+        if (connectionId && staleSessionId) {
+          divertToUnreachableCard(staleSessionId)
+          return false
+        }
         if (staleSessionId) {
           deps.clearExitedPanePtyLayoutBinding(pane.id, staleSessionId)
+          deps.clearTabPtyId(deps.tabId, staleSessionId)
         } else {
           deps.syncPanePtyLayoutBinding(pane.id, null)
         }
-        if (staleSessionId) {
-          deps.clearTabPtyId(deps.tabId, staleSessionId)
-        }
-        // Why: SSH sleep/reconnect can invalidate the relay PTY while the tab stays mounted; replace the dead lease in-place, not a stale overlay.
         startFreshColdRestoreAgentResume(coldRestoreStartup, {
           forceBlankRestoredViewport: true
         })
@@ -8202,7 +8329,10 @@ export function connectPanePty(
           }
           writeReplayData('\x1b[2J\x1b[3J\x1b[H')
           // Why: re-arm the kitty keyboard mirror from the snapshot preamble so Option chords keep their encoding after a window reload.
-          kittyKeyboardModes.scanReplay(daemonSnapshotReplay)
+          applySnapshotKittyKeyboardModes(daemonSnapshotReplay, {
+            kittyKeyboardFlags: connectResult.snapshotKittyKeyboardFlags,
+            snapshotSeq: connectResult.snapshotSeq
+          })
           // A narrower fit clips the fixed-grid alt frame; drop it and let SIGWINCH repaint.
           // A dead-owner restore keeps history plus its restored-session treatment;
           // a frozen foreign-width frame would look live when no owner remains.
@@ -8211,8 +8341,7 @@ export function connectPanePty(
             typeof snapshotFrameRestoreAnsi === 'string' &&
             shouldSkipAltFrameForWidthMismatch(
               connectResult.snapshotCols,
-              readProposedTerminalCols(pane),
-              { skipIfTargetUnknown: true }
+              readProposedTerminalCols(pane)
             )
           writeReplayData(
             daemonAltFrameSkippable
@@ -8270,7 +8399,10 @@ export function connectPanePty(
                 suppressStructuralReplayPtyResize = false
               }
             }
-            kittyKeyboardModes.scanReplay(modelData)
+            applySnapshotKittyKeyboardModes(modelData, {
+              kittyKeyboardFlags: modelSnapshot.kittyKeyboardFlags,
+              snapshotSeq: modelSnapshot.seq
+            })
             // Why shared: park+reveal of an alt-screen TUI needs the same
             // ?1049l/?1049h rebuild as applyMainBufferSnapshot (main strips
             // the ?1049h marker when splitting scrollbackAnsi) — inlined here
@@ -8278,10 +8410,7 @@ export function connectPanePty(
             for (const replayChunk of buildMainModelSnapshotReplayWrites(modelSnapshot, {
               skipAltFrame: shouldSkipAltFrameForWidthMismatch(
                 modelCols,
-                readProposedTerminalCols(pane),
-                {
-                  skipIfTargetUnknown: true
-                }
+                readProposedTerminalCols(pane)
               )
             })) {
               writeReplayData(replayChunk)
@@ -8309,6 +8438,11 @@ export function connectPanePty(
             // Relay replay may overlap xterm's pre-disconnect content; clear first to avoid duplication.
             writeReplayData('\x1b[2J\x1b[3J\x1b[H')
             // Why: raw relay replay may contain the app's own kitty pushes; re-arm with set semantics so redelivery can't grow the stack.
+            // A constructor-fresh mirror (window reload) first demotes to unproven:
+            // the replay window proves nothing about negotiations that predate it.
+            if (!kittyKeyboardModes.hasProvenBaseline) {
+              kittyKeyboardModes.resetForSnapshot()
+            }
             kittyKeyboardModes.scanReplay(connectResult.replay)
             writeReplayData(connectResult.replay)
             writeReplayData(
@@ -8708,11 +8842,7 @@ export function connectPanePty(
                   if (rejectObsoleteDirectSshReattach(pendingSessionId)) {
                     return
                   }
-                  deps.clearExitedPanePtyLayoutBinding(pane.id, pendingSessionId)
-                  deps.clearTabPtyId(deps.tabId, pendingSessionId)
-                  startFreshColdRestoreAgentResume(coldRestoreStartup, {
-                    forceBlankRestoredViewport: true
-                  })
+                  divertToUnreachableCard(pendingSessionId)
                   return
                 }
                 const accepted = await handleReattachResult(
@@ -8754,14 +8884,18 @@ export function connectPanePty(
                 if (rejectObsoleteDirectSshReattach(pendingSessionId)) {
                   return
                 }
-                if (isSshSessionExpiredError(err)) {
-                  deps.clearExitedPanePtyLayoutBinding(pane.id, pendingSessionId)
-                  deps.clearTabPtyId(deps.tabId, pendingSessionId)
-                  startFreshColdRestoreAgentResume(coldRestoreStartup, {
-                    forceBlankRestoredViewport: true
-                  })
+                // Why: only proof that the session is gone may respawn. Anything
+                // else leaves the shell running, because respawning with the
+                // restored id resumes the same agent session a second time.
+                // Nothing proves it yet (see reattach-failure-classification), and this flow is
+                // nested under `connectionId`, so the respawn below is unreachable today. It is
+                // the shape the proof capability plugs into, not forgotten code.
+                if (!isProvenSshSessionGoneError(err)) {
+                  divertToUnreachableCard(pendingSessionId)
                   return
                 }
+                deps.clearExitedPanePtyLayoutBinding(pane.id, pendingSessionId)
+                deps.clearTabPtyId(deps.tabId, pendingSessionId)
                 startFreshColdRestoreAgentResume(coldRestoreStartup, {
                   forceBlankRestoredViewport: true
                 })
@@ -8945,6 +9079,16 @@ export function connectPanePty(
             if (rejectObsoleteDirectSshReattach(deferredReattachSessionId)) {
               return
             }
+            if (divertToUnreachableCard(deferredReattachSessionId)) {
+              return
+            }
+            // Unlike the direct-SSH flow above, this path is not nested under `connectionId`: a
+            // local pane with a restored id and a runtime-host wake both reach it, and neither can
+            // be shown an SSH card. A local provider is authoritative about its own ptys, so
+            // replacing in place is right for it. A remote runtime shares SSH's ambiguity and is
+            // NOT — but the card is SSH-scoped (its retry dials an SSH target), so serving one is
+            // its own design, not something to graft on here. This keeps the behaviour it has
+            // today rather than quietly changing it.
             deps.clearExitedPanePtyLayoutBinding(pane.id, deferredReattachSessionId)
             deps.clearTabPtyId(deps.tabId, deferredReattachSessionId)
             startFreshColdRestoreAgentResume(coldRestoreStartup, {
@@ -8999,15 +9143,23 @@ export function connectPanePty(
             ptyId: deferredReattachSessionId,
             reason: message
           })
-          deps.clearExitedPanePtyLayoutBinding(pane.id, deferredReattachSessionId)
-          deps.clearTabPtyId(deps.tabId, deferredReattachSessionId)
-          if (connectionId && isSshSessionExpiredError(err)) {
-            startFreshColdRestoreAgentResume(coldRestoreStartup, {
-              forceBlankRestoredViewport: true
-            })
+          // Why: only proof that the session is gone may respawn. A transport
+          // fault, a wedged call, or a source that merely needs re-establishing
+          // leaves the shell running, and respawning there resumes the same
+          // agent session a second time into one transcript. A pane with no card
+          // to show falls through to the replace-in-place below — this path, unlike
+          // the direct-SSH one, is not nested under `connectionId`.
+          if (
+            !isProvenSshSessionGoneError(err) &&
+            divertToUnreachableCard(deferredReattachSessionId)
+          ) {
             return
           }
-          reportError(message)
+          deps.clearExitedPanePtyLayoutBinding(pane.id, deferredReattachSessionId)
+          deps.clearTabPtyId(deps.tabId, deferredReattachSessionId)
+          if (!(connectionId && isSshSessionExpiredError(err))) {
+            reportError(message)
+          }
           startFreshColdRestoreAgentResume(coldRestoreStartup, {
             forceBlankRestoredViewport: true
           })
@@ -9337,10 +9489,6 @@ export function connectPanePty(
         clearTimeout(startupInjectTimer)
         startupInjectTimer = null
       }
-      if (sshShellReadyFallbackTimer !== null) {
-        clearTimeout(sshShellReadyFallbackTimer)
-        sshShellReadyFallbackTimer = null
-      }
       cleanupStartupDraftPasteTimers()
       releaseUnattemptedStartupDraftPasteDelivery()
       unregisterAgentHookTerminalLifecycle()
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
index f7d0812f616..251eb04b91c 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
@@ -469,7 +469,8 @@ describe('pty input write queue', () => {
   })
 
   it('dual mode-2031 enqueues through the real queue never paint 997 under host echo-safe write', async () => {
-    // Issue path: xterm onData + mode-2031 scan each enqueue mode2031SequenceFor.
+    // Two 997s can still coalesce in one write: a fast theme flip, or an old client that
+    // still answers 2031 subscribes (#9993 made this host silent, mixed versions have not).
     // Drive the real write queue → host intercept (extract + answerLiveQueryReply)
     // → ingress echo strip, and assert no `997;1n` emission at the confirm prompt.
     vi.useFakeTimers()
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-types.ts b/src/renderer/src/components/terminal-pane/pty-transport-types.ts
index d0c20224e5a..64e4ac3c689 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-types.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-types.ts
@@ -41,6 +41,21 @@ export type PtyBufferSnapshot = {
    *  before post-snapshot live chunks — so the continuation completes it
    *  exactly as live instead of rendering literal (Bug E / #7329). */
   pendingEscapeTailAnsi?: string
+  /** Effective kitty flags the owner of this image proved at `seq`. Absent
+   *  means unknown; never rewrite that silence into a known `0`. */
+  kittyKeyboardFlags?: number
+}
+
+/** Metadata for one authoritative replay payload. */
+export type PtyReplayDataMeta = {
+  clearBeforeReplay?: boolean
+  pendingEscapeTailAnsi?: string
+  /** Kitty flags the snapshot's owner PROVED at `snapshotSeq`. Absent means
+   *  unknown; the pane tracker must stay unproven rather than assume zero. */
+  kittyKeyboardFlags?: number
+  /** The boundary `kittyKeyboardFlags` describes, recorded as the renderer's
+   *  ordered high-water so a quiet pane can still publish a coherent snapshot. */
+  snapshotSeq?: number
 }
 
 export type LocalPtySessionMetadata = {
@@ -67,6 +82,11 @@ export type PtyConnectResult = {
   snapshotFrameAnsi?: string
   /** Live state to append when omitting `snapshotFrameAnsi`. */
   snapshotFrameRestoreAnsi?: string
+  /** Kitty keyboard flags the daemon snapshot proved, paired with the renderer-
+   *  domain `snapshotSeq` main reconciled for the same attach boundary. Absent
+   *  means unknown, never a proven inactive protocol. */
+  snapshotKittyKeyboardFlags?: number
+  snapshotSeq?: number
   isAlternateScreen?: boolean
   sessionExpired?: boolean
   coldRestore?: { scrollback: string; cwd: string; cols?: number; rows?: number }
@@ -84,12 +104,12 @@ type PtyCallbacks = {
   /** Called before an adopted PTY can publish buffered/live bytes. */
   onReattachDetermined?: () => void
   onConnect?: () => void
+  /** A stream re-established after loss carries only new bytes, so the pane must
+   *  re-pull the host's retained buffer or an idle/exited pane paints nothing. */
+  onStreamRecovered?: () => void
   onDisconnect?: () => void
   onData?: (data: string, meta?: PtyDataMeta) => void
-  onReplayData?: (
-    data: string,
-    meta?: { clearBeforeReplay?: boolean; pendingEscapeTailAnsi?: string }
-  ) => void
+  onReplayData?: (data: string, meta?: PtyReplayDataMeta) => void
   onStatus?: (shell: string) => void
   onError?: (message: string, errors?: string[]) => void
   onExit?: (code: number) => void
@@ -110,6 +130,8 @@ export type PtyTransportRecoveryState = {
     | 'disposed'
   epoch: number
   attempt: number
+  /** Set only for a pane whose shell we cannot reach; drives the two-action disconnected banner. */
+  unreachablePane?: { onRetry: () => void; onStartNewTerminal: () => void }
 }
 
 export type PtyTransport = {
@@ -124,10 +146,18 @@ export type PtyTransport = {
      *  Ignored by remote-runtime transports (not gate-markable). */
     initiallyHidden?: boolean
     command?: string
+    commandDelivery?: 'renderer' | 'provider'
     env?: Record<string, string>
     envToDelete?: string[]
     launchConfig?: SleepingAgentLaunchConfig
     resumeProviderSession?: AgentProviderSessionMetadata
+    /** Start a genuinely new shell: ignore the startup this transport was constructed with.
+     *  Omitting the fields is not enough — connect falls back to its constructor values, so a
+     *  "fresh" spawn would silently resume the saved agent session. */
+    suppressSavedStartup?: boolean
+    /** Refuse adoption: this pane's recorded shell cannot be reached, so attaching it would fail
+     *  and create nothing. The old shell is left alive and unbound. */
+    createFreshShellForUnreachablePane?: boolean
     launchToken?: string
     launchAgent?: TuiAgent
     startupCommandDelivery?: StartupCommandDelivery
@@ -204,6 +234,7 @@ export type IpcPtyTransportOptions = {
   env?: Record<string, string>
   envToDelete?: string[]
   command?: string
+  commandDelivery?: 'renderer' | 'provider'
   launchConfig?: SleepingAgentLaunchConfig
   resumeProviderSession?: AgentProviderSessionMetadata
   agentPrompt?: string
diff --git a/src/renderer/src/components/terminal-pane/pty-transport.test.ts b/src/renderer/src/components/terminal-pane/pty-transport.test.ts
index 14ff327146e..1c3c5b1269c 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport.test.ts
@@ -9,6 +9,7 @@ import {
   encodeTerminalStreamText
 } from '../../../../shared/terminal-stream-protocol'
 import { createTerminalSessionStateSaveFailureMessage } from '../../../../shared/terminal-session-state-save-failure'
+import { TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
 import {
   TERMINAL_INPUT_CHUNK_MAX_BYTES,
   TERMINAL_INPUT_MAX_BYTES
@@ -96,6 +97,24 @@ describe('createIpcPtyTransport', () => {
     transport.disconnect()
   })
 
+  it('threads provider command ownership through the spawn IPC', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const transport = createIpcPtyTransport({
+      command: 'printf ready',
+      commandDelivery: 'provider'
+    })
+
+    await transport.connect({ url: '', callbacks: {} })
+
+    expect(window.api.pty.spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        command: 'printf ready',
+        commandDelivery: 'provider'
+      })
+    )
+    transport.disconnect()
+  })
+
   it('routes a rejected daemon write to the owning transport recovery callback', async () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const recovery = vi.fn()
@@ -243,6 +262,29 @@ describe('createIpcPtyTransport', () => {
     )
   })
 
+  it('drops a retired launch token from a suppressed fresh spawn', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const spawn = window.api.pty.spawn as unknown as ReturnType<typeof vi.fn>
+    const transport = createIpcPtyTransport({
+      env: {
+        ORCA_PANE_KEY: 'tab-1:11111111-1111-4111-8111-111111111111',
+        ORCA_AGENT_LAUNCH_TOKEN: 'retired-token'
+      },
+      launchToken: 'retired-token'
+    })
+
+    await transport.connect({ url: '', callbacks: {}, suppressSavedStartup: true })
+
+    expect(spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        env: { ORCA_PANE_KEY: 'tab-1:11111111-1111-4111-8111-111111111111' }
+      })
+    )
+    expect(spawn).toHaveBeenCalledWith(
+      expect.not.objectContaining({ launchToken: 'retired-token' })
+    )
+  })
+
   it('forwards automatic resume provenance to the PTY spawn', async () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const spawn = window.api.pty.spawn as unknown as ReturnType<typeof vi.fn>
@@ -2494,7 +2536,10 @@ describe('createRemoteRuntimePtyTransport', () => {
             result: {
               runtimeProtocolVersion: 3,
               minCompatibleRuntimeClientVersion: 2,
-              capabilities: ['agent-session.host-authority.v1']
+              capabilities: [
+                'agent-session.host-authority.v1',
+                TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY
+              ]
             },
             _meta: { runtimeId: 'runtime-remote' }
           }
@@ -2593,12 +2638,14 @@ describe('createRemoteRuntimePtyTransport', () => {
         worktree: 'id:repo1::/remote/wt',
         clientMutationId: expect.any(String),
         command: 'claude',
-        env: { ORCA_TAB_ID: 'tab-1' },
+        env: { ORCA_TAB_ID: 'tab-1', ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
         tabId: 'tab-1',
         leafId: '11111111-1111-4111-8111-111111111111',
         focus: false,
         presentation: 'background'
       },
+      expectedEnvironmentPairingRevision: undefined,
       timeoutMs: 15_000
     })
     expect(runtimeSubscribe).toHaveBeenCalledWith(
@@ -2650,20 +2697,34 @@ describe('createRemoteRuntimePtyTransport', () => {
   })
 
   it('reports a host stable-pane adoption as reattach without fresh-spawn ownership', async () => {
-    runtimeCall.mockResolvedValue({
-      id: 'rpc-create',
-      ok: true,
-      result: {
-        terminal: {
-          handle: 'term-original',
-          worktreeId: 'repo1::/remote/wt',
-          title: 'Original',
-          surface: 'background',
-          isReattach: true
-        }
-      },
-      _meta: { runtimeId: 'runtime-remote' }
-    })
+    runtimeCall.mockImplementation(async (args: { method?: string }) =>
+      args.method === 'status.get'
+        ? {
+            id: 'rpc-status',
+            ok: true,
+            result: {
+              runtimeId: 'runtime-remote',
+              runtimeProtocolVersion: 3,
+              minCompatibleRuntimeClientVersion: 2,
+              capabilities: [TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY]
+            },
+            _meta: { runtimeId: 'runtime-remote' }
+          }
+        : {
+            id: 'rpc-create',
+            ok: true,
+            result: {
+              terminal: {
+                handle: 'term-original',
+                worktreeId: 'repo1::/remote/wt',
+                title: 'Original',
+                surface: 'background',
+                isReattach: true
+              }
+            },
+            _meta: { runtimeId: 'runtime-remote' }
+          }
+    )
     const onPtySpawn = vi.fn()
     const onReattachDetermined = vi.fn()
     const { createRemoteRuntimePtyTransport } = await import('./remote-runtime-pty-transport')
@@ -2791,6 +2852,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         },
         presentation: 'background'
       },
+      expectedEnvironmentPairingRevision: undefined,
       timeoutMs: 15_000
     })
     expect(runtimeCall).not.toHaveBeenCalledWith(
@@ -2816,9 +2878,13 @@ describe('createRemoteRuntimePtyTransport', () => {
             id: 'rpc-status',
             ok: true,
             result: {
+              runtimeId: 'runtime-remote',
               runtimeProtocolVersion: 3,
               minCompatibleRuntimeClientVersion: 2,
-              capabilities: ['agent-session.host-authority.v1']
+              capabilities: [
+                'agent-session.host-authority.v1',
+                TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY
+              ]
             }
           }
     )
@@ -2864,6 +2930,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         },
         presentation: 'background'
       },
+      expectedEnvironmentPairingRevision: undefined,
       timeoutMs: 15_000
     })
     expect(runtimeCall).not.toHaveBeenCalledWith(
diff --git a/src/renderer/src/components/terminal-pane/pty-transport.ts b/src/renderer/src/components/terminal-pane/pty-transport.ts
index 561234f64ca..7ad897eaee9 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport.ts
@@ -13,6 +13,7 @@ import {
   iterateTerminalInputChunks
 } from '../../../../shared/terminal-input'
 import { isRuntimeOwnedSshTargetId } from '../../../../shared/execution-host'
+import { SSH_SESSION_EXPIRED_ERROR } from '../../../../shared/ssh-pty-failure-tokens'
 import {
   ptyDataHandlers,
   ptyReplayHandlers,
@@ -66,11 +67,11 @@ export type {
   LocalPtySessionMetadata,
   PtyBufferSnapshot,
   PtyConnectResult,
+  PtyReplayDataMeta,
   PtyTransport
 } from './pty-transport-types'
 export { extractLastOscTitle } from '../../../../shared/agent-detection'
 
-const SSH_SESSION_EXPIRED_ERROR = 'SSH_SESSION_EXPIRED'
 // Why: main rejects a session reattached under a different SSH connection with this phrase; treat as stale (spawn fresh), not a crash.
 const SSH_PTY_CONNECTION_MISMATCH_MARKER = 'belongs to SSH connection'
 const STALE_TITLE_TIMEOUT = 3000 // ms before stale working title is cleared
@@ -104,6 +105,9 @@ type ProcessPtyOutputOptions = {
   clearBeforeReplay?: boolean
   // Why: a mid-escape tail; the replay consumer writes it LAST (after the post-replay reset) so the next live chunk completes it, not renders it literally (#7329).
   pendingEscapeTailAnsi?: string
+  /** Kitty flags the snapshot owner proved at `snapshotSeq`. */
+  kittyKeyboardFlags?: number
+  snapshotSeq?: number
 }
 
 type PendingPtySideEffect = {
@@ -496,7 +500,13 @@ export function createPtyOutputProcessor({
         ...(options.clearBeforeReplay === false ? { clearBeforeReplay: false } : {}),
         ...(options.pendingEscapeTailAnsi
           ? { pendingEscapeTailAnsi: options.pendingEscapeTailAnsi }
-          : {})
+          : {}),
+        // Why forwarded together: the flags are only valid for the boundary the
+        // image describes, so they never travel without their sequence.
+        ...(options.kittyKeyboardFlags !== undefined
+          ? { kittyKeyboardFlags: options.kittyKeyboardFlags }
+          : {}),
+        ...(options.snapshotSeq !== undefined ? { snapshotSeq: options.snapshotSeq } : {})
       }
       // Why: preserve the bare-data call shape when there's no replay metadata, so eager-buffer replay (which passes none) is unchanged.
       if (Object.keys(replayMeta).length > 0) {
@@ -550,6 +560,7 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
     env,
     envToDelete,
     command,
+    commandDelivery,
     launchConfig,
     resumeProviderSession,
     launchToken,
@@ -785,8 +796,14 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
         return { id: options.sessionId, exitedBeforeAttach: true } satisfies PtyConnectResult
       }
 
+      // A session id IS the instruction to attach: the provider reattaches on it before any
+      // pane-owner logic runs. So refusing adoption has to drop it here, at the last gate before
+      // the IPC — skipping owner resolution in main is not enough, and left this action still
+      // attaching the very shell it could not reach.
       const admittedSessionId =
-        options.sessionId && !isPreHandlerPtyStateDiscarded(options.sessionId)
+        options.sessionId &&
+        !options.createFreshShellForUnreachablePane &&
+        !isPreHandlerPtyStateDiscarded(options.sessionId)
           ? options.sessionId
           : undefined
 
@@ -799,32 +816,66 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
         // Why: cwd fallback is only for fresh local spawns — reattach keeps the session's cwd and SSH transports resolve cwd on the remote host.
         const shouldSendLocalCwdFallback =
           cwdFallback === 'worktree' && !connectionId && !admittedSessionId
+        // Every constructor value that can launch or resume an agent is suppressed together.
+        const saved = options.suppressSavedStartup
+          ? ({} as Partial<{
+              command: typeof command
+              commandDelivery: typeof commandDelivery
+              launchConfig: typeof launchConfig
+              resumeProviderSession: typeof resumeProviderSession
+              launchToken: typeof launchToken
+              launchAgent: typeof launchAgent
+              startupCommandDelivery: typeof startupCommandDelivery
+            }>)
+          : {
+              command,
+              commandDelivery,
+              launchConfig,
+              resumeProviderSession,
+              launchToken,
+              launchAgent,
+              startupCommandDelivery
+            }
+        let spawnEnv = options.env ?? env
+        if (options.suppressSavedStartup && spawnEnv?.ORCA_AGENT_LAUNCH_TOKEN !== undefined) {
+          spawnEnv = { ...spawnEnv }
+          delete spawnEnv.ORCA_AGENT_LAUNCH_TOKEN
+        }
         const result = await window.api.pty.spawn({
           cols: options.cols ?? 80,
           rows: options.rows ?? 24,
           cwd,
           ...(shouldSendLocalCwdFallback ? { cwdFallback } : {}),
-          env: options.env ?? env,
+          ...(options.createFreshShellForUnreachablePane
+            ? { createFreshShellForUnreachablePane: true }
+            : {}),
+          env: spawnEnv,
           ...((options.envToDelete ?? envToDelete)
             ? { envToDelete: options.envToDelete ?? envToDelete }
             : {}),
-          command: options.command ?? command,
-          ...((options.launchConfig ?? launchConfig)
-            ? { launchConfig: options.launchConfig ?? launchConfig }
+          command: options.command ?? saved.command,
+          ...((options.commandDelivery ?? saved.commandDelivery)
+            ? { commandDelivery: options.commandDelivery ?? saved.commandDelivery }
             : {}),
-          ...((options.resumeProviderSession ?? resumeProviderSession)
+          ...((options.launchConfig ?? saved.launchConfig)
+            ? { launchConfig: options.launchConfig ?? saved.launchConfig }
+            : {}),
+          ...((options.resumeProviderSession ?? saved.resumeProviderSession)
             ? {
-                resumeProviderSession: options.resumeProviderSession ?? resumeProviderSession
+                resumeProviderSession: options.resumeProviderSession ?? saved.resumeProviderSession
               }
             : {}),
-          ...((options.launchToken ?? launchToken)
-            ? { launchToken: options.launchToken ?? launchToken }
+          ...((options.launchToken ?? saved.launchToken)
+            ? { launchToken: options.launchToken ?? saved.launchToken }
             : {}),
-          ...((options.launchAgent ?? launchAgent)
-            ? { launchAgent: options.launchAgent ?? launchAgent }
+          ...((options.launchAgent ?? saved.launchAgent)
+            ? { launchAgent: options.launchAgent ?? saved.launchAgent }
             : {}),
-          ...((options.startupCommandDelivery ?? startupCommandDelivery)
-            ? { startupCommandDelivery: options.startupCommandDelivery ?? startupCommandDelivery }
+          ...((options.startupCommandDelivery ?? saved.startupCommandDelivery)
+            ? {
+                startupCommandDelivery:
+                  options.startupCommandDelivery ?? saved.startupCommandDelivery
+              }
             : {}),
           ...(connectionId ? { connectionId } : {}),
           ...(admittedSessionId ? { sessionId: admittedSessionId } : {}),
diff --git a/src/renderer/src/components/terminal-pane/reattach-failure-classification.test.ts b/src/renderer/src/components/terminal-pane/reattach-failure-classification.test.ts
new file mode 100644
index 00000000000..b514f6cf926
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/reattach-failure-classification.test.ts
@@ -0,0 +1,107 @@
+/**
+ * Duplicate-agent oracles. Reattach failure used to converge on "spawn a fresh
+ * shell", so a transient fault started a second `--resume` against the same
+ * agent session and both processes appended to one transcript.
+ *
+ * Respawn requires proof the session is gone. These pin which failures qualify.
+ */
+import { describe, expect, it } from 'vitest'
+import { isProvenSshSessionGoneError } from './reattach-failure-classification'
+
+describe('reattach failure classification', () => {
+  // INVERTED for STA-3077. Both clauses below asserted that a not-found — raw, or wrapped as
+  // SSH_SESSION_EXPIRED — proves the shell is gone. It does not, and this was the last live route
+  // to the reported duplicate resume.
+  //
+  // A not-found means the relay WE ASKED cannot hand that id back. That is proof of an exit only
+  // if the relay process that minted the pty is the one answering. When a relay is restarted or
+  // replaced, the new process reports not-found for shells still running under its predecessor —
+  // observed directly in the Docker relay harness, where a stalled relay is superseded by a fresh
+  // one with no memory of `pty-1` while the old shells keep running. Respawning there starts a
+  // second `--resume` against the same agent session.
+  //
+  // SSH_SESSION_EXPIRED is not independent evidence: its ONLY producer is that same not-found
+  // mapping in reattachSshPtySession. Telling the two apart needs `relayInstanceId` on the consumer
+  // grant (design step E-2), which is not built — so the honest answer is "unproven".
+  it('does not treat an explicit host expiry as proof', () => {
+    expect(isProvenSshSessionGoneError(new Error('SSH_SESSION_EXPIRED: ssh-1:pty-9'))).toBe(false)
+  })
+
+  it('does not treat a not-found PTY as proof', () => {
+    expect(isProvenSshSessionGoneError(new Error('PTY "pty-9" not found'))).toBe(false)
+  })
+
+  // The reported defect: a source that needs re-establishing was reported as
+  // expiry, so the pane respawned and duplicate-resumed a live agent session.
+  it('does not treat a required source restore as proof', () => {
+    expect(isProvenSshSessionGoneError(new Error('SSH_SOURCE_RESTORE_REQUIRED: ssh-1:pty-9'))).toBe(
+      false
+    )
+  })
+
+  it.each([
+    ['a transport fault', new Error('read ECONNRESET')],
+    ['a timed-out call', new Error('relay request timed out')],
+    ['a disconnected client', new Error('client_disconnected')],
+    ['an unavailable owner', new Error('execution_owner_unavailable')],
+    ['an identity mismatch', new Error('SSH_PTY_IDENTITY_MISMATCH')],
+    ['an empty rejection value', ''],
+    ['a non-Error rejection', 'something went wrong']
+  ])('does not treat %s as proof', (_label, error) => {
+    expect(isProvenSshSessionGoneError(error)).toBe(false)
+  })
+
+  // A new failure mode must not silently become a respawn.
+  it('defaults an unrecognized failure to unresolved', () => {
+    expect(isProvenSshSessionGoneError(new Error('SOME_FUTURE_RELAY_ERROR'))).toBe(false)
+  })
+})
+
+// The `reattach failure description` cases moved rather than vanished. An unproven failure no
+// longer renders an error string at all — it renders the disconnected banner with two actions
+// (STA-3077 step E-0), so "keeps the wire token out of the pane" is now asserted against that
+// copy in TerminalPaneDisconnectedBanner.test.tsx, alongside the no-death-verbs constraint.
+
+// An identity mismatch is the relay saying "I have this pty and its recorded
+// pane differs" — proof the shell is ALIVE. It is worded "not found", so the
+// not-found regex alone reads it backwards and respawns onto a live shell,
+// resuming the agent a second time. Reachable by detaching a pane to a new tab.
+describe('an identity mismatch is never proof of death', () => {
+  it('refuses the token main publishes', () => {
+    const error = new Error('SSH_PTY_IDENTITY_MISMATCH: pty-7')
+    expect(isProvenSshSessionGoneError(error)).toBe(false)
+  })
+
+  // Defense in depth: any route that surfaces the relay's raw wording unwrapped
+  // must not read as death either.
+  it('refuses the relay wording unwrapped', () => {
+    const error = new Error('PTY "pty-7" not found (identity mismatch)')
+    expect(isProvenSshSessionGoneError(error)).toBe(false)
+  })
+
+  // INVERTED with the two clauses above. This was the clause-selectivity guard: it pinned that
+  // silencing the mismatch case had not silenced plain expiry too. Plain expiry is now unproven as
+  // well, on its own evidence — so what remains to guard is that the pane is not stranded, and that
+  // is the disconnected affordance's job, asserted in TerminalPaneDisconnectedBanner.test.tsx.
+  it('does not prove death for the same wording without the mismatch clause either', () => {
+    expect(isProvenSshSessionGoneError(new Error('PTY "pty-7" not found'))).toBe(false)
+  })
+})
+
+/**
+ * The respawn arms are now unreachable, and that is the point: no reattach failure authorizes
+ * replacing a running shell. The design keeps the grant as a CONDITIONAL for step E-2 — a
+ * not-found whose `relayInstanceId` matches the recorded one is genuine proof — so the decision
+ * point stays rather than being deleted. This clause pins that nothing reaches it meanwhile.
+ */
+describe('no reattach failure authorizes a respawn today', () => {
+  it.each([
+    ['a relay-worded not-found', new Error('PTY "pty-9" not found')],
+    ['the expiry token main publishes', new Error('SSH_SESSION_EXPIRED: ssh-1:pty-9')],
+    ['an identity mismatch', new Error('SSH_PTY_IDENTITY_MISMATCH: pty-7')],
+    ['a required source restore', new Error('SSH_SOURCE_RESTORE_REQUIRED: ssh-1:pty-9')],
+    ['a transport fault', new Error('read ECONNRESET')]
+  ])('leaves %s unproven', (_label, error) => {
+    expect(isProvenSshSessionGoneError(error)).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/reattach-failure-classification.ts b/src/renderer/src/components/terminal-pane/reattach-failure-classification.ts
new file mode 100644
index 00000000000..98ee18b912b
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/reattach-failure-classification.ts
@@ -0,0 +1,26 @@
+// Why this module exists: reattach failure used to converge on one action —
+// spawn a fresh shell. A transport fault and a genuinely-gone session were
+// indistinguishable at the decision point, so a transient error respawned the
+// pane and resumed the same agent session a second time; both processes then
+// appended to one transcript.
+//
+// Respawn now requires proof. Everything else is unresolved, which leaves the
+// shell running and the binding intact for a later reattach.
+
+/**
+ * True only when the failure proves the session no longer exists.
+ *
+ * Nothing available at this decision point does. A not-found means the relay we asked cannot hand
+ * that id back — which is proof of an exit ONLY if the relay process that minted the pty is the one
+ * answering. A restarted or replaced relay reports not-found for shells that are still running
+ * under its predecessor, and respawning there resumes the same agent a second time into one
+ * transcript. `SSH_SESSION_EXPIRED` is not independent evidence: its only producer is that same
+ * not-found mapping.
+ *
+ * Distinguishing the two needs `relayInstanceId` on the consumer grant (design step E-2), which is
+ * not built. Until it is, the honest answer is "unproven", and an unverifiable pane surfaces as
+ * disconnected for the user to resolve rather than being silently replaced.
+ */
+export function isProvenSshSessionGoneError(_error: unknown): boolean {
+  return false
+}
diff --git a/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts b/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts
index 0c9b286703c..0e98202aab3 100644
--- a/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts
@@ -32,6 +32,7 @@ function leafIdForPane(paneId: number): string {
 type ConnectCallbacks = {
   onReattachDetermined?: () => void
   onConnect?: () => void
+  onStreamRecovered?: () => void
   onData?: (
     data: string,
     meta?: { seq?: number; rawLength?: number; background?: boolean; droppedOutput?: boolean }
@@ -379,6 +380,7 @@ type RemotePaneDrive = {
   disposable: { dispose: () => void }
   deliver: (data: string, seq: number) => void
   setOutputPaused: (paused: boolean) => void
+  recoverStream: () => void
   writtenChunks: () => string[]
 }
 
@@ -396,9 +398,11 @@ async function connectHiddenRemoteAgentPane(
   const capturedOutputPauseCallback: {
     current: ((paused: boolean, supported: boolean) => void) | null
   } = { current: null }
+  const capturedStreamRecoveredCallback: { current: (() => void) | null } = { current: null }
   transport.connect.mockImplementation(async ({ callbacks }: { callbacks?: ConnectCallbacks }) => {
     capturedDataCallback.current = callbacks?.onData ?? null
     capturedOutputPauseCallback.current = callbacks?.onOutputPauseChanged ?? null
+    capturedStreamRecoveredCallback.current = callbacks?.onStreamRecovered ?? null
     return REMOTE_PTY_ID
   })
   transportFactoryQueue.push(transport)
@@ -415,6 +419,7 @@ async function connectHiddenRemoteAgentPane(
     disposable,
     deliver: (data, seq) => capturedDataCallback.current?.(data, { seq, rawLength: data.length }),
     setOutputPaused: (paused) => capturedOutputPauseCallback.current?.(paused, true),
+    recoverStream: () => capturedStreamRecoveredCallback.current?.(),
     writtenChunks: () => pane.terminal.write.mock.calls.map(([data]) => String(data))
   }
 }
@@ -618,6 +623,24 @@ describe('remote hidden-output restore outcomes', () => {
     resetAgentStartupDelayedDeliveryForTests()
   })
 
+  it('[modern] repaints a recovered visible pane from the retained host buffer', async () => {
+    const serializeBuffer = vi.fn()
+    const serializeBufferOutcome = vi.fn().mockResolvedValue({
+      availability: { kind: 'snapshot' },
+      snapshot: HOST_SNAPSHOT
+    })
+    const drive = await connectHiddenRemoteAgentPane(serializeBuffer, serializeBufferOutcome)
+    ;(drive.deps.isVisibleRef as { current: boolean }).current = true
+
+    drive.recoverStream()
+    await flushAsyncTicks(20)
+
+    expect(serializeBufferOutcome).toHaveBeenCalledTimes(1)
+    expect(drive.writtenChunks().join('')).toContain(HOST_SNAPSHOT_MARKER)
+    expect(serializeBuffer).not.toHaveBeenCalled()
+    drive.disposable.dispose()
+  })
+
   it('[modern] accepts an empty snapshot as successful recovery without a loss banner', async () => {
     const serializeBuffer = vi.fn()
     const serializeBufferOutcome = vi.fn().mockResolvedValue({
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts
index 0292d0b1749..c160188f64d 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts
@@ -14,7 +14,12 @@ import {
   TERMINAL_INPUT_MAX_BYTES
 } from '../../../../shared/terminal-input'
 import { CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS } from '../../../../shared/clipboard-text'
-import { TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import {
+  MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
+  RUNTIME_PROTOCOL_VERSION,
+  TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY,
+  TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
 
 describe('createRemoteRuntimePtyTransport', () => {
   const runtimeCall = vi.fn()
@@ -113,6 +118,19 @@ describe('createRemoteRuntimePtyTransport', () => {
     }
   }
 
+  function currentRuntimeStatus(capabilities: string[] = []): unknown {
+    return {
+      ok: true,
+      result: {
+        runtimeId: 'runtime-1',
+        graphStatus: 'ready',
+        runtimeProtocolVersion: RUNTIME_PROTOCOL_VERSION,
+        minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
+        capabilities: [TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY, ...capabilities]
+      }
+    }
+  }
+
   function emitOutput(streamId: number, data: string): void {
     subscriptionCallbacks?.onBinary?.(
       encodeTerminalStreamFrame({
@@ -187,6 +205,18 @@ describe('createRemoteRuntimePtyTransport', () => {
     subscriptionSendBinary.mockReset()
     refreshSessionTabsSnapshot.mockClear()
     runtimeCall.mockImplementation(async (request: { method: string; params?: unknown }) => {
+      if (request.method === 'status.get') {
+        return {
+          ok: true,
+          result: {
+            runtimeId: 'runtime-1',
+            graphStatus: 'ready',
+            runtimeProtocolVersion: RUNTIME_PROTOCOL_VERSION,
+            minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
+            capabilities: [TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY]
+          }
+        }
+      }
       if (request.method === 'session.tabs.activate') {
         const params = request.params as { tabId: string; leafId?: string }
         const resolvedLeafId = params.leafId ?? 'pane:1'
@@ -541,10 +571,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     let createCalls = 0
     runtimeCall.mockImplementation(async (args: { method: string; params?: unknown }) => {
       if (args.method === 'status.get') {
-        return {
-          ok: true,
-          result: { capabilities: [TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY] }
-        }
+        return currentRuntimeStatus([TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY])
       }
       if (args.method === 'terminal.create') {
         createCalls += 1
@@ -592,13 +619,14 @@ describe('createRemoteRuntimePtyTransport', () => {
     try {
       const startedAt = Date.now()
       let createCalls = 0
+      let statusCalls = 0
       runtimeCall.mockImplementation(async (args: { method: string }) => {
         if (args.method === 'status.get') {
-          vi.setSystemTime(startedAt + 59_000)
-          return {
-            ok: true,
-            result: { capabilities: [TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY] }
+          statusCalls += 1
+          if (statusCalls > 1) {
+            vi.setSystemTime(startedAt + 59_000)
           }
+          return currentRuntimeStatus([TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY])
         }
         if (args.method === 'terminal.create') {
           createCalls += 1
@@ -632,7 +660,7 @@ describe('createRemoteRuntimePtyTransport', () => {
   it('does not retry an unknown create outcome against an older runtime', async () => {
     runtimeCall.mockImplementation(async (args: { method: string }) => {
       if (args.method === 'status.get') {
-        return { ok: true, result: { capabilities: [] } }
+        return currentRuntimeStatus()
       }
       throw Object.assign(new Error('Timed out waiting for the remote Orca runtime.'), {
         code: 'runtime_timeout'
@@ -653,12 +681,16 @@ describe('createRemoteRuntimePtyTransport', () => {
   })
 
   it('surfaces an authoritative capability-probe failure after an unknown create outcome', async () => {
+    let statusCalls = 0
     runtimeCall.mockImplementation(async (args: { method: string }) => {
-      if (args.method === 'status.get') {
+      if (args.method === 'status.get' && ++statusCalls > 1) {
         throw Object.assign(new Error('Remote runtime pairing credentials expired.'), {
           code: 'unauthorized'
         })
       }
+      if (args.method === 'status.get') {
+        return currentRuntimeStatus([TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY])
+      }
       throw Object.assign(new Error('Timed out waiting for the remote Orca runtime.'), {
         code: 'runtime_timeout'
       })
@@ -694,10 +726,7 @@ describe('createRemoteRuntimePtyTransport', () => {
               }, args.timeoutMs)
             })
           }
-          return {
-            ok: true,
-            result: { capabilities: [TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY] }
-          }
+          return currentRuntimeStatus([TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY])
         }
         if (args.method === 'terminal.create' && reachable) {
           return { ok: true, result: { terminal: { handle: 'terminal-recovered' } } }
@@ -763,9 +792,10 @@ describe('createRemoteRuntimePtyTransport', () => {
           return {
             ok: true,
             result: {
+              runtimeId: 'runtime-1',
               runtimeProtocolVersion: 3,
               minCompatibleRuntimeClientVersion: 2,
-              capabilities: ['agent-session.host-authority.v1']
+              capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
             }
           }
         }
@@ -813,9 +843,65 @@ describe('createRemoteRuntimePtyTransport', () => {
         .filter((args) => args.method === 'terminal.createAgentSession')
       expect(allCreates.every((args) => args.params?.clientOperationId === operationId)).toBe(true)
       expect(runtimeCall.mock.calls.some(([args]) => args.method === 'terminal.create')).toBe(false)
-      expect(runtimeCall.mock.calls.filter(([args]) => args.method === 'status.get')).toHaveLength(
-        1
+      expect(
+        runtimeCall.mock.calls.filter(([args]) => args.method === 'status.get').length
+      ).toBeGreaterThan(1)
+      transport.destroy?.()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('refuses structured replay after an in-place host downgrade', async () => {
+    vi.useFakeTimers()
+    try {
+      let statusCalls = 0
+      const onError = vi.fn()
+      runtimeCall.mockImplementation(async (args: { method: string }) => {
+        if (args.method === 'status.get') {
+          statusCalls += 1
+          return {
+            ok: true,
+            result: {
+              runtimeId: 'runtime-1',
+              runtimeProtocolVersion: 3,
+              minCompatibleRuntimeClientVersion: 2,
+              capabilities:
+                statusCalls === 1
+                  ? ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
+                  : ['agent-session.host-authority.v1']
+            }
+          }
+        }
+        if (args.method === 'terminal.createAgentSession') {
+          throw Object.assign(new Error('Timed out waiting for the remote Orca runtime.'), {
+            code: 'runtime_timeout'
+          })
+        }
+        return { ok: true, result: {} }
+      })
+      const { createRemoteRuntimePtyTransport } = await import('./remote-runtime-pty-transport')
+      const transport = createRemoteRuntimePtyTransport('env-1', {
+        worktreeId: 'wt-1',
+        tabId: 'tab-1',
+        leafId: 'pane:1',
+        launchAgent: 'codex'
+      })
+
+      const connect = transport.connect({ url: '', callbacks: { onError } })
+      await vi.advanceTimersByTimeAsync(250)
+      await connect
+
+      expect(onError).toHaveBeenCalledWith(
+        expect.stringContaining('no fallback launch was attempted')
       )
+      expect(
+        runtimeCall.mock.calls.filter(([args]) => args.method === 'terminal.createAgentSession')
+      ).toHaveLength(1)
+      expect(runtimeCall.mock.calls.filter(([args]) => args.method === 'status.get')).toHaveLength(
+        2
+      )
+      expect(runtimeCall.mock.calls.some(([args]) => args.method === 'terminal.create')).toBe(false)
       transport.destroy?.()
     } finally {
       vi.useRealTimers()
@@ -3855,6 +3941,9 @@ describe('createRemoteRuntimePtyTransport', () => {
   it('closes a remote terminal created after the pane was destroyed', async () => {
     let resolveCreate: (value: unknown) => void = () => {}
     runtimeCall.mockImplementation((args) => {
+      if (args.method === 'status.get') {
+        return Promise.resolve(currentRuntimeStatus())
+      }
       if (args.method === 'terminal.create') {
         return new Promise((resolve) => {
           resolveCreate = resolve
@@ -3870,6 +3959,11 @@ describe('createRemoteRuntimePtyTransport', () => {
     })
 
     const connect = transport.connect({ url: '', callbacks: {} })
+    await vi.waitFor(() =>
+      expect(runtimeCall).toHaveBeenCalledWith(
+        expect.objectContaining({ method: 'terminal.create' })
+      )
+    )
     transport.destroy?.()
     resolveCreate({ ok: true, result: { terminal: { handle: 'terminal-late' } } })
     await connect
@@ -3878,13 +3972,17 @@ describe('createRemoteRuntimePtyTransport', () => {
       selector: 'env-1',
       method: 'terminal.close',
       params: { terminal: 'terminal-late' },
-      timeoutMs: 15_000
+      timeoutMs: 15_000,
+      expectedEnvironmentPairingRevision: undefined
     })
   })
 
   it('cannot let a stale create completion replace a newer attached terminal', async () => {
     let resolveCreate: (value: unknown) => void = () => {}
     runtimeCall.mockImplementation((args) => {
+      if (args.method === 'status.get') {
+        return Promise.resolve(currentRuntimeStatus())
+      }
       if (args.method === 'terminal.create') {
         return new Promise((resolve) => {
           resolveCreate = resolve
@@ -3900,6 +3998,11 @@ describe('createRemoteRuntimePtyTransport', () => {
     })
 
     const connect = transport.connect({ url: '', callbacks: {} })
+    await vi.waitFor(() =>
+      expect(runtimeCall).toHaveBeenCalledWith(
+        expect.objectContaining({ method: 'terminal.create' })
+      )
+    )
     transport.attach({ existingPtyId: 'remote:env-2@@terminal-attached', callbacks: {} })
     resolveCreate({ ok: true, result: { terminal: { handle: 'terminal-late' } } })
     await connect
@@ -3910,7 +4013,8 @@ describe('createRemoteRuntimePtyTransport', () => {
       selector: 'env-1',
       method: 'terminal.close',
       params: { terminal: 'terminal-late' },
-      timeoutMs: 15_000
+      timeoutMs: 15_000,
+      expectedEnvironmentPairingRevision: undefined
     })
     transport.destroy?.()
   })
@@ -3924,7 +4028,7 @@ describe('createRemoteRuntimePtyTransport', () => {
           result: {
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: ['agent-session.host-authority.v1']
+            capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
           }
         })
       }
@@ -3974,7 +4078,7 @@ describe('createRemoteRuntimePtyTransport', () => {
           result: {
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: ['agent-session.host-authority.v1']
+            capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
           }
         })
       }
@@ -4089,7 +4193,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         method: 'terminal.create',
         params: expect.objectContaining({
           command: "codex 'linked issue context'",
-          envToDelete: ['CODEX_HOME', 'ORCA_CODEX_HOME'],
+          envToDelete: ['CODEX_HOME', 'ORCA_CODEX_HOME', 'ORCA_ENABLE_GIT_ATTRIBUTION'],
           startupCommandDelivery: 'shell-ready',
           terminalColorQueryReplies: { foreground: '#ffffff', background: '#282c34' }
         })
@@ -4105,7 +4209,11 @@ describe('createRemoteRuntimePtyTransport', () => {
             result: {
               runtimeProtocolVersion: 3,
               minCompatibleRuntimeClientVersion: 2,
-              capabilities: ['agent-session.host-authority.v1', 'agent-session.omp-resume-path.v1']
+              capabilities: [
+                'agent-session.host-authority.v1',
+                'agent-session.omp-resume-path.v1',
+                'terminal.attribution-removed.v1'
+              ]
             }
           }
         : { ok: true, result: { terminal: { handle: 'terminal-1' } } }
@@ -4169,7 +4277,7 @@ describe('createRemoteRuntimePtyTransport', () => {
             result: {
               runtimeProtocolVersion: 3,
               minCompatibleRuntimeClientVersion: 2,
-              capabilities: ['agent-session.host-authority.v1']
+              capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
             }
           }
         : {
@@ -4219,9 +4327,10 @@ describe('createRemoteRuntimePtyTransport', () => {
         ? {
             ok: true,
             result: {
+              runtimeId: 'runtime-1',
               runtimeProtocolVersion: 3,
               minCompatibleRuntimeClientVersion: 2,
-              capabilities: []
+              capabilities: [TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY]
             }
           }
         : { ok: true, result: { terminal: { handle: 'terminal-legacy' } } }
@@ -4257,7 +4366,12 @@ describe('createRemoteRuntimePtyTransport', () => {
         worktree: 'id:wt-1',
         clientMutationId: expect.any(String),
         command: "codex '--model' 'gpt-5' 'resume' 'session-1'",
-        env: { CODEX_PROFILE: 'captured', ORCA_AGENT_LAUNCH_TOKEN: 'fresh-token' },
+        env: {
+          CODEX_PROFILE: 'captured',
+          ORCA_AGENT_LAUNCH_TOKEN: 'fresh-token',
+          ORCA_ATTRIBUTION_BYPASS: '1'
+        },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
         launchConfig: {
           agentArgs: '--model gpt-5',
           agentEnv: { CODEX_PROFILE: 'captured' }
@@ -4269,7 +4383,9 @@ describe('createRemoteRuntimePtyTransport', () => {
         focus: false,
         presentation: 'background'
       },
-      timeoutMs: 15_000
+      timeoutMs: 15_000,
+      expectedEnvironmentPairingRevision: undefined,
+      expectedRuntimeId: 'runtime-1'
     })
     expect(runtimeCall).not.toHaveBeenCalledWith(
       expect.objectContaining({ method: 'terminal.createAgentSession' })
@@ -5054,6 +5170,91 @@ describe('createRemoteRuntimePtyTransport', () => {
     transport.destroy?.()
   })
 
+  it('re-arms the retained-buffer restore when a recovery subscribe replays no snapshot', async () => {
+    const { createRemoteRuntimePtyTransport } = await import('./remote-runtime-pty-transport')
+    const onReplayData = vi.fn()
+    const onStreamRecovered = vi.fn()
+    const onConnect = vi.fn()
+    const transport = createRemoteRuntimePtyTransport('env-1', {
+      worktreeId: 'wt-1',
+      tabId: 'tab-1',
+      leafId: 'pane:1'
+    })
+
+    await transport.connect({
+      url: '',
+      callbacks: { onReplayData, onStreamRecovered, onConnect }
+    })
+    await vi.waitFor(() => expect(subscriptionSendBinary).toHaveBeenCalled())
+    const firstStreamId = latestSubscribePayload().streamId
+    emitSnapshot(firstStreamId, 'INITIAL_SNAPSHOT')
+    subscriptionCallbacks?.onResponse({
+      ok: true,
+      result: {
+        type: 'subscribed',
+        streamId: firstStreamId,
+        capabilities: { outputPause: 1 }
+      }
+    })
+    await vi.waitFor(() => expect(onConnect).toHaveBeenCalledTimes(1))
+    // The first subscribe already carries the host snapshot; re-arming there would cost
+    // every pane a redundant restore request on open.
+    expect(onStreamRecovered).not.toHaveBeenCalled()
+
+    subscriptionCallbacks?.onClose?.()
+    await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() =>
+      expect(
+        subscriptionSendBinary.mock.calls
+          .map((call) => decodeTerminalStreamFrame(call[0]))
+          .filter((frame) => frame?.opcode === TerminalStreamOpcode.Subscribe)
+      ).toHaveLength(2)
+    )
+    const reconnectStreamId = latestSubscribePayload().streamId
+    // An exited-but-preserved pane has nothing to push and will never emit live bytes,
+    // so without the re-arm the pane stays blank until a visibility flip.
+    emitSnapshot(reconnectStreamId, '')
+    subscriptionCallbacks?.onResponse({
+      ok: true,
+      result: {
+        type: 'subscribed',
+        streamId: reconnectStreamId,
+        capabilities: { outputPause: 1 }
+      }
+    })
+
+    await vi.waitFor(() => expect(onStreamRecovered).toHaveBeenCalledTimes(1))
+    expect(onReplayData.mock.calls.map((call) => call[0])).toEqual(['INITIAL_SNAPSHOT'])
+
+    subscriptionCallbacks?.onClose?.()
+    await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalledTimes(3))
+    await vi.waitFor(() =>
+      expect(
+        subscriptionSendBinary.mock.calls
+          .map((call) => decodeTerminalStreamFrame(call[0]))
+          .filter((frame) => frame?.opcode === TerminalStreamOpcode.Subscribe)
+      ).toHaveLength(3)
+    )
+    const populatedReconnectStreamId = latestSubscribePayload().streamId
+    emitSnapshot(populatedReconnectStreamId, 'RECOVERY_SNAPSHOT')
+    subscriptionCallbacks?.onResponse({
+      ok: true,
+      result: {
+        type: 'subscribed',
+        streamId: populatedReconnectStreamId,
+        capabilities: { outputPause: 1 }
+      }
+    })
+
+    await vi.waitFor(() => expect(onConnect).toHaveBeenCalledTimes(3))
+    expect(onStreamRecovered).toHaveBeenCalledTimes(1)
+    expect(onReplayData.mock.calls.map((call) => call[0])).toEqual([
+      'INITIAL_SNAPSHOT',
+      'RECOVERY_SNAPSHOT'
+    ])
+    transport.destroy?.()
+  })
+
   it('backs off before retrying a capacity-rejected terminal stream', async () => {
     vi.useFakeTimers()
     try {
@@ -5601,6 +5802,9 @@ describe('createRemoteRuntimePtyTransport', () => {
 
   it('returns runtime acceptance for acknowledged terminal input', async () => {
     runtimeCall.mockImplementation((args) => {
+      if (args.method === 'status.get') {
+        return Promise.resolve(currentRuntimeStatus())
+      }
       if (args.method === 'terminal.create') {
         return Promise.resolve({ ok: true, result: { terminal: { handle: 'terminal-1' } } })
       }
@@ -5640,6 +5844,9 @@ describe('createRemoteRuntimePtyTransport', () => {
     vi.useFakeTimers()
     try {
       runtimeCall.mockImplementation((args) => {
+        if (args.method === 'status.get') {
+          return Promise.resolve(currentRuntimeStatus())
+        }
         if (args.method === 'terminal.create') {
           return Promise.resolve({ ok: true, result: { terminal: { handle: 'terminal-1' } } })
         }
@@ -5685,6 +5892,9 @@ describe('createRemoteRuntimePtyTransport', () => {
 
   it('returns false when acknowledged terminal input is rejected by the runtime', async () => {
     runtimeCall.mockImplementation((args) => {
+      if (args.method === 'status.get') {
+        return Promise.resolve(currentRuntimeStatus())
+      }
       if (args.method === 'terminal.create') {
         return Promise.resolve({ ok: true, result: { terminal: { handle: 'terminal-1' } } })
       }
@@ -5710,6 +5920,9 @@ describe('createRemoteRuntimePtyTransport', () => {
 
   it('splits large acknowledged remote input before terminal.send RPCs', async () => {
     runtimeCall.mockImplementation((args) => {
+      if (args.method === 'status.get') {
+        return Promise.resolve(currentRuntimeStatus())
+      }
       if (args.method === 'terminal.create') {
         return Promise.resolve({ ok: true, result: { terminal: { handle: 'terminal-1' } } })
       }
@@ -5749,6 +5962,9 @@ describe('createRemoteRuntimePtyTransport', () => {
     vi.useFakeTimers()
     try {
       runtimeCall.mockImplementation((args) => {
+        if (args.method === 'status.get') {
+          return Promise.resolve(currentRuntimeStatus())
+        }
         if (args.method === 'terminal.create') {
           return Promise.resolve({ ok: true, result: { terminal: { handle: 'terminal-1' } } })
         }
@@ -5798,6 +6014,9 @@ describe('createRemoteRuntimePtyTransport', () => {
     const firstChunk = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
     const rejectedChunk = `tail${'y'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES - 4)}`
     runtimeCall.mockImplementation((args) => {
+      if (args.method === 'status.get') {
+        return Promise.resolve(currentRuntimeStatus())
+      }
       if (args.method === 'terminal.create') {
         return Promise.resolve({ ok: true, result: { terminal: { handle: 'terminal-1' } } })
       }
@@ -5836,6 +6055,9 @@ describe('createRemoteRuntimePtyTransport', () => {
 
   it('rejects oversized acknowledged remote input before runtime RPCs', async () => {
     runtimeCall.mockImplementation((args) => {
+      if (args.method === 'status.get') {
+        return Promise.resolve(currentRuntimeStatus())
+      }
       if (args.method === 'terminal.create') {
         return Promise.resolve({ ok: true, result: { terminal: { handle: 'terminal-1' } } })
       }
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
index d34bd384511..35189447c57 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
@@ -20,8 +20,11 @@ import type {
   RuntimeTerminalSend
 } from '../../../../shared/runtime-types'
 import {
+  AGENT_SESSION_HOST_AUTHORITY_RUNTIME_CAPABILITY,
   AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
-  TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY
+  TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY,
+  TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY,
+  type RuntimeCapability
 } from '../../../../shared/protocol-version'
 import {
   isTerminalInputTooLargeWithDeferredMeasurement,
@@ -34,7 +37,11 @@ import type {
   PtyTransportRecoveryState
 } from './pty-transport-types'
 import { createPtyOutputProcessor } from './pty-transport'
-import { RuntimeRpcCallError, unwrapRuntimeRpcResult } from '../../runtime/runtime-rpc-client'
+import {
+  RuntimeRpcCallError,
+  unwrapRuntimeRpcResult,
+  type LiveRuntimeEnvironmentAuthority
+} from '../../runtime/runtime-rpc-client'
 import {
   getRemoteRuntimePtyEnvironmentId,
   getRemoteRuntimeTerminalHandle,
@@ -83,6 +90,10 @@ import {
   ptyShutdownLifecycleHandlers
 } from './pty-shutdown-data-suspension'
 import { getRuntimeEnvironmentRevision } from '@/runtime/runtime-environment-revision'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  withLegacyTerminalAttributionDisabledEnv
+} from '../../../../shared/legacy-terminal-attribution-env'
 
 const REMOTE_TERMINAL_INPUT_FLUSH_MS = 8
 const REMOTE_TERMINAL_VIEWPORT_FLUSH_MS = 33
@@ -92,6 +103,8 @@ const HOST_SESSION_ATTACH_TIMEOUT_MS = 15_000
 const HOST_SESSION_INVENTORY_MAX_WINDOWS_PER_RECOVERY = 2
 const HOST_SESSION_SAME_HANDLE_END_REUSE_LIMIT = 2
 const TERMINAL_CREATE_RETRY_DELAYS_MS = [250, 500, 1000, 2000, 4000, 8000, 15_000, 30_000] as const
+const AGENT_SESSION_REPLAY_UPDATE_REQUIRED_MESSAGE =
+  'Remote agent recovery requires the same updated Orca server that accepted the launch. Update the workspace host and try again; no fallback launch was attempted.'
 
 type HostHandleReplacementPolicy = 'reuse' | 'prefer-replacement' | 'require-replacement'
 
@@ -358,6 +371,7 @@ export function createRemoteRuntimePtyTransport(
   // Why: reconnect retries must replay one host operation instead of creating
   // another fresh agent when the first response was lost.
   const agentCreateOperation = createAgentSessionCreateOperation()
+  let agentSessionCreateAuthority: LiveRuntimeEnvironmentAuthority | null = null
   const outputProcessor = createPtyOutputProcessor({
     onTitleChange,
     onBell,
@@ -852,14 +866,16 @@ export function createRemoteRuntimePtyTransport(
     environmentId: string,
     method: string,
     params?: unknown,
-    timeoutMs = 15_000
+    timeoutMs = 15_000,
+    expectedRuntimeId?: string
   ): Promise<TResult> {
     const response = await window.api.runtimeEnvironments.call({
       selector: environmentId,
       method,
       params,
       timeoutMs,
-      expectedEnvironmentPairingRevision: runtimeEnvironmentPairingRevision
+      expectedEnvironmentPairingRevision: runtimeEnvironmentPairingRevision,
+      ...(expectedRuntimeId ? { expectedRuntimeId } : {})
     })
     return unwrapRuntimeRpcResult(response as RuntimeRpcResponse<TResult>)
   }
@@ -908,7 +924,8 @@ export function createRemoteRuntimePtyTransport(
       reconcileExisting: boolean
     ) => Promise<RemoteAgentSessionLaunchResult>,
     environmentId: string,
-    expectedLifecycleEpoch: number
+    expectedLifecycleEpoch: number,
+    beforeReplay?: (timeoutMs: number) => Promise<void>
   ): Promise<RemoteAgentSessionLaunchResult | null> {
     let retryAttempt = 0
     // Structured operations already carry their replay proof; ordinary terminal.create
@@ -993,6 +1010,9 @@ export function createRemoteRuntimePtyTransport(
         break
       }
       try {
+        if (reconcileExisting) {
+          await beforeReplay?.(Math.min(5_000, createRemainingMs ?? 5_000))
+        }
         return await invoke(Math.min(15_000, createRemainingMs ?? 15_000), reconcileExisting)
       } catch (error) {
         lastError = error
@@ -1735,6 +1755,7 @@ export function createRemoteRuntimePtyTransport(
     setAttachmentReady(false)
     let transportClosed = false
     let subscriptionAttached = false
+    let subscriptionSnapshotHadContent = false
     // Why: viewport handed to subscribe; a resize during the round-trip falls back to the refresh-only one-shot RPC, replayed through the stream below once current.
     const subscribedViewport = desiredViewport
     const isCurrentSubscription = (): boolean =>
@@ -1760,6 +1781,7 @@ export function createRemoteRuntimePtyTransport(
         onSnapshot: (data, meta) => {
           // Why: an empty snapshot can still carry a pending mid-escape tail that must replay so the next live chunk completes it.
           if ((data || meta?.pendingEscapeTailAnsi) && isCurrentSubscription()) {
+            subscriptionSnapshotHadContent = true
             if (subscribedPtyId && bufferPtyShutdownReplayData(subscribedPtyId, data)) {
               return
             }
@@ -1768,6 +1790,14 @@ export function createRemoteRuntimePtyTransport(
               suppressAttentionEvents: true,
               ...(meta?.pendingEscapeTailAnsi
                 ? { pendingEscapeTailAnsi: meta.pendingEscapeTailAnsi }
+                : {}),
+              // Why both or neither: the host's flags describe this image's own
+              // boundary, so an unsequenced snapshot proves nothing.
+              ...(meta?.kittyKeyboardFlags !== undefined && meta.seq !== undefined
+                ? {
+                    kittyKeyboardFlags: meta.kittyKeyboardFlags,
+                    snapshotSeq: meta.seq
+                  }
                 : {})
             })
           }
@@ -1798,6 +1828,12 @@ export function createRemoteRuntimePtyTransport(
           markRecoveryHealthy()
           emitRecoveryState()
           storedCallbacks.onConnect?.()
+          // Why: a recovery subscribe replays nothing when the host's push snapshot is
+          // empty (idle or exited pane), so ask for the retained buffer instead of
+          // waiting for bytes that an exited process will never send.
+          if (expectedRecoveryEpoch !== undefined && !subscriptionSnapshotHadContent) {
+            storedCallbacks.onStreamRecovered?.()
+          }
           storedCallbacks.onStatus?.('shell')
         },
         onEnd: () => {
@@ -1959,8 +1995,10 @@ export function createRemoteRuntimePtyTransport(
         const commandToSend = options.command ?? command
         const startupCommandDeliveryToSend =
           options.startupCommandDelivery ?? startupCommandDelivery
-        const envToSend = options.env ?? env
-        const envToDeleteToSend = options.envToDelete ?? envToDelete
+        const envToSend = withLegacyTerminalAttributionDisabledEnv(options.env ?? env)
+        const envToDeleteToSend = addLegacyTerminalAttributionDisableRequest(
+          options.envToDelete ?? envToDelete
+        )
         const launchConfigToSend = options.launchConfig ?? launchConfig
         const resumeProviderSessionToSend = options.resumeProviderSession ?? resumeProviderSession
         const launchTokenToSend = options.launchToken ?? launchToken
@@ -1988,7 +2026,7 @@ export function createRemoteRuntimePtyTransport(
           presentation: 'background' as const,
           ...(activate === true ? { activate: true } : {})
         }
-        const legacyCreate = () =>
+        const legacyCreate = ({ authority }: { authority: LiveRuntimeEnvironmentAuthority }) =>
           createWithUnknownOutcomeRecovery(
             'terminal',
             (timeoutMs, reconcileExisting) =>
@@ -1999,13 +2037,49 @@ export function createRemoteRuntimePtyTransport(
                   ...legacyCreateParams,
                   ...(reconcileExisting ? { reconcileExisting: true } : {})
                 },
-                timeoutMs
+                timeoutMs,
+                authority.runtimeId
               ),
             createEnvironmentId,
             connectLifecycleEpoch
           )
-        const hostAuthorityCreate = () =>
-          createWithUnknownOutcomeRecovery(
+        const requiredAgentSessionCapabilities: readonly RuntimeCapability[] =
+          resumeProviderSessionToSend && launchAgentToSend === 'omp'
+            ? [AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY]
+            : []
+        const revalidateAgentSessionReplay = async (
+          timeoutMs: number,
+          authority: LiveRuntimeEnvironmentAuthority
+        ): Promise<void> => {
+          const status = await callRuntimeForEnvironment<RuntimeStatus>(
+            createEnvironmentId,
+            'status.get',
+            undefined,
+            timeoutMs,
+            authority.runtimeId
+          )
+          const requiredCapabilities = [
+            AGENT_SESSION_HOST_AUTHORITY_RUNTIME_CAPABILITY,
+            TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY,
+            ...requiredAgentSessionCapabilities
+          ]
+          const capabilities = Array.isArray(status.capabilities) ? status.capabilities : []
+          if (
+            status.runtimeId !== authority.runtimeId ||
+            requiredCapabilities.some((capability) => !capabilities.includes(capability))
+          ) {
+            throw new Error(AGENT_SESSION_REPLAY_UPDATE_REQUIRED_MESSAGE)
+          }
+        }
+        const hostAuthorityCreate = (authority: LiveRuntimeEnvironmentAuthority) => {
+          if (
+            agentSessionCreateAuthority &&
+            agentSessionCreateAuthority.runtimeId !== authority.runtimeId
+          ) {
+            throw new Error(AGENT_SESSION_REPLAY_UPDATE_REQUIRED_MESSAGE)
+          }
+          agentSessionCreateAuthority ??= authority
+          return createWithUnknownOutcomeRecovery(
             'agent-session',
             (timeoutMs) =>
               resumeProviderSessionToSend
@@ -2027,7 +2101,8 @@ export function createRemoteRuntimePtyTransport(
                       placement: { tabId, leafId },
                       presentation: 'background'
                     },
-                    timeoutMs
+                    timeoutMs,
+                    authority.runtimeId
                   )
                 : callRuntimeForEnvironment<RuntimeCreateAgentSessionResult>(
                     createEnvironmentId,
@@ -2049,23 +2124,37 @@ export function createRemoteRuntimePtyTransport(
                       },
                       agentCreateOperation.clientOperationId
                     ),
-                    timeoutMs
+                    timeoutMs,
+                    authority.runtimeId
                   ),
             createEnvironmentId,
-            connectLifecycleEpoch
+            connectLifecycleEpoch,
+            (timeoutMs) => revalidateAgentSessionReplay(timeoutMs, authority)
           )
+        }
         const created = launchAgentToSend
           ? agentSessionRequiresHostAuthorityReplay
-            ? await hostAuthorityCreate()
+            ? agentSessionCreateAuthority
+              ? await hostAuthorityCreate(agentSessionCreateAuthority)
+              : await runRemoteAgentSessionLaunch<RemoteAgentSessionLaunchResult | null>({
+                  environmentId: createEnvironmentId,
+                  expectedEnvironmentPairingRevision: runtimeEnvironmentPairingRevision,
+                  hostAuthority: hostAuthorityCreate,
+                  requiredHostAuthorityCapabilities: requiredAgentSessionCapabilities,
+                  legacy: legacyCreate
+                })
             : await runRemoteAgentSessionLaunch<RemoteAgentSessionLaunchResult | null>({
                 environmentId: createEnvironmentId,
+                expectedEnvironmentPairingRevision: runtimeEnvironmentPairingRevision,
                 hostAuthority: hostAuthorityCreate,
-                ...(resumeProviderSessionToSend && launchAgentToSend === 'omp'
-                  ? { hostAuthorityCapability: AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY }
-                  : {}),
+                requiredHostAuthorityCapabilities: requiredAgentSessionCapabilities,
                 legacy: legacyCreate
               })
-          : await legacyCreate()
+          : await runRemoteAgentSessionLaunch<RemoteAgentSessionLaunchResult | null>({
+              environmentId: createEnvironmentId,
+              expectedEnvironmentPairingRevision: runtimeEnvironmentPairingRevision,
+              legacy: legacyCreate
+            })
         if (!created) {
           if (!destroyed && lifecycleEpoch === connectLifecycleEpoch) {
             connecting = false
@@ -2141,13 +2230,21 @@ export function createRemoteRuntimePtyTransport(
         if (!destroyed && lifecycleEpoch === connectLifecycleEpoch) {
           connecting = false
           const message = runtimeTerminalErrorMessage(error)
+          const recoverable = isRecoverableRemoteRuntimeConnectionError(
+            toRemoteRuntimeClientErrorLike(error)
+          )
           if (isRemoteTerminalGoneMessage(message)) {
             recovery.cancel()
             handleRemoteTerminalError(error)
           } else if (
-            isRecoverableRemoteRuntimeConnectionError(toRemoteRuntimeClientErrorLike(error))
+            recoverable ||
+            terminalCreateNeedsReconciliation ||
+            agentSessionRequiresHostAuthorityReplay
           ) {
             recovery.markDisconnected()
+            if (!recoverable) {
+              surfaceErrorMessage(message)
+            }
           } else {
             recovery.cancel()
             emitRecoveryState()
diff --git a/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts b/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
index 1b7c36a0a1f..959b4a9a7e4 100644
--- a/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
@@ -36,9 +36,7 @@ function buildForkWorkspaceName(sourceName: string): string {
 }
 
 function resolveTuiAgent(value: string | null | undefined): TuiAgent | null {
-  return value && Object.prototype.hasOwnProperty.call(TUI_AGENT_CONFIG, value)
-    ? (value as TuiAgent)
-    : null
+  return value && Object.hasOwn(TUI_AGENT_CONFIG, value) ? (value as TuiAgent) : null
 }
 
 function getUsableForkBase(
diff --git a/src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx b/src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx
index 9a97a10745b..08fadd307fe 100644
--- a/src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx
+++ b/src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx
@@ -154,6 +154,7 @@ function OverlayHost(): React.JSX.Element | null {
     terminalTabs,
     assignments: EMPTY_ASSIGNMENTS,
     isWorktreeActive: false,
+    activeTerminalTabId: null,
     coldParkTerminalPanes: false,
     shouldMeasureHiddenWorktree: false,
     activityTerminalPortals: EMPTY_PORTALS,
diff --git a/src/renderer/src/components/terminal-pane/terminal-hidden-delivery-gate.ts b/src/renderer/src/components/terminal-pane/terminal-hidden-delivery-gate.ts
index 367c42afe78..0950b05508e 100644
--- a/src/renderer/src/components/terminal-pane/terminal-hidden-delivery-gate.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-hidden-delivery-gate.ts
@@ -4,7 +4,7 @@
  * The gate only operates when main holds side-effect authority for the PTY
  * (see isMainTerminalSideEffectAuthorityForPty) AND the gate-specific kill
  * switch is on. Callers decide once at pane/watcher creation — the decision
- * picks which mode-2031 responder is registered (byte sidecar vs fact reply),
+ * picks which observer records mode-2031 subscriptions (byte scan vs fact),
  * so it must never flip per chunk.
  */
 import type { GlobalSettings } from '../../../../shared/types'
diff --git a/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts b/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts
index 823ce3dd867..a93c28ddc01 100644
--- a/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts
@@ -585,6 +585,43 @@ describe('selectColdParkedTerminalTabs', () => {
     expect(selected).toEqual(new Set())
   })
 
+  // Why: view switches stamp every tab together, so UUID order cannot express recency.
+  it('resolves an identical-hiddenSinceMs tie by activation order, not by tab id', () => {
+    const hiddenSinceMs = nowMs - TERMINAL_TAB_HOT_RETAIN_MS
+    const selected = selectColdParkedTerminalTabs({
+      worktreeId: 'wt-1',
+      terminalTabs: [
+        { ...localTab('tab-aaa', hiddenSinceMs), lastActivatedSeq: 1 },
+        { ...localTab('tab-zzz', hiddenSinceMs), lastActivatedSeq: 2 }
+      ],
+      pendingStartupByTabId: {},
+      parkingEnabled: true,
+      nowMs,
+      hotRetainLimit: 0
+    })
+
+    expect(selected).toEqual(new Set(['tab-aaa']))
+  })
+
+  // Why: the cap and exemption must share one recency ranking.
+  it('keeps the most recently activated tab warm when the cap evicts a tie', () => {
+    const hiddenSinceMs = nowMs - TERMINAL_TAB_HOT_RETAIN_MS + 1
+    const selected = selectColdParkedTerminalTabs({
+      worktreeId: 'wt-1',
+      terminalTabs: [
+        { ...localTab('tab-aaa', hiddenSinceMs), lastActivatedSeq: 1 },
+        { ...localTab('tab-bbb', hiddenSinceMs), lastActivatedSeq: 3 },
+        { ...localTab('tab-ccc', hiddenSinceMs), lastActivatedSeq: 2 }
+      ],
+      pendingStartupByTabId: {},
+      parkingEnabled: true,
+      nowMs,
+      hotRetainLimit: 2
+    })
+
+    expect(selected).toEqual(new Set(['tab-aaa']))
+  })
+
   it('selects nothing when the settings kill switch disables parking', () => {
     const selected = selectColdParkedTerminalTabs({
       worktreeId: 'wt-1',
diff --git a/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.ts b/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.ts
index 2aab92ac592..2efcff11f4d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.ts
@@ -49,6 +49,8 @@ export type TerminalTabColdParkCandidate = ColdParkableTerminalTab & {
   isVisible: boolean
   hasActivityTerminalPortal: boolean
   hiddenSinceMs: number | null
+  /** Higher means activated more recently; breaks same-pass hidden-time ties. */
+  lastActivatedSeq?: number
 }
 
 function getPendingActivationSpawnCount(value: boolean | number | undefined): number {
@@ -198,21 +200,33 @@ export function canParkTerminalTabRenderer(args: {
   return isParkRestorableTerminalPty(tab.ptyId, args.worktreeId, args.restorePolicy)
 }
 
-export type ColdParkRetainCandidate = { id: string; hiddenSinceMs: number }
+export type ColdParkRetainCandidate = {
+  id: string
+  hiddenSinceMs: number
+  lastActivatedSeq?: number
+}
+
+// Why: a view switch stamps every owned tab at once, so activation order must
+// break the routine hidden-time tie before the deterministic UUID fallback.
+function compareColdParkRecencyDesc(
+  a: ColdParkRetainCandidate,
+  b: ColdParkRetainCandidate
+): number {
+  if (a.hiddenSinceMs !== b.hiddenSinceMs) {
+    return b.hiddenSinceMs - a.hiddenSinceMs
+  }
+  const activationDelta = (b.lastActivatedSeq ?? -1) - (a.lastActivatedSeq ?? -1)
+  return activationDelta === 0 ? a.id.localeCompare(b.id) : activationDelta
+}
 
 // Why: the single most-recently-hidden candidate is the view the user just
 // switched away from; keeping it warm regardless of the TTL or cap means
 // switching back after any absence (a meeting, coffee) is always instant, the
-// remount cost users actually notice. Ties break by id for determinism.
+// remount cost users actually notice.
 function selectLastActiveRetainedId(candidates: ColdParkRetainCandidate[]): string | null {
   let lastActive: ColdParkRetainCandidate | null = null
   for (const candidate of candidates) {
-    if (
-      lastActive === null ||
-      candidate.hiddenSinceMs > lastActive.hiddenSinceMs ||
-      (candidate.hiddenSinceMs === lastActive.hiddenSinceMs &&
-        candidate.id.localeCompare(lastActive.id) < 0)
-    ) {
+    if (lastActive === null || compareColdParkRecencyDesc(candidate, lastActive) < 0) {
       lastActive = candidate
     }
   }
@@ -221,8 +235,7 @@ function selectLastActiveRetainedId(candidates: ColdParkRetainCandidate[]): stri
 
 // Why: hot-retain keeps the most recently hidden ids warm up to the limit;
 // ids hidden past hotRetainMs or beyond the limit cold-park. The last-active
-// id is exempt from both so returning to it never pays a remount. Ties sort by
-// id so the selection is deterministic.
+// id is exempt from both so returning to it never pays a remount.
 export function selectIdsBeyondHotRetain(
   candidates: ColdParkRetainCandidate[],
   args: { nowMs: number; hotRetainMs: number; hotRetainLimit: number }
@@ -240,10 +253,7 @@ export function selectIdsBeyondHotRetain(
       retainedCandidates.push(candidate)
     }
   }
-  retainedCandidates.sort((a, b) => {
-    const recencyDelta = b.hiddenSinceMs - a.hiddenSinceMs
-    return recencyDelta === 0 ? a.id.localeCompare(b.id) : recencyDelta
-  })
+  retainedCandidates.sort(compareColdParkRecencyDesc)
   // Why: the last-active id already holds one slot in the warm working set, so
   // the cap counts it out — the remaining candidates fill hotRetainLimit-1.
   const remainingLimit = lastActiveId === null ? args.hotRetainLimit : args.hotRetainLimit - 1
@@ -322,7 +332,11 @@ export function selectColdParkedTerminalTabs(
     ) {
       continue
     }
-    candidates.push({ id: tab.id, hiddenSinceMs: tab.hiddenSinceMs })
+    candidates.push({
+      id: tab.id,
+      hiddenSinceMs: tab.hiddenSinceMs,
+      lastActivatedSeq: tab.lastActivatedSeq
+    })
   }
   return selectIdsBeyondHotRetain(candidates, {
     nowMs: args.nowMs,
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-kitty-commit-encoding.ts b/src/renderer/src/components/terminal-pane/terminal-ime-kitty-commit-encoding.ts
index c47b77f53fa..df4d015fb6b 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-kitty-commit-encoding.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-kitty-commit-encoding.ts
@@ -10,12 +10,17 @@ import { KittyKeyboard } from '@xterm/xterm/src/common/input/KittyKeyboard'
  */
 const KITTY_REPORT_ALL_KEYS_AS_ESCAPE_CODES = 0b1000
 
+/** `report_event_types`. The only flag that makes a printable press owe a release. */
+const KITTY_REPORT_EVENT_TYPES = 0b0010
+
 /**
- * `KittyKeyboardEventType.PRESS` / `.REPEAT`. Inlined because the upstream enum is a
- * `const enum`, which does not survive an import across module boundaries.
+ * `KittyKeyboardEventType.PRESS` / `.REPEAT` / `.RELEASE`. Inlined because the
+ * upstream enum is a `const enum`, which does not survive an import across
+ * module boundaries.
  */
 const KITTY_EVENT_TYPE_PRESS = 1
 const KITTY_EVENT_TYPE_REPEAT = 2
+const KITTY_EVENT_TYPE_RELEASE = 3
 
 const kittyKeyboardEncoder = new KittyKeyboard()
 
@@ -28,17 +33,70 @@ export type ImeCommitKeyPress = {
   repeat?: boolean
 }
 
+/**
+ * The matching physical release, read from the actual `keyup`.
+ *
+ * Why not reuse the press's fields: macOS lets Shift come up first, and the
+ * browser then reports the printable keyup with the UNSHIFTED `key` and
+ * `shiftKey: false`. Encoding that release from the press's shifted fields
+ * would report a modifier the app no longer holds.
+ */
+export type ImeReleaseKeyEvent = {
+  key: string
+  code?: string
+  shiftKey: boolean
+  ctrlKey?: boolean
+  altKey?: boolean
+  metaKey?: boolean
+}
+
+/**
+ * Opaque proof that a delivered press/repeat owes a release report, carrying
+ * the flags read at commit time. Only `encodeImeReleaseForKitty` interprets it:
+ * the forwarder must never re-test event-type bits or rebuild CSI-u itself.
+ */
+export type ImeCommitReleaseObligation = { readonly flags: number }
+
+export type ImeCommitKittyEncoding = {
+  /** CSI-u press/repeat report, or null when the commit goes out as raw text. */
+  report: string | null
+  /** Non-null when the commit-time flags requested press/repeat/release events. */
+  release: ImeCommitReleaseObligation | null
+}
+
+function evaluateKittyReport(
+  press: { key: string; code?: string; shiftKey: boolean },
+  modifiers: { ctrlKey?: boolean; altKey?: boolean; metaKey?: boolean },
+  kittyKeyboardFlags: number,
+  eventType: number
+): string | null {
+  const encoded = kittyKeyboardEncoder.evaluate(
+    {
+      type: eventType === KITTY_EVENT_TYPE_RELEASE ? 'keyup' : 'keydown',
+      key: press.key,
+      code: press.code ?? '',
+      keyCode: 0,
+      shiftKey: press.shiftKey,
+      altKey: modifiers.altKey === true,
+      ctrlKey: modifiers.ctrlKey === true,
+      metaKey: modifiers.metaKey === true
+    },
+    kittyKeyboardFlags,
+    eventType
+  )
+  return encoded.key ?? null
+}
+
 /**
  * A pane that negotiated bit 3 asked for every printable key as a CSI-u report,
  * so writing IME-committed text raw hands it the legacy byte stream it declined.
  * Re-encode the press that produced the commit instead.
  *
- * The gate is bit 3 ALONE. "Kitty is active" and `flags !== 0` are both wrong:
- * a pane negotiating only disambiguation or event types still expects printable
- * keys as text, and encoding there would drop every substituted character.
- *
- * Returns null when the commit should be written raw, which is every case except
- * bit 3.
+ * The gate is bit 3 ALONE for the press. "Kitty is active" and `flags !== 0` are
+ * both wrong: a pane negotiating only disambiguation or event types still
+ * expects printable keys as text, and encoding there would drop every
+ * substituted character. Bit 1 (`report_event_types`) is independent — it makes
+ * even a raw-text commit owe exactly one release report.
  *
  * Known limit: the report carries the *physical* key's codepoint, not the
  * committed glyph — bit 3 is the app declaring it does not want text, and bit 4
@@ -46,31 +104,65 @@ export type ImeCommitKeyPress = {
  * derives that text field from the same `key` it derives the keycode from, so
  * carrying the committed glyph under bit 4 needs an encoder change, not a flag.
  */
-export function encodeImeCommitAsKittyReport(
+export function encodeImeCommitForKitty(
   press: ImeCommitKeyPress | null,
   kittyKeyboardFlags: number
+): ImeCommitKittyEncoding {
+  if (!press) {
+    return { report: null, release: null }
+  }
+  const report =
+    (kittyKeyboardFlags & KITTY_REPORT_ALL_KEYS_AS_ESCAPE_CODES) === 0
+      ? null
+      : evaluateKittyReport(
+          press,
+          // Why: the forwarder only claims presses with no control chord, so the
+          // modifier fields are known-false rather than read from a live event.
+          {},
+          kittyKeyboardFlags,
+          // Why: a held key emits repeated keydowns, and the protocol reports those as REPEAT.
+          // Defaulting them all to PRESS would make one held key look like N separate strikes to
+          // an app that counts presses or filters repeats.
+          press.repeat === true ? KITTY_EVENT_TYPE_REPEAT : KITTY_EVENT_TYPE_PRESS
+        )
+  return {
+    report,
+    release:
+      (kittyKeyboardFlags & KITTY_REPORT_EVENT_TYPES) === 0 ? null : { flags: kittyKeyboardFlags }
+  }
+}
+
+/**
+ * Resolve a press's release obligation against the physical `keyup` that
+ * actually settled it. Returns null when no release report is owed anymore.
+ */
+export function encodeImeReleaseForKitty(
+  obligation: ImeCommitReleaseObligation,
+  release: ImeReleaseKeyEvent,
+  context: {
+    /** The claimed press's identity, for keyups whose `key` an input source rewrote. */
+    press?: { key: string; code?: string }
+    /** The pane's flags at RELEASE time, deciding whether a release is still wanted. */
+    currentKittyKeyboardFlags: number
+  }
 ): string | null {
-  if ((kittyKeyboardFlags & KITTY_REPORT_ALL_KEYS_AS_ESCAPE_CODES) === 0 || !press) {
+  // Why the current-flags gate: the app can pop kitty mode between commit and
+  // keyup (a TUI quitting on the pressed key). xterm suppresses releases the
+  // moment `report_event_types` is gone — match it so the successor process
+  // never receives CSI-u bytes it did not negotiate. The report itself still
+  // encodes under the commit-time flags so the press/release pair stays
+  // consistent.
+  if ((context.currentKittyKeyboardFlags & KITTY_REPORT_EVENT_TYPES) === 0) {
     return null
   }
-  // Why: the forwarder only claims presses with no control chord, so the
-  // modifier fields are known-false rather than read from a live event.
-  const encoded = kittyKeyboardEncoder.evaluate(
-    {
-      type: 'keydown',
-      key: press.key,
-      code: press.code ?? '',
-      keyCode: 0,
-      shiftKey: press.shiftKey,
-      altKey: false,
-      ctrlKey: false,
-      metaKey: false
-    },
-    kittyKeyboardFlags,
-    // Why: a held key emits repeated keydowns, and the protocol reports those as REPEAT.
-    // Defaulting them all to PRESS would make one held key look like N separate strikes to
-    // an app that counts presses or filters repeats.
-    press.repeat === true ? KITTY_EVENT_TYPE_REPEAT : KITTY_EVENT_TYPE_PRESS
-  )
-  return encoded.key ?? null
+  // Why the key fallback: an input source can rewrite the keyup's `key`
+  // ('Process' after a source switch mid-hold) while `code` still matches the
+  // press; xterm's evaluate finds no encodable key there and would silently
+  // drop the release, leaving the app with the key held forever. The keyup's
+  // own single-char `key` wins (Shift-up-first correctly reports unshifted).
+  const releaseKey =
+    release.key.length === 1 || context.press === undefined
+      ? release
+      : { ...release, key: context.press.key, code: context.press.code ?? release.code }
+  return evaluateKittyReport(releaseKey, release, obligation.flags, KITTY_EVENT_TYPE_RELEASE)
 }
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.ts b/src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.ts
index 5594bcb3cbe..525a8d2b12a 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.ts
@@ -118,7 +118,7 @@ function isPlainAsciiDigitKey(event: XtermBypassEvent): boolean {
 /** Tracks legacy desktop Linux IME candidate-selection event sequences. */
 export function createTerminalImeLinuxCandidateState(
   now: () => number = () => Date.now(),
-  pendingPlainLetterKeydownsByCode: Set<string> = new Set()
+  pendingPlainLetterKeydownsByCode = new Set<string>()
 ): TerminalImeLinuxCandidateState {
   let candidateDigitUntil = 0
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts
index 2894df2e2be..ef758edf22a 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts
@@ -180,10 +180,10 @@ describe('installTerminalImeNativeTextForwarder', () => {
       )
       dispatchInsertText(textarea, 'á')
 
-      // The keypress is what must be suppressed (it would double-send the ASCII 'a').
-      // The keyup is not: 'á' reached the pty, so the app is owed the matching release.
+      // The keypress must be suppressed (it would double-send the ASCII 'a'), and so must the
+      // keyup — the forwarder owns the whole claimed lifecycle and emits any owed release itself.
       expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: 'a', code: 'KeyA' }))).toBe(
-        false
+        true
       )
       expect(sendInput).toHaveBeenCalledExactlyOnceWith('á')
     })
@@ -273,13 +273,15 @@ describe('installTerminalImeNativeTextForwarder', () => {
     })
 
     // An app that negotiated kitty `report_event_types` expects a release for every press it
-    // received. The claim now takes every printable keydown, so swallowing the keyup
-    // unconditionally would drop the release for ordinary typing and leave keys stuck down.
-    it('lets the keyup through once the press has reached the pty, so its release still fires', () => {
+    // received, but xterm's own kitty state is defensively reset while the application tracker
+    // stays active — so the forwarder keeps the keyup and encodes the release from the flags it
+    // read at commit time rather than delegating either decision to xterm.
+    it('keeps the keyup inside the forwarder once the press has reached the pty', () => {
       const { forwarder, sendInput } = install()
       expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
       dispatchInsertText(textarea, '，')
-      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: ',' }))).toBe(false)
+      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: ',' }))).toBe(true)
+      // Flags default to 0 here: no event types negotiated, so no release is owed.
       expect(sendInput).toHaveBeenCalledExactlyOnceWith('，')
     })
 
@@ -292,6 +294,35 @@ describe('installTerminalImeNativeTextForwarder', () => {
       expect(sendInput).not.toHaveBeenCalled()
     })
 
+    it('keeps the claim armed across a bare modifier keydown before the commit lands', () => {
+      // Fast typing: ',' is pressed and released, then Shift goes down for the
+      // NEXT character while the text system is still delivering '，'.
+      const { forwarder, sendInput } = install()
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
+      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: ',' }))).toBe(true)
+      expect(
+        forwarder.claimKeyEvent(keyEvent({ key: 'Shift', code: 'ShiftLeft', shiftKey: true }))
+      ).toBe(false)
+      dispatchInsertText(textarea, '，')
+      expect(sendInput).toHaveBeenCalledExactlyOnceWith('，')
+    })
+
+    it('lets a chorded keyup reach xterm after a fresh chorded press of the same key', () => {
+      const { forwarder, sendInput } = install()
+      // A claimed press whose input never arrived and whose keyup was swallowed
+      // elsewhere leaves a tombstone behind.
+      expect(forwarder.claimKeyEvent(keyEvent({ key: 'n', code: 'KeyN' }))).toBe(true)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: 'x', code: 'KeyX' }))).toBe(true)
+      // Ctrl+N is xterm's press; its keyup must not be eaten by the stale tombstone.
+      expect(forwarder.claimKeyEvent(keyEvent({ key: 'n', code: 'KeyN', ctrlKey: true }))).toBe(
+        false
+      )
+      expect(
+        forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: 'n', code: 'KeyN', ctrlKey: true }))
+      ).toBe(false)
+      expect(sendInput).not.toHaveBeenCalled()
+    })
+
     it('releases the claim on blur', () => {
       const { forwarder, sendInput } = install()
       forwarder.claimKeyEvent(keyEvent({ key: ',' }))
@@ -396,6 +427,55 @@ describe('installTerminalImeNativeTextForwarder', () => {
       expect(sendInput).not.toHaveBeenCalled()
     })
 
+    it('emits the owed release before a same-key re-claim when the input event never came', () => {
+      const { forwarder, sendInput } = installWithFlags(() => 0b1010)
+      // The first press delivers and owes a release.
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
+      dispatchInsertText(textarea, '，')
+      // An auto-repeat claim whose text the input source swallows absorbs the
+      // eventual keyup; the next fresh press must settle that owed release
+      // instead of deleting the record that holds it.
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',', repeat: true }))).toBe(true)
+      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: ',' }))).toBe(true)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
+      expect(sendInput.mock.calls.map((call) => call[0])).toEqual(['\x1b[44u', '\x1b[44;1:3u'])
+    })
+
+    it('settles an owed release before a fresh same-key press after a lost keyup', () => {
+      const { forwarder, sendInput } = installWithFlags(() => 0b1010)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',', code: 'Comma' }))).toBe(true)
+      dispatchInsertText(textarea, '，')
+
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',', code: 'Comma' }))).toBe(true)
+      expect(sendInput.mock.calls.map((call) => call[0])).toEqual(['\x1b[44u', '\x1b[44;1:3u'])
+    })
+
+    it('suppresses the owed release when the app popped kitty mode before the keyup', () => {
+      // A TUI that quits on the pressed key pops its negotiation before the
+      // keyup; a CSI-u release would land in the successor shell as junk.
+      let flags = 0b1010
+      const { forwarder, sendInput } = installWithFlags(() => flags)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: 'q', code: 'KeyQ' }))).toBe(true)
+      dispatchInsertText(textarea, 'q')
+      flags = 0
+      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: 'q', code: 'KeyQ' }))).toBe(
+        true
+      )
+      expect(sendInput).toHaveBeenCalledExactlyOnceWith('\x1b[113u')
+    })
+
+    it('encodes the release from the press when an input source rewrote the keyup key', () => {
+      const { forwarder, sendInput } = installWithFlags(() => 0b1010)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
+      dispatchInsertText(textarea, '，')
+      // Chromium reports 'Process' for IME-owned keys after a source switch
+      // mid-hold; `code` still identifies the physical press.
+      expect(
+        forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: 'Process', code: 'Comma' }))
+      ).toBe(true)
+      expect(sendInput.mock.calls.map((call) => call[0])).toEqual(['\x1b[44u', '\x1b[44;1:3u'])
+    })
+
     it('writes the commit raw when the caller tracks no flags at all', () => {
       // The preview bridge installs the forwarder with no pane to negotiate with.
       const sendInput = vi.fn()
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.ts b/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.ts
index c200e3c04e7..e077a5df3d9 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.ts
@@ -1,5 +1,10 @@
 import type { IDisposable } from '@xterm/xterm'
-import { encodeImeCommitAsKittyReport } from './terminal-ime-kitty-commit-encoding'
+import {
+  encodeImeCommitForKitty,
+  encodeImeReleaseForKitty,
+  type ImeCommitReleaseObligation,
+  type ImeReleaseKeyEvent
+} from './terminal-ime-kitty-commit-encoding'
 
 // Why: a plain printable keydown never produces terminal bytes. Bytes for
 // printable characters come only from the `input` event, which on macOS *is*
@@ -18,6 +23,38 @@ type ClaimedKeyPress = {
   repeat?: boolean
 }
 
+/** A claimed press waiting for its `insertText`, plus an early keyup if one already landed. */
+type PendingCommit = {
+  press: ClaimedKeyPress
+  /** Non-null when `keyup` preceded `insertText` — an order some macOS IMEs use. */
+  keyup: ImeReleaseKeyEvent | null
+}
+
+/**
+ * What a claimed physical key still owes once its commit settled. A non-null
+ * `obligation` is an encoder-owned release report; a null one is a tombstone
+ * that only keeps the matching keyup away from xterm for a press the app
+ * never received.
+ */
+type ClaimedKeyRecord = {
+  key: string
+  code?: string
+  obligation: ImeCommitReleaseObligation | null
+}
+
+// Bare modifier keydowns produce no terminal bytes and legitimately interleave
+// between a claimed press and its commit (Shift pressed for the NEXT character
+// before the text system delivers this one's `insertText`).
+const MODIFIER_KEYDOWN_KEYS = new Set([
+  'Shift',
+  'Control',
+  'Alt',
+  'Meta',
+  'CapsLock',
+  'AltGraph',
+  'Fn'
+])
+
 export type ImeNativeTextKeyEvent = {
   type: string
   key: string
@@ -76,13 +113,21 @@ function isNativeTextKeydown(event: ImeNativeTextKeyEvent, compositionActive: bo
   )
 }
 
-function matchesClaimedPress(event: ImeNativeTextKeyEvent, claimedPress: ClaimedKeyPress): boolean {
+function matchesClaimedPress(
+  event: ImeNativeTextKeyEvent,
+  claimedPress: { key: string; code?: string }
+): boolean {
   if (event.code && claimedPress.code) {
     return event.code === claimedPress.code
   }
   return event.key === claimedPress.key
 }
 
+/** Different held keys coexist, so records are keyed by physical identity. */
+function claimedKeyId(press: { key: string; code?: string }): string {
+  return press.code ?? press.key
+}
+
 export function installTerminalImeNativeTextForwarder(args: {
   terminalElement: HTMLElement | null | undefined
   isComposing: () => boolean
@@ -102,11 +147,64 @@ export function installTerminalImeNativeTextForwarder(args: {
   }
 
   const terminalElement = args.terminalElement
-  let pendingForward = false
   let compositionTransactionPending = false
-  let claimedPress: ClaimedKeyPress | null = null
-  /** Whether the claimed press actually reached the pty, which decides if its release does. */
-  let forwardedPressBytes = false
+  let pendingCommit: PendingCommit | null = null
+  // Why keyed rather than a single slot: rollover and auto-repeat can leave one
+  // key still held while the next one commits, and each held key owes its own
+  // single release.
+  const claimedKeyRecords = new Map<string, ClaimedKeyRecord>()
+
+  const findClaimedRecordId = (event: ImeNativeTextKeyEvent): string | null => {
+    const direct = claimedKeyId(event)
+    if (claimedKeyRecords.has(direct)) {
+      return direct
+    }
+    for (const [id, record] of claimedKeyRecords) {
+      if (matchesClaimedPress(event, record)) {
+        return id
+      }
+    }
+    return null
+  }
+
+  /** Emits at most one release for a claimed press; xterm emits none for it. */
+  const settleRelease = (recordId: string, release: ImeReleaseKeyEvent): void => {
+    const record = claimedKeyRecords.get(recordId)
+    claimedKeyRecords.delete(recordId)
+    if (!record?.obligation) {
+      return
+    }
+    const report = encodeImeReleaseForKitty(record.obligation, release, {
+      press: { key: record.key, code: record.code },
+      currentKittyKeyboardFlags: args.getKittyKeyboardFlags?.() ?? 0
+    })
+    if (report) {
+      args.sendInput(report)
+    }
+  }
+
+  /**
+   * Move a claimed press out of awaiting-commit state. A fresh obligation is
+   * upserted; a repeat or cancellation that produced none must not erase one an
+   * earlier delivered press already owed.
+   */
+  const settleCommit = (
+    commit: PendingCommit,
+    obligation: ImeCommitReleaseObligation | null
+  ): void => {
+    const recordId = claimedKeyId(commit.press)
+    const existing = claimedKeyRecords.get(recordId)
+    if (obligation || !existing) {
+      claimedKeyRecords.set(recordId, {
+        key: commit.press.key,
+        code: commit.press.code,
+        obligation: obligation ?? existing?.obligation ?? null
+      })
+    }
+    if (commit.keyup) {
+      settleRelease(recordId, commit.keyup)
+    }
+  }
 
   const markCompositionTransactionAccepted = (): void => {
     compositionTransactionPending = true
@@ -118,44 +216,85 @@ export function installTerminalImeNativeTextForwarder(args: {
 
   const claimKeyEvent = (event: ImeNativeTextKeyEvent): boolean => {
     if (event.type === 'keydown') {
+      if (pendingCommit && matchesClaimedPress(event, pendingCommit.press)) {
+        // The same key pressed again while its claim still awaits `input`:
+        // settle first so an absorbed early keyup's owed release is emitted
+        // rather than silently overwritten.
+        settleCommit(pendingCommit, null)
+        pendingCommit = null
+      } else if (pendingCommit && !MODIFIER_KEYDOWN_KEYS.has(event.key)) {
+        // Why: retiring here is also what drops a stale claim whose input event
+        // never arrived (the input source swallowed the key) — no timer needed.
+        // It leaves a tombstone so the stale press's keyup still cannot reach
+        // xterm, which never saw its keydown. Bare modifier keydowns are
+        // exempt: they precede a still-inbound commit during fast typing and
+        // must not retire the claim it belongs to.
+        settleCommit(pendingCommit, null)
+        pendingCommit = null
+      }
+      if (event.repeat !== true) {
+        // Why: a fresh same-key press proves the prior press ended; settle its owed release first.
+        const staleRecordId = findClaimedRecordId(event)
+        if (staleRecordId !== null) {
+          settleRelease(staleRecordId, {
+            key: event.key,
+            code: event.code,
+            shiftKey: event.shiftKey === true,
+            ctrlKey: event.ctrlKey,
+            altKey: event.altKey,
+            metaKey: event.metaKey
+          })
+        }
+      }
       if (!isNativeTextKeydown(event, args.isComposing())) {
         return false
       }
-      // Why: re-arming here is also what drops a stale claim whose input event
-      // never arrived (the input source swallowed the key) — no timer needed.
-      pendingForward = true
-      forwardedPressBytes = false
-      claimedPress = {
-        key: event.key,
-        code: event.code,
-        shiftKey: event.shiftKey === true,
-        repeat: event.repeat === true
+      pendingCommit = {
+        press: {
+          key: event.key,
+          code: event.code,
+          shiftKey: event.shiftKey === true,
+          repeat: event.repeat === true
+        },
+        keyup: null
       }
       return true
     }
-    if (!claimedPress) {
-      return false
-    }
-    if (event.ctrlKey || event.altKey || event.metaKey || event.isComposing === true) {
-      return false
-    }
     if (event.type === 'keyup') {
-      if (!matchesClaimedPress(event, claimedPress)) {
+      if (pendingCommit && matchesClaimedPress(event, pendingCommit.press)) {
+        // Copy the release's own fields: the commit has not happened yet, and
+        // the encoder needs the modifier state as of the actual release.
+        pendingCommit.keyup = {
+          key: event.key,
+          code: event.code,
+          shiftKey: event.shiftKey === true,
+          ctrlKey: event.ctrlKey,
+          altKey: event.altKey,
+          metaKey: event.metaKey
+        }
+        return true
+      }
+      const recordId = findClaimedRecordId(event)
+      if (recordId === null) {
         return false
       }
-      const pressReachedThePty = forwardedPressBytes
-      claimedPress = null
-      forwardedPressBytes = false
-      // Why: a release report describes a press the app received. Suppress it only when
-      // this press put nothing on the wire — swallowed by the input source, or owned by a
-      // composition transaction. Suppressing unconditionally would drop the kitty release
-      // for ordinary typing, because the structural claim takes every printable keydown
-      // rather than the short punctuation list the previous design claimed.
-      return !pressReachedThePty
+      // Why the forwarder owns this instead of returning false: xterm's kitty
+      // state is defensively reset while the application tracker stays active,
+      // so delegating the release would either lose it or emit it under flags
+      // the app never negotiated.
+      settleRelease(recordId, {
+        key: event.key,
+        code: event.code,
+        shiftKey: event.shiftKey === true,
+        ctrlKey: event.ctrlKey,
+        altKey: event.altKey,
+        metaKey: event.metaKey
+      })
+      return true
     }
     // Keep the keydown's armed state but still bypass xterm so it does not
     // double-send printable text before our input forward runs.
-    return event.type === 'keypress'
+    return event.type === 'keypress' && pendingCommit !== null
   }
 
   const forwardCommittedText = (event: Event): void => {
@@ -165,24 +304,33 @@ export function installTerminalImeNativeTextForwarder(args: {
     // Why: an accepted composition transaction already owns its commit; letting
     // it through here would send the text a second time.
     if (compositionTransactionPending && event.inputType === 'insertText') {
-      pendingForward = false
+      if (pendingCommit) {
+        settleCommit(pendingCommit, null)
+        pendingCommit = null
+      }
       event.stopImmediatePropagation()
       return
     }
-    if (!pendingForward) {
+    const commit = pendingCommit
+    if (!commit) {
       return
     }
-    pendingForward = false
+    pendingCommit = null
     if (event.inputType !== 'insertText') {
+      // A non-text input takes the press over; it delivered nothing, so only the
+      // keyup suppression survives.
+      settleCommit(commit, null)
       return
     }
     if (event.data) {
-      const kittyReport = encodeImeCommitAsKittyReport(
-        claimedPress,
-        args.getKittyKeyboardFlags?.() ?? 0
-      )
-      args.sendInput(kittyReport ?? event.data)
-      forwardedPressBytes = true
+      // Read the mutable flags EXACTLY once, here: kitty state can change
+      // between keydown and commit, and the release must describe the same
+      // negotiation the press was encoded under.
+      const encoding = encodeImeCommitForKitty(commit.press, args.getKittyKeyboardFlags?.() ?? 0)
+      args.sendInput(encoding.report ?? event.data)
+      settleCommit(commit, encoding.release)
+    } else {
+      settleCommit(commit, null)
     }
     event.stopImmediatePropagation()
     // Clear the helper textarea so the committed text doesn't accumulate.
@@ -191,11 +339,13 @@ export function installTerminalImeNativeTextForwarder(args: {
     }
   }
 
+  // Blur and disposal drop every record without synthesizing bytes: the app
+  // stops receiving this element's keys entirely, so an invented release would
+  // describe a press it can no longer correlate.
   const cancelPending = (): void => {
-    pendingForward = false
-    forwardedPressBytes = false
     compositionTransactionPending = false
-    claimedPress = null
+    pendingCommit = null
+    claimedKeyRecords.clear()
   }
 
   terminalElement.addEventListener(
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts
index 267c7a61093..d23d2858eb6 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts
@@ -195,10 +195,8 @@ describe('input-source text substitution reaches the terminal', () => {
   describe.each([
     ['none', 0],
     ['disambiguate', 1],
-    ['event types', 2],
     ['alternate keys', 4],
     ['disambiguate + alternate keys', 5],
-    ['disambiguate + event types + alternate keys', 7],
     // Bit 4 asks for associated text, which only decorates a report bit 3 would already have
     // produced — on its own it does not turn a printable key into one.
     ['associated text', 16]
@@ -208,13 +206,23 @@ describe('input-source text substitution reaches the terminal', () => {
     })
   })
 
+  // Bit 1 (`report_event_types`) is orthogonal to bit 3: the press stays raw substituted text,
+  // but the app asked to be told when the key came back up, and the forwarder owns that keyup.
+  describe.each([
+    ['event types', 2],
+    ['disambiguate + event types + alternate keys', 7]
+  ])('with kitty flags %s (%d) negotiated', (_name, flags) => {
+    it('sends the substituted character raw followed by one CSI-u release', () => {
+      expect(type([COMMA], flags)).toBe('，\x1b[44;1:3u')
+    })
+  })
+
   // Bit 3 is `report_all_keys_as_escape_codes`: the app asked for every printable key as a CSI-u
   // report, so committing raw UTF-8 hands it a byte stream it declined. Re-encode the press that
   // produced the commit. This is not CJK-specific — it is every printable key in such a pane.
   describe.each([
     ['all keys as escape codes', 8],
-    ['all keys + disambiguate', 9],
-    ['all keys + disambiguate + event types + alternate keys', 15]
+    ['all keys + disambiguate', 9]
   ])('with kitty flags %s (%d) negotiated', (_name, flags) => {
     it('sends a CSI-u report for the physical key instead of the substituted character', () => {
       // `,` is the physical Comma key; U+002C is 44. The committed `，` is deliberately absent —
@@ -224,6 +232,10 @@ describe('input-source text substitution reaches the terminal', () => {
     })
   })
 
+  it('pairs the CSI-u press with exactly one release when event types are also negotiated', () => {
+    expect(type([COMMA], 15)).toBe('\x1b[44u\x1b[44;1:3u')
+  })
+
   it('reports the physical key as the associated text under bit 3 + bit 4, not the substitution', () => {
     // Pins the limit named in terminal-ime-kitty-commit-encoding.ts: bit 4 is where the committed
     // glyph U+FF0C (65292) would ride, and 44 shows up in that slot instead. Closing that needs the
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
index d43702057f1..7ca537b014d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
@@ -44,7 +44,7 @@ function omitLeafRecord(
   source: Record<string, string> | undefined,
   leafId: string
 ): Record<string, string> | undefined {
-  if (!source || !Object.prototype.hasOwnProperty.call(source, leafId)) {
+  if (!source || !Object.hasOwn(source, leafId)) {
     return source
   }
   const next = { ...source }
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
index bd780e89495..9f21c39056b 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
@@ -51,7 +51,7 @@ function remapLeafRecord(
 
 function collectLeafCounts(
   node: TerminalPaneLayoutNode,
-  counts: Map<string, number> = new Map()
+  counts = new Map<string, number>()
 ): Map<string, number> {
   if (node.type === 'leaf') {
     counts.set(node.leafId, (counts.get(node.leafId) ?? 0) + 1)
@@ -73,7 +73,7 @@ function hasLeafPtyBinding(
   ptyIdsByLeafId: Record<string, string> | undefined,
   leafId: string
 ): boolean {
-  return ptyIdsByLeafId ? Object.prototype.hasOwnProperty.call(ptyIdsByLeafId, leafId) : false
+  return ptyIdsByLeafId ? Object.hasOwn(ptyIdsByLeafId, leafId) : false
 }
 
 export function resolveRootlessTerminalLayoutLeafId(
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts b/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
index f0742328240..4c44c3e6ead 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
@@ -105,7 +105,7 @@ function coalesceLeafRecord(
       continue
     }
     const retainedLeafId = resolveRetainedLeafId(removedLeafId, retainedLeafIdByRemovedLeafId)
-    if (!Object.prototype.hasOwnProperty.call(retained, retainedLeafId)) {
+    if (!Object.hasOwn(retained, retainedLeafId)) {
       retained[retainedLeafId] = value
     }
   }
@@ -113,7 +113,7 @@ function coalesceLeafRecord(
 }
 
 function hasLeafRecordValue(source: Record<string, string> | undefined, leafId: string): boolean {
-  return Boolean(source && Object.prototype.hasOwnProperty.call(source, leafId))
+  return Boolean(source && Object.hasOwn(source, leafId))
 }
 
 function coalesceScrollbackRecords(
@@ -225,7 +225,7 @@ function resolveOwnedActiveLeafId(
   ptyIdsByLeafId: Record<string, string> | undefined
 ): string | null {
   const hasBinding = (leafId: string): boolean =>
-    Boolean(ptyIdsByLeafId && Object.prototype.hasOwnProperty.call(ptyIdsByLeafId, leafId))
+    Boolean(ptyIdsByLeafId && Object.hasOwn(ptyIdsByLeafId, leafId))
   if (rootLeafIds.length === 0) {
     const boundLeafIds = Object.keys(ptyIdsByLeafId ?? {})
     if (activeLeafId) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts b/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
index 5535e7bde9f..8350ec17fec 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
@@ -1,5 +1,8 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing'
+import {
+  registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener
+} from '@/lib/http-link-routing'
 import {
   closeTerminalLinkActionRequest,
   requestTerminalLinkAction,
@@ -12,6 +15,7 @@ import { handleTerminalHttpLink } from './terminal-url-link-hit-testing'
 const openUrl = vi.fn()
 const createBrowserTab = vi.fn()
 const setActiveWorktree = vi.fn()
+const openRuntimeBrowserTab = vi.fn(() => Promise.resolve())
 
 function plainEvent(): MouseEvent {
   return {
@@ -44,9 +48,11 @@ beforeEach(() => {
     setActiveWorktree,
     createBrowserTab
   }))
+  registerRuntimeHttpLinkBrowserOpener(openRuntimeBrowserTab)
 })
 
 afterEach(() => {
+  registerRuntimeHttpLinkBrowserOpener(null)
   vi.clearAllMocks()
   vi.unstubAllGlobals()
 })
@@ -181,6 +187,28 @@ describe('terminal link action routing', () => {
     expect(request.mock.calls[0][0].alternate).toBeUndefined()
   })
 
+  it('routes an explicit Orca Browser action to the owning runtime', () => {
+    const request = vi.fn()
+
+    handleTerminalHttpLink('https://example.com/path', plainEvent(), {
+      worktreeId: 'wt-1',
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' },
+      linkActionContext: actionContext(request),
+      actionDestinations: { primary: 'system', alternate: 'orca' }
+    })
+
+    request.mock.calls[0][0].primary.run()
+    expect(openUrl).toHaveBeenCalledWith('https://example.com/path')
+    request.mock.calls[0][0].alternate.run()
+    expect(openRuntimeBrowserTab).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: 'https://example.com/path',
+      intent: { kind: 'url' },
+      expectedRuntimeEnvironmentId: 'env-1'
+    })
+    expect(createBrowserTab).not.toHaveBeenCalled()
+  })
+
   it('uses Shift+modifier for the alternate local destination', () => {
     const event = { ...plainEvent(), metaKey: true, shiftKey: true }
 
@@ -195,6 +223,19 @@ describe('terminal link action routing', () => {
     expect(openUrl).not.toHaveBeenCalled()
   })
 
+  it('keeps Shift+modifier on the only capability-backed destination', () => {
+    const event = { ...plainEvent(), metaKey: true, shiftKey: true }
+
+    handleTerminalHttpLink('https://example.com/path', event, {
+      worktreeId: 'wt-1',
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' },
+      actionDestinations: { primary: 'system' }
+    })
+
+    expect(openUrl).toHaveBeenCalledWith('https://example.com/path')
+    expect(openRuntimeBrowserTab).not.toHaveBeenCalled()
+  })
+
   it('exposes the actual hidden OSC 8 destination', () => {
     const request = vi.fn()
     const destination = 'https://example.com'
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts b/src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts
index 801eec81c98..514f36aad6d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts
@@ -1,5 +1,9 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { getTerminalUrlOpenHint, terminalUrlOpenHintOptionsFor } from './terminal-link-open-hints'
+import {
+  getTerminalUrlOpenHint,
+  terminalHttpLinkActionDestinationsFor,
+  terminalUrlOpenHintOptionsFor
+} from './terminal-link-open-hints'
 
 function stubPlatform(isMac: boolean): void {
   vi.stubGlobal('navigator', { userAgent: isMac ? 'Mac OS X' : 'Windows NT 10.0' })
@@ -138,4 +142,42 @@ describe('terminalUrlOpenHintOptionsFor', () => {
     expect(options.modifierInverts).toBe(true)
     expect(getTerminalUrlOpenHint(options)).toContain('to open in Orca')
   })
+
+  it('keeps inversion for a runtime pane when its host can open an Orca browser', () => {
+    const options = terminalUrlOpenHintOptionsFor(
+      {
+        openLinksInApp: false,
+        openLinksInAppModifierInverts: true
+      },
+      { kind: 'runtime', runtimeEnvironmentId: 'env-1' },
+      true
+    )
+
+    expect(options.modifierInverts).toBe(true)
+  })
+})
+
+describe('terminalHttpLinkActionDestinationsFor', () => {
+  it('offers both destinations for a capable runtime and follows the preference', () => {
+    const owner = { kind: 'runtime', runtimeEnvironmentId: 'env-1' } as const
+
+    expect(terminalHttpLinkActionDestinationsFor({ openLinksInApp: true }, owner, true)).toEqual({
+      primary: 'orca',
+      alternate: 'system'
+    })
+    expect(terminalHttpLinkActionDestinationsFor({ openLinksInApp: false }, owner, true)).toEqual({
+      primary: 'system',
+      alternate: 'orca'
+    })
+  })
+
+  it.each([
+    ['incapable runtime', { kind: 'runtime', runtimeEnvironmentId: 'env-1' } as const],
+    ['SSH', { kind: 'ssh', connectionId: 'ssh-1' } as const],
+    ['unknown owner', { kind: 'unknown' } as const]
+  ])('offers only the system browser for an %s', (_label, owner) => {
+    expect(terminalHttpLinkActionDestinationsFor({ openLinksInApp: true }, owner, false)).toEqual({
+      primary: 'system'
+    })
+  })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-open-hints.ts b/src/renderer/src/components/terminal-pane/terminal-link-open-hints.ts
index e1a5f4ff81f..7820f28341f 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-open-hints.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-open-hints.ts
@@ -1,4 +1,5 @@
 import type { HttpLinkSourceOwner } from '@/lib/http-link-routing'
+import type { TerminalHttpLinkActionDestinations } from './terminal-url-link-hit-testing'
 
 export function isMacPlatform(): boolean {
   return navigator.userAgent.includes('Mac')
@@ -36,10 +37,22 @@ export type TerminalUrlOpenHintOptions = {
   showActions?: boolean
 }
 
-// Why: openHttpLink only routes to Orca when the source is local, so a remote pane
-// pins every link to the system browser and inverting cannot reach Orca there. The
-// clicked pane's owner decides that, not the global active runtime — a workspace-bound
-// remote pane is remote even when no runtime is globally active.
+export function terminalHttpLinkActionDestinationsFor(
+  settings: { openLinksInApp?: boolean } | null | undefined,
+  sourceOwner: HttpLinkSourceOwner,
+  canOpenRuntimeBrowser: boolean
+): TerminalHttpLinkActionDestinations {
+  const canOpenInOrca =
+    sourceOwner.kind === 'local' || (sourceOwner.kind === 'runtime' && canOpenRuntimeBrowser)
+  if (!canOpenInOrca) {
+    return { primary: 'system' }
+  }
+  return settings?.openLinksInApp === true
+    ? { primary: 'orca', alternate: 'system' }
+    : { primary: 'system', alternate: 'orca' }
+}
+
+// Why: only a capability-verified runtime can advertise the in-app destination.
 export function terminalUrlOpenHintOptionsFor(
   settings:
     | {
@@ -49,14 +62,15 @@ export function terminalUrlOpenHintOptionsFor(
       }
     | null
     | undefined,
-  sourceOwner?: HttpLinkSourceOwner
+  sourceOwner?: HttpLinkSourceOwner,
+  canOpenRuntimeBrowser = false
 ): TerminalUrlOpenHintOptions {
-  const sourceIsLocal = sourceOwner
-    ? sourceOwner.kind === 'local'
+  const sourceCanOpenInOrca = sourceOwner
+    ? sourceOwner.kind === 'local' || (sourceOwner.kind === 'runtime' && canOpenRuntimeBrowser)
     : !settings?.activeRuntimeEnvironmentId?.trim()
   return {
     openLinksInApp: settings?.openLinksInApp === true,
-    modifierInverts: settings?.openLinksInAppModifierInverts === true && sourceIsLocal
+    modifierInverts: settings?.openLinksInAppModifierInverts === true && sourceCanOpenInOrca
   }
 }
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts b/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
index 4c091456e32..fb0bf470004 100644
--- a/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
@@ -1,5 +1,5 @@
 import { isTerminalLeafId } from '../../../../shared/stable-pane-id'
-import { isRemoteRuntimePtyId, sendRuntimePtyInput } from '@/runtime/runtime-terminal-inspection'
+import { isRemoteRuntimePtyId } from '@/runtime/runtime-terminal-inspection'
 import { useAppStore } from '@/store'
 import { closeTerminalTab } from '../terminal/terminal-tab-actions'
 import { startParkedTerminalByteWatcher } from './parked-terminal-byte-watcher'
@@ -82,10 +82,7 @@ export function startParkedPtyWatcher(args: {
     paneId: pane.paneId,
     drivesTabTitle: pane.drivesTabTitle,
     ...(initialTitle !== undefined ? { initialTitle } : {}),
-    ...(restoreTitleOnRegister ? { restoreTitleOnRegister: true } : {}),
-    sendInput: (data) => {
-      sendRuntimePtyInput(useAppStore.getState().settings, ptyId, data)
-    }
+    ...(restoreTitleOnRegister ? { restoreTitleOnRegister: true } : {})
   })
   const unsubscribeExit = isRemoteRuntimePtyId(ptyId)
     ? () => {}
diff --git a/src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts b/src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts
index 2e9b3a52ef2..a129f033176 100644
--- a/src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts
@@ -206,14 +206,6 @@ describe('terminal-parked-tab-watchers', () => {
     expect(startedWatchers[0].options.restoreTitleOnRegister).toBe(true)
   })
 
-  it('routes watcher sendInput to window.api.pty.write for the watched PTY', () => {
-    capturePanes([{ ptyId: PTY_ID, paneId: 1, leafId: LEAF_ID, drivesTabTitle: true }])
-    syncParked()
-
-    startedWatchers[0].options.sendInput('\x1b[?2031;1$y')
-    expect(ptyWrite).toHaveBeenCalledWith(PTY_ID, '\x1b[?2031;1$y')
-  })
-
   it('skips legacy non-UUID leaf ids instead of throwing in makePaneKey', () => {
     capturePanes([
       { ptyId: PTY_ID, paneId: 1, leafId: 'legacy-leaf-1', drivesTabTitle: true },
diff --git a/src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts b/src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts
index 1f4b522040a..b2fb9b3de07 100644
--- a/src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts
@@ -58,10 +58,10 @@ export function terminalWatcherLiveWorkspaceIds(workspaceIds: Iterable<string>):
 }
 
 /**
- * Whether this tab is parked right now — the reveal remount's own mount effect
- * runs before the host effect that disposes the watcher (child effects first),
- * so a pane reading this at connect time can tell a park-reveal from an
- * in-place reattach. Empty entries are pinned-close tombstones, not live parks.
+ * Whether this tab is parked right now — the reveal remount renders before the
+ * host effect that disposes the watcher, so a pane reading this at render time
+ * can tell a park-reveal from an in-place reattach. Empty entries are
+ * pinned-close tombstones, not live parks.
  */
 export function isTerminalTabParked(tabId: string): boolean {
   return (parkedWatchersByTabId.get(tabId)?.disposersByPtyId.size ?? 0) > 0
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-diagnostics.ts b/src/renderer/src/components/terminal-pane/terminal-paste-diagnostics.ts
index b32decb98ff..9c89536db50 100644
--- a/src/renderer/src/components/terminal-pane/terminal-paste-diagnostics.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-diagnostics.ts
@@ -29,7 +29,7 @@ export function createRedactedPasteExecutionDiagnostic({
   chunksWritten: number
   durationMs: number
   plan: TerminalPastePlan
-  reason?: TerminalPasteExecutionReason | string
+  reason?: TerminalPasteExecutionReason | (string & {})
   status: TerminalPasteExecutionResult['status']
 }): string {
   return [
diff --git a/src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts b/src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts
index 0113ea31a3d..01896238c05 100644
--- a/src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts
@@ -1,6 +1,9 @@
 import type { IBufferLine, Terminal } from '@xterm/xterm'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing'
+import {
+  registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener
+} from '@/lib/http-link-routing'
 import { handleOscLink } from './terminal-osc-link-routing'
 import { handleTerminalWebLinkClick } from './terminal-web-link-click'
 import { installHttpLinkClickFallback } from './terminal-url-link-hit-testing'
@@ -12,6 +15,7 @@ const ROWS = 24
 const openUrlMock = vi.fn()
 const setActiveWorktreeMock = vi.fn()
 const createBrowserTabMock = vi.fn()
+const openRuntimeBrowserTabMock = vi.fn(() => Promise.resolve())
 const runtimeSourceOwner = { kind: 'runtime', runtimeEnvironmentId: 'env-1' } as const
 const sshSourceOwner = { kind: 'ssh', connectionId: 'ssh-1' } as const
 
@@ -104,26 +108,34 @@ beforeEach(() => {
     setActiveWorktree: setActiveWorktreeMock,
     createBrowserTab: createBrowserTabMock
   }))
+  registerRuntimeHttpLinkBrowserOpener(openRuntimeBrowserTabMock)
 })
 
 afterEach(() => {
+  registerRuntimeHttpLinkBrowserOpener(null)
   vi.unstubAllGlobals()
 })
 
 describe('terminal HTTP links on a runtime-hosted pane', () => {
   const baseDeps = { worktreeId: 'wt-1', worktreePath: '/tmp', startupCwd: '/tmp' }
 
-  it('sends an OSC 8 hyperlink to the system browser', () => {
+  it('opens an OSC 8 hyperlink on the owning runtime', () => {
     expect(handleOscLink(URL, clickEvent(), { ...baseDeps, sourceOwner: runtimeSourceOwner })).toBe(
       true
     )
 
-    expect(openUrlMock).toHaveBeenCalledWith(URL)
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: URL,
+      intent: { kind: 'url' },
+      expectedRuntimeEnvironmentId: 'env-1'
+    })
+    expect(openUrlMock).not.toHaveBeenCalled()
     expect(createBrowserTabMock).not.toHaveBeenCalled()
     expect(setActiveWorktreeMock).not.toHaveBeenCalled()
   })
 
-  it('sends a WebLinksAddon click to the system browser', () => {
+  it('opens a WebLinksAddon click on the owning runtime', () => {
     const { terminal } = makeTerminal()
 
     expect(
@@ -134,11 +146,14 @@ describe('terminal HTTP links on a runtime-hosted pane', () => {
       })
     ).toBe(true)
 
-    expect(openUrlMock).toHaveBeenCalledWith(URL)
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedRuntimeEnvironmentId: 'env-1', url: URL })
+    )
+    expect(openUrlMock).not.toHaveBeenCalled()
     expect(createBrowserTabMock).not.toHaveBeenCalled()
   })
 
-  it('sends a click-fallback activation to the system browser', () => {
+  it('opens a click-fallback activation on the owning runtime', () => {
     const { terminal, registrations } = makeTerminal()
     const disposable = installHttpLinkClickFallback(terminal, {
       worktreeId: 'wt-1',
@@ -149,12 +164,15 @@ describe('terminal HTTP links on a runtime-hosted pane', () => {
       ([name, _listener, options]) => name === 'mouseup' && options === undefined
     )?.[1](clickEvent())
 
-    expect(openUrlMock).toHaveBeenCalledWith(URL)
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedRuntimeEnvironmentId: 'env-1', url: URL })
+    )
+    expect(openUrlMock).not.toHaveBeenCalled()
     expect(createBrowserTabMock).not.toHaveBeenCalled()
     disposable.dispose()
   })
 
-  it('never prompts for the in-app routing preference it could not honor', () => {
+  it('uses the persisted routing preference without prompting again', () => {
     const requestOpenLinksInAppPreference = vi.fn(() => Promise.resolve(true))
 
     handleOscLink(URL, clickEvent(), {
@@ -164,7 +182,8 @@ describe('terminal HTTP links on a runtime-hosted pane', () => {
     })
 
     expect(requestOpenLinksInAppPreference).not.toHaveBeenCalled()
-    expect(openUrlMock).toHaveBeenCalledWith(URL)
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledOnce()
+    expect(openUrlMock).not.toHaveBeenCalled()
   })
 })
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.ts b/src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.ts
index 546af83987b..578a4147375 100644
--- a/src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.ts
@@ -86,8 +86,8 @@ export type TerminalSideEffectFactConsumerCallbacks = {
   onCommandCodeWorking?: (prompt: string) => void
   onCommandCodeDone?: (prompt: string) => void
   /** DECSET 2031 subscribe observed by main's tracker. Registered only by
-   *  hidden-delivery-gated consumers (their bytes never arrive); the theme
-   *  reply is sent renderer-side — query authority stays with the view. */
+   *  hidden-delivery-gated consumers (their bytes never arrive); it records the
+   *  subscription for later theme-flip pushes, it does not answer. */
   onMode2031Subscribe?: () => void
   /** DECSET 2031 withdrawal observed by main's tracker. Clears the pane's
    *  subscription registry so later theme flips stop pushing CSI 997. */
diff --git a/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts b/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts
index 9a3aa6621c5..042f6bed3d8 100644
--- a/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts
@@ -89,18 +89,35 @@ describe('shouldSkipAltFrameForWidthMismatch', () => {
     expect(shouldSkipAltFrameForWidthMismatch(Number.NaN, 128)).toBe(false)
     expect(shouldSkipAltFrameForWidthMismatch(Number.POSITIVE_INFINITY, 128)).toBe(false)
   })
-
-  it('can conservatively skip a live frame until a hidden pane has a final grid', () => {
-    expect(shouldSkipAltFrameForWidthMismatch(135, undefined, { skipIfTargetUnknown: true })).toBe(
-      true
-    )
-    expect(
-      shouldSkipAltFrameForWidthMismatch(undefined, undefined, { skipIfTargetUnknown: true })
-    ).toBe(false)
-  })
 })
 
 describe('buildMainModelSnapshotReplayWrites alt-frame skip', () => {
+  it('restores the exact capture-grid alt frame while the target grid is unknown', async () => {
+    const terminal = new Terminal({ cols: 12, rows: 5, scrollback: 20 })
+    const snapshot = {
+      data: '\x1b[1;1HTOP---------\x1b[2;1HMIDDLE------\x1b[3;1HBOTTOM------',
+      frameRestoreAnsi: '\x1b[?25l',
+      alternateScreen: true,
+      scrollbackAnsi: 'history'
+    }
+
+    try {
+      const skipAltFrame = shouldSkipAltFrameForWidthMismatch(12, undefined)
+      for (const chunk of buildMainModelSnapshotReplayWrites(snapshot, { skipAltFrame })) {
+        await writeTerminal(terminal, chunk)
+      }
+
+      expect(
+        Array.from({ length: 3 }, (_, row) =>
+          terminal.buffer.active.getLine(row)?.translateToString(true)
+        )
+      ).toEqual(['TOP---------', 'MIDDLE------', 'BOTTOM------'])
+      expect(terminal.buffer.normal.getLine(0)?.translateToString(true)).toBe('history')
+    } finally {
+      terminal.dispose()
+    }
+  })
+
   it('keeps normal history and a clean alt grid through the real resize path', async () => {
     const terminal = new Terminal({ cols: 12, rows: 5, scrollback: 20 })
     const snapshot = {
diff --git a/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.ts b/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.ts
index 643ca0de925..aa41ff6d645 100644
--- a/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.ts
@@ -35,8 +35,8 @@ export function resolvePositiveTerminalDimensions(
  * The column count the post-replay fit will land on. Why not terminal.cols: a
  * pane that has not been fitted yet still reads xterm's 80-column default, so
  * comparing against it would drop frames whose width actually matches the
- * container. Returns undefined when the pane cannot be measured; callers with
- * a repaint owner can clear and defer, while offline preconnect paint cannot.
+ * container. Returns undefined when the pane cannot be measured, so replay can
+ * retain the frame at its capture grid until a final fit exists.
  */
 export function readProposedTerminalCols(pane: ManagedPane): number | undefined {
   return readProposedPaneFitDimensions(pane)?.cols
@@ -44,15 +44,14 @@ export function readProposedTerminalCols(pane: ManagedPane): number | undefined
 
 export function shouldSkipAltFrameForWidthMismatch(
   snapshotCols: number | undefined,
-  targetCols: number | undefined,
-  options: { skipIfTargetUnknown?: boolean } = {}
+  targetCols: number | undefined
 ): boolean {
   if (typeof snapshotCols !== 'number' || !Number.isFinite(snapshotCols) || snapshotCols <= 0) {
     return false
   }
   if (typeof targetCols !== 'number' || !Number.isFinite(targetCols) || targetCols <= 0) {
-    // A hidden pane has no final grid; its live app can repaint after the deferred fit.
-    return options.skipIfTargetUnknown === true
+    // Keep the frame at its capture grid until a real fit can replace that grid.
+    return false
   }
   // Fixed-grid alt rows clip at narrower columns; normal history remains reflowable.
   return snapshotCols > targetCols
diff --git a/src/renderer/src/components/terminal-pane/terminal-tab-activation-order.ts b/src/renderer/src/components/terminal-pane/terminal-tab-activation-order.ts
new file mode 100644
index 00000000000..2f4096b1142
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-tab-activation-order.ts
@@ -0,0 +1,35 @@
+/** Ranks tabs hidden in the same pass by the user's activation order. */
+export type TerminalTabActivationOrder = {
+  recordActiveTabId(activeTabId: string | null): void
+  getActivationSeq(tabId: string): number | undefined
+  retainTabIds(liveTabIds: ReadonlySet<string>): void
+}
+
+export function createTerminalTabActivationOrder(): TerminalTabActivationOrder {
+  const activationSeqByTabId = new Map<string, number>()
+  let previousActiveTabId: string | null = null
+  let nextActivationSeq = 0
+
+  return {
+    recordActiveTabId(activeTabId) {
+      if (activeTabId !== null && activeTabId !== previousActiveTabId) {
+        activationSeqByTabId.set(activeTabId, nextActivationSeq)
+        nextActivationSeq += 1
+      }
+      previousActiveTabId = activeTabId
+    },
+    getActivationSeq(tabId) {
+      return activationSeqByTabId.get(tabId)
+    },
+    retainTabIds(liveTabIds) {
+      if (previousActiveTabId !== null && !liveTabIds.has(previousActiveTabId)) {
+        previousActiveTabId = null
+      }
+      for (const tabId of Array.from(activationSeqByTabId.keys())) {
+        if (!liveTabIds.has(tabId)) {
+          activationSeqByTabId.delete(tabId)
+        }
+      }
+    }
+  }
+}
diff --git a/src/renderer/src/components/terminal-pane/terminal-tab-park-candidates.ts b/src/renderer/src/components/terminal-pane/terminal-tab-park-candidates.ts
new file mode 100644
index 00000000000..cb0e357b280
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-tab-park-candidates.ts
@@ -0,0 +1,43 @@
+/** Builds the stateful per-tab cold-park candidate list. */
+import type { TerminalTab } from '../../../../shared/types'
+import type { TerminalTabColdParkCandidate } from './terminal-hidden-view-parking'
+import type { TerminalTabActivationOrder } from './terminal-tab-activation-order'
+
+export function buildTerminalTabColdParkCandidates(args: {
+  terminalTabs: readonly TerminalTab[]
+  assignments: ReadonlyMap<string, { isActiveInGroup: boolean }>
+  isWorktreeActive: boolean
+  activeTerminalTabId: string | null
+  portalTabIds: ReadonlySet<string>
+  shouldMeasureHiddenWorktree: boolean
+  hiddenSinceByTabId: Map<string, number>
+  activationOrder: TerminalTabActivationOrder
+  nowMs: number
+}): TerminalTabColdParkCandidate[] {
+  args.activationOrder.recordActiveTabId(args.isWorktreeActive ? args.activeTerminalTabId : null)
+  const visibleTabIds = new Set<string>()
+  for (const terminalTab of args.terminalTabs) {
+    if (args.isWorktreeActive && args.assignments.get(terminalTab.id)?.isActiveInGroup === true) {
+      visibleTabIds.add(terminalTab.id)
+    }
+  }
+  return args.terminalTabs.map((terminalTab) => {
+    const isVisible = visibleTabIds.has(terminalTab.id)
+    const hasActivityTerminalPortal = args.portalTabIds.has(terminalTab.id)
+    // Why: measure probes need mounted panes without restarting the park clock.
+    if (isVisible || hasActivityTerminalPortal) {
+      args.hiddenSinceByTabId.delete(terminalTab.id)
+    } else if (!args.shouldMeasureHiddenWorktree && !args.hiddenSinceByTabId.has(terminalTab.id)) {
+      args.hiddenSinceByTabId.set(terminalTab.id, args.nowMs)
+    }
+    return {
+      id: terminalTab.id,
+      ptyId: terminalTab.ptyId,
+      pendingActivationSpawn: terminalTab.pendingActivationSpawn,
+      isVisible,
+      hasActivityTerminalPortal,
+      hiddenSinceMs: args.hiddenSinceByTabId.get(terminalTab.id) ?? null,
+      lastActivatedSeq: args.activationOrder.getActivationSeq(terminalTab.id)
+    }
+  })
+}
diff --git a/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts b/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts
index 98824d140f4..fad5301c804 100644
--- a/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts
@@ -72,7 +72,7 @@ export function handleTerminalHttpLink(
 ): boolean {
   if (isTerminalHttpLinkActivation(event)) {
     const forceDestination = event?.shiftKey
-      ? deps.actionDestinations?.alternate
+      ? (deps.actionDestinations?.alternate ?? deps.actionDestinations?.primary)
       : deps.actionDestinations?.primary
     openTerminalHttpLink(url, {
       ...deps,
@@ -273,11 +273,11 @@ function rangeContainsBufferPosition(
 }
 
 export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): void {
-  // Why: Orca browser tabs are local-only, so a link clicked in a runtime-hosted
-  // pane must be classified by its pane's host, not the global active runtime.
+  // Why: pane ownership beats the global active runtime for both local and remote routes.
   const sourceOwner = deps.sourceOwner ?? { kind: 'local' }
   if (deps.forceDestination) {
     openHttpLink(url, {
+      allowRuntimeInApp: true,
       worktreeId: deps.worktreeId,
       forceInApp: deps.forceDestination === 'orca',
       forceSystemBrowser: deps.forceDestination === 'system',
@@ -288,16 +288,20 @@ export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): voi
   if (deps.modifierHeld) {
     // Why: the modifier states a destination outright, so it also skips the
     // one-time routing prompt; openHttpLink resolves which destination it means.
-    openHttpLink(url, { worktreeId: deps.worktreeId, modifierHeld: true, sourceOwner })
+    openHttpLink(url, {
+      allowRuntimeInApp: true,
+      worktreeId: deps.worktreeId,
+      modifierHeld: true,
+      sourceOwner
+    })
     return
   }
 
-  // Why: a runtime-hosted link can only reach the system browser, so prompting
-  // would persist an in-app preference this click cannot honor.
+  // Why: remote panes use the persisted routing preference and never prompt the viewing client.
   const preferenceDecision =
     sourceOwner.kind === 'local' ? deps.requestOpenLinksInAppPreference?.(url) : null
   if (preferenceDecision === null || preferenceDecision === undefined) {
-    openHttpLink(url, { worktreeId: deps.worktreeId, sourceOwner })
+    openHttpLink(url, { allowRuntimeInApp: true, worktreeId: deps.worktreeId, sourceOwner })
     return
   }
 
@@ -307,12 +311,18 @@ export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): voi
   void Promise.resolve(preferenceDecision)
     .then((openInOrca) => {
       openHttpLink(url, {
+        allowRuntimeInApp: true,
         worktreeId: deps.worktreeId,
         forceSystemBrowser: !openInOrca,
         sourceOwner
       })
     })
     .catch(() => {
-      openHttpLink(url, { worktreeId: deps.worktreeId, forceSystemBrowser: true, sourceOwner })
+      openHttpLink(url, {
+        allowRuntimeInApp: true,
+        worktreeId: deps.worktreeId,
+        forceSystemBrowser: true,
+        sourceOwner
+      })
     })
 }
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.ts
index f9a6e544193..9e9a63a94f2 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.ts
@@ -168,18 +168,18 @@ export function useTerminalPaneGlobalEffects({
       hiddenReasonRef.current = null
       applyPendingFollowOutputRequests()
       return
-    } else {
-      const hiddenState = hideTerminalVisibility({
-        manager,
-        wasVisible,
-        wasWorktreeActive,
-        isWorktreeActive,
-        hasCompletedVisibleResume: hasCompletedVisibleResumeRef.current,
-        captureViewportPositions
-      })
-      renderingSuspendedByVisibilityRef.current = hiddenState.renderingSuspended
-      hiddenReasonRef.current = hiddenState.hiddenReason
     }
+    const hiddenState = hideTerminalVisibility({
+      manager,
+      wasVisible,
+      wasWorktreeActive,
+      isWorktreeActive,
+      hasCompletedVisibleResume: hasCompletedVisibleResumeRef.current,
+      captureViewportPositions
+    })
+    renderingSuspendedByVisibilityRef.current = hiddenState.renderingSuspended
+    hiddenReasonRef.current = hiddenState.hiddenReason
+
     wasVisibleRef.current = false
     wasWorktreeActiveRef.current = isWorktreeActive
     // eslint-disable-next-line react-hooks/exhaustive-deps
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
index 74e53a0b6be..bc0582ca9fe 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
@@ -9,6 +9,7 @@ import {
   resolvePaneLinkCwd,
   resolvePaneSeedCwd,
   resolveQueuedInitialCwd,
+  replayLayoutWithOneShotParkIntent,
   resetTerminalKeyboardProtocolAfterInterrupt,
   retireMountedTerminalPaneSurface,
   shouldDetachPaneTransportOnUnmount,
@@ -248,6 +249,35 @@ describe('splitPaneWithOneShotStartup', () => {
   })
 })
 
+describe('replayLayoutWithOneShotParkIntent', () => {
+  it('exposes park intent to replayed panes and clears it before later splits', () => {
+    const deps = { mountFollowsTerminalPark: true }
+    const observedByReplayedPane: boolean[] = []
+
+    const restored = replayLayoutWithOneShotParkIntent(deps, () => {
+      observedByReplayedPane.push(deps.mountFollowsTerminalPark)
+      return 'restored-panes'
+    })
+
+    expect(restored).toBe('restored-panes')
+    expect(observedByReplayedPane).toEqual([true])
+    // A split after replay reads the same deps object, so it must see ordinary reconnect semantics.
+    expect(deps.mountFollowsTerminalPark).toBe(false)
+  })
+
+  it('clears park intent even when layout replay throws', () => {
+    const deps = { mountFollowsTerminalPark: true }
+
+    expect(() =>
+      replayLayoutWithOneShotParkIntent(deps, () => {
+        throw new Error('replay failed')
+      })
+    ).toThrow('replay failed')
+
+    expect(deps.mountFollowsTerminalPark).toBe(false)
+  })
+})
+
 describe('applyTerminalScrollbackRowsToMountedPanes', () => {
   it('updates mounted pane xterm scrollback options only when needed', () => {
     const firstOptions = { scrollback: 1_000 }
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
index 4e23a47538e..31928913df5 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
@@ -32,7 +32,10 @@ import {
   getTerminalUrlOpenHint,
   installFilePathLinkClickFallback
 } from './terminal-link-handlers'
-import { terminalUrlOpenHintOptionsFor } from './terminal-link-open-hints'
+import {
+  terminalHttpLinkActionDestinationsFor,
+  terminalUrlOpenHintOptionsFor
+} from './terminal-link-open-hints'
 import { createTerminalHandleLinkProvider } from './terminal-handle-links'
 import type { LinkHandlerDeps } from './terminal-link-handlers'
 import { handleOscLink } from './terminal-osc-link-routing'
@@ -53,6 +56,7 @@ import {
   type HttpLinkSourceOwner
 } from '@/lib/http-link-routing'
 import { resolveTerminalHttpLinkSourceOwner } from './terminal-http-link-source-owner'
+import { canOpenWorkspaceBrowserTabOnRuntime } from '@/lib/workspace-browser-tab-open'
 import type {
   GlobalSettings,
   SetupSplitDirection,
@@ -126,6 +130,7 @@ import { markTerminalPinnedViewport } from '@/lib/pane-manager/terminal-scroll-i
 import { syncTerminalScrollIntentSoon } from '@/lib/pane-manager/terminal-scroll-intent-settle'
 import { registerRuntimeTerminalTab, scheduleRuntimeGraphSync } from '@/runtime/sync-runtime-graph'
 import { captureParkedTerminalPaneCandidates } from './terminal-parked-tab-watchers'
+import { useTerminalParkMountIntent } from './use-terminal-park-mount-intent'
 import { e2eConfig } from '@/lib/e2e-config'
 import {
   PRIMARY_SELECTION_MAX_LENGTH,
@@ -479,6 +484,19 @@ export function splitPaneWithOneShotStartup<TPane>(
   }
 }
 
+/** Scopes `deps.mountFollowsTerminalPark` to the restored-layout replay. */
+export function replayLayoutWithOneShotParkIntent<TRestored>(
+  deps: { mountFollowsTerminalPark: boolean },
+  replayLayout: () => TRestored
+): TRestored {
+  // Why: only panes reconstructed by this replay belong to the park reveal; later splits must use ordinary reconnect semantics.
+  try {
+    return replayLayout()
+  } finally {
+    deps.mountFollowsTerminalPark = false
+  }
+}
+
 export function shouldDetachPaneTransportOnUnmount(args: {
   tabStillExists: boolean
   tabId: string
@@ -661,6 +679,7 @@ export function useTerminalPaneLifecycle({
   const systemPrefersDarkRef = useRef(systemPrefersDark)
   systemPrefersDarkRef.current = systemPrefersDark
   const previousVisibleForReconcileRef = useRef<TerminalPaneVisibilitySnapshot | null>(null)
+  const mountFollowsTerminalPark = useTerminalParkMountIntent(tabId)
   const linkProviderDisposablesRef = useRef(new Map<number, IDisposable>())
   const terminalHandleLinkDisposablesRef = useRef(new Map<number, IDisposable>())
   const linkifierClickPrimingDisposablesRef = useRef(new Map<number, IDisposable>())
@@ -742,15 +761,24 @@ export function useTerminalPaneLifecycle({
       resolvePaneLinkCwd(paneCwdRef.current, paneId, startupCwd)
     const getHttpLinkSourceOwnerForPane = (paneId: number) =>
       resolveTerminalHttpLinkSourceOwner(paneTransportsRef.current.get(paneId))
+    const canOpenRuntimeBrowserForPane = (paneId: number): boolean => {
+      const sourceOwner = getHttpLinkSourceOwnerForPane(paneId)
+      return (
+        sourceOwner.kind === 'runtime' &&
+        canOpenWorkspaceBrowserTabOnRuntime(
+          useAppStore.getState(),
+          worktreeId,
+          sourceOwner.runtimeEnvironmentId
+        )
+      )
+    }
     const getHttpLinkActionDestinations = (paneId: number): TerminalHttpLinkActionDestinations => {
       const sourceOwner = getHttpLinkSourceOwnerForPane(paneId)
-      if (sourceOwner.kind !== 'local') {
-        return { primary: 'system' }
-      }
-      const options = terminalUrlOpenHintOptionsFor(settingsRef.current, sourceOwner)
-      return options.openLinksInApp
-        ? { primary: 'orca', alternate: 'system' }
-        : { primary: 'system', alternate: 'orca' }
+      return terminalHttpLinkActionDestinationsFor(
+        settingsRef.current,
+        sourceOwner,
+        canOpenRuntimeBrowserForPane(paneId)
+      )
     }
     const getLinkActionContext = (paneId: number): TerminalLinkActionContext | null => {
       if (settingsRef.current?.terminalLinkActionPopoverEnabled === false) {
@@ -841,6 +869,7 @@ export function useTerminalPaneLifecycle({
       worktreeId,
       cwd: startupCwd,
       startup: startupWithSetupSplitWait,
+      mountFollowsTerminalPark,
       paneTransportsRef,
       paneMode2031Ref,
       paneKittyKeyboardModesRef,
@@ -879,10 +908,10 @@ export function useTerminalPaneLifecycle({
         }
         suppression.handlePtyInput(data, forward)
       },
-      // Why: record the main-answered 2031 subscribe in the CSI handler's registries, else theme flips never push CSI 997.
-      recordPaneMode2031Subscription: (paneId: number, repliedMode: 'dark' | 'light') => {
+      // Why: record the fact-observed 2031 subscribe in the pane registries, else theme flips never push CSI 997.
+      recordPaneMode2031Subscription: (paneId: number, subscribedMode: 'dark' | 'light') => {
         paneMode2031Ref.current.set(paneId, true)
-        paneLastThemeModeRef.current.set(paneId, repliedMode)
+        paneLastThemeModeRef.current.set(paneId, subscribedMode)
       },
       restoredPtyIdByLeafId: initialLayoutRef.current.ptyIdsByLeafId ?? {}
     }
@@ -901,7 +930,8 @@ export function useTerminalPaneLifecycle({
       getTerminalUrlOpenHint({
         ...terminalUrlOpenHintOptionsFor(
           settingsRef.current,
-          getHttpLinkSourceOwnerForPane(paneId)
+          getHttpLinkSourceOwnerForPane(paneId),
+          canOpenRuntimeBrowserForPane(paneId)
         ),
         showActions: settingsRef.current?.terminalLinkActionPopoverEnabled !== false
       })
@@ -1561,7 +1591,9 @@ export function useTerminalPaneLifecycle({
       window.__paneManagers = window.__paneManagers ?? new Map()
       window.__paneManagers.set(tabId, manager)
     }
-    const restoredPaneByLeafId = replayTerminalLayout(manager, initialLayoutRef.current, isActive)
+    const restoredPaneByLeafId = replayLayoutWithOneShotParkIntent(ptyDeps, () =>
+      replayTerminalLayout(manager, initialLayoutRef.current, isActive)
+    )
 
     const restoredBuffers = initialLayoutRef.current.buffersByLeafId
     restoreScrollbackBuffers(
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx b/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx
new file mode 100644
index 00000000000..7ab3ac8ae30
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx
@@ -0,0 +1,76 @@
+/** @vitest-environment happy-dom */
+import { StrictMode, act, useEffect } from 'react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, describe, expect, it } from 'vitest'
+import { disposeParkedTabWatchers, parkedWatchersByTabId } from './terminal-parked-watcher-registry'
+import { useTerminalParkMountIntent } from './use-terminal-park-mount-intent'
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+const TAB_ID = 'strict-park-reveal'
+const observations: boolean[] = []
+
+function Child(): null {
+  const mountFollowsTerminalPark = useTerminalParkMountIntent(TAB_ID)
+  useEffect(() => {
+    observations.push(mountFollowsTerminalPark)
+  }, [mountFollowsTerminalPark])
+  return null
+}
+
+function Parent() {
+  useEffect(() => {
+    disposeParkedTabWatchers(TAB_ID)
+  }, [])
+  return <Child />
+}
+
+function parkTab(): void {
+  parkedWatchersByTabId.set(TAB_ID, {
+    worktreeId: 'wt-1',
+    tabPtyId: 'pty-1',
+    paneIdByPtyId: new Map([['pty-1', 1]]),
+    disposersByPtyId: new Map([['pty-1', () => {}]])
+  })
+}
+
+afterEach(() => {
+  observations.length = 0
+  disposeParkedTabWatchers(TAB_ID)
+})
+
+describe('useTerminalParkMountIntent', () => {
+  it('survives StrictMode effect replay after the parent disposes the watcher', () => {
+    parkTab()
+    const container = document.createElement('div')
+    const root = createRoot(container)
+
+    act(() => {
+      root.render(
+        <StrictMode>
+          <Parent />
+        </StrictMode>
+      )
+    })
+
+    expect(observations).toEqual([true, true])
+    act(() => root.unmount())
+  })
+
+  // Why: the lifecycle effect re-runs on cwd changes for the same component
+  // instance, so intent cached per instance would resupply a stale park reveal.
+  it('re-reads park intent when the same instance re-renders after disposal', () => {
+    parkTab()
+    const container = document.createElement('div')
+    const root = createRoot(container)
+
+    act(() => root.render(<Child />))
+    expect(observations).toEqual([true])
+
+    disposeParkedTabWatchers(TAB_ID)
+    act(() => root.render(<Child />))
+
+    expect(observations).toEqual([true, false])
+    act(() => root.unmount())
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.ts b/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.ts
new file mode 100644
index 00000000000..dba51fcc8ea
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.ts
@@ -0,0 +1,9 @@
+import { isTerminalTabParked } from './terminal-parked-watcher-registry'
+
+// Why render time: the host effect that disposes the watcher runs after every
+// child render, so reading here — not at connect time — is what lets a reveal
+// remount still see the park. Caching it per instance would instead resupply a
+// stale reveal on later same-instance effect re-runs (cwd change).
+export function useTerminalParkMountIntent(tabId: string): boolean {
+  return isTerminalTabParked(tabId)
+}
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts
index 2e1c97c5450..783ff7af574 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts
@@ -74,6 +74,7 @@ function hookArgs(shouldMeasureHiddenWorktree: boolean) {
     terminalTabs: [terminalTab('tab-1'), terminalTab('tab-2')],
     assignments: new Map<string, { groupId: string; isActiveInGroup: boolean }>(),
     isWorktreeActive: false,
+    activeTerminalTabId: null as string | null,
     coldParkTerminalPanes: false,
     shouldMeasureHiddenWorktree,
     activityTerminalPortals: [],
@@ -97,6 +98,86 @@ describe('useTerminalTabColdParking measure-clock contract', () => {
     mocks.storeState.runtimeStatusByEnvironmentId = new Map()
   })
 
+  // Why: leaving a worktree gives every tab the same hidden time.
+  it('exempts the tab the worktree was left on when every tab hides in one pass', () => {
+    const assignments = new Map([
+      ['tab-1', { groupId: 'group-1', isActiveInGroup: false }],
+      ['tab-2', { groupId: 'group-1', isActiveInGroup: true }]
+    ])
+    const { result, rerender } = renderHook(
+      (args: ReturnType<typeof hookArgs> & { isWorktreeActive: boolean }) =>
+        useTerminalTabColdParking(args),
+      {
+        initialProps: {
+          ...hookArgs(false),
+          assignments,
+          isWorktreeActive: true,
+          activeTerminalTabId: 'tab-2'
+        }
+      }
+    )
+    expect(result.current.size).toBe(0)
+
+    act(() => {
+      rerender({
+        ...hookArgs(false),
+        assignments,
+        isWorktreeActive: false,
+        activeTerminalTabId: 'tab-2'
+      })
+    })
+    act(() => {
+      vi.advanceTimersByTime(TERMINAL_TAB_HOT_RETAIN_MS + 1)
+    })
+
+    expect(result.current).toEqual(new Set(['tab-1']))
+  })
+
+  it('records focused split changes when the visible tab set does not change', () => {
+    const assignments = new Map([
+      ['tab-1', { groupId: 'group-1', isActiveInGroup: true }],
+      ['tab-2', { groupId: 'group-2', isActiveInGroup: true }]
+    ])
+    const { result, rerender } = renderHook(
+      (
+        args: ReturnType<typeof hookArgs> & {
+          activeTerminalTabId: string | null
+          isWorktreeActive: boolean
+        }
+      ) => useTerminalTabColdParking(args),
+      {
+        initialProps: {
+          ...hookArgs(false),
+          assignments,
+          isWorktreeActive: true,
+          activeTerminalTabId: 'tab-1'
+        }
+      }
+    )
+
+    act(() => {
+      rerender({
+        ...hookArgs(false),
+        assignments,
+        isWorktreeActive: true,
+        activeTerminalTabId: 'tab-2'
+      })
+    })
+    act(() => {
+      rerender({
+        ...hookArgs(false),
+        assignments,
+        isWorktreeActive: false,
+        activeTerminalTabId: 'tab-2'
+      })
+    })
+    act(() => {
+      vi.advanceTimersByTime(TERMINAL_TAB_HOT_RETAIN_MS + 1)
+    })
+
+    expect(result.current).toEqual(new Set(['tab-1']))
+  })
+
   it('parks paired-runtime tabs only when their exact host advertises restore', () => {
     const environmentId = 'paired-env'
     const remoteArgs = {
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
index f33023c9499..94df8daf738 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
@@ -17,8 +17,7 @@ import { getTerminalTabColdParkRecheckDelayMs } from './terminal-cold-park-reche
 import {
   TERMINAL_TAB_COLD_PARK_DELAY_MS,
   selectPairedRuntimeParkingEnvironmentIds,
-  selectColdParkedTerminalTabs,
-  type TerminalTabColdParkCandidate
+  selectColdParkedTerminalTabs
 } from './terminal-hidden-view-parking'
 import {
   recordParkVerdictFlips,
@@ -32,6 +31,8 @@ import {
 } from './terminal-eviction-exempt-tabs'
 import { selectSleepingRecordParkExemptTabIds } from './sleeping-record-park-exemption'
 import { canWatcherCoverParkedTerminalTab } from './terminal-parked-tab-watchers'
+import { createTerminalTabActivationOrder } from './terminal-tab-activation-order'
+import { buildTerminalTabColdParkCandidates } from './terminal-tab-park-candidates'
 import {
   getTerminalParkingAssignmentsKey,
   getTerminalParkingInputsKey,
@@ -62,6 +63,7 @@ export function useTerminalTabColdParking(args: {
   terminalTabs: readonly TerminalTab[]
   assignments: ReadonlyMap<string, TerminalOverlayTabAssignment>
   isWorktreeActive: boolean
+  activeTerminalTabId: string | null
   /** Worktree-level park verdict from Terminal.tsx. */
   coldParkTerminalPanes: boolean
   /** Retention-budget force-park (C1 slice B): unlike ordinary parks, the
@@ -81,6 +83,7 @@ export function useTerminalTabColdParking(args: {
     terminalTabs,
     assignments,
     isWorktreeActive,
+    activeTerminalTabId,
     coldParkTerminalPanes,
     isForceParked = false,
     shouldMeasureHiddenWorktree,
@@ -115,6 +118,8 @@ export function useTerminalTabColdParking(args: {
     [sleepingAgentSessionsByPaneKey, worktreeId]
   )
   const terminalTabHiddenSinceRef = useRef(new Map<string, number>())
+  // Why: view switches hide every tab at once, so the park clock cannot rank them.
+  const terminalTabActivationOrderRef = useRef(createTerminalTabActivationOrder())
   // Why (shared measure-clock contract with Terminal.tsx): tab hiddenSince
   // survives a background-measure window so per-tab park deadlines stay in
   // sync with the worktree retention/TTL clock, and a post-measure cool-down
@@ -161,6 +166,7 @@ export function useTerminalTabColdParking(args: {
         terminalTabHiddenSinceRef.current.delete(tabId)
       }
     }
+    terminalTabActivationOrderRef.current.retainTabIds(currentTerminalTabIds)
 
     // Why: measure end starts the re-park cool-down (worktree measure-clock
     // contract) — hiddenSince is preserved through the window, so without the
@@ -180,30 +186,16 @@ export function useTerminalTabColdParking(args: {
       measureParkCooldownUntilRef.current = null
     }
 
-    const candidates: TerminalTabColdParkCandidate[] = terminalTabs.map((terminalTab) => {
-      const assignment = assignments.get(terminalTab.id)
-      const isVisible = Boolean(isWorktreeActive && assignment && assignment.isActiveInGroup)
-      const hasActivityTerminalPortal = portalTabIds.has(terminalTab.id)
-      // Why measuring preserves the clock: the startup probe still needs
-      // mounted panes (selection + render veto below), but deleting
-      // hiddenSince would restart the hysteresis AND desync per-tab deadlines
-      // from the worktree retention/TTL clock on every ~3s probe.
-      if (isVisible || hasActivityTerminalPortal) {
-        terminalTabHiddenSinceRef.current.delete(terminalTab.id)
-      } else if (
-        !shouldMeasureHiddenWorktree &&
-        !terminalTabHiddenSinceRef.current.has(terminalTab.id)
-      ) {
-        terminalTabHiddenSinceRef.current.set(terminalTab.id, nowMs)
-      }
-      return {
-        id: terminalTab.id,
-        ptyId: terminalTab.ptyId,
-        pendingActivationSpawn: terminalTab.pendingActivationSpawn,
-        isVisible,
-        hasActivityTerminalPortal,
-        hiddenSinceMs: terminalTabHiddenSinceRef.current.get(terminalTab.id) ?? null
-      }
+    const candidates = buildTerminalTabColdParkCandidates({
+      terminalTabs,
+      assignments,
+      isWorktreeActive,
+      activeTerminalTabId,
+      portalTabIds,
+      shouldMeasureHiddenWorktree,
+      hiddenSinceByTabId: terminalTabHiddenSinceRef.current,
+      activationOrder: terminalTabActivationOrderRef.current,
+      nowMs
     })
 
     const nextColdParkedTerminalTabIds = selectColdParkedTerminalTabs({
@@ -259,6 +251,7 @@ export function useTerminalTabColdParking(args: {
     // eslint-disable-next-line react-hooks/exhaustive-deps -- semantic keys own the tab and assignment dependencies.
   }, [
     activityTerminalPortals,
+    activeTerminalTabId,
     isWorktreeActive,
     pendingStartupByTabId,
     runtimeStatusByEnvironmentId,
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAdvancedSection.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAdvancedSection.tsx
index d49be9c9616..af196b2c628 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAdvancedSection.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAdvancedSection.tsx
@@ -7,6 +7,7 @@ import { Button } from '@/components/ui/button'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import { TerminalQuickCommandAppendEnterSwitch } from './TerminalQuickCommandAppendEnterSwitch'
+import { TerminalQuickCommandCollapsibleRow } from './TerminalQuickCommandCollapsibleRow'
 import { TerminalQuickCommandScopeField } from './TerminalQuickCommandScopeField'
 
 type TerminalQuickCommandAdvancedSectionProps = {
@@ -50,42 +51,26 @@ export function TerminalQuickCommandAdvancedSection({
         <ChevronDown className={cn('size-4 transition-transform', advancedOpen && 'rotate-180')} />
       </Button>
 
-      <div
-        className={cn(
-          'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
-          advancedOpen ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
-        )}
-        aria-hidden={!advancedOpen}
-      >
-        <div className="min-h-0">
-          <div
-            className={cn(
-              'space-y-4 px-1 pt-1 pb-1 transition-[opacity,transform] duration-150 ease-out',
-              advancedOpen
-                ? 'translate-y-0 opacity-100 delay-200'
-                : '-translate-y-1 opacity-0 delay-0'
-            )}
-          >
-            {!isTerminalAgentQuickCommand(draft) ? (
-              <TerminalQuickCommandAppendEnterSwitch
-                appendEnter={draft.appendEnter}
-                onToggle={toggleAppendEnter}
-              />
-            ) : null}
-            <TerminalQuickCommandScopeField
-              repos={repos}
-              selectedScope={selectedScope}
-              selectedRepoId={selectedRepoId}
-              selectedRepoMissing={selectedRepoMissing}
-              lastRepoScopeId={lastRepoScopeIdRef.current}
-              rememberRepoScopeId={(repoId) => {
-                lastRepoScopeIdRef.current = repoId
-              }}
-              setDraft={setDraft}
-            />
-          </div>
-        </div>
-      </div>
+      <TerminalQuickCommandCollapsibleRow open={advancedOpen} className="space-y-4 px-1 pt-2 pb-1">
+        <TerminalQuickCommandScopeField
+          repos={repos}
+          selectedScope={selectedScope}
+          selectedRepoId={selectedRepoId}
+          selectedRepoMissing={selectedRepoMissing}
+          lastRepoScopeId={lastRepoScopeIdRef.current}
+          rememberRepoScopeId={(repoId) => {
+            lastRepoScopeIdRef.current = repoId
+          }}
+          setDraft={setDraft}
+        />
+        {!isTerminalAgentQuickCommand(draft) ? (
+          <TerminalQuickCommandAppendEnterSwitch
+            appendEnter={draft.appendEnter}
+            disabled={!advancedOpen}
+            onToggle={toggleAppendEnter}
+          />
+        ) : null}
+      </TerminalQuickCommandCollapsibleRow>
     </div>
   )
 }
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAppendEnterSwitch.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAppendEnterSwitch.tsx
index 4450562729e..73f69ebf5d8 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAppendEnterSwitch.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAppendEnterSwitch.tsx
@@ -3,11 +3,13 @@ import { Switch } from '@/components/ui/switch'
 type TerminalQuickCommandAppendEnterSwitchProps = {
   appendEnter: boolean
   onToggle: () => void
+  disabled?: boolean
 }
 
 export function TerminalQuickCommandAppendEnterSwitch({
   appendEnter,
-  onToggle
+  onToggle,
+  disabled = false
 }: TerminalQuickCommandAppendEnterSwitchProps): React.JSX.Element {
   return (
     <div className="flex items-start justify-between gap-4">
@@ -27,6 +29,7 @@ export function TerminalQuickCommandAppendEnterSwitch({
       </div>
       <Switch
         checked={appendEnter}
+        disabled={disabled}
         aria-label={translate(
           'auto.components.terminal.quick.commands.TerminalQuickCommandAppendEnterSwitch.e4e5fed3b3',
           'Toggle append Enter'
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandCollapsibleRow.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandCollapsibleRow.tsx
new file mode 100644
index 00000000000..ab09a287b6a
--- /dev/null
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandCollapsibleRow.tsx
@@ -0,0 +1,38 @@
+import type { ReactNode } from 'react'
+import { cn } from '@/lib/utils'
+
+type TerminalQuickCommandCollapsibleRowProps = {
+  open: boolean
+  className?: string
+  children: ReactNode
+}
+
+/** Why: switching action adds/removes fields; animating the rows keeps the
+ *  dialog from snapping between content heights. */
+export function TerminalQuickCommandCollapsibleRow({
+  open,
+  className,
+  children
+}: TerminalQuickCommandCollapsibleRowProps): React.JSX.Element {
+  return (
+    <div
+      className={cn(
+        'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
+        open ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
+      )}
+      aria-hidden={!open}
+    >
+      <div className="min-h-0">
+        <div
+          className={cn(
+            'transition-[opacity,transform] duration-150 ease-out',
+            open ? 'translate-y-0 opacity-100 delay-200' : '-translate-y-1 opacity-0 delay-0',
+            className
+          )}
+        >
+          {children}
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandContentSection.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandContentSection.tsx
index 34035a6233f..19967b0daba 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandContentSection.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandContentSection.tsx
@@ -12,9 +12,11 @@ import {
   SelectTrigger,
   SelectValue
 } from '@/components/ui/select'
+import { Textarea } from '@/components/ui/textarea'
 import { AgentIcon } from '@/lib/agent-catalog'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
+import { TerminalQuickCommandCollapsibleRow } from './TerminalQuickCommandCollapsibleRow'
 import { getTerminalQuickCommandAgentOptions } from './terminal-quick-command-agent-options'
 import type { TerminalQuickCommandDialogDraftMemory } from './terminal-quick-command-dialog-draft'
 
@@ -37,85 +39,66 @@ export function TerminalQuickCommandContentSection({
 }: TerminalQuickCommandContentSectionProps): React.JSX.Element {
   return (
     <div>
-      {/* Why: action changes add/remove agent-only fields; animating rows here
-          keeps the fixed dialog from snapping between content heights. */}
-      <div
-        className={cn(
-          'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
-          isAgentAction ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
-        )}
-        aria-hidden={!isAgentAction}
-      >
-        <div className="min-h-0">
-          <div
-            className={cn(
-              'space-y-2 px-1 pt-1 pb-4 transition-[opacity,transform] duration-150 ease-out',
-              isAgentAction
-                ? 'translate-y-0 opacity-100 delay-200'
-                : '-translate-y-1 opacity-0 delay-0'
-            )}
-          >
-            <Label>
-              {translate(
-                'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.0adba8fa0c',
-                'Agent'
+      <TerminalQuickCommandCollapsibleRow open={isAgentAction} className="space-y-2 px-1 pt-1 pb-4">
+        <Label>
+          {translate(
+            'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.0adba8fa0c',
+            'Agent'
+          )}
+        </Label>
+        <Select
+          value={selectedAgent}
+          disabled={!isAgentAction}
+          onValueChange={(agent) => {
+            const nextAgent = agent as TuiAgent
+            draftMemoryRef.current = {
+              ...draftMemoryRef.current,
+              agent: nextAgent
+            }
+            setDraft((current) =>
+              isTerminalAgentQuickCommand(current) ? { ...current, agent: nextAgent } : current
+            )
+          }}
+        >
+          <SelectTrigger>
+            <SelectValue
+              placeholder={translate(
+                'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.346d409ab2',
+                'Choose agent'
               )}
-            </Label>
-            <Select
-              value={selectedAgent}
-              disabled={!isAgentAction}
-              onValueChange={(agent) => {
-                const nextAgent = agent as TuiAgent
-                draftMemoryRef.current = {
-                  ...draftMemoryRef.current,
-                  agent: nextAgent
-                }
-                setDraft((current) =>
-                  isTerminalAgentQuickCommand(current) ? { ...current, agent: nextAgent } : current
-                )
-              }}
-            >
-              <SelectTrigger>
-                <SelectValue
-                  placeholder={translate(
-                    'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.346d409ab2',
-                    'Choose agent'
-                  )}
-                />
-              </SelectTrigger>
-              <SelectContent
-                position="popper"
-                side="bottom"
-                align="start"
-                sideOffset={4}
-                className="max-h-[min(20rem,var(--radix-select-content-available-height))] w-[--radix-select-trigger-width]"
-              >
-                {QUICK_COMMAND_AGENT_OPTIONS.map((entry) => {
-                  const supported = supportsTerminalAgentQuickCommand(entry.id)
-                  return (
-                    <SelectItem key={entry.id} value={entry.id} disabled={!supported}>
-                      <span className="flex min-w-0 items-center gap-2">
-                        <AgentIcon agent={entry.id} size={16} />
-                        <span className="flex min-w-0 flex-col">
-                          <span className="truncate">{entry.label}</span>
-                          {!supported ? (
-                            <span className="truncate text-xs text-muted-foreground">
-                              {translate(
-                                'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.026cfb232a',
-                                'Does not support prompt commands'
-                              )}
-                            </span>
-                          ) : null}
+            />
+          </SelectTrigger>
+          <SelectContent
+            position="popper"
+            side="bottom"
+            align="start"
+            sideOffset={4}
+            className="max-h-[min(20rem,var(--radix-select-content-available-height))] w-[--radix-select-trigger-width]"
+          >
+            {QUICK_COMMAND_AGENT_OPTIONS.map((entry) => {
+              const supported = supportsTerminalAgentQuickCommand(entry.id)
+              return (
+                <SelectItem key={entry.id} value={entry.id} disabled={!supported}>
+                  <span className="flex min-w-0 items-center gap-2">
+                    <AgentIcon agent={entry.id} size={16} />
+                    <span className="flex min-w-0 flex-col">
+                      <span className="truncate">{entry.label}</span>
+                      {!supported ? (
+                        <span className="truncate text-xs text-muted-foreground">
+                          {translate(
+                            'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.026cfb232a',
+                            'Does not support prompt commands'
+                          )}
                         </span>
-                      </span>
-                    </SelectItem>
-                  )
-                })}
-              </SelectContent>
-            </Select>
-          </div>
-        </div>
-      </div>
+                      ) : null}
+                    </span>
+                  </span>
+                </SelectItem>
+              )
+            })}
+          </SelectContent>
+        </Select>
+      </TerminalQuickCommandCollapsibleRow>
 
       <div className="space-y-2">
         <Label>
@@ -129,7 +112,7 @@ export function TerminalQuickCommandContentSection({
                 'Command Text'
               )}
         </Label>
-        <textarea
+        <Textarea
           value={isTerminalAgentQuickCommand(draft) ? draft.prompt : draft.command}
           onChange={(event) => {
             const text = event.target.value
@@ -159,44 +142,31 @@ export function TerminalQuickCommandContentSection({
                   'npm run dev'
                 )
           }
-          rows={4}
+          rows={8}
+          spellCheck={isAgentAction}
           className={cn(
-            'min-h-24 w-full resize-y rounded-md border border-input bg-transparent px-3 py-2 text-sm shadow-xs outline-none transition-[color,box-shadow] focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50',
+            'max-h-[40vh] min-h-40 resize-y text-sm leading-relaxed',
             !isAgentAction && 'font-mono'
           )}
         />
       </div>
 
-      <div
-        className={cn(
-          'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
-          isAgentAction ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
-        )}
-        aria-hidden={!isAgentAction}
+      <TerminalQuickCommandCollapsibleRow
+        open={isAgentAction}
+        className="px-1 pt-2 text-xs text-muted-foreground"
       >
-        <div className="min-h-0">
-          <p
-            className={cn(
-              'px-1 pt-2 text-xs text-muted-foreground transition-[opacity,transform] duration-150 ease-out',
-              isAgentAction
-                ? 'translate-y-0 opacity-100 delay-200'
-                : '-translate-y-1 opacity-0 delay-0'
-            )}
-          >
-            {translate(
-              'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.e604bd40d6',
-              'Supports skills, file paths, and built-in commands like'
-            )}{' '}
-            <code className="rounded bg-muted px-1 font-mono text-[11px]">
-              {translate(
-                'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.97e96cc027',
-                '/goal'
-              )}
-            </code>
-            .
-          </p>
-        </div>
-      </div>
+        {translate(
+          'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.e604bd40d6',
+          'Supports skills, file paths, and built-in commands like'
+        )}{' '}
+        <code className="rounded bg-muted px-1 font-mono text-[11px]">
+          {translate(
+            'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.97e96cc027',
+            '/goal'
+          )}
+        </code>
+        .
+      </TerminalQuickCommandCollapsibleRow>
     </div>
   )
 }
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.tsx
index 493eb755bd6..1c9c615d72d 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.tsx
@@ -40,6 +40,9 @@ type TerminalQuickCommandDialogProps = {
   mode: TerminalQuickCommandDialogMode
   command: TerminalQuickCommand
   repos?: readonly Pick<Repo, 'id' | 'displayName' | 'path' | 'badgeColor'>[]
+  /** Settings has no ambient workspace to imply scope from, so it opens the
+   *  Advanced section up front. In-workspace entry points leave it collapsed. */
+  defaultAdvancedOpen?: boolean
   onOpenChange: (open: boolean) => void
   onSave: (command: TerminalQuickCommand) => void
 }
@@ -63,6 +66,7 @@ export function TerminalQuickCommandDialog({
   mode,
   command,
   repos = EMPTY_REPOS,
+  defaultAdvancedOpen = false,
   onOpenChange,
   onSave
 }: TerminalQuickCommandDialogProps): React.JSX.Element {
@@ -76,7 +80,7 @@ export function TerminalQuickCommandDialog({
   const lastRepoScopeIdRef = useRef<string | null>(
     initialScope.type === 'repo' ? initialScope.repoId : null
   )
-  const [advancedOpen, setAdvancedOpen] = useState(false)
+  const [advancedOpen, setAdvancedOpen] = useState(defaultAdvancedOpen)
   const selectedAction = getTerminalQuickCommandAction(draft)
   const selectedScope = getTerminalQuickCommandScope(draft)
   const isAgentAction = isTerminalAgentQuickCommand(draft)
@@ -95,7 +99,7 @@ export function TerminalQuickCommandDialog({
     draftMemoryRef.current = createTerminalQuickCommandDialogDraftMemory(command, fallbackAgent)
     const commandScope = getTerminalQuickCommandScope(command)
     lastRepoScopeIdRef.current = commandScope.type === 'repo' ? commandScope.repoId : null
-    setAdvancedOpen(false)
+    setAdvancedOpen(defaultAdvancedOpen)
     setDraft({ ...command })
   }
 
@@ -164,9 +168,12 @@ export function TerminalQuickCommandDialog({
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-md sm:max-w-md" showCloseButton={false}>
+      <DialogContent
+        className="max-h-[min(88vh,54rem)] grid-rows-[auto_minmax(0,1fr)_auto] sm:max-w-xl"
+        showCloseButton={false}
+      >
         <DialogHeader>
-          <DialogTitle className="text-sm">
+          <DialogTitle>
             {mode === 'edit'
               ? translate(
                   'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.f9b184fc16',
@@ -177,7 +184,7 @@ export function TerminalQuickCommandDialog({
                   'Add Quick Command'
                 )}
           </DialogTitle>
-          <DialogDescription className="text-xs">
+          <DialogDescription>
             {translate(
               'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.ed04233b3e',
               'Save terminal commands or agent prompts for quick access.'
@@ -185,8 +192,11 @@ export function TerminalQuickCommandDialog({
           </DialogDescription>
         </DialogHeader>
 
+        {/* Why -mx-3/px-3: overflow clips at the padding box, so the padding has
+            to cover the widest negative margin inside (Advanced's -ml-2) plus a
+            focus ring. The matching negative margin keeps children aligned. */}
         <div
-          className="space-y-4"
+          className="-mx-3 min-h-0 space-y-4 overflow-y-auto px-3 py-1 scrollbar-sleek"
           onKeyDown={(event) => {
             if (isScreenSubmitShortcut(event) && canSave) {
               event.preventDefault()
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialogFooter.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialogFooter.tsx
index 6bcd65fd7b7..d2f98bef2c7 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialogFooter.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialogFooter.tsx
@@ -1,5 +1,7 @@
 import { Button } from '@/components/ui/button'
 import { DialogFooter } from '@/components/ui/dialog'
+import { ShortcutKeyCombo } from '@/components/ShortcutKeyCombo'
+import { getScreenSubmitModifierLabel } from '@/lib/screen-submit-shortcut'
 import { translate } from '@/i18n/i18n'
 
 type TerminalQuickCommandDialogFooterProps = {
@@ -16,7 +18,7 @@ export function TerminalQuickCommandDialogFooter({
   onSave
 }: TerminalQuickCommandDialogFooterProps): React.JSX.Element {
   return (
-    <DialogFooter>
+    <DialogFooter className="sm:items-center">
       <Button type="button" variant="outline" onClick={onCancel}>
         {translate(
           'auto.components.terminal.quick.commands.TerminalQuickCommandDialogFooter.28370f16b9',
@@ -37,7 +39,11 @@ export function TerminalQuickCommandDialogFooter({
           'auto.components.terminal.quick.commands.TerminalQuickCommandDialogFooter.2e2b958dfc',
           'Save'
         )}
-        <span className="ml-1 text-[10px] opacity-60">{submitShortcutLabel}</span>
+        <ShortcutKeyCombo
+          keys={[getScreenSubmitModifierLabel(), 'Enter']}
+          className="ml-1"
+          keyCapClassName="border-primary-foreground/25 bg-primary-foreground/15 text-primary-foreground/80 shadow-none"
+        />
       </Button>
     </DialogFooter>
   )
diff --git a/src/renderer/src/components/ui/textarea.tsx b/src/renderer/src/components/ui/textarea.tsx
new file mode 100644
index 00000000000..5e78f5555ef
--- /dev/null
+++ b/src/renderer/src/components/ui/textarea.tsx
@@ -0,0 +1,28 @@
+import * as React from 'react'
+
+import { cn } from '@/lib/utils'
+
+const Textarea = React.forwardRef<HTMLTextAreaElement, React.ComponentProps<'textarea'>>(
+  ({ className, ...props }, ref) => {
+    return (
+      <textarea
+        ref={ref}
+        data-slot="textarea"
+        // Why scrollbar-sleek here: a textarea scrolls without an overflow class,
+        // so it escapes the scrollbar lint rule and paints Chromium's default
+        // light scrollbar on dark surfaces.
+        className={cn(
+          'scrollbar-sleek min-h-16 w-full min-w-0 rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none placeholder:text-muted-foreground/60 disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm dark:bg-input/30',
+          'focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50',
+          'aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40',
+          className
+        )}
+        {...props}
+      />
+    )
+  }
+)
+
+Textarea.displayName = 'Textarea'
+
+export { Textarea }
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.ts
index 4c686fb28c7..2384e4749b7 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.ts
@@ -289,7 +289,7 @@ function reportLateWorkspaceCleanupResult(
 
 function removeArrayEntry<T>(entries: T[], entry: T): void {
   const index = entries.indexOf(entry)
-  if (index >= 0) {
+  if (index !== -1) {
     entries.splice(index, 1)
   }
 }
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-post-batch-late-settlement.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-post-batch-late-settlement.ts
index 6239da304b2..280aabd6790 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-post-batch-late-settlement.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-post-batch-late-settlement.ts
@@ -253,7 +253,7 @@ function releaseSettledPostBatchState(state: PostBatchLateSettlementState): void
 
 function removeArrayEntry<T>(entries: T[], entry: T): void {
   const index = entries.indexOf(entry)
-  if (index >= 0) {
+  if (index !== -1) {
     entries.splice(index, 1)
   }
 }
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-skipped-ancestor-reclassification.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-skipped-ancestor-reclassification.ts
index e2bfd7a4c3c..cb301b557e2 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-skipped-ancestor-reclassification.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-skipped-ancestor-reclassification.ts
@@ -65,7 +65,7 @@ export function reclassifySkippedWorkspaceCleanupAncestors({
 
 function removeArrayEntry<T>(entries: T[], entry: T): void {
   const index = entries.indexOf(entry)
-  if (index >= 0) {
+  if (index !== -1) {
     entries.splice(index, 1)
   }
 }
diff --git a/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx b/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx
new file mode 100644
index 00000000000..524707485f6
--- /dev/null
+++ b/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx
@@ -0,0 +1,59 @@
+// @vitest-environment happy-dom
+
+import { useRef } from 'react'
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { WorkspaceEmojiSuggestionPopover } from './WorkspaceEmojiSuggestionPopover'
+import type { WorkspaceEmojiSuggestion } from '@/lib/workspace-emoji-shortcodes'
+
+Element.prototype.scrollIntoView ??= () => {}
+
+const SUGGESTIONS: WorkspaceEmojiSuggestion[] = [
+  { shortcode: 'smile', emoji: '😄' },
+  { shortcode: 'smiley', emoji: '😃' },
+  { shortcode: 'smirk', emoji: '😏' }
+]
+
+function PopoverHarness({ commandValue }: { commandValue: string }): React.JSX.Element {
+  const anchorRef = useRef<HTMLInputElement>(null)
+
+  return (
+    <div>
+      <input ref={anchorRef} aria-label="Workspace name" readOnly value=":smi" />
+      <WorkspaceEmojiSuggestionPopover
+        anchorRef={anchorRef}
+        commandValue={commandValue}
+        heading="Emoji"
+        onCommandValueChange={() => {}}
+        onOpenChange={() => {}}
+        onSelect={() => {}}
+        open
+        suggestions={SUGGESTIONS}
+      />
+    </div>
+  )
+}
+
+describe('WorkspaceEmojiSuggestionPopover', () => {
+  let scrollIntoView: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    scrollIntoView = vi.spyOn(Element.prototype, 'scrollIntoView').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    scrollIntoView.mockRestore()
+    cleanup()
+  })
+
+  it('scrolls the externally selected suggestion into view', async () => {
+    const { rerender } = render(<PopoverHarness commandValue="emoji:smile" />)
+    await screen.findByText(':smirk:')
+    scrollIntoView.mockClear()
+
+    rerender(<PopoverHarness commandValue="emoji:smirk" />)
+
+    const scrolled = scrollIntoView.mock.instances as unknown as Element[]
+    expect(scrolled.some((node) => node.getAttribute('data-value') === 'emoji:smirk')).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.tsx b/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.tsx
index 7497f080a75..b54c6fcb205 100644
--- a/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.tsx
+++ b/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.tsx
@@ -1,4 +1,4 @@
-import type { ComponentProps, RefObject } from 'react'
+import { useEffect, useRef, type ComponentProps, type RefObject } from 'react'
 import { Command, CommandGroup, CommandItem, CommandList } from '@/components/ui/command'
 import { Popover, PopoverAnchor, PopoverContent } from '@/components/ui/popover'
 import { cn } from '@/lib/utils'
@@ -31,6 +31,28 @@ export function WorkspaceEmojiSuggestionPopover({
   side = 'top',
   suggestions
 }: WorkspaceEmojiSuggestionPopoverProps): React.JSX.Element {
+  const listRef = useRef<HTMLDivElement>(null)
+
+  // cmdk only auto-scrolls when it owns the arrow keys; here selection is driven from the input.
+  useEffect(() => {
+    if (!open || !commandValue) {
+      return
+    }
+    const item = Array.from(
+      listRef.current?.querySelectorAll<HTMLElement>('[cmdk-item=""]') ?? []
+    ).find((node) => node.getAttribute('data-value') === commandValue)
+    if (!item) {
+      return
+    }
+    if (item.parentElement?.firstElementChild === item) {
+      item
+        .closest('[cmdk-group=""]')
+        ?.querySelector('[cmdk-group-heading=""]')
+        ?.scrollIntoView({ block: 'nearest' })
+    }
+    item.scrollIntoView({ block: 'nearest' })
+  }, [commandValue, open, suggestions])
+
   return (
     <Popover open={open} onOpenChange={onOpenChange}>
       <PopoverAnchor virtualRef={anchorRef as RefObject<HTMLInputElement>} />
@@ -64,7 +86,7 @@ export function WorkspaceEmojiSuggestionPopover({
           shouldFilter={false}
           className="bg-transparent"
         >
-          <CommandList className="!max-h-none min-h-0 flex-1 scrollbar-sleek">
+          <CommandList ref={listRef} className="!max-h-none min-h-0 flex-1 scrollbar-sleek">
             <CommandGroup heading={heading} className="p-1">
               {suggestions.map((suggestion) => (
                 <CommandItem
diff --git a/src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts b/src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts
index 31bdaf65d5e..788e9e8d871 100644
--- a/src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts
+++ b/src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts
@@ -13,15 +13,15 @@ function sourceBetween(startPattern: string, endPattern: string): string {
 }
 
 describe('WorktreeJumpPalette source-context boundaries', () => {
-  it('defers pasted GitHub URL resolution to the composer so cross-project detection runs', () => {
-    // Why: pasting a cross-project URL must surface the same "Switch project?"
-    // prompt as Cmd+N. The palette hands the raw URL to the composer's name
-    // field instead of pre-resolving it against an arbitrary repo, which
-    // silently linked cross-project items to the wrong project.
+  it('attaches a resolved GitHub URL entity and leaves GitLab/Jira as raw URLs', () => {
+    // Why: GitHub create reuses the Cmd+J preview (lookup lives in the effect,
+    // not Case 1). GitLab/Jira still hand the raw URL to the composer.
     const githubLinkSection = sourceBetween(
-      '// Case 1: user pasted a GH issue/PR URL.',
+      '// Case 1: user pasted a GH/GitLab/Jira URL.',
       '// Case 2: user typed a raw issue number.'
     )
+    expect(githubLinkSection).toContain('linkedWorkItem')
+    expect(githubLinkSection).toContain('initialGitHubWorkItem: item')
     expect(githubLinkSection).toContain('prefilledName: trimmed')
     expect(githubLinkSection).not.toContain('lookupGitHubWorkItemByOwnerRepoForSource')
   })
diff --git a/src/renderer/src/hooks/direct-ssh-host-hydration.test.ts b/src/renderer/src/hooks/direct-ssh-host-hydration.test.ts
index 71d29e256e6..3f8a00813eb 100644
--- a/src/renderer/src/hooks/direct-ssh-host-hydration.test.ts
+++ b/src/renderer/src/hooks/direct-ssh-host-hydration.test.ts
@@ -3,7 +3,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { HostLineageSnapshot } from '../../../shared/host-lineage-contract'
 import type { HostRepoCatalogSnapshot } from '../../../shared/host-repo-catalog-contract'
 import type { DirectSshAuthority, SshProviderEpoch } from '../../../shared/ssh-types'
-import type { Repo } from '../../../shared/types'
+import type { Repo, WorktreeLineage, WorkspaceLineage } from '../../../shared/types'
 import { folderWorkspaceKey, worktreeWorkspaceKey } from '../../../shared/workspace-scope'
 import type { AppState } from '../store/types'
 import { createDirectSshHostHydration } from './direct-ssh-host-hydration'
@@ -40,6 +40,34 @@ function state(overrides: Record<string, unknown> = {}): AppState {
   } as unknown as AppState
 }
 
+function productionLineage(worktreeId: string, parentWorktreeId: string): WorktreeLineage {
+  return {
+    worktreeId,
+    worktreeInstanceId: `${worktreeId}-instance`,
+    parentWorktreeId,
+    parentWorktreeInstanceId: `${parentWorktreeId}-instance`,
+    origin: 'orchestration',
+    capture: { source: 'orchestration-context', confidence: 'explicit' },
+    taskId: 'task-1',
+    coordinatorHandle: 'coord-1',
+    createdAt: 1
+  }
+}
+
+function productionWorkspaceLineage(childId: string, parentId: string): WorkspaceLineage {
+  return {
+    childWorkspaceKey: worktreeWorkspaceKey(childId),
+    childInstanceId: `${childId}-instance`,
+    parentWorkspaceKey: worktreeWorkspaceKey(parentId),
+    parentInstanceId: `${parentId}-instance`,
+    origin: 'orchestration',
+    capture: { source: 'orchestration-context', confidence: 'explicit' },
+    taskId: 'task-1',
+    coordinatorHandle: 'coord-1',
+    createdAt: 1
+  }
+}
+
 function hostSnapshot(
   owner: DirectSshAuthority,
   repos: ReturnType<typeof repo>[]
@@ -341,6 +369,79 @@ describe('createDirectSshHostHydration', () => {
     })
   })
 
+  it('keeps lineage map identity for a cloned no-op host snapshot', async () => {
+    const owner = authority()
+    const hostLineage = productionLineage('a::/work', 'a::/parent')
+    const foreignLineage = productionLineage('b::/work', 'b::/parent')
+    const hostWorkspace = productionWorkspaceLineage('a::/work', 'a::/parent')
+    const foreignWorkspace = productionWorkspaceLineage('b::/work', 'b::/parent')
+    const store = createStore<AppState>(() =>
+      state({
+        repos: [repo('a', 'target-a'), repo('b', 'target-b')],
+        worktreesByRepo: {
+          a: [{ id: 'a::/work', repoId: 'a', hostId: 'ssh:target-a' }],
+          b: [{ id: 'b::/work', repoId: 'b', hostId: 'ssh:target-b' }]
+        },
+        worktreeLineageById: {
+          'a::/work': hostLineage,
+          'b::/work': foreignLineage
+        },
+        workspaceLineageByChildKey: {
+          [worktreeWorkspaceKey('a::/work')]: hostWorkspace,
+          [worktreeWorkspaceKey('b::/work')]: foreignWorkspace
+        }
+      })
+    )
+    const snapshot: HostLineageSnapshot = {
+      authoritative: true,
+      authority: {
+        kind: 'direct-ssh',
+        executionHostId: 'ssh:target-a',
+        ...owner
+      },
+      worktreeLineageById: {
+        'a::/work': hostLineage
+      },
+      workspaceLineageByChildKey: {
+        [worktreeWorkspaceKey('a::/work')]: hostWorkspace
+      }
+    }
+    let publications = 0
+    store.subscribe(() => {
+      publications += 1
+    })
+    const hydration = createDirectSshHostHydration({
+      store,
+      listRepos: vi.fn(),
+      listLineage: vi.fn(async () => structuredClone(snapshot)),
+      isCurrentAuthority: () => true
+    })
+    const beforeLineage = store.getState().worktreeLineageById
+    const beforeWorkspace = store.getState().workspaceLineageByChildKey
+
+    await expect(
+      hydration.readHostScopedLineage({
+        ...owner,
+        catalogRevision: 0,
+        repoRefs: [{ repoId: 'a', executionHostId: 'ssh:target-a' }],
+        authorityRequirement: 'required',
+        reason: 'reconnect'
+      })
+    ).resolves.toBe('complete')
+
+    expect(store.getState().worktreeLineageById).toBe(beforeLineage)
+    expect(store.getState().workspaceLineageByChildKey).toBe(beforeWorkspace)
+    expect(store.getState().worktreeLineageById['a::/work']).toBe(hostLineage)
+    expect(store.getState().worktreeLineageById['b::/work']).toBe(foreignLineage)
+    expect(store.getState().workspaceLineageByChildKey[worktreeWorkspaceKey('a::/work')]).toBe(
+      hostWorkspace
+    )
+    expect(store.getState().workspaceLineageByChildKey[worktreeWorkspaceKey('b::/work')]).toBe(
+      foreignWorkspace
+    )
+    expect(publications).toBe(0)
+  })
+
   it('rejects lineage captured before a newer same-authority catalog revision', async () => {
     const owner = authority()
     const store = createStore<AppState>(() =>
diff --git a/src/renderer/src/hooks/direct-ssh-host-hydration.ts b/src/renderer/src/hooks/direct-ssh-host-hydration.ts
index d3a5a2bc366..069b3b3d323 100644
--- a/src/renderer/src/hooks/direct-ssh-host-hydration.ts
+++ b/src/renderer/src/hooks/direct-ssh-host-hydration.ts
@@ -5,6 +5,7 @@ import type { HostRepoCatalogSnapshot } from '../../../shared/host-repo-catalog-
 import type { DirectSshAuthority } from '../../../shared/ssh-types'
 import { isWorkspaceKey } from '../../../shared/workspace-scope'
 import type { AppState } from '../store/types'
+import { reuseEqualRecordMap } from '../store/slices/repo-identity-reconcile'
 import type {
   DirectSshLineageOutcome,
   DirectSshPreparationInput,
@@ -71,6 +72,20 @@ function mergeExactHostCatalog(state: AppState, snapshot: HostRepoCatalogSnapsho
   }
 }
 
+// Why: the host owns every in-scope key, so drop the stale in-scope rows, overlay the snapshot's,
+// and leave out-of-scope hosts alone. Reusing equal rows keeps a cloned no-op read from republishing.
+function overlayHostScopedLineage<T>(
+  previous: Readonly<Record<string, T>>,
+  incoming: Readonly<Record<string, T>>,
+  isHostScoped: (key: string) => boolean
+): Readonly<Record<string, T>> {
+  const next: Record<string, T> = Object.fromEntries([
+    ...Object.entries(previous).filter(([key]) => !isHostScoped(key)),
+    ...Object.entries(incoming).filter(([key]) => isHostScoped(key))
+  ])
+  return reuseEqualRecordMap(previous, next)
+}
+
 function mergeExactHostLineage(
   state: AppState,
   snapshot: Extract<HostLineageSnapshot, { authoritative: true }>,
@@ -78,38 +93,23 @@ function mergeExactHostLineage(
   catalogRevision: number
 ): AppState {
   const scope = directSshHostHydrationScope(state, authority, catalogRevision)
-  const worktreeLineageById = Object.fromEntries(
-    Object.entries(state.worktreeLineageById).filter(
-      ([worktreeId]) => !scope.gitWorktreeIds.has(worktreeId)
-    )
+  const worktreeLineageById = overlayHostScopedLineage(
+    state.worktreeLineageById,
+    snapshot.worktreeLineageById,
+    (worktreeId) => scope.gitWorktreeIds.has(worktreeId)
   )
-  const workspaceLineageByChildKey = Object.fromEntries(
-    Object.entries(state.workspaceLineageByChildKey).filter(
-      ([childKey]) => !isWorkspaceKey(childKey) || !scope.lineageWorkspaceKeys.has(childKey)
-    )
+  const workspaceLineageByChildKey = overlayHostScopedLineage(
+    state.workspaceLineageByChildKey,
+    snapshot.workspaceLineageByChildKey,
+    (childKey) => isWorkspaceKey(childKey) && scope.lineageWorkspaceKeys.has(childKey)
   )
-  const incomingWorktreeLineage = Object.fromEntries(
-    Object.entries(snapshot.worktreeLineageById).filter(([worktreeId]) =>
-      scope.gitWorktreeIds.has(worktreeId)
-    )
-  )
-  const incomingWorkspaceLineage = Object.fromEntries(
-    Object.entries(snapshot.workspaceLineageByChildKey).filter(
-      ([workspaceKey]) =>
-        isWorkspaceKey(workspaceKey) && scope.lineageWorkspaceKeys.has(workspaceKey)
-    )
-  )
-  return {
-    ...state,
-    worktreeLineageById: {
-      ...worktreeLineageById,
-      ...incomingWorktreeLineage
-    },
-    workspaceLineageByChildKey: {
-      ...workspaceLineageByChildKey,
-      ...incomingWorkspaceLineage
-    }
+  if (
+    worktreeLineageById === state.worktreeLineageById &&
+    workspaceLineageByChildKey === state.workspaceLineageByChildKey
+  ) {
+    return state
   }
+  return { ...state, worktreeLineageById, workspaceLineageByChildKey }
 }
 
 export function createDirectSshHostHydration(
diff --git a/src/renderer/src/hooks/direct-ssh-reconnect-coordinator-stabilization.ts b/src/renderer/src/hooks/direct-ssh-reconnect-coordinator-stabilization.ts
index 9924e55d70b..f20ea1e4a30 100644
--- a/src/renderer/src/hooks/direct-ssh-reconnect-coordinator-stabilization.ts
+++ b/src/renderer/src/hooks/direct-ssh-reconnect-coordinator-stabilization.ts
@@ -5,7 +5,7 @@ export type DirectSshReconnectTargetState = {
   authority: DirectSshAuthority
   installedAt: number
   dampUntil: number | null
-  timer: DirectSshReconnectTimer | null
+  timer: DirectSshReconnectTimer
 }
 
 export function createDirectSshReconnectTargetState(
diff --git a/src/renderer/src/hooks/installed-agent-skill-discovery-cache.test.ts b/src/renderer/src/hooks/installed-agent-skill-discovery-cache.test.ts
index ed23b3c5d76..0a99ddd26df 100644
--- a/src/renderer/src/hooks/installed-agent-skill-discovery-cache.test.ts
+++ b/src/renderer/src/hooks/installed-agent-skill-discovery-cache.test.ts
@@ -1,10 +1,11 @@
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { SkillDiscoveryResult } from '../../../shared/skills'
 import {
   clearInstalledAgentSkillDiscoveryCache,
   getInstalledAgentSkillDiscoveryCacheSizeForTests,
   hasInstalledAgentSkillDiscoveryCacheEntryForTests,
   INSTALLED_AGENT_SKILL_DISCOVERY_CACHE_MAX,
+  INSTALLED_AGENT_SKILL_DISCOVERY_FRESH_MS,
   peekInstalledAgentSkillDiscoveryCache,
   readInstalledAgentSkillDiscoveryCache,
   resetInstalledAgentSkillDiscoveryCacheForTests,
@@ -17,6 +18,7 @@ function result(scannedAt: number): SkillDiscoveryResult {
 
 afterEach(() => {
   resetInstalledAgentSkillDiscoveryCacheForTests()
+  vi.restoreAllMocks()
 })
 
 describe('installed agent skill discovery cache', () => {
@@ -89,4 +91,28 @@ describe('installed agent skill discovery cache', () => {
     expect(getInstalledAgentSkillDiscoveryCacheSizeForTests()).toBe(0)
     expect(peekInstalledAgentSkillDiscoveryCache('target')).toBeNull()
   })
+
+  it('stops serving a read once the freshness window lapses', () => {
+    const startedAt = 1_700_000_000_000
+    const nowSpy = vi.spyOn(Date, 'now').mockReturnValue(startedAt)
+    writeInstalledAgentSkillDiscoveryCache('target', result(1))
+
+    nowSpy.mockReturnValue(startedAt + INSTALLED_AGENT_SKILL_DISCOVERY_FRESH_MS - 1)
+    expect(readInstalledAgentSkillDiscoveryCache('target')).toEqual(result(1))
+
+    nowSpy.mockReturnValue(startedAt + INSTALLED_AGENT_SKILL_DISCOVERY_FRESH_MS)
+    expect(readInstalledAgentSkillDiscoveryCache('target')).toBeNull()
+    expect(getInstalledAgentSkillDiscoveryCacheSizeForTests()).toBe(0)
+  })
+
+  it('still peeks a lapsed result so a first render shows the last known state', () => {
+    const startedAt = 1_700_000_000_000
+    const nowSpy = vi.spyOn(Date, 'now').mockReturnValue(startedAt)
+    writeInstalledAgentSkillDiscoveryCache('target', result(1))
+
+    nowSpy.mockReturnValue(startedAt + INSTALLED_AGENT_SKILL_DISCOVERY_FRESH_MS + 1)
+
+    // A lapsed entry triggers a rescan; showing it beats flashing empty meanwhile.
+    expect(peekInstalledAgentSkillDiscoveryCache('target')).toEqual(result(1))
+  })
 })
diff --git a/src/renderer/src/hooks/installed-agent-skill-discovery-cache.ts b/src/renderer/src/hooks/installed-agent-skill-discovery-cache.ts
index a93abe2c3f9..29d30eb4c98 100644
--- a/src/renderer/src/hooks/installed-agent-skill-discovery-cache.ts
+++ b/src/renderer/src/hooks/installed-agent-skill-discovery-cache.ts
@@ -5,21 +5,44 @@ import type { SkillDiscoveryResult } from '../../../shared/skills'
 // the window has ever resolved.
 export const INSTALLED_AGENT_SKILL_DISCOVERY_CACHE_MAX = 256
 
-let cachedDiscoveryByTarget = new Map<string, SkillDiscoveryResult>()
+// Why: focus-triggered refreshes read through this cache instead of forcing a
+// disk walk, so it needs a lifetime — without one a non-forced read would never
+// see a skill installed outside Orca. Matches the focus-rescan cooldown the
+// freshness inventory already applies to its own scan (`useSkillFreshness`), so
+// the two disk-reading surfaces answer a burst of alt-tabs the same way.
+export const INSTALLED_AGENT_SKILL_DISCOVERY_FRESH_MS = 15_000
+
+type CachedDiscovery = { result: SkillDiscoveryResult; expiresAt: number }
+
+let cachedDiscoveryByTarget = new Map<string, CachedDiscovery>()
+
+function readUnexpired(key: string): CachedDiscovery | null {
+  const cached = cachedDiscoveryByTarget.get(key)
+  if (!cached) {
+    return null
+  }
+  if (cached.expiresAt <= Date.now()) {
+    cachedDiscoveryByTarget.delete(key)
+    return null
+  }
+  return cached
+}
 
 // Why: render reads must not reorder recency — React can discard a render pass.
 export function peekInstalledAgentSkillDiscoveryCache(key: string): SkillDiscoveryResult | null {
-  return cachedDiscoveryByTarget.get(key) ?? null
+  // Why: an expired entry is still the last thing this window knew, and showing it
+  // beats flashing empty while the refresh it triggers is in flight.
+  return cachedDiscoveryByTarget.get(key)?.result ?? null
 }
 
 export function readInstalledAgentSkillDiscoveryCache(key: string): SkillDiscoveryResult | null {
-  const result = cachedDiscoveryByTarget.get(key)
-  if (!result) {
+  const cached = readUnexpired(key)
+  if (!cached) {
     return null
   }
   cachedDiscoveryByTarget.delete(key)
-  cachedDiscoveryByTarget.set(key, result)
-  return result
+  cachedDiscoveryByTarget.set(key, cached)
+  return cached.result
 }
 
 export function writeInstalledAgentSkillDiscoveryCache(
@@ -27,7 +50,10 @@ export function writeInstalledAgentSkillDiscoveryCache(
   result: SkillDiscoveryResult
 ): void {
   cachedDiscoveryByTarget.delete(key)
-  cachedDiscoveryByTarget.set(key, result)
+  cachedDiscoveryByTarget.set(key, {
+    result,
+    expiresAt: Date.now() + INSTALLED_AGENT_SKILL_DISCOVERY_FRESH_MS
+  })
   while (cachedDiscoveryByTarget.size > INSTALLED_AGENT_SKILL_DISCOVERY_CACHE_MAX) {
     const oldestKey = cachedDiscoveryByTarget.keys().next().value
     if (oldestKey === undefined) {
diff --git a/src/renderer/src/hooks/installed-agent-skill-discovery.ts b/src/renderer/src/hooks/installed-agent-skill-discovery.ts
index a501611889c..2530bdeb11a 100644
--- a/src/renderer/src/hooks/installed-agent-skill-discovery.ts
+++ b/src/renderer/src/hooks/installed-agent-skill-discovery.ts
@@ -104,7 +104,10 @@ function startInstalledAgentSkillDiscovery(
 ): Promise<SkillDiscoveryResult> {
   const generation = discoveryGeneration
   const normalizedTarget = normalizeSkillDiscoveryTarget(target)
-  const discovery = discoverSkillsForRuntimeTarget(runtimeTarget, normalizedTarget)
+  // Why: a forced caller knows disk changed (install finished, explicit recheck),
+  // so it must also bypass the host's shared scans — not just this window's cache.
+  const requestTarget = force ? { ...normalizedTarget, refresh: true } : normalizedTarget
+  const discovery = discoverSkillsForRuntimeTarget(runtimeTarget, requestTarget)
     .then((result) => {
       if (generation === discoveryGeneration) {
         writeInstalledAgentSkillDiscoveryCache(key, result)
diff --git a/src/renderer/src/hooks/use-terminal-quick-command-hosts.ts b/src/renderer/src/hooks/use-terminal-quick-command-hosts.ts
index f8239f1dcb4..df70bb58fdc 100644
--- a/src/renderer/src/hooks/use-terminal-quick-command-hosts.ts
+++ b/src/renderer/src/hooks/use-terminal-quick-command-hosts.ts
@@ -43,11 +43,11 @@ type TerminalQuickCommandHostState = {
   remoteEnvironmentId: string | null
   remoteHostId: ExecutionHostId | null
   remoteState: RuntimeTerminalQuickCommands | undefined
-  runtimeEnvironments: PublicKnownRuntimeEnvironment[]
+  runtimeEnvironments: readonly PublicKnownRuntimeEnvironment[]
   settings: GlobalSettings | null
 }
 
-const EMPTY_RUNTIME_ENVIRONMENTS: PublicKnownRuntimeEnvironment[] = []
+const EMPTY_RUNTIME_ENVIRONMENTS: readonly PublicKnownRuntimeEnvironment[] = []
 const DISABLED_TERMINAL_QUICK_COMMAND_HOSTS: TerminalQuickCommandHost[] = []
 const DISABLED_TERMINAL_QUICK_COMMAND_HOST_STATE: TerminalQuickCommandHostState = {
   executionHostId: LOCAL_EXECUTION_HOST_ID,
diff --git a/src/renderer/src/hooks/useAgentDetectionTarget.test.ts b/src/renderer/src/hooks/useAgentDetectionTarget.test.ts
index 22ad26ae016..dd8f1b8176c 100644
--- a/src/renderer/src/hooks/useAgentDetectionTarget.test.ts
+++ b/src/renderer/src/hooks/useAgentDetectionTarget.test.ts
@@ -1,9 +1,31 @@
 import { describe, expect, it } from 'vitest'
 import type { FolderWorkspace, ProjectGroup, Repo } from '../../../shared/types'
 import { folderWorkspaceKey } from '../../../shared/workspace-scope'
-import { getAgentDetectionTargetKeyForWorktree } from './useAgentDetectionTarget'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
+import {
+  getAgentDetectionTargetKeyForWorktree,
+  parseAgentDetectionTargetKey
+} from './useAgentDetectionTarget'
 
 describe('getAgentDetectionTargetKeyForWorktree', () => {
+  it('carries explicit local Floating Workspace authority into detection', () => {
+    const state = {
+      settings: { activeRuntimeEnvironmentId: 'active-wsl-project' },
+      folderWorkspaces: [],
+      projectGroups: [],
+      repos: [],
+      worktreesByRepo: {}
+    } as Parameters<typeof getAgentDetectionTargetKeyForWorktree>[0]
+
+    const key = getAgentDetectionTargetKeyForWorktree(state, FLOATING_TERMINAL_WORKTREE_ID)
+
+    expect(parseAgentDetectionTargetKey(key)).toEqual({
+      kind: 'local',
+      worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+      contextKey: 'host'
+    })
+  })
+
   it('uses an explicit runtime owner without scanning ambiguous child SSH repos', () => {
     let projectGroupReads = 0
     const repos: readonly Repo[] = Array.from({ length: 100 }, (_, index) => {
@@ -139,3 +161,12 @@ describe('getAgentDetectionTargetKeyForWorktree', () => {
     expect(repoIdReads).toBe(100)
   })
 })
+
+describe('parseAgentDetectionTargetKey', () => {
+  it.each(['local:missing-context', 'local:%:host'])(
+    'falls back to unscoped local detection for malformed key %s',
+    (key) => {
+      expect(parseAgentDetectionTargetKey(key)).toEqual({ kind: 'local' })
+    }
+  )
+})
diff --git a/src/renderer/src/hooks/useAgentDetectionTarget.ts b/src/renderer/src/hooks/useAgentDetectionTarget.ts
index 5f00d3100b8..f8c5787a901 100644
--- a/src/renderer/src/hooks/useAgentDetectionTarget.ts
+++ b/src/renderer/src/hooks/useAgentDetectionTarget.ts
@@ -10,9 +10,16 @@ import { getResolvedExecutionHostIdForWorktree } from '@/lib/resolved-worktree-e
 import { parseExecutionHostId } from '../../../shared/execution-host'
 import { parseWorkspaceKey } from '../../../shared/workspace-scope'
 import type { AgentDetectionTarget } from './useDetectedAgents'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 
 export const AGENT_DETECTION_LOCAL_TARGET_KEY = 'local'
 
+function getLocalAgentDetectionTargetKey(worktreeId: string): string {
+  return worktreeId === FLOATING_TERMINAL_WORKTREE_ID
+    ? `${AGENT_DETECTION_LOCAL_TARGET_KEY}:${encodeURIComponent(worktreeId)}:host`
+    : AGENT_DETECTION_LOCAL_TARGET_KEY
+}
+
 type AgentDetectionOwnerState = Parameters<typeof getConnectionIdFromState>[0] &
   WorktreeRuntimeOwnerState
 
@@ -57,7 +64,7 @@ export function getAgentDetectionTargetKeyForWorktree(
   if (executionHost?.kind === 'runtime') {
     return `runtime:${executionHost.environmentId}`
   }
-  return AGENT_DETECTION_LOCAL_TARGET_KEY
+  return getLocalAgentDetectionTargetKey(worktreeId)
 }
 
 export function parseAgentDetectionTargetKey(
@@ -69,6 +76,23 @@ export function parseAgentDetectionTargetKey(
   if (key === AGENT_DETECTION_LOCAL_TARGET_KEY) {
     return { kind: 'local' }
   }
+  if (key.startsWith(`${AGENT_DETECTION_LOCAL_TARGET_KEY}:`)) {
+    const [encodedWorktreeId, encodedContextKey] = key
+      .slice(`${AGENT_DETECTION_LOCAL_TARGET_KEY}:`.length)
+      .split(':')
+    if (!encodedWorktreeId || !encodedContextKey) {
+      return { kind: 'local' }
+    }
+    try {
+      return {
+        kind: 'local',
+        worktreeId: decodeURIComponent(encodedWorktreeId),
+        contextKey: decodeURIComponent(encodedContextKey)
+      }
+    } catch {
+      return { kind: 'local' }
+    }
+  }
   if (key.startsWith('ssh:')) {
     return { kind: 'ssh', connectionId: key.slice('ssh:'.length) }
   }
diff --git a/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts b/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
index 46585b0091c..557663a8a25 100644
--- a/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
+++ b/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
@@ -5,6 +5,7 @@ const mockLaunchAgentBackgroundSession = vi.fn()
 const mockLaunchWorktreeBackgroundTerminals = vi.fn()
 const mockFindReusableAutomationSession = vi.fn()
 const mockObserveExistingAutomationSession = vi.fn()
+const mockSubmitPromptToAgentPty = vi.fn()
 const mockCreateWorktree = vi.fn()
 const mockMarkDispatchResult = vi.fn()
 const mockOnDispatchRequested = vi.fn()
@@ -14,6 +15,11 @@ const mockReleaseTerminalOwnership = vi.fn()
 const mockSshNeedsPassphrasePrompt = vi.fn()
 const mockSshGetState = vi.fn()
 const mockSshConnect = vi.fn()
+let latestStoreSubscriber: (() => void) | null = null
+const mockStoreSubscribe = vi.fn((listener: () => void) => {
+  latestStoreSubscriber = listener
+  return () => {}
+})
 
 const setupLaunch = {
   runnerScriptPath: '/tmp/setup.sh',
@@ -124,7 +130,9 @@ vi.mock('@/lib/launch-worktree-background-terminals', () => ({
   launchWorktreeBackgroundTerminals: mockLaunchWorktreeBackgroundTerminals
 }))
 
-vi.mock('@/lib/agent-paste-draft', () => ({}))
+vi.mock('@/lib/agent-paste-draft', () => ({
+  submitPromptToAgentPty: mockSubmitPromptToAgentPty
+}))
 
 vi.mock('@/lib/automation-session-reuse', () => ({
   findReusableAutomationSession: mockFindReusableAutomationSession
@@ -137,9 +145,20 @@ vi.mock('@/lib/automation-session-observer', () => ({
 vi.mock('@/components/automations/automation-run-output-snapshot', () => ({
   createAutomationRunOutputSnapshotBuffer: () => ({
     append: vi.fn(),
-    snapshot: () => ''
+    snapshot: () => null
   }),
-  selectAutomationRunOutputSnapshot: () => null
+  selectAutomationRunOutputSnapshot: (
+    assistantMessage: string | null | undefined,
+    terminalSnapshot: unknown
+  ) =>
+    assistantMessage
+      ? {
+          format: 'plain_text',
+          content: assistantMessage,
+          capturedAt: 1,
+          truncated: false
+        }
+      : terminalSnapshot
 }))
 
 vi.mock('@/i18n/i18n', () => ({
@@ -153,7 +172,7 @@ vi.mock('@/lib/browser-uuid', () => ({
 vi.mock('@/store', () => ({
   useAppStore: {
     getState: () => state,
-    subscribe: vi.fn(() => () => {})
+    subscribe: mockStoreSubscribe
   }
 }))
 
@@ -171,6 +190,7 @@ describe('useAutomationDispatchEvents setup launch', () => {
     state.projectGroups = []
     state.worktreesByRepo = {}
     state.agentStatusByPaneKey = {}
+    latestStoreSubscriber = null
     state.allWorktrees.mockReturnValue([])
     state.getKnownWorktreeById.mockReturnValue(undefined)
     mockCreateWorktree.mockResolvedValue({ worktree: createdWorktree, setup: setupLaunch })
@@ -189,6 +209,7 @@ describe('useAutomationDispatchEvents setup launch', () => {
     mockSshNeedsPassphrasePrompt.mockResolvedValue(false)
     mockSshGetState.mockResolvedValue({ status: 'connected' })
     mockSshConnect.mockResolvedValue({ status: 'connected' })
+    mockSubmitPromptToAgentPty.mockResolvedValue(true)
     vi.stubGlobal('window', {
       api: {
         automations: {
@@ -581,6 +602,132 @@ describe('useAutomationDispatchEvents setup launch', () => {
     await vi.waitFor(() => expect(mockFinalizeTerminalOwnership).toHaveBeenCalledOnce())
   })
 
+  it('persists assistant output from a batched working→done→working transition', async () => {
+    const paneKey = 'agent-tab:7c6fb4e5-3bf1-4ff4-8259-03f7ae81c40d'
+
+    await registerAndDispatch()
+    const transitionStartedAt = Date.now() + 1
+    state.agentStatusByPaneKey = {
+      [paneKey]: {
+        paneKey,
+        state: 'working',
+        prompt: 'second turn',
+        agentType: 'claude',
+        updatedAt: transitionStartedAt + 2,
+        stateStartedAt: transitionStartedAt + 2,
+        lastCompletedAssistantMessage: 'Summary.\n\nDetails.',
+        stateHistory: [
+          { state: 'working', prompt: 'first turn', startedAt: transitionStartedAt },
+          { state: 'done', prompt: 'first turn', startedAt: transitionStartedAt + 1 }
+        ]
+      }
+    }
+    if (!latestStoreSubscriber) {
+      throw new Error('agent status observer was not registered')
+    }
+    latestStoreSubscriber()
+
+    await vi.waitFor(() => expect(mockFinalizeTerminalOwnership).toHaveBeenCalledOnce())
+    expect(mockMarkDispatchResult).toHaveBeenCalledWith(
+      expect.objectContaining({
+        runId: 'run-1',
+        status: 'completed',
+        outputSnapshot: {
+          format: 'plain_text',
+          content: 'Summary.\n\nDetails.',
+          capturedAt: 1,
+          truncated: false
+        }
+      })
+    )
+  })
+
+  it('does not let later working authorize an earlier historical done on rescan', async () => {
+    const paneKey = 'agent-tab:7c6fb4e5-3bf1-4ff4-8259-03f7ae81c40d'
+    mockFindReusableAutomationSession.mockReturnValue({
+      tabId: 'agent-tab',
+      paneKey,
+      ptyId: 'agent-pty'
+    })
+    mockObserveExistingAutomationSession.mockResolvedValue(() => {})
+
+    await registerAndDispatch(makeAutomation({ reuseSession: true }))
+    const transitionStartedAt = Date.now() + 1
+    state.agentStatusByPaneKey = {
+      [paneKey]: {
+        paneKey,
+        state: 'working',
+        prompt: 'new turn',
+        agentType: 'claude',
+        updatedAt: transitionStartedAt + 1,
+        stateStartedAt: transitionStartedAt + 1,
+        stateHistory: [{ state: 'done', prompt: 'old turn', startedAt: transitionStartedAt }]
+      }
+    }
+    if (!latestStoreSubscriber) {
+      throw new Error('agent status observer was not registered')
+    }
+
+    latestStoreSubscriber()
+    latestStoreSubscriber()
+    await Promise.resolve()
+
+    expect(mockMarkDispatchResult).not.toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'completed' })
+    )
+  })
+
+  // Why: transport loss, PTY exit and cap eviction all drop and recreate the live
+  // entry with an empty stateHistory. The working edge is only in the observer's
+  // own bookkeeping by then, so it must survive a zero-overlap rescan.
+  it('completes a reuse-session run when the entry is recreated with no history', async () => {
+    const paneKey = 'agent-tab:7c6fb4e5-3bf1-4ff4-8259-03f7ae81c40d'
+    mockFindReusableAutomationSession.mockReturnValue({
+      tabId: 'agent-tab',
+      paneKey,
+      ptyId: 'agent-pty'
+    })
+    mockObserveExistingAutomationSession.mockResolvedValue(() => {})
+
+    await registerAndDispatch(makeAutomation({ reuseSession: true }))
+    const workingStartedAt = Date.now() + 1
+    state.agentStatusByPaneKey = {
+      [paneKey]: {
+        paneKey,
+        state: 'working',
+        prompt: 'turn',
+        agentType: 'claude',
+        updatedAt: workingStartedAt,
+        stateStartedAt: workingStartedAt,
+        stateHistory: [{ state: 'working', prompt: 'turn', startedAt: workingStartedAt }]
+      }
+    }
+    if (!latestStoreSubscriber) {
+      throw new Error('agent status observer was not registered')
+    }
+    latestStoreSubscriber()
+    await Promise.resolve()
+
+    // The entry is dropped and recreated: same pane, now done, history gone.
+    state.agentStatusByPaneKey = {
+      [paneKey]: {
+        paneKey,
+        state: 'done',
+        prompt: 'turn',
+        agentType: 'claude',
+        updatedAt: workingStartedAt + 2,
+        stateStartedAt: workingStartedAt + 2,
+        stateHistory: []
+      }
+    }
+    latestStoreSubscriber()
+    await Promise.resolve()
+
+    expect(mockMarkDispatchResult).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'completed' })
+    )
+  })
+
   it('consumes duplicate done and zero-exit completion through one finalizer', async () => {
     let launchArgs: {
       onAgentStatus?: (payload: { state: string }) => void
diff --git a/src/renderer/src/hooks/useAutomationDispatchEvents.ts b/src/renderer/src/hooks/useAutomationDispatchEvents.ts
index f4ae2067688..a7741ec959e 100644
--- a/src/renderer/src/hooks/useAutomationDispatchEvents.ts
+++ b/src/renderer/src/hooks/useAutomationDispatchEvents.ts
@@ -32,6 +32,7 @@ import {
 } from '../../../shared/execution-host'
 import { parseWorkspaceKey } from '../../../shared/workspace-scope'
 import { getFolderWorkspaceConnectionId } from '@/lib/folder-workspace-connection'
+import type { AgentStateHistoryEntry } from '../../../shared/agent-status-types'
 
 const AUTOMATIONS_CHANGED_EVENT = 'orca:automations-changed'
 const activeReuseDispatchTabIds = new Set<string>()
@@ -54,6 +55,37 @@ function buildAutomationWorkspaceName(runTitle: string, scheduledFor: number): s
   return `auto-${slug || 'run'}-${stamp}`
 }
 
+function agentStateHistoryEntriesEqual(
+  left: AgentStateHistoryEntry,
+  right: AgentStateHistoryEntry
+): boolean {
+  return (
+    left.state === right.state &&
+    left.prompt === right.prompt &&
+    left.startedAt === right.startedAt &&
+    left.interrupted === right.interrupted
+  )
+}
+
+function getAgentStateHistoryOverlap(
+  previous: AgentStateHistoryEntry[],
+  current: AgentStateHistoryEntry[]
+): number {
+  for (let overlap = Math.min(previous.length, current.length); overlap > 0; overlap -= 1) {
+    const previousOffset = previous.length - overlap
+    if (
+      current
+        .slice(0, overlap)
+        .every((entry, index) =>
+          agentStateHistoryEntriesEqual(entry, previous[previousOffset + index])
+        )
+    ) {
+      return overlap
+    }
+  }
+  return 0
+}
+
 export function useAutomationDispatchEvents(): void {
   useEffect(() => {
     const unsubscribe = window.api.automations.onDispatchRequested(
@@ -405,12 +437,41 @@ export function useAutomationDispatchEvents(): void {
             options?: { requireWorkingAfterStart?: boolean }
           ): void => {
             let sawWorkingAfterStart = false
+            let observedStateHistory: AgentStateHistoryEntry[] = []
             const checkCurrentStatus = (): void => {
               const { agentStatusByPaneKey } = useAppStore.getState()
               for (const [paneKey, entry] of Object.entries(agentStatusByPaneKey)) {
                 if (paneKey !== targetPaneKey || entry.updatedAt < startedAfter) {
                   continue
                 }
+                const historyOverlap = getAgentStateHistoryOverlap(
+                  observedStateHistory,
+                  entry.stateHistory
+                )
+                // Why: sawWorkingAfterStart stays monotonic — a recreated entry
+                // (transport loss, PTY exit, cap eviction) arrives with an empty
+                // stateHistory, so clearing it here would strand reuseSession runs
+                // with nothing left to re-derive the working edge from.
+                for (const historicalState of entry.stateHistory.slice(historyOverlap)) {
+                  if (historicalState.startedAt < startedAfter) {
+                    continue
+                  }
+                  if (historicalState.state === 'working') {
+                    sawWorkingAfterStart = true
+                  }
+                  if (
+                    historicalState.state === 'done' &&
+                    (!options?.requireWorkingAfterStart || sawWorkingAfterStart)
+                  ) {
+                    // Why: this `done` already rolled out of the live entry, so its output
+                    // survives only in the entry-level completed slot.
+                    latestAssistantMessage =
+                      entry.lastCompletedAssistantMessage?.trim() || latestAssistantMessage
+                    handleAgentDone()
+                    return
+                  }
+                }
+                observedStateHistory = [...entry.stateHistory]
                 if (entry.state === 'working') {
                   sawWorkingAfterStart = true
                 }
diff --git a/src/renderer/src/hooks/useDetectedAgents.test.tsx b/src/renderer/src/hooks/useDetectedAgents.test.tsx
index a4f0d7f3f96..cc1c49b5b90 100644
--- a/src/renderer/src/hooks/useDetectedAgents.test.tsx
+++ b/src/renderer/src/hooks/useDetectedAgents.test.tsx
@@ -14,7 +14,11 @@ import {
   RUNTIME_PROTOCOL_VERSION
 } from '../../../shared/protocol-version'
 import { clearRuntimeCompatibilityCacheForTests } from '@/runtime/runtime-rpc-client'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
+
+const detectLocalAgents = vi.fn()
 const detectRemoteAgents = vi.fn()
 const refreshLocalAgents = vi.fn()
 const runtimeEnvironmentCall = vi.fn()
@@ -22,8 +26,15 @@ const initialAppState = useAppStore.getInitialState()
 const roots: Root[] = []
 let latestHookResult: UseDetectedAgentsResult | null = null
 
-function HookProbe({ target }: { target: AgentDetectionTarget | undefined }): null {
+function HookProbe({
+  target,
+  onResult
+}: {
+  target: AgentDetectionTarget | undefined
+  onResult?: (result: UseDetectedAgentsResult) => void
+}): null {
   latestHookResult = useDetectedAgents(target)
+  onResult?.(latestHookResult)
   return null
 }
 
@@ -34,13 +45,16 @@ async function flushEffects(): Promise<void> {
   })
 }
 
-async function renderProbe(target: AgentDetectionTarget | undefined): Promise<Root> {
+async function renderProbe(
+  target: AgentDetectionTarget | undefined,
+  onResult?: (result: UseDetectedAgentsResult) => void
+): Promise<Root> {
   const container = document.createElement('div')
   document.body.appendChild(container)
   const root = createRoot(container)
   roots.push(root)
   await act(async () => {
-    root.render(createElement(HookProbe, { target }))
+    root.render(createElement(HookProbe, { target, onResult }))
   })
   await flushEffects()
   return root
@@ -51,6 +65,11 @@ beforeEach(() => {
   useAppStore.setState(initialAppState, true)
   latestHookResult = null
   detectRemoteAgents.mockReset().mockResolvedValue([])
+  detectLocalAgents
+    .mockReset()
+    .mockImplementation((context) =>
+      Promise.resolve(context?.projectRuntime?.runtime.kind === 'wsl' ? ['claude'] : ['codex'])
+    )
   refreshLocalAgents.mockReset().mockResolvedValue({
     agents: [],
     addedPathSegments: [],
@@ -80,11 +99,100 @@ beforeEach(() => {
     })
   })
   globalThis.window.api = {
-    preflight: { detectRemoteAgents, refreshAgents: refreshLocalAgents },
-    runtimeEnvironments: { call: runtimeEnvironmentCall }
+    preflight: {
+      detectAgents: detectLocalAgents,
+      detectRemoteAgents,
+      refreshAgents: refreshLocalAgents
+    },
+    runtimeEnvironments: { call: runtimeEnvironmentCall },
+    platform: { get: () => ({ platform: 'win32' }) }
   } as unknown as Window['api']
 })
 
+describe('Floating Workspace authority', () => {
+  it('advertises native Windows agents beside an active WSL project', async () => {
+    const activeResult: { current: UseDetectedAgentsResult | null } = { current: null }
+    const floatingResult: { current: UseDetectedAgentsResult | null } = { current: null }
+    useAppStore.getState().clearLocalDetectedAgents()
+    useAppStore.setState({
+      activeRepoId: 'repo-wsl',
+      activeWorktreeId: 'worktree-wsl',
+      projects: [
+        {
+          id: 'repo-wsl',
+          localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' }
+        }
+      ],
+      repos: [
+        {
+          id: 'repo-wsl',
+          path: '\\\\wsl.localhost\\Ubuntu\\home\\alice\\repo',
+          displayName: 'WSL project',
+          badgeColor: '#000000',
+          addedAt: 0
+        }
+      ],
+      worktreesByRepo: {
+        'repo-wsl': [
+          {
+            id: 'worktree-wsl',
+            repoId: 'repo-wsl',
+            path: '\\\\wsl.localhost\\Ubuntu\\home\\alice\\repo',
+            displayName: 'main'
+          }
+        ]
+      }
+    } as never)
+
+    await renderProbe(
+      { kind: 'local', worktreeId: 'worktree-wsl' } as AgentDetectionTarget,
+      (result) => {
+        activeResult.current = result
+      }
+    )
+    await renderProbe(
+      {
+        kind: 'local',
+        worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+        contextKey: 'host'
+      } as AgentDetectionTarget,
+      (result) => {
+        floatingResult.current = result
+      }
+    )
+
+    expect(activeResult.current?.detectedIds).toEqual(['claude'])
+    expect(floatingResult.current?.detectedIds).toEqual(['codex'])
+    expect(useAppStore.getState().detectedAgentIds).toEqual(['claude'])
+    const detectedContexts = detectLocalAgents.mock.calls.map(([context]) => context)
+    expect(detectedContexts).toEqual([
+      expect.objectContaining({
+        projectRuntime: expect.objectContaining({
+          runtime: expect.objectContaining({ kind: 'wsl', distro: 'Ubuntu' })
+        })
+      }),
+      undefined
+    ])
+
+    refreshLocalAgents.mockResolvedValueOnce({
+      agents: ['codex'],
+      addedPathSegments: [],
+      shellHydrationOk: true,
+      pathSource: 'process_env',
+      pathFailureReason: 'none'
+    })
+    await act(async () => {
+      await floatingResult.current?.refresh()
+    })
+    await flushEffects()
+
+    expect(activeResult.current?.detectedIds).toEqual(['claude'])
+    expect(floatingResult.current?.detectedIds).toEqual(['codex'])
+    expect(useAppStore.getState().detectedAgentIds).toEqual(['claude'])
+    expect(refreshLocalAgents).toHaveBeenLastCalledWith(undefined)
+  })
+})
+
 afterEach(async () => {
   for (const root of roots) {
     await act(async () => {
diff --git a/src/renderer/src/hooks/useDetectedAgents.ts b/src/renderer/src/hooks/useDetectedAgents.ts
index 2776f2b69da..3015e524aa4 100644
--- a/src/renderer/src/hooks/useDetectedAgents.ts
+++ b/src/renderer/src/hooks/useDetectedAgents.ts
@@ -17,7 +17,7 @@ export type UseDetectedAgentsResult = {
 }
 
 export type AgentDetectionTarget =
-  | { kind: 'local' }
+  | { kind: 'local'; worktreeId?: string | null; contextKey?: string }
   | { kind: 'ssh'; connectionId: string }
   | { kind: 'runtime'; environmentId: string }
 
@@ -65,6 +65,8 @@ export function useDetectedAgents(
       : target?.kind === 'runtime'
         ? target.environmentId
         : null
+  const localWorktreeId = target?.kind === 'local' ? target.worktreeId : undefined
+  const localContextKey = target?.kind === 'local' ? target.contextKey : undefined
   const remoteTargetKey =
     targetKind === 'ssh' && targetId
       ? `ssh:${targetId}`
@@ -82,7 +84,9 @@ export function useDetectedAgents(
     if (targetKind === 'runtime' && targetId) {
       return s.runtimeDetectedAgentIds[targetId] ?? null
     }
-    return s.detectedAgentIds
+    return localContextKey
+      ? (s.localDetectedAgentIdsByContext[localContextKey] ?? null)
+      : s.detectedAgentIds
   })
   const isLoading = useAppStore((s) => {
     if (isUnknown) {
@@ -94,7 +98,9 @@ export function useDetectedAgents(
     if (targetKind === 'runtime' && targetId) {
       return s.isDetectingRuntimeAgents[targetId] ?? false
     }
-    return s.isDetectingAgents
+    return localContextKey
+      ? (s.isDetectingLocalAgentsByContext[localContextKey] ?? false)
+      : s.isDetectingAgents
   })
   const isRefreshing = useAppStore((s) => {
     if (targetKind === 'runtime' && targetId) {
@@ -103,7 +109,12 @@ export function useDetectedAgents(
     if (targetKind === 'ssh' && targetId) {
       return s.isDetectingRemoteAgents[targetId] ?? false
     }
-    return targetKind === 'local' ? s.isRefreshingAgents : false
+    if (targetKind !== 'local') {
+      return false
+    }
+    return localContextKey
+      ? (s.isRefreshingLocalAgentsByContext[localContextKey] ?? false)
+      : s.isRefreshingAgents
   })
   const detectionFailed =
     detectedIds === null &&
@@ -126,8 +137,8 @@ export function useDetectedAgents(
     if (targetKind === 'ssh' && targetId) {
       return state.refreshRemoteDetectedAgents(targetId)
     }
-    return state.refreshDetectedAgents()
-  }, [isUnknown, targetKind, targetId])
+    return state.refreshDetectedAgents(localWorktreeId)
+  }, [isUnknown, localWorktreeId, targetKind, targetId])
 
   useEffect(() => {
     if (isUnknown) {
@@ -159,10 +170,18 @@ export function useDetectedAgents(
       }
     } else {
       if (detectedIds === null) {
-        void state.ensureDetectedAgents()
+        void state.ensureDetectedAgents(localWorktreeId)
       }
     }
-  }, [isUnknown, targetKind, targetId, remoteTargetKey, detectedIds])
+  }, [
+    isUnknown,
+    targetKind,
+    targetId,
+    remoteTargetKey,
+    detectedIds,
+    localWorktreeId,
+    localContextKey
+  ])
 
   return { detectedIds, isLoading, detectionFailed, isRefreshing, refresh }
 }
diff --git a/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts
new file mode 100644
index 00000000000..cfcb973d968
--- /dev/null
+++ b/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts
@@ -0,0 +1,129 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as EditorAutosaveModule from '@/components/editor/editor-autosave'
+import type * as CrossPlatformPathModule from '../../../shared/cross-platform-path'
+import type { FsChangedPayload } from '../../../shared/types'
+
+const pathOperationCounts = vi.hoisted(() => ({
+  aliasComparisons: 0,
+  normalizations: 0,
+  identities: 0
+}))
+
+vi.mock('@/store', () => ({ useAppStore: { getState: vi.fn() } }))
+vi.mock('@/components/editor/editor-autosave', async (importOriginal) => {
+  const actual = await importOriginal<typeof EditorAutosaveModule>()
+  return { ...actual, notifyEditorExternalFileChange: vi.fn() }
+})
+vi.mock('../../../shared/cross-platform-path', async (importOriginal) => {
+  type PathModuleWithIdentity = typeof CrossPlatformPathModule & {
+    getLocalWindowsWslPathIdentity?: (value: string) => unknown
+  }
+  const actual = await importOriginal<PathModuleWithIdentity>()
+  return {
+    ...actual,
+    normalizeRuntimePathForComparison: (value: string) => {
+      pathOperationCounts.normalizations++
+      return actual.normalizeRuntimePathForComparison(value)
+    },
+    areLocalWindowsWslPathAliases: (left: string, right: string) => {
+      pathOperationCounts.aliasComparisons++
+      return actual.areLocalWindowsWslPathAliases(left, right)
+    },
+    ...(actual.getLocalWindowsWslPathIdentity
+      ? {
+          getLocalWindowsWslPathIdentity: (value: string) => {
+            pathOperationCounts.identities++
+            return actual.getLocalWindowsWslPathIdentity!(value)
+          }
+        }
+      : {})
+  }
+})
+
+import { useAppStore } from '@/store'
+import {
+  getOpenFilesForExternalFileChange,
+  notifyEditorExternalFileChange
+} from '@/components/editor/editor-autosave'
+import { createExternalWatchEventHandler } from './useEditorExternalWatch'
+
+const EVENT_COUNT = 5_000
+const OPEN_FILE_COUNT = 100
+const payloadWorktreePath = '\\\\wsl.localhost\\Ubuntu\\workspace\\repo'
+
+describe('external watcher path matching complexity', () => {
+  beforeEach(() => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    vi.clearAllMocks()
+    pathOperationCounts.aliasComparisons = 0
+    pathOperationCounts.normalizations = 0
+    pathOperationCounts.identities = 0
+    vi.stubGlobal('window', { dispatchEvent: vi.fn() })
+    vi.stubGlobal('navigator', { userAgent: 'Windows' })
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.unstubAllGlobals()
+  })
+
+  it('bounds a maximum-sized opposite-alias batch by events plus open files', () => {
+    const openFiles = Array.from({ length: OPEN_FILE_COUNT }, (_, index) => ({
+      id: `//wsl.localhost/Ubuntu/workspace/repo/file-${index}.ts`,
+      filePath: `//wsl.localhost/Ubuntu/workspace/repo/file-${index}.ts`,
+      relativePath: `file-${index}.ts`,
+      worktreeId: 'wt-wsl',
+      mode: 'edit' as const,
+      isDirty: false
+    }))
+    const initialOpenFiles = [
+      ...openFiles,
+      {
+        id: 'combined-diff',
+        filePath: payloadWorktreePath,
+        relativePath: '',
+        worktreeId: 'wt-wsl',
+        mode: 'diff' as const,
+        diffSource: 'combined-uncommitted' as const,
+        isDirty: false
+      }
+    ]
+    vi.mocked(useAppStore.getState).mockReturnValue({
+      openFiles: initialOpenFiles,
+      setExternalMutation: vi.fn()
+    } as never)
+    const payload: FsChangedPayload = {
+      worktreePath: payloadWorktreePath,
+      events: Array.from({ length: EVENT_COUNT }, (_, index) => ({
+        kind: 'update' as const,
+        absolutePath: `\\\\wsl.localhost\\Ubuntu\\workspace\\repo\\file-${index}.ts`
+      }))
+    }
+    const { handleFsChanged, dispose } = createExternalWatchEventHandler(() => ({
+      worktreeId: 'wt-wsl',
+      worktreePath: payload.worktreePath,
+      connectionId: undefined,
+      runtimeEnvironmentId: null,
+      allowLocalWindowsWslAliases: true
+    }))
+
+    const startedAt = process.hrtime.bigint()
+    handleFsChanged(payload)
+    const elapsedMs = Number(process.hrtime.bigint() - startedAt) / 1_000_000
+    vi.advanceTimersByTime(100)
+    expect(notifyEditorExternalFileChange).toHaveBeenCalledTimes(EVENT_COUNT)
+    // Why: a tab/store update during debounce must rebuild the index once, not rescan per event.
+    const currentOpenFiles = initialOpenFiles.map((file) => ({ ...file }))
+    for (const [notification] of vi.mocked(notifyEditorExternalFileChange).mock.calls) {
+      getOpenFilesForExternalFileChange(currentOpenFiles as never, notification)
+    }
+    const pathOperations =
+      pathOperationCounts.aliasComparisons +
+      pathOperationCounts.normalizations +
+      pathOperationCounts.identities
+
+    console.info('STA-3942 watcher oracle', { ...pathOperationCounts, pathOperations, elapsedMs })
+    expect(pathOperations).toBeLessThanOrEqual(3 * (EVENT_COUNT + initialOpenFiles.length))
+    dispose()
+  })
+})
diff --git a/src/renderer/src/hooks/useEditorExternalWatch.test.ts b/src/renderer/src/hooks/useEditorExternalWatch.test.ts
index 747babef0e1..891bbc35e4e 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch.test.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch.test.ts
@@ -287,7 +287,8 @@ describe('createExternalWatchEventHandler tombstone coalescing', () => {
       filePath: 'C:\\Repo\\notes.md',
       relativePath: 'notes.md',
       mode: 'edit' as const,
-      isDirty: false
+      isDirty: false,
+      runtimeEnvironmentId: 'env-1'
     }
     vi.mocked(useAppStore.getState).mockReturnValue({
       openFiles: [file],
@@ -324,7 +325,8 @@ describe('createExternalWatchEventHandler tombstone coalescing', () => {
       filePath: '//Server/Share/Repo/notes.md',
       relativePath: 'notes.md',
       mode: 'edit' as const,
-      isDirty: false
+      isDirty: false,
+      runtimeEnvironmentId: 'env-1'
     }
     vi.mocked(useAppStore.getState).mockReturnValue({
       openFiles: [file],
diff --git a/src/renderer/src/hooks/useEditorExternalWatch.ts b/src/renderer/src/hooks/useEditorExternalWatch.ts
index 5b0236d82f7..c07f9bd25c1 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch.ts
@@ -2,9 +2,7 @@
 import { useEffect, useRef } from 'react'
 import { useAppStore, type AppState } from '@/store'
 import { basename, joinPath } from '@/lib/path'
-import { getExternalFileChangeRelativePath } from '@/components/right-sidebar/useFileExplorerWatch'
 import {
-  areLocalWindowsWslPathAliases,
   isWindowsAbsolutePathLike,
   normalizeRuntimePathForComparison
 } from '../../../shared/cross-platform-path'
@@ -12,9 +10,9 @@ import {
   canAutoSaveOpenFile,
   getOpenFilesForExternalFileChange,
   isExternalReloadableEditorTab,
-  isWorkingTreeCombinedDiffTab,
   notifyEditorExternalFileChange
 } from '@/components/editor/editor-autosave'
+import { indexEditorExternalWatchBatchPaths } from '@/components/editor/editor-external-watch-path-index'
 import {
   clearSelfWrite,
   getRecentSelfWrite,
@@ -87,6 +85,9 @@ type ExternalWatchNotification = {
   relativePath: string
   runtimeEnvironmentId: string | null
   allowLocalWindowsWslAliases?: true
+  indexedOpenFiles?: {
+    matches: (openFiles: OpenFile[]) => OpenFile[]
+  }
 }
 
 function localWslAliasOption(
@@ -97,26 +98,6 @@ function localWslAliasOption(
     : {}
 }
 
-function findMatchingWatchedPath(
-  watchedPaths: ReadonlyMap<string, string>,
-  filePath: string,
-  allowLocalWslAliases?: true
-): string | undefined {
-  const directMatch = watchedPaths.get(normalizeRuntimePathForComparison(filePath))
-  if (directMatch !== undefined) {
-    return directMatch
-  }
-  if (allowLocalWslAliases !== true || !isLocalWindowsDesktopClient()) {
-    return undefined
-  }
-  for (const watchedPath of watchedPaths.values()) {
-    if (areLocalWindowsWslPathAliases(filePath, watchedPath)) {
-      return watchedPath
-    }
-  }
-  return undefined
-}
-
 function isLocalHostStamp(value: string | null | undefined): boolean {
   return parseExecutionHostId(value)?.kind === 'local'
 }
@@ -525,19 +506,15 @@ export function createExternalWatchEventHandler(
       )
     }
 
-    // Why: collect create/update paths first to cancel any pending same-path delete — this absorbs the macOS atomic-write delete→create split across two payloads.
-    const createOrUpdatePaths = new Map<string, string>()
-    for (const evt of payload.events) {
-      if (evt.isDirectory === true) {
-        continue
-      }
-      if (evt.kind === 'create' || evt.kind === 'update') {
-        createOrUpdatePaths.set(
-          normalizeRuntimePathForComparison(evt.absolutePath),
-          evt.absolutePath
-        )
-      }
-    }
+    // Why: one batch index keeps local WSL alias normalization out of event×tab loops.
+    const openFilesAtStart = useAppStore.getState().openFiles
+    const batchPaths = indexEditorExternalWatchBatchPaths(payload, openFilesAtStart, {
+      worktreeId: target.worktreeId,
+      worktreePath: target.worktreePath,
+      runtimeEnvironmentId: target.runtimeEnvironmentId,
+      ...localWslAliasOption(target)
+    })
+    const createOrUpdatePaths = batchPaths.createOrUpdatePaths
     for (const createdPath of createOrUpdatePaths.keys()) {
       const key = pendingKey(target.worktreeId, target.runtimeEnvironmentId, createdPath)
       const existing = pendingDeletes.get(key)
@@ -548,25 +525,16 @@ export function createExternalWatchEventHandler(
     }
 
     // Why: mark editor tabs deleted/renamed instead of closing them so the user keeps in-memory content; a paired create means rename, a lone delete is hard.
-    // Why: snapshot openFiles once so the delete/rename helpers share a consistent view without N store reads per payload.
-    const openFilesAtStart = useAppStore.getState().openFiles
-    const deletedOpenEditorIdsRaw = collectDeletedOpenEditorIds(
-      payload,
-      target.worktreeId,
-      target.runtimeEnvironmentId,
-      openFilesAtStart,
-      target.allowLocalWindowsWslAliases
-    )
+    // Why: snapshot openFiles once so delete, rename, and update matching share one indexed view.
+    const deletedOpenEditorsRaw = batchPaths.deletedOpenEditors
     // Only pay the per-id lookup to suppress a move's own source-delete while a move is live; else the batch stays O(deletes).
-    const deletedOpenEditorIds = hasActiveEditorPathMoves()
-      ? deletedOpenEditorIdsRaw.filter((fileId) => {
-          const file = openFilesAtStart.find((f) => f.id === fileId)
-          return (
-            !file ||
+    const deletedOpenEditors = hasActiveEditorPathMoves()
+      ? deletedOpenEditorsRaw.filter(
+          ({ file }) =>
             !isActiveMoveSourcePath(target.worktreeId, target.runtimeEnvironmentId, file.filePath)
-          )
-        })
-      : deletedOpenEditorIdsRaw
+        )
+      : deletedOpenEditorsRaw
+    const deletedOpenEditorIds = deletedOpenEditors.map(({ file }) => file.id)
     // Why: correlate creates to deletes by basename to avoid mislabelling unrelated create+delete pairs as "renamed"; default to 'deleted' when we can't correlate.
     const hasPairedCreate =
       deletedOpenEditorIds.length > 0 &&
@@ -580,19 +548,9 @@ export function createExternalWatchEventHandler(
         }
       } else {
         // Why: defer the 'deleted' tombstone so a follow-up same-path create in the next payload can cancel it (macOS atomic write).
-        const deletePathByFileId = buildDeletePathByFileId(
-          payload,
-          target.worktreeId,
-          target.runtimeEnvironmentId,
-          deletedOpenEditorIds,
-          openFilesAtStart,
-          target.allowLocalWindowsWslAliases
-        )
-        for (const fileId of deletedOpenEditorIds) {
-          const absolutePath = deletePathByFileId.get(fileId)
-          if (!absolutePath) {
-            continue
-          }
+        for (const { file, normalizedDeletePath } of deletedOpenEditors) {
+          const fileId = file.id
+          const absolutePath = normalizedDeletePath
           const key = pendingKey(target.worktreeId, target.runtimeEnvironmentId, absolutePath)
           const existing = pendingDeletes.get(key)
           if (existing) {
@@ -622,61 +580,32 @@ export function createExternalWatchEventHandler(
           openFileRuntimeOwner(file) === target.runtimeEnvironmentId &&
           (file.mode === 'edit' || file.mode === 'markdown-preview') &&
           (file.externalMutation === 'deleted' || file.externalMutation === 'renamed') &&
-          findMatchingWatchedPath(
-            createOrUpdatePaths,
-            file.filePath,
-            target.allowLocalWindowsWslAliases
-          ) !== undefined
+          batchPaths.matchesCreateOrUpdate(file)
         ) {
           state.setExternalMutation(file.id, null)
         }
       }
     }
 
-    const changedFiles = new Set<string>()
+    let overflowed = false
     for (const evt of payload.events) {
       if (evt.kind === 'overflow') {
         // Why: overflow omits per-path info, so conservatively clear stale tombstones or a file that reappeared during the overrun stays struck through.
         for (const notification of getOverflowExternalReloadTargets(target)) {
           scheduleDebouncedExternalReload(notification)
         }
-        // Why: `break` not `return` — changedFiles is empty so the rest early-returns anyway, and this is more robust to code added after the loop.
+        overflowed = true
         break
       }
-
-      if (evt.kind === 'update' && evt.isDirectory === true) {
-        continue
-      }
-
-      if (evt.kind === 'delete') {
-        // Why: deletes are tombstoned above; feeding them into reload would read the ENOENT path and replace in-memory content with an error, losing the user's view.
-        continue
-      }
-
-      const relativePath = getExternalFileChangeRelativePath(
-        target.worktreePath,
-        evt.absolutePath,
-        evt.isDirectory
-      )
-      if (relativePath) {
-        changedFiles.add(relativePath)
-      }
     }
 
-    if (changedFiles.size === 0) {
+    if (overflowed || batchPaths.changes.length === 0) {
       return
     }
 
-    // Why: read openFiles once per payload to avoid N store reads on large batches; consumers skip dirty tabs so external writes don't destroy unsaved work.
-    const openFilesSnapshot = useAppStore.getState().openFiles
-    // Why: the combined "Changes" tab is per-worktree not per-path, so compute it once instead of rescanning openFiles per changed file in a large batched payload.
-    const hasCombinedDiffConsumer = openFilesSnapshot.some(
-      (f) =>
-        f.worktreeId === target.worktreeId &&
-        openFileRuntimeOwner(f) === target.runtimeEnvironmentId &&
-        isWorkingTreeCombinedDiffTab(f)
-    )
-    for (const relativePath of changedFiles) {
+    for (const change of batchPaths.changes) {
+      const relativePath = change.relativePath
+      const matching = batchPaths.matchingOpenFiles(change)
       const notification = {
         worktreeId: target.worktreeId,
         worktreePath: target.worktreePath,
@@ -684,11 +613,15 @@ export function createExternalWatchEventHandler(
         runtimeEnvironmentId: target.runtimeEnvironmentId,
         ...localWslAliasOption(target)
       }
-      const absolutePath = joinPath(notification.worktreePath, notification.relativePath)
-      const matching = getOpenFilesForExternalFileChange(openFilesSnapshot, notification)
+      Object.defineProperty(notification, 'indexedOpenFiles', {
+        value: {
+          matches: (openFiles: OpenFile[]) => batchPaths.matchingOpenFiles(change, openFiles)
+        }
+      })
+      const absolutePath = change.absolutePath
       if (matching.length === 0) {
         // Why: combined-diff tab has no in-memory content to clobber and guards its own reload, so notify it directly without self-write suppression.
-        if (hasCombinedDiffConsumer) {
+        if (batchPaths.hasCombinedDiffConsumer) {
           scheduleDebouncedExternalReload(notification)
         }
         continue
@@ -717,7 +650,7 @@ export function createExternalWatchEventHandler(
           scheduleChangedOnDiskMark(target, notification, dirtyIds)
         }
         if (dirtyMatches.length === matching.length) {
-          if (hasCombinedDiffConsumer) {
+          if (batchPaths.hasCombinedDiffConsumer) {
             scheduleDebouncedExternalReload(notification)
           }
           continue
@@ -1033,79 +966,6 @@ export function getOverflowExternalReloadTargets(
   return notifications
 }
 
-function buildDeletePathByFileId(
-  payload: FsChangedPayload,
-  worktreeId: string,
-  runtimeEnvironmentId: string | null,
-  deletedOpenEditorIds: string[],
-  openFiles: OpenFile[],
-  allowLocalWindowsWslAliases?: true
-): Map<string, string> {
-  const deletePaths = new Map<string, string>()
-  for (const evt of payload.events) {
-    if (evt.kind === 'delete') {
-      deletePaths.set(normalizeRuntimePathForComparison(evt.absolutePath), evt.absolutePath)
-    }
-  }
-  const result = new Map<string, string>()
-  if (deletePaths.size === 0) {
-    return result
-  }
-  const deletedIdSet = new Set(deletedOpenEditorIds)
-  for (const file of openFiles) {
-    if (
-      !deletedIdSet.has(file.id) ||
-      file.worktreeId !== worktreeId ||
-      openFileRuntimeOwner(file) !== runtimeEnvironmentId
-    ) {
-      continue
-    }
-    const deletePath = findMatchingWatchedPath(
-      deletePaths,
-      file.filePath,
-      allowLocalWindowsWslAliases
-    )
-    if (deletePath) {
-      result.set(file.id, normalizeRuntimePathForComparison(deletePath))
-    }
-  }
-  return result
-}
-
-function collectDeletedOpenEditorIds(
-  payload: FsChangedPayload,
-  worktreeId: string,
-  runtimeEnvironmentId: string | null,
-  openFiles: OpenFile[],
-  allowLocalWindowsWslAliases?: true
-): string[] {
-  const deletePaths = new Map<string, string>()
-  for (const evt of payload.events) {
-    if (evt.kind === 'delete') {
-      deletePaths.set(normalizeRuntimePathForComparison(evt.absolutePath), evt.absolutePath)
-    }
-  }
-  if (deletePaths.size === 0) {
-    return []
-  }
-  const result: string[] = []
-  for (const file of openFiles) {
-    if (
-      file.worktreeId !== worktreeId ||
-      openFileRuntimeOwner(file) !== runtimeEnvironmentId ||
-      (file.mode !== 'edit' && file.mode !== 'markdown-preview')
-    ) {
-      continue
-    }
-    if (
-      findMatchingWatchedPath(deletePaths, file.filePath, allowLocalWindowsWslAliases) !== undefined
-    ) {
-      result.push(file.id)
-    }
-  }
-  return result
-}
-
 /**
  * Returns true if the batched payload contains at least one file-create event
  * whose basename matches a deleted open editor file.
diff --git a/src/renderer/src/hooks/useInstalledAgentSkills.react.test.tsx b/src/renderer/src/hooks/useInstalledAgentSkills.react.test.tsx
index f6b446964ac..19494e46aac 100644
--- a/src/renderer/src/hooks/useInstalledAgentSkills.react.test.tsx
+++ b/src/renderer/src/hooks/useInstalledAgentSkills.react.test.tsx
@@ -13,6 +13,7 @@ import type { GlobalSettings } from '../../../shared/types'
 import { createCompatibleRuntimeStatusResponseIfNeeded } from '@/runtime/runtime-compatibility-test-fixture'
 import { clearRuntimeCompatibilityCacheForTests } from '@/runtime/runtime-rpc-client'
 import { useAppStore } from '@/store'
+import { INSTALLED_AGENT_SKILL_DISCOVERY_FRESH_MS } from './installed-agent-skill-discovery-cache'
 import {
   GLOBAL_AGENT_SKILL_SOURCE_KINDS,
   type InstalledAgentSkillState,
@@ -216,7 +217,8 @@ describe('useInstalledAgentSkill', () => {
 
     expect(latestState?.installed).toBe(false)
     expect(discover).toHaveBeenNthCalledWith(1, undefined)
-    expect(discover).toHaveBeenNthCalledWith(2, undefined)
+    // A forced refresh must also bypass the host's shared scans, not just this cache.
+    expect(discover).toHaveBeenNthCalledWith(2, { refresh: true })
   })
 
   it('returns installed from refresh when a legacy Linear skill is discovered', async () => {
@@ -289,13 +291,15 @@ describe('useInstalledAgentSkill', () => {
     })
   })
 
-  it('stays settled through a focus rescan so status surfaces do not flash', async () => {
+  it('serves a focus rescan from cache so window switching does not walk disk', async () => {
+    // Why: the freshness window is wall-clock, so pin the clock — a stalled runner
+    // could otherwise cross it mid-test and turn this into a flake.
+    vi.spyOn(Date, 'now').mockReturnValue(1_700_000_000_000)
     const firstScan = deferred<SkillDiscoveryResult>()
-    const focusScan = deferred<SkillDiscoveryResult>()
     const discover = vi
       .fn<(target?: SkillDiscoveryTarget) => Promise<SkillDiscoveryResult>>()
       .mockReturnValueOnce(firstScan.promise)
-      .mockReturnValueOnce(focusScan.promise)
+      .mockResolvedValue(discoveryResult([skill({ name: 'orca-linear' })]))
     Object.defineProperty(window, 'api', {
       configurable: true,
       value: { skills: { discover } }
@@ -310,21 +314,48 @@ describe('useInstalledAgentSkill', () => {
     })
     expect(latestState?.settled).toBe(true)
     expect(latestState?.installed).toBe(true)
+    expect(discover).toHaveBeenCalledTimes(1)
 
+    for (let focusEvent = 0; focusEvent < 5; focusEvent += 1) {
+      await act(async () => {
+        window.dispatchEvent(new Event('focus'))
+      })
+      await flushMicrotasks()
+    }
+
+    // Focus is a backstop, not a mutation signal: a burst of window switches
+    // costs no scans, and the surface never flashes unsettled.
+    expect(discover).toHaveBeenCalledTimes(1)
+    expect(latestState?.loading).toBe(false)
+    expect(latestState?.settled).toBe(true)
+    expect(latestState?.installed).toBe(true)
+  })
+
+  it('rescans on focus once the cached scan is no longer fresh', async () => {
+    const nowSpy = vi.spyOn(Date, 'now')
+    const startedAt = 1_700_000_000_000
+    nowSpy.mockReturnValue(startedAt)
+    const discover = vi
+      .fn<(target?: SkillDiscoveryTarget) => Promise<SkillDiscoveryResult>>()
+      .mockResolvedValue(discoveryResult([skill({ name: 'orca-linear' })]))
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: { skills: { discover } }
+    })
+
+    await renderProbe()
+    await flushMicrotasks()
+    expect(discover).toHaveBeenCalledTimes(1)
+
+    nowSpy.mockReturnValue(startedAt + INSTALLED_AGENT_SKILL_DISCOVERY_FRESH_MS + 1)
     await act(async () => {
       window.dispatchEvent(new Event('focus'))
     })
+    await flushMicrotasks()
 
-    // The forced rescan is in flight, but the previous result is still current.
-    expect(latestState?.loading).toBe(true)
-    expect(latestState?.settled).toBe(true)
-    expect(latestState?.installed).toBe(true)
-
-    focusScan.resolve(discoveryResult([skill({ name: 'orca-linear' })]))
-    await act(async () => {
-      await focusScan.promise
-    })
-    expect(latestState?.settled).toBe(true)
+    // The freshness window is what bounds the storm; past it, focus still reads disk.
+    expect(discover).toHaveBeenCalledTimes(2)
+    expect(discover).toHaveBeenLastCalledWith(undefined)
   })
 
   it('reuses cached discovery when another surface finishes re-checking', async () => {
@@ -351,13 +382,13 @@ describe('useInstalledAgentSkill', () => {
     expect(latestState?.installed).toBe(true)
   })
 
-  it('clears loading when a silent refresh supersedes an in-flight focus rescan', async () => {
+  it('clears loading when a silent refresh supersedes an in-flight forced rescan', async () => {
     const firstScan = deferred<SkillDiscoveryResult>()
-    const focusScan = deferred<SkillDiscoveryResult>()
+    const forcedScan = deferred<SkillDiscoveryResult>()
     const discover = vi
       .fn<(target?: SkillDiscoveryTarget) => Promise<SkillDiscoveryResult>>()
       .mockReturnValueOnce(firstScan.promise)
-      .mockReturnValueOnce(focusScan.promise)
+      .mockReturnValueOnce(forcedScan.promise)
     Object.defineProperty(window, 'api', {
       configurable: true,
       value: { skills: { discover } }
@@ -369,8 +400,10 @@ describe('useInstalledAgentSkill', () => {
       await firstScan.promise
     })
 
+    // The recheck button forces past the cache without clearing it, so the silent
+    // refresh below can still be served from it while this scan is in flight.
     await act(async () => {
-      window.dispatchEvent(new Event('focus'))
+      void latestState?.refresh()
     })
     expect(latestState?.loading).toBe(true)
 
@@ -382,9 +415,9 @@ describe('useInstalledAgentSkill', () => {
     await flushMicrotasks()
     expect(latestState?.loading).toBe(false)
 
-    focusScan.resolve(discoveryResult([skill({ name: 'orca-linear' })]))
+    forcedScan.resolve(discoveryResult([skill({ name: 'orca-linear' })]))
     await act(async () => {
-      await focusScan.promise
+      await forcedScan.promise
     })
     expect(latestState?.loading).toBe(false)
   })
diff --git a/src/renderer/src/hooks/useInstalledAgentSkills.ts b/src/renderer/src/hooks/useInstalledAgentSkills.ts
index 482ea67386d..a7d96fe9451 100644
--- a/src/renderer/src/hooks/useInstalledAgentSkills.ts
+++ b/src/renderer/src/hooks/useInstalledAgentSkills.ts
@@ -247,21 +247,26 @@ export function useInstalledAgentSkillNames(
     if (!enabled) {
       return
     }
-    const refreshFromExternalChange = (): void => {
+    // Why: skill install commands run outside React state, often in a terminal, so
+    // an install event is authoritative and forces past every cache.
+    const refreshFromInstall = (): void => {
       void refresh(true)
     }
-    const refreshFromCompletedScan = (): void => {
+    // Why: focus fires on every app and window switch, and a forced refresh
+    // bypasses every cache down to the host's disk walk — that is what turned an
+    // alt-tab into a multi-root filesystem scan per window and per client. Focus,
+    // and another surface finishing its own scan, are both only hints that
+    // something may have changed, so they read through the freshness window.
+    const refreshQuietly = (): void => {
       void refresh(false, false)
     }
-    // Why: skill install commands run outside React state, often in a terminal.
-    // Refresh on focus and explicit install events so completion is detected.
-    window.addEventListener('focus', refreshFromExternalChange)
-    window.addEventListener(INSTALLED_AGENT_SKILLS_CHANGED_EVENT, refreshFromExternalChange)
-    window.addEventListener(INSTALLED_AGENT_SKILLS_REFRESHED_EVENT, refreshFromCompletedScan)
+    window.addEventListener('focus', refreshQuietly)
+    window.addEventListener(INSTALLED_AGENT_SKILLS_CHANGED_EVENT, refreshFromInstall)
+    window.addEventListener(INSTALLED_AGENT_SKILLS_REFRESHED_EVENT, refreshQuietly)
     return () => {
-      window.removeEventListener('focus', refreshFromExternalChange)
-      window.removeEventListener(INSTALLED_AGENT_SKILLS_CHANGED_EVENT, refreshFromExternalChange)
-      window.removeEventListener(INSTALLED_AGENT_SKILLS_REFRESHED_EVENT, refreshFromCompletedScan)
+      window.removeEventListener('focus', refreshQuietly)
+      window.removeEventListener(INSTALLED_AGENT_SKILLS_CHANGED_EVENT, refreshFromInstall)
+      window.removeEventListener(INSTALLED_AGENT_SKILLS_REFRESHED_EVENT, refreshQuietly)
     }
   }, [enabled, refresh])
 
diff --git a/src/renderer/src/hooks/useIpcEvents.test.ts b/src/renderer/src/hooks/useIpcEvents.test.ts
index 679ac28509c..c19fe942461 100644
--- a/src/renderer/src/hooks/useIpcEvents.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents.test.ts
@@ -22,11 +22,21 @@ import {
   makeWorktree,
   TEST_REPO
 } from '../store/slices/store-test-helpers'
+import type {
+  AgentStatusBatchTransaction,
+  AgentStatusBatchUpdate,
+  AgentStatusUpdate
+} from '../store/slices/agent-status'
+import type { AppState } from '../store/types'
 import type { SleepingAgentLaunchConfig } from '../../../shared/agent-session-resume'
-import type { AgentStatusClearIpcPayload } from '../../../shared/agent-status-types'
-import type { TuiAgent } from '../../../shared/types'
+import type {
+  AgentStatusClearIpcPayload,
+  MigrationUnsupportedPtyEntry
+} from '../../../shared/agent-status-types'
+import type { TerminalPaneLayoutNode, TuiAgent } from '../../../shared/types'
 import type * as CmdJRowIndexJump from '@/lib/cmd-j-row-index-jump'
 import { makePaneKey } from '../../../shared/stable-pane-id'
+import { folderWorkspaceKey } from '../../../shared/workspace-scope'
 import { YOLO_TUI_AGENT_ARGS } from '../../../shared/tui-agent-permissions'
 import {
   FLOATING_WORKSPACE_GUEST_CLOSE_EVENT,
@@ -5000,6 +5010,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
     terminalHandle?: string
     launchToken?: string
     providerSession?: { key: 'session_id'; id: string }
+    providerSessionOnly?: boolean
     orchestration?: {
       taskId?: string
       dispatchId?: string
@@ -5030,11 +5041,72 @@ describe('useIpcEvents agent status snapshot integration', () => {
     driver: { kind: 'mobile'; clientId: string }
   }) => void
 
+  function applyMockAgentStatusUpdate(state: StoreLike, update: AgentStatusBatchUpdate): boolean {
+    const statuses = state.agentStatusByPaneKey as Record<
+      string,
+      | ({ agentType?: string; state?: string; updatedAt?: number } & Record<string, unknown>)
+      | undefined
+    >
+    const existing = statuses[update.paneKey]
+    const updatedAt = update.timing?.updatedAt
+    if (
+      existing?.updatedAt !== undefined &&
+      updatedAt !== undefined &&
+      updatedAt < existing.updatedAt
+    ) {
+      return false
+    }
+    const next = { ...statuses }
+    if (update.kind === 'providerSession') {
+      delete next[update.paneKey]
+    } else {
+      next[update.paneKey] = {
+        ...existing,
+        ...update.payload,
+        updatedAt,
+        providerSession: update.metadata?.providerSession
+      }
+    }
+    state.agentStatusByPaneKey = next
+    return true
+  }
+
+  function installMockAgentStatusTransaction(state: StoreLike): void {
+    state.transactAgentStatuses = <Result>(
+      operation: (transaction: AgentStatusBatchTransaction) => Result
+    ): Result => {
+      const stagedState = {
+        ...state,
+        agentStatusByPaneKey: {
+          ...(state.agentStatusByPaneKey as Record<string, unknown>)
+        }
+      }
+      const attemptedUpdates: AgentStatusBatchUpdate[] = []
+      const effects: (() => void)[] = []
+      const result = operation({
+        getState: () => stagedState as AppState,
+        apply: (update) => {
+          attemptedUpdates.push(update)
+          return applyMockAgentStatusUpdate(stagedState, update)
+        },
+        afterCommit: (effect) => effects.push(effect)
+      })
+      const setStatuses = state.setAgentStatuses as (
+        updates: readonly AgentStatusBatchUpdate[]
+      ) => readonly boolean[]
+      setStatuses(attemptedUpdates)
+      for (const effect of effects) {
+        effect()
+      }
+      return result
+    }
+  }
+
   function buildStoreState(overrides: StoreLike): StoreLike {
     // Why: copy the defensive set of getState() fields the hook touches during
     // mount so individual tests only need to override workspaceSessionReady,
     // tabsByWorktree, and setAgentStatus.
-    return {
+    const state: StoreLike = {
       setUpdateStatus: vi.fn(),
       fetchRepos: vi.fn(),
       fetchWorktrees: vi.fn(),
@@ -5064,9 +5136,12 @@ describe('useIpcEvents agent status snapshot integration', () => {
       removeSshCredentialRequest: vi.fn(),
       clearTabPtyId: vi.fn(),
       updateTabTitle: vi.fn(),
+      updateTabTitles: vi.fn(),
       runtimePaneTitlesByTabId: {},
       terminalLayoutsByTabId: {},
       agentStatusByPaneKey: {},
+      setAgentStatuses: vi.fn(() => []),
+      recordAgentProviderSession: vi.fn(),
       clearTransientAgentStatuses: vi.fn(),
       getAgentLaunchConfigForStatusMetadata: vi.fn(() => undefined),
       recentlyClosedAgentStatusTabIds: {},
@@ -5078,6 +5153,45 @@ describe('useIpcEvents agent status snapshot integration', () => {
       settings: { terminalFontSize: 13 },
       ...overrides
     }
+    if (!('updateTabTitles' in overrides)) {
+      state.updateTabTitles = vi.fn((updates: readonly { tabId: string; title: string }[]) => {
+        const updateTitle = state.updateTabTitle as AppState['updateTabTitle']
+        for (const { tabId, title } of updates) {
+          updateTitle(tabId, title)
+        }
+      })
+    }
+    if (!('setAgentStatuses' in overrides)) {
+      state.setAgentStatuses = vi.fn((updates: readonly AgentStatusBatchUpdate[]) =>
+        updates.map((update) => {
+          if (update.kind === 'providerSession') {
+            const recordProviderSession =
+              state.recordAgentProviderSession as AppState['recordAgentProviderSession']
+            recordProviderSession(
+              update.paneKey,
+              update.agent,
+              update.providerSession,
+              update.timing,
+              update.routing,
+              update.metadata
+            )
+          } else {
+            const setStatus = state.setAgentStatus as AppState['setAgentStatus']
+            setStatus(
+              update.paneKey,
+              update.payload,
+              update.terminalTitle,
+              update.timing,
+              update.routing,
+              update.metadata
+            )
+          }
+          return true
+        })
+      )
+    }
+    installMockAgentStatusTransaction(state)
+    return state
   }
 
   function buildWindowApi(args: {
@@ -5087,6 +5201,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
       cb: (data: { paneKey: string; resolution: 'adopted' | 'exited' }) => void
     ) => () => void
     getSnapshot?: () => Promise<AgentStatusSetData[]>
+    getMigrationUnsupportedSnapshot?: () => Promise<MigrationUnsupportedPtyEntry[]>
     drop?: (paneKey: string) => void
     remoteWorkspace?: Record<string, unknown>
     runtime?: Record<string, unknown>
@@ -5200,6 +5315,9 @@ describe('useIpcEvents agent status snapshot integration', () => {
           onLegacyWorkerTerminalRecovery:
             args.onLegacyWorkerTerminalRecovery ?? vi.fn(() => () => {}),
           getSnapshot: args.getSnapshot ?? vi.fn(() => Promise.resolve([])),
+          ...(args.getMigrationUnsupportedSnapshot
+            ? { getMigrationUnsupportedSnapshot: args.getMigrationUnsupportedSnapshot }
+            : {}),
           drop: args.drop ?? vi.fn()
         },
         remoteWorkspace: args.remoteWorkspace
@@ -6136,6 +6254,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
       tabsByWorktree: {},
       workspaceSessionReady: false
     })
+    const setAgentStatuses = vi.mocked(storeState.setAgentStatuses as AppState['setAgentStatuses'])
 
     stubReactSyncEffect()
     vi.doMock('../store', () => ({
@@ -6201,6 +6320,8 @@ describe('useIpcEvents agent status snapshot integration', () => {
     await Promise.resolve()
 
     expect(setAgentStatus).toHaveBeenCalledTimes(1)
+    expect(setAgentStatuses).toHaveBeenCalledTimes(1)
+    expect(setAgentStatuses.mock.calls[0]?.[0]).toHaveLength(1)
     expect(setAgentStatus).toHaveBeenCalledWith(
       FUTURE_PANE_KEY,
       expect.objectContaining({ state: 'working', prompt: 'p', agentType: 'claude' }),
@@ -6211,18 +6332,582 @@ describe('useIpcEvents agent status snapshot integration', () => {
     )
   })
 
+  it('applies a large snapshot with one status and two bounded title publications', async () => {
+    const paneCount = 100
+    const snapshot: AgentStatusSetData[] = []
+    const worktrees: AppState['worktreesByRepo'][string] = []
+    const tabsByWorktree: AppState['tabsByWorktree'] = {}
+    const terminalLayoutsByTabId: AppState['terminalLayoutsByTabId'] = {}
+    for (let index = 0; index < paneCount; index += 1) {
+      const worktreeId = `wt-snapshot-${index}`
+      const tabId = `tab-snapshot-${index}`
+      const leafId = `00000000-0000-4000-8000-${String(index).padStart(12, '0')}`
+      const paneKey = makePaneKey(tabId, leafId)
+      worktrees.push(makeWorktree({ id: worktreeId, repoId: TEST_REPO.id }))
+      tabsByWorktree[worktreeId] = [
+        makeTab({ id: tabId, worktreeId, title: 'Pi', ptyId: `pty-${index}` })
+      ]
+      terminalLayoutsByTabId[tabId] = {
+        root: { type: 'leaf', leafId },
+        activeLeafId: leafId,
+        expandedLeafId: null
+      }
+      snapshot.push({
+        paneKey,
+        worktreeId,
+        state: 'waiting',
+        prompt: `remote prompt ${index}`,
+        agentType: 'pi',
+        receivedAt: 1_700_000_000_000 + index,
+        stateStartedAt: 1_700_000_000_000 + index
+      })
+    }
+    let resolveSnapshot: ((entries: AgentStatusSetData[]) => void) | undefined
+    const getSnapshot = vi.fn(
+      () =>
+        new Promise<AgentStatusSetData[]>((resolve) => {
+          resolveSnapshot = resolve
+        })
+    )
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [TEST_REPO],
+      worktreesByRepo: { [TEST_REPO.id]: worktrees },
+      tabsByWorktree,
+      terminalLayoutsByTabId,
+      activeWorktreeId: worktrees[0]?.id ?? null,
+      settings: {
+        ...store.getState().settings,
+        tabAutoGenerateTitle: true,
+        terminalFontSize: 13
+      }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        getSnapshot,
+        onSet: () => () => {}
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    await Promise.resolve()
+    let relevantPublications = 0
+    const unsubscribe = store.subscribe((state, previousState) => {
+      if (
+        state.agentStatusByPaneKey !== previousState.agentStatusByPaneKey ||
+        state.tabsByWorktree !== previousState.tabsByWorktree
+      ) {
+        relevantPublications += 1
+      }
+    })
+    resolveSnapshot?.(snapshot)
+
+    await vi.waitFor(() => {
+      expect(Object.keys(store.getState().agentStatusByPaneKey)).toHaveLength(paneCount)
+      expect(store.getState().tabsByWorktree['wt-snapshot-99']?.[0]?.title).toBe(
+        'Pi - action required'
+      )
+      expect(store.getState().tabsByWorktree['wt-snapshot-99']?.[0]?.generatedTitle).toBeTruthy()
+    })
+
+    expect(relevantPublications).toBe(3)
+    unsubscribe()
+  })
+
+  it('indexes one 100-pane tab and its split tree once per snapshot', async () => {
+    const paneCount = 100
+    const tabId = 'tab-indexed-snapshot'
+    const worktreeId = 'wt-indexed-snapshot'
+    const leafIds = Array.from(
+      { length: paneCount },
+      (_, index) => `00000000-0000-4000-8001-${String(index).padStart(12, '0')}`
+    )
+    let leafIdLookupCount = 0
+    const leaves = leafIds.map((leafId) => {
+      const leaf = { type: 'leaf' } as TerminalPaneLayoutNode
+      Object.defineProperty(leaf, 'leafId', {
+        enumerable: true,
+        get: () => {
+          leafIdLookupCount += 1
+          return leafId
+        }
+      })
+      return leaf
+    })
+    const root = leaves
+      .slice(1)
+      .reduce<TerminalPaneLayoutNode>(
+        (tree, leaf) => ({ type: 'split', direction: 'vertical', first: tree, second: leaf }),
+        leaves[0]!
+      )
+    let tabIdLookupCount = 0
+    const tab = makeTab({ id: tabId, worktreeId, title: 'Workspace', ptyId: 'pty-indexed' })
+    Object.defineProperty(tab, 'id', {
+      enumerable: true,
+      get: () => {
+        tabIdLookupCount += 1
+        return tabId
+      }
+    })
+    const snapshot = leafIds.map(
+      (leafId, index): AgentStatusSetData => ({
+        paneKey: makePaneKey(tabId, leafId),
+        worktreeId,
+        state: 'working',
+        prompt: `indexed prompt ${index}`,
+        agentType: 'claude',
+        receivedAt: 1_700_000_000_000 + index,
+        stateStartedAt: 1_700_000_000_000 + index
+      })
+    )
+    let resolveSnapshot!: (entries: AgentStatusSetData[]) => void
+    const getSnapshot = vi.fn(
+      () =>
+        new Promise<AgentStatusSetData[]>((resolve) => {
+          resolveSnapshot = resolve
+        })
+    )
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [TEST_REPO],
+      worktreesByRepo: {
+        [TEST_REPO.id]: [makeWorktree({ id: worktreeId, repoId: TEST_REPO.id })]
+      },
+      tabsByWorktree: { [worktreeId]: [tab] },
+      terminalLayoutsByTabId: {
+        [tabId]: {
+          root,
+          activeLeafId: leafIds[0]!,
+          expandedLeafId: null
+        }
+      },
+      setGeneratedTabTitlesFromAgentPrompts: vi.fn(),
+      settings: { ...store.getState().settings, terminalFontSize: 13 }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal('window', buildWindowApi({ getSnapshot, onSet: () => () => {} }))
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    await Promise.resolve()
+    tabIdLookupCount = 0
+    leafIdLookupCount = 0
+    resolveSnapshot(snapshot)
+
+    await vi.waitFor(() => {
+      expect(Object.keys(store.getState().agentStatusByPaneKey)).toHaveLength(paneCount)
+    })
+    expect(tabIdLookupCount).toBe(1)
+    expect(leafIdLookupCount).toBe(paneCount)
+  })
+
+  it('indexes 100 distinct tab owners once per snapshot', async () => {
+    const paneCount = 100
+    const worktreeId = 'wt-indexed-tabs'
+    const tabs: AppState['tabsByWorktree'][string] = []
+    const snapshot: AgentStatusSetData[] = []
+    const unsupportedSnapshot: MigrationUnsupportedPtyEntry[] = []
+    let tabIdLookupCount = 0
+    for (let index = 0; index < paneCount; index += 1) {
+      const tabId = `tab-indexed-${index}`
+      const leafId = `00000000-0000-4000-8003-${String(index).padStart(12, '0')}`
+      const tab = makeTab({
+        id: tabId,
+        worktreeId,
+        title: 'Workspace',
+        ptyId: `pty-indexed-${index}`
+      })
+      Object.defineProperty(tab, 'id', {
+        enumerable: true,
+        get: () => {
+          tabIdLookupCount += 1
+          return tabId
+        }
+      })
+      tabs.push(tab)
+      snapshot.push({
+        paneKey: makePaneKey(tabId, leafId),
+        worktreeId,
+        state: 'working',
+        prompt: `indexed tab prompt ${index}`,
+        agentType: 'claude',
+        receivedAt: 1_700_000_000_500 + index,
+        stateStartedAt: 1_700_000_000_500 + index
+      })
+      unsupportedSnapshot.push({
+        ptyId: `pty-indexed-${index}`,
+        worktreeId,
+        tabId,
+        leafId,
+        paneKey: makePaneKey(tabId, leafId),
+        reason: 'legacy-numeric-pane-key',
+        source: 'local',
+        updatedAt: 1_700_000_000_500 + index
+      })
+    }
+    let resolveSnapshot!: (entries: AgentStatusSetData[]) => void
+    const getSnapshot = vi.fn(
+      () =>
+        new Promise<AgentStatusSetData[]>((resolve) => {
+          resolveSnapshot = resolve
+        })
+    )
+    let resolveUnsupportedSnapshot!: (entries: MigrationUnsupportedPtyEntry[]) => void
+    const getMigrationUnsupportedSnapshot = vi.fn(
+      () =>
+        new Promise<MigrationUnsupportedPtyEntry[]>((resolve) => {
+          resolveUnsupportedSnapshot = resolve
+        })
+    )
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [TEST_REPO],
+      worktreesByRepo: {
+        [TEST_REPO.id]: [makeWorktree({ id: worktreeId, repoId: TEST_REPO.id })]
+      },
+      tabsByWorktree: { [worktreeId]: tabs },
+      terminalLayoutsByTabId: {},
+      setGeneratedTabTitlesFromAgentPrompts: vi.fn(),
+      settings: {
+        ...store.getState().settings,
+        terminalFontSize: 13,
+        tabAutoGenerateTitle: false
+      }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        getSnapshot,
+        getMigrationUnsupportedSnapshot,
+        onSet: () => () => {}
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    await Promise.resolve()
+    tabIdLookupCount = 0
+    resolveSnapshot(snapshot)
+
+    await vi.waitFor(() => {
+      expect(Object.keys(store.getState().agentStatusByPaneKey)).toHaveLength(paneCount)
+    })
+    expect(tabIdLookupCount).toBe(paneCount)
+    expect(getMigrationUnsupportedSnapshot).toHaveBeenCalledTimes(1)
+
+    tabIdLookupCount = 0
+    resolveUnsupportedSnapshot(unsupportedSnapshot)
+    await vi.waitFor(() => {
+      expect(Object.keys(store.getState().migrationUnsupportedByPtyId)).toHaveLength(paneCount)
+    })
+    expect(tabIdLookupCount).toBe(paneCount)
+  })
+
+  it('preserves inactive, SSH, and folder routing parity in one batch', async () => {
+    type RoutingCase = {
+      tabId: string
+      leafId: string
+      ownerId: string
+      payloadWorktreeId: string
+      connectionId?: string
+      rootless?: boolean
+      expected: boolean
+    }
+    const folderId = 'folder-routing'
+    const folderKey = folderWorkspaceKey(folderId)
+    const cases: RoutingCase[] = [
+      {
+        tabId: 'tab-routing-inactive',
+        leafId: '00000000-0000-4000-8002-000000000001',
+        ownerId: 'wt-routing-local',
+        payloadWorktreeId: 'wt-routing-local',
+        rootless: true,
+        expected: true
+      },
+      {
+        tabId: 'tab-routing-ssh-match',
+        leafId: '00000000-0000-4000-8002-000000000002',
+        ownerId: 'wt-routing-ssh',
+        payloadWorktreeId: 'wt-routing-ssh',
+        connectionId: 'ssh-live',
+        expected: true
+      },
+      {
+        tabId: 'tab-routing-ssh-mismatch',
+        leafId: '00000000-0000-4000-8002-000000000003',
+        ownerId: 'wt-routing-ssh',
+        payloadWorktreeId: 'wt-routing-ssh',
+        connectionId: 'ssh-stale',
+        expected: false
+      },
+      {
+        tabId: 'tab-routing-hydrating',
+        leafId: '00000000-0000-4000-8002-000000000004',
+        ownerId: 'wt-routing-hydrating',
+        payloadWorktreeId: 'wt-routing-hydrating',
+        connectionId: 'ssh-hydrating',
+        expected: true
+      },
+      {
+        tabId: 'tab-routing-hydrating-mismatch',
+        leafId: '00000000-0000-4000-8002-000000000005',
+        ownerId: 'wt-routing-hydrating',
+        payloadWorktreeId: 'wt-routing-other',
+        connectionId: 'ssh-hydrating',
+        expected: false
+      },
+      {
+        tabId: 'tab-routing-folder',
+        leafId: '00000000-0000-4000-8002-000000000006',
+        ownerId: folderKey,
+        payloadWorktreeId: folderKey,
+        connectionId: 'ssh-folder-stale',
+        expected: true
+      }
+    ]
+    const tabsByWorktree: AppState['tabsByWorktree'] = {}
+    const terminalLayoutsByTabId: AppState['terminalLayoutsByTabId'] = {}
+    for (const entry of cases) {
+      ;(tabsByWorktree[entry.ownerId] ??= []).push(
+        makeTab({
+          id: entry.tabId,
+          worktreeId: entry.ownerId,
+          title: 'Workspace',
+          ptyId: `pty-${entry.tabId}`
+        })
+      )
+      terminalLayoutsByTabId[entry.tabId] = {
+        root: entry.rootless ? null : { type: 'leaf', leafId: entry.leafId },
+        activeLeafId: entry.rootless ? null : entry.leafId,
+        expandedLeafId: null
+      }
+    }
+    const snapshot = cases.map(
+      (entry, index): AgentStatusSetData => ({
+        paneKey: makePaneKey(entry.tabId, entry.leafId),
+        worktreeId: entry.payloadWorktreeId,
+        ...(entry.connectionId ? { connectionId: entry.connectionId } : {}),
+        state: 'working',
+        prompt: `routing case ${index}`,
+        agentType: 'claude',
+        receivedAt: 1_700_000_001_000 + index,
+        stateStartedAt: 1_700_000_001_000 + index
+      })
+    )
+    const localRepo = { ...TEST_REPO, id: 'repo-routing-local', connectionId: null }
+    const sshRepo = { ...TEST_REPO, id: 'repo-routing-ssh', connectionId: 'ssh-live' }
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [localRepo, sshRepo],
+      worktreesByRepo: {
+        [localRepo.id]: [makeWorktree({ id: 'wt-routing-local', repoId: localRepo.id })],
+        [sshRepo.id]: [makeWorktree({ id: 'wt-routing-ssh', repoId: sshRepo.id })]
+      },
+      folderWorkspaces: [
+        {
+          id: folderId,
+          projectGroupId: 'group-routing',
+          name: 'Folder routing',
+          folderPath: '/folder-routing',
+          connectionId: 'ssh-folder-live',
+          linkedTask: null,
+          comment: '',
+          isArchived: false,
+          isUnread: false,
+          isPinned: false,
+          sortOrder: 0,
+          lastActivityAt: 0,
+          createdAt: 0,
+          updatedAt: 0
+        }
+      ],
+      tabsByWorktree,
+      terminalLayoutsByTabId,
+      activeWorktreeId: null,
+      settings: { ...store.getState().settings, terminalFontSize: 13 }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({ getSnapshot: vi.fn().mockResolvedValue(snapshot), onSet: () => () => {} })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+
+    await vi.waitFor(() => {
+      expect(
+        cases
+          .filter((entry) => entry.expected)
+          .every(
+            (entry) => store.getState().agentStatusByPaneKey[makePaneKey(entry.tabId, entry.leafId)]
+          )
+      ).toBe(true)
+    })
+    for (const entry of cases) {
+      expect(
+        store.getState().agentStatusByPaneKey[makePaneKey(entry.tabId, entry.leafId)] !== undefined
+      ).toBe(entry.expected)
+    }
+  })
+
+  it('projects ordered tab titles across panes in an inactive split snapshot', async () => {
+    const tabId = 'tab-inactive-split'
+    const worktreeId = 'wt-inactive-split'
+    const waitingPaneKey = makePaneKey(tabId, '00000000-0000-4000-8000-000000000001')
+    const donePaneKey = makePaneKey(tabId, '00000000-0000-4000-8000-000000000002')
+    const getSnapshot = vi.fn().mockResolvedValue([
+      {
+        paneKey: waitingPaneKey,
+        worktreeId,
+        state: 'waiting',
+        prompt: 'waiting turn',
+        agentType: 'pi',
+        receivedAt: 1_700_000_000_000,
+        stateStartedAt: 1_700_000_000_000
+      },
+      {
+        paneKey: donePaneKey,
+        worktreeId,
+        state: 'done',
+        prompt: 'completed turn',
+        agentType: 'pi',
+        receivedAt: 1_700_000_000_001,
+        stateStartedAt: 1_700_000_000_001
+      }
+    ] satisfies AgentStatusSetData[])
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [TEST_REPO],
+      worktreesByRepo: {
+        [TEST_REPO.id]: [makeWorktree({ id: worktreeId, repoId: TEST_REPO.id })]
+      },
+      tabsByWorktree: {
+        [worktreeId]: [makeTab({ id: tabId, worktreeId, title: 'My Project' })]
+      },
+      terminalLayoutsByTabId: {
+        [tabId]: {
+          root: null,
+          activeLeafId: null,
+          expandedLeafId: null,
+          ptyIdsByLeafId: {}
+        }
+      },
+      activeWorktreeId: null,
+      settings: { ...store.getState().settings, terminalFontSize: 13 }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        getSnapshot,
+        onSet: () => () => {}
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+
+    await vi.waitFor(() => {
+      expect(store.getState().agentStatusByPaneKey[waitingPaneKey]?.state).toBe('waiting')
+      expect(store.getState().agentStatusByPaneKey[donePaneKey]?.state).toBe('done')
+      expect(store.getState().tabsByWorktree[worktreeId]?.[0]?.title).toBe('Pi ready')
+    })
+  })
+
   it('applies a burst leading-edge first, then coalesces the rest into one deferred batch', async () => {
     // Why: each live status event is its own IPC task, so N events used to pay
     // N full render passes (STA-3328 mechanism 2). The leading event must stay
     // synchronous (zero added latency); followers within the burst window must
     // apply together on one later task, in arrival order.
     vi.useFakeTimers()
-    const setAgentStatus = vi.fn()
+    let storeState: StoreLike
+    let publicationCount = 0
+    const applyStatus = (paneKey: string, payload: unknown): void => {
+      storeState.agentStatusByPaneKey = {
+        ...(storeState.agentStatusByPaneKey as Record<string, unknown>),
+        [paneKey]: payload
+      }
+    }
+    const setAgentStatus = vi.fn((paneKey: string, payload: unknown) => {
+      applyStatus(paneKey, payload)
+      publicationCount += 1
+    })
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusBatchUpdate[]) => {
+      for (const update of updates) {
+        if (update.kind === 'providerSession') {
+          const next = { ...(storeState.agentStatusByPaneKey as Record<string, unknown>) }
+          delete next[update.paneKey]
+          storeState.agentStatusByPaneKey = next
+        } else {
+          applyStatus(update.paneKey, update.payload)
+        }
+      }
+      publicationCount += 1
+      return updates.map(() => true)
+    })
+    const recordAgentProviderSession = vi.fn()
     const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
       current: null
     }
-    const storeState: StoreLike = buildStoreState({
+    storeState = buildStoreState({
       setAgentStatus,
+      setAgentStatuses,
+      recordAgentProviderSession,
       workspaceSessionReady: true,
       tabsByWorktree: {
         'wt-1': [{ id: 'tab-future', ptyId: 'pty-1', worktreeId: 'wt-1', title: 'Future Tab' }]
@@ -6235,7 +6920,6 @@ describe('useIpcEvents agent status snapshot integration', () => {
         }
       }
     })
-
     stubReactSyncEffect()
     vi.doMock('../store', () => ({
       useAppStore: {
@@ -6273,15 +6957,275 @@ describe('useIpcEvents agent status snapshot integration', () => {
 
       emit(1_700_000_000_000, 'first')
       expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(publicationCount).toBe(1)
 
       emit(1_700_000_000_001, 'second')
       emit(1_700_000_000_002, 'third')
+      onSetListenerRef.current({
+        paneKey: FUTURE_PANE_KEY,
+        state: 'working',
+        prompt: 'provider identity',
+        agentType: 'pi',
+        providerSession: { key: 'session_id', id: 'pi-session' },
+        providerSessionOnly: true,
+        receivedAt: 1_700_000_000_003,
+        stateStartedAt: 1_700_000_000_003
+      })
       expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses).not.toHaveBeenCalled()
 
       vi.advanceTimersByTime(40)
-      expect(setAgentStatus).toHaveBeenCalledTimes(3)
-      expect(setAgentStatus.mock.calls[1][1]).toEqual(expect.objectContaining({ prompt: 'second' }))
-      expect(setAgentStatus.mock.calls[2][1]).toEqual(expect.objectContaining({ prompt: 'third' }))
+      expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses.mock.calls[0][0]).toEqual([
+        expect.objectContaining({
+          paneKey: FUTURE_PANE_KEY,
+          payload: expect.objectContaining({ prompt: 'second' })
+        }),
+        expect.objectContaining({
+          paneKey: FUTURE_PANE_KEY,
+          payload: expect.objectContaining({ prompt: 'third' })
+        }),
+        expect.objectContaining({
+          kind: 'providerSession',
+          paneKey: FUTURE_PANE_KEY,
+          agent: 'pi',
+          providerSession: { key: 'session_id', id: 'pi-session' }
+        })
+      ])
+      expect(recordAgentProviderSession).not.toHaveBeenCalled()
+      expect(publicationCount).toBe(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps a live event enqueued by a synchronous batch subscriber for the next flush', async () => {
+    vi.useFakeTimers()
+    const setAgentStatus = vi.fn()
+    const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
+      current: null
+    }
+    let reentered = false
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusUpdate[]) => {
+      if (!reentered) {
+        reentered = true
+        onSetListenerRef.current?.({
+          paneKey: FUTURE_PANE_KEY,
+          state: 'working',
+          prompt: 'reentered',
+          agentType: 'claude',
+          receivedAt: 1_700_000_000_002,
+          stateStartedAt: 1_700_000_000_002
+        })
+      }
+      return updates.map(() => true)
+    })
+    const storeState = buildStoreState({
+      setAgentStatus,
+      setAgentStatuses,
+      workspaceSessionReady: true,
+      tabsByWorktree: {
+        'wt-1': [{ id: 'tab-future', ptyId: 'pty-1', worktreeId: 'wt-1', title: 'Future Tab' }]
+      },
+      terminalLayoutsByTabId: {
+        'tab-future': {
+          root: { type: 'leaf', leafId: FUTURE_LEAF_ID },
+          activeLeafId: FUTURE_LEAF_ID,
+          expandedLeafId: null
+        }
+      }
+    })
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: vi.fn(() => () => {}),
+        getState: () => storeState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        onSet: (callback) => {
+          onSetListenerRef.current = callback
+          return () => {}
+        }
+      })
+    )
+
+    try {
+      const { useIpcEvents } = await import('./useIpcEvents')
+      useIpcEvents()
+      if (!onSetListenerRef.current) {
+        throw new Error('Expected agentStatus.onSet listener to be registered')
+      }
+
+      onSetListenerRef.current({
+        paneKey: FUTURE_PANE_KEY,
+        state: 'working',
+        prompt: 'leading',
+        agentType: 'claude',
+        receivedAt: 1_700_000_000_000,
+        stateStartedAt: 1_700_000_000_000
+      })
+      onSetListenerRef.current({
+        paneKey: FUTURE_PANE_KEY,
+        state: 'working',
+        prompt: 'queued',
+        agentType: 'claude',
+        receivedAt: 1_700_000_000_001,
+        stateStartedAt: 1_700_000_000_001
+      })
+
+      vi.advanceTimersByTime(40)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses.mock.calls[0][0][0].payload.prompt).toBe('queued')
+
+      vi.advanceTimersByTime(40)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(2)
+      expect(setAgentStatuses.mock.calls[1][0][0].payload.prompt).toBe('reentered')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('projects synthetic pane titles across ordered same-pane batch updates', async () => {
+    vi.useFakeTimers()
+    let storeState: StoreLike
+    const applyStatusUpdate = (update: AgentStatusUpdate): void => {
+      storeState.agentStatusByPaneKey = {
+        ...(storeState.agentStatusByPaneKey as Record<string, unknown>),
+        [update.paneKey]: {
+          ...update.payload,
+          updatedAt: update.timing?.updatedAt,
+          providerSession: update.metadata?.providerSession
+        }
+      }
+    }
+    const setAgentStatus = vi.fn(
+      (
+        paneKey: string,
+        payload: AgentStatusUpdate['payload'],
+        terminalTitle?: string,
+        timing?: AgentStatusUpdate['timing'],
+        routing?: AgentStatusUpdate['routing'],
+        metadata?: AgentStatusUpdate['metadata']
+      ) => applyStatusUpdate({ paneKey, payload, terminalTitle, timing, routing, metadata })
+    )
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusUpdate[]) => {
+      return updates.map((update) => {
+        const existing = (
+          storeState.agentStatusByPaneKey as Record<string, { updatedAt?: number } | undefined>
+        )[update.paneKey]
+        if (
+          existing?.updatedAt !== undefined &&
+          update.timing?.updatedAt !== undefined &&
+          update.timing.updatedAt < existing.updatedAt
+        ) {
+          return false
+        }
+        applyStatusUpdate(update)
+        return true
+      })
+    })
+    const updateTabTitle = vi.fn()
+    const observeAgentHookCompletionForNotification = vi.fn()
+    const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
+      current: null
+    }
+    storeState = buildStoreState({
+      setAgentStatus,
+      setAgentStatuses,
+      updateTabTitle,
+      workspaceSessionReady: true,
+      tabsByWorktree: {
+        'wt-1': [{ id: 'tab-future', ptyId: 'pty-1', worktreeId: 'wt-1', title: 'Codex' }]
+      },
+      terminalLayoutsByTabId: {
+        'tab-future': {
+          root: { type: 'leaf', leafId: FUTURE_LEAF_ID },
+          activeLeafId: FUTURE_LEAF_ID,
+          expandedLeafId: null
+        }
+      }
+    })
+    const updateTabTitles = vi.mocked(storeState.updateTabTitles as AppState['updateTabTitles'])
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: vi.fn(() => () => {}),
+        getState: () => storeState
+      }
+    }))
+    vi.doMock('./agent-hook-completion-notifications', () => ({
+      observeAgentHookCompletionForNotification,
+      resetAgentHookCompletionNotificationCoordinators: vi.fn(),
+      syncAgentHookCompletionNotificationsForStoreUpdate: vi.fn()
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        onSet: (callback) => {
+          onSetListenerRef.current = callback
+          return () => {}
+        }
+      })
+    )
+
+    try {
+      const { useIpcEvents } = await import('./useIpcEvents')
+      useIpcEvents()
+      const onSet = onSetListenerRef.current
+      if (!onSet) {
+        throw new Error('Expected agentStatus.onSet listener to be registered')
+      }
+      const emit = (
+        receivedAt: number,
+        state: AgentStatusSetData['state'],
+        agentType?: string
+      ): void => {
+        onSet({
+          paneKey: FUTURE_PANE_KEY,
+          state,
+          prompt: state,
+          agentType,
+          receivedAt,
+          stateStartedAt: receivedAt
+        })
+      }
+
+      emit(1_700_000_000_000, 'working', 'pi')
+      emit(1_700_000_000_001, 'waiting', 'pi')
+      emit(1_700_000_000_002, 'waiting', 'pi')
+      emit(1_700_000_000_003, 'done', 'pi')
+      emit(1_700_000_000_002, 'waiting', 'pi')
+      vi.advanceTimersByTime(40)
+
+      expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses.mock.calls[0][0]).toEqual([
+        expect.objectContaining({
+          payload: expect.objectContaining({ agentType: 'pi', state: 'waiting' }),
+          terminalTitle: 'Pi - action required'
+        }),
+        expect.objectContaining({
+          payload: expect.objectContaining({ agentType: 'pi', state: 'waiting' }),
+          terminalTitle: 'Pi - action required'
+        }),
+        expect.objectContaining({
+          payload: expect.objectContaining({ agentType: 'pi', state: 'done' }),
+          terminalTitle: 'Pi ready'
+        })
+      ])
+      expect(setAgentStatuses.mock.results[0].value).toEqual([true, true, true])
+      expect(updateTabTitle).toHaveBeenCalledOnce()
+      expect(updateTabTitle).toHaveBeenCalledWith('tab-future', 'Pi ready')
+      expect(updateTabTitles).toHaveBeenCalledTimes(1)
+      expect(observeAgentHookCompletionForNotification).toHaveBeenCalledTimes(4)
     } finally {
       vi.useRealTimers()
     }
@@ -6290,19 +7234,32 @@ describe('useIpcEvents agent status snapshot integration', () => {
   it('preserves queued set-clear order for working removal and done retention', async () => {
     vi.useFakeTimers()
     let storeState: StoreLike
+    const applyStatusUpdate = (
+      paneKey: string,
+      payload: { state: string },
+      timing: { updatedAt?: number } | undefined
+    ): void => {
+      storeState.agentStatusByPaneKey = {
+        ...(storeState.agentStatusByPaneKey as Record<string, unknown>),
+        [paneKey]: { ...payload, updatedAt: timing?.updatedAt }
+      }
+    }
     const setAgentStatus = vi.fn(
       (
         paneKey: string,
         payload: { state: string },
         _title: unknown,
-        timing: { updatedAt: number }
+        timing: { updatedAt?: number } | undefined
       ) => {
-        storeState.agentStatusByPaneKey = {
-          ...(storeState.agentStatusByPaneKey as Record<string, unknown>),
-          [paneKey]: { ...payload, updatedAt: timing.updatedAt }
-        }
+        applyStatusUpdate(paneKey, payload, timing)
       }
     )
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusUpdate[]) => {
+      for (const update of updates) {
+        applyStatusUpdate(update.paneKey, update.payload, update.timing)
+      }
+      return updates.map(() => true)
+    })
     const removeAgentStatus = vi.fn((paneKey: string) => {
       const next = { ...(storeState.agentStatusByPaneKey as Record<string, unknown>) }
       delete next[paneKey]
@@ -6316,6 +7273,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
     }
     storeState = buildStoreState({
       setAgentStatus,
+      setAgentStatuses,
       removeAgentStatus,
       workspaceSessionReady: true,
       tabsByWorktree: {
@@ -6385,23 +7343,28 @@ describe('useIpcEvents agent status snapshot integration', () => {
       expect(storeState.agentStatusByPaneKey).toEqual({})
 
       vi.advanceTimersByTime(40)
-      expect(setAgentStatus).toHaveBeenCalledTimes(2)
+      expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(1)
       expect(storeState.agentStatusByPaneKey).toEqual({})
 
       emit(1_700_000_000_002, 'task')
       emit(1_700_000_000_003, 'task', 'done')
-      expect(setAgentStatus).toHaveBeenCalledTimes(3)
+      expect(setAgentStatus).toHaveBeenCalledTimes(2)
 
       onClearListenerRef.current({ paneKey: FUTURE_PANE_KEY })
 
-      expect(setAgentStatus).toHaveBeenCalledTimes(4)
-      expect(setAgentStatus.mock.calls[3][1]).toEqual(expect.objectContaining({ state: 'done' }))
+      expect(setAgentStatus).toHaveBeenCalledTimes(2)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(2)
+      expect(setAgentStatuses.mock.calls[1][0][0]).toEqual(
+        expect.objectContaining({ payload: expect.objectContaining({ state: 'done' }) })
+      )
       expect(removeAgentStatus).toHaveBeenCalledTimes(1)
       expect(storeState.agentStatusByPaneKey).toEqual({
         [FUTURE_PANE_KEY]: expect.objectContaining({ state: 'done' })
       })
       vi.advanceTimersByTime(40)
-      expect(setAgentStatus).toHaveBeenCalledTimes(4)
+      expect(setAgentStatus).toHaveBeenCalledTimes(2)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(2)
     } finally {
       vi.useRealTimers()
     }
@@ -6505,6 +7468,93 @@ describe('useIpcEvents agent status snapshot integration', () => {
     expect(setAgentStatusCalls).toBe(1)
   })
 
+  // Why: the pending queue is spliced before the fold, so a throwing fold would drop every
+  // buffered event permanently. Before batching the queue was only replaced after the loop,
+  // so a throw left it intact — keep that.
+  it('keeps pending statuses queued when the retry fold throws', async () => {
+    const subscribeListenerRef: { current: StoreSubscribeListener | null } = { current: null }
+    const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
+      current: null
+    }
+    let shouldThrow = true
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusUpdate[]) => {
+      if (shouldThrow) {
+        shouldThrow = false
+        throw new Error('fold blew up')
+      }
+      return updates.map(() => true)
+    })
+    const storeState: StoreLike = buildStoreState({
+      setAgentStatus: vi.fn(),
+      setAgentStatuses,
+      workspaceSessionReady: true,
+      settings: { terminalFontSize: 13, notifications: { enabled: false } },
+      // Pane does not exist yet -> the incoming event is buffered as pending.
+      tabsByWorktree: {},
+      terminalLayoutsByTabId: {}
+    })
+    const notify = (): void => subscribeListenerRef.current?.(storeState, storeState)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: vi.fn((listener: StoreSubscribeListener) => {
+          subscribeListenerRef.current = listener
+          return () => {
+            subscribeListenerRef.current = null
+          }
+        }),
+        getState: () => storeState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        onSet: (cb) => {
+          onSetListenerRef.current = cb
+          return () => {}
+        }
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    await Promise.resolve()
+    if (typeof onSetListenerRef.current !== 'function') {
+      throw new Error('Expected agentStatus.onSet listener to be registered')
+    }
+
+    onSetListenerRef.current({
+      paneKey: FUTURE_PANE_KEY,
+      state: 'working',
+      prompt: 'buffered',
+      agentType: 'claude',
+      receivedAt: 1_700_000_000_100,
+      stateStartedAt: 1_700_000_000_100
+    })
+
+    // Tab hydrates, so the next store update flushes the pending event — and throws.
+    storeState.tabsByWorktree = {
+      'wt-1': [{ id: 'tab-future', ptyId: 'pty-1', worktreeId: 'wt-1', title: 'Future Tab' }]
+    }
+    storeState.terminalLayoutsByTabId = {
+      'tab-future': {
+        root: { type: 'leaf', leafId: FUTURE_LEAF_ID },
+        activeLeafId: FUTURE_LEAF_ID,
+        expandedLeafId: null
+      }
+    }
+    expect(() => notify()).toThrow('fold blew up')
+
+    // The event must still be queued, so the next flush replays it.
+    notify()
+    const replayedAfterThrow = setAgentStatuses.mock.calls
+      .slice(1)
+      .flatMap((call) => call[0].map((update) => update.payload.prompt))
+    expect(replayedAfterThrow).toContain('buffered')
+  })
+
   it('applies ready push events for an unmounted inactive terminal tab', async () => {
     const setAgentStatus = vi.fn()
     const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
@@ -7728,6 +8778,9 @@ describe('useIpcEvents agent status snapshot integration', () => {
         }
       }
     })
+    const setAgentStatusBatch = vi.mocked(
+      storeState.setAgentStatuses as AppState['setAgentStatuses']
+    )
 
     stubReactSyncEffect()
     vi.doMock('../store', () => ({
@@ -7799,6 +8852,8 @@ describe('useIpcEvents agent status snapshot integration', () => {
     subscribeListenerRef.current(storeState, previousStoreState)
 
     expect(setAgentStatus).toHaveBeenCalledTimes(2)
+    expect(setAgentStatusBatch).toHaveBeenCalledTimes(1)
+    expect(setAgentStatusBatch.mock.calls[0]?.[0]).toHaveLength(2)
     expect(setAgentStatus).toHaveBeenNthCalledWith(
       1,
       FUTURE_PANE_KEY,
@@ -9120,6 +10175,189 @@ describe('useIpcEvents agent status snapshot integration', () => {
   })
 })
 
+describe('runtime host catalog refresh on reposChanged', () => {
+  // Why: the host emits one reposChanged for project-group and folder-workspace edits
+  // too, so a repos-only refresh leaves those catalogs stale on every paired client.
+  it('refetches the runtime host project group and folder workspace catalogs', async () => {
+    vi.resetModules()
+    vi.useFakeTimers()
+    try {
+      const calls: string[] = []
+      const fetchRuntimeEnvironmentRepos = vi.fn(() => {
+        calls.push('repos')
+        return Promise.resolve([])
+      })
+      const fetchProjectGroups = vi.fn(() => {
+        calls.push('project-groups')
+        return Promise.resolve()
+      })
+      const fetchFolderWorkspaces = vi.fn(() => {
+        calls.push('folder-workspaces')
+        return Promise.resolve()
+      })
+      const state = {
+        settings: { activeRuntimeEnvironmentId: 'env-1' as string | null },
+        repos: [],
+        worktreesByRepo: {},
+        folderWorkspaces: [],
+        projectGroups: [],
+        runtimeEnvironments: [],
+        runtimeStatusByEnvironmentId: new Map(),
+        tabsByWorktree: {},
+        ptyIdsByTabId: {},
+        remountTerminalTabForRecovery: vi.fn(),
+        markEnvironmentSshStateStale: vi.fn(),
+        fetchRepos: vi.fn(() => Promise.resolve()),
+        fetchRuntimeEnvironmentRepos,
+        fetchProjectGroups,
+        fetchFolderWorkspaces,
+        fetchWorktrees: vi.fn(() => Promise.resolve()),
+        fetchWorktreeLineage: vi.fn(() => Promise.resolve())
+      }
+
+      vi.doMock('react', async () => {
+        const actual = await vi.importActual<typeof ReactModule>('react')
+        return { ...actual, useEffect: (effect: () => void | (() => void)) => void effect() }
+      })
+      vi.doMock('../store', () => ({
+        useAppStore: { subscribe: vi.fn(() => () => {}), getState: () => state }
+      }))
+      const noopListener = (): (() => void) => () => {}
+      const autoStubNamespace = new Proxy(
+        {},
+        {
+          get:
+            () =>
+            (...args: unknown[]) => {
+              if (typeof args[0] === 'function') {
+                return noopListener()
+              }
+              return new Promise(() => {})
+            }
+        }
+      )
+      let runtimeOnResponse: ((response: unknown) => void) | undefined
+      const api = new Proxy(
+        {
+          runtimeEnvironments: {
+            subscribe: async (_args: unknown, callbacks: { onResponse: (r: unknown) => void }) => {
+              runtimeOnResponse = callbacks.onResponse
+              return { unsubscribe: vi.fn(), sendBinary: vi.fn() }
+            }
+          }
+        } as Record<string, unknown>,
+        { get: (target, prop: string) => target[prop] ?? autoStubNamespace }
+      )
+      vi.stubGlobal('window', { api })
+
+      const { useIpcEvents } = await import('./useIpcEvents')
+      useIpcEvents()
+      // Seeded discovery for the connected runtime; drains the scheduler's debounce.
+      await vi.advanceTimersByTimeAsync(300)
+
+      const runtimeOwner = { runtimeEnvironmentId: 'env-1' }
+      expect(fetchProjectGroups).toHaveBeenCalledWith(runtimeOwner)
+      expect(fetchFolderWorkspaces).toHaveBeenCalledWith(runtimeOwner)
+      // Folder workspaces resolve their owning group from projectGroups, so groups must land first.
+      expect(calls).toEqual(['repos', 'project-groups', 'folder-workspaces'])
+
+      calls.length = 0
+      fetchProjectGroups.mockClear()
+      fetchFolderWorkspaces.mockClear()
+      if (!runtimeOnResponse) {
+        throw new Error('Expected runtime client event callbacks')
+      }
+      // Past the scheduler's min interval so the event schedules on the debounce alone.
+      await vi.advanceTimersByTimeAsync(5_000)
+      runtimeOnResponse({ ok: true, result: { type: 'reposChanged' } })
+      await vi.advanceTimersByTimeAsync(300)
+
+      expect(fetchProjectGroups).toHaveBeenCalledWith(runtimeOwner)
+      expect(fetchFolderWorkspaces).toHaveBeenCalledWith(runtimeOwner)
+      expect(calls).toEqual(['repos', 'project-groups', 'folder-workspaces'])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
+
+describe('repo catalog refresh on repos:changed', () => {
+  it('skips remote catalog RPCs when refreshing local rows under a runtime', async () => {
+    vi.resetModules()
+    let reposChangedListener: (() => void) | undefined
+    const fetchRepos = vi.fn(() => Promise.resolve())
+    const fetchProjectGroups = vi.fn(() => Promise.resolve())
+    const fetchFolderWorkspaces = vi.fn(() => Promise.resolve())
+    const remountTerminalTabForRecovery = vi.fn(() => true)
+    const state = {
+      settings: { activeRuntimeEnvironmentId: null as string | null },
+      repos: [{ id: 'repo1', connectionId: 'conn-1' }],
+      worktreesByRepo: { repo1: [{ id: 'wt-1', repoId: 'repo1' }] },
+      folderWorkspaces: [],
+      projectGroups: [],
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: null }] },
+      ptyIdsByTabId: {},
+      remountTerminalTabForRecovery,
+      fetchRepos,
+      fetchProjectGroups,
+      fetchFolderWorkspaces
+    }
+
+    vi.doMock('react', async () => {
+      const actual = await vi.importActual<typeof ReactModule>('react')
+      return { ...actual, useEffect: (effect: () => void | (() => void)) => void effect() }
+    })
+    vi.doMock('../store', () => ({
+      useAppStore: { subscribe: vi.fn(() => () => {}), getState: () => state }
+    }))
+    const noopListener = (): (() => void) => () => {}
+    const autoStubNamespace = new Proxy(
+      {},
+      {
+        get:
+          () =>
+          (...args: unknown[]) => {
+            if (typeof args[0] === 'function') {
+              return noopListener()
+            }
+            return new Promise(() => {})
+          }
+      }
+    )
+    const api = new Proxy(
+      {
+        repos: {
+          onChanged: (listener: () => void) => {
+            reposChangedListener = listener
+            return () => {}
+          }
+        }
+      } as Record<string, unknown>,
+      { get: (target, prop: string) => target[prop] ?? autoStubNamespace }
+    )
+    vi.stubGlobal('window', { api })
+
+    const { recordTerminalTabParkedOnUnresolvedHost, clearTerminalTabsParkedOnUnresolvedHost } =
+      await import('@/lib/parked-terminal-host-hydration')
+    clearTerminalTabsParkedOnUnresolvedHost()
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    state.settings.activeRuntimeEnvironmentId = 'env-1'
+    // Why: the local-slice refresh still has to release panes that parked on an unhydrated host.
+    recordTerminalTabParkedOnUnresolvedHost('wt-1', 'tab-1')
+    reposChangedListener?.()
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    const localOwner = { runtimeEnvironmentId: null }
+    expect(fetchRepos).toHaveBeenCalledWith(localOwner)
+    expect(fetchProjectGroups).toHaveBeenCalledWith(localOwner)
+    expect(fetchFolderWorkspaces).toHaveBeenCalledWith(localOwner)
+    expect(remountTerminalTabForRecovery).toHaveBeenCalledWith('tab-1')
+    clearTerminalTabsParkedOnUnresolvedHost()
+  })
+})
+
 describe('parked terminal recovery on repos:changed', () => {
   it('remounts a pane that parked on an unresolved host once repos hydrate', async () => {
     vi.resetModules()
diff --git a/src/renderer/src/hooks/useIpcEvents.ts b/src/renderer/src/hooks/useIpcEvents.ts
index 984a8fd833f..85fd5757722 100644
--- a/src/renderer/src/hooks/useIpcEvents.ts
+++ b/src/renderer/src/hooks/useIpcEvents.ts
@@ -128,7 +128,6 @@ import type { AppState } from '../store/types'
 import { guardPinnedTabClose, resolvePinnedTabLabel } from '../store/pinned-tab-close-guard'
 import {
   closeWebRuntimeSessionTab,
-  createWebRuntimeSessionBrowserTab,
   createWebRuntimeSessionTerminal,
   isWebRuntimeSessionActive
 } from '@/runtime/web-runtime-session'
@@ -154,9 +153,15 @@ import { shouldSuppressCodexAutoApprovalStatus } from '@/components/terminal-pan
 import { showTerminalShortcutCaptureNotification } from '@/lib/terminal-shortcut-capture-notification'
 import { resolveAgentStatusTerminalTitle } from '@/lib/agent-status-terminal-title'
 import { titleHasAgentName } from '../../../shared/agent-detection'
+import { isDecorativeAgentTitleFrameChange } from '../../../shared/agent-decorative-title-signature'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { resolveTerminalWorktreeRoute } from '@/lib/terminal-worktree-route'
 import { resolveAgentPaneAuthorityKey } from '@/store/slices/agent-pane-authority'
+import type {
+  AgentStatusBatchTransaction,
+  AgentStatusBatchUpdate,
+  AgentStatusUpdate
+} from '@/store/slices/agent-status'
 import { translate } from '@/i18n/i18n'
 import { redactKagiSessionToken } from '../../../shared/browser-url'
 import { closeTerminalTab } from '@/components/terminal/terminal-tab-actions'
@@ -762,6 +767,27 @@ export function useIpcEvents(): void {
       replay: boolean
     }
     type AgentStatusApplyResult = 'applied' | 'pending' | 'dropped'
+    type ProjectedAgentTabTitles = {
+      title: string | undefined
+      identityTitle: string | undefined
+    }
+    type AgentStatusBatchContext = {
+      transaction: AgentStatusBatchTransaction
+      routingIndex: AgentStatusPaneRoutingIndex
+      projectedTitlesByTabId: Map<string, ProjectedAgentTabTitles>
+      tabTitlesByTabId: Map<string, string>
+      notificationEffects: (() => void)[]
+    }
+    type AgentStatusBatchEvent = {
+      data: AgentStatusIpcPayload
+      replay?: boolean
+      retry?: boolean
+    }
+    type AgentStatusApplyOptions = {
+      replay?: boolean
+      retry?: boolean
+      batch?: AgentStatusBatchContext
+    }
     const pendingAgentStatusEvents: PendingAgentStatusEvent[] = []
     const transientClearWatermarkByConnectionId = new Map<string, number>()
     let agentStatusEffectDisposed = false
@@ -911,6 +937,11 @@ export function useIpcEvents(): void {
         // Why: project events can reveal target CRUD, but known target states already arrive by push.
         void refreshRuntimeEnvironmentSshTargetMetadata(environmentId).catch(() => {})
         const repos = await useAppStore.getState().fetchRuntimeEnvironmentRepos(environmentId)
+        // Why: the host emits one reposChanged for group/folder-workspace edits too, so those
+        // catalogs go stale without this; groups first because folder workspaces resolve owners from them.
+        const runtimeOwner = { runtimeEnvironmentId: environmentId }
+        await useAppStore.getState().fetchProjectGroups(runtimeOwner)
+        await useAppStore.getState().fetchFolderWorkspaces(runtimeOwner)
         await refreshRuntimeProjectWorktreesAndLineage(
           environmentId,
           repos,
@@ -1070,9 +1101,10 @@ export function useIpcEvents(): void {
         if (isRuntimeEnvironmentActive()) {
           // Why: the all-host sidebar shows local repos even under a runtime; refresh the local slice, keep runtime slices.
           void (async () => {
-            await state.fetchReposForAllHosts()
-            await state.fetchProjectGroupsForAllHosts()
-            await state.fetchFolderWorkspacesForAllHosts()
+            const localOwner = { runtimeEnvironmentId: null }
+            await state.fetchRepos(localOwner)
+            await state.fetchProjectGroups(localOwner)
+            await state.fetchFolderWorkspaces(localOwner)
             remountTerminalTabsAwaitingHostHydration()
           })()
           return
@@ -2147,35 +2179,23 @@ export function useIpcEvents(): void {
       window.api.ui.onNewBrowserTab(() => {
         const store = useAppStore.getState()
         if (isFloatingWorkspacePanelFocused()) {
-          void createFloatingWorkspaceBrowserTab(store)
+          void createFloatingWorkspaceBrowserTab(store).catch((error) => {
+            toast.error(error instanceof Error ? error.message : String(error))
+          })
           return
         }
         const worktreeId = store.activeWorktreeId
-        if (worktreeId) {
-          const environmentId = getWorktreeRuntimeEnvironmentId(worktreeId)
-          if (environmentId) {
-            if (!isWebRuntimeSessionActive(environmentId)) {
-              store.createBrowserTab(worktreeId, store.browserDefaultUrl ?? 'about:blank', {
-                title: translate('auto.hooks.useIpcEvents.f6300deb8b', 'New Browser Tab'),
-                focusAddressBar: true
-              })
-              return
-            }
-            void (async () => {
-              // Why: paired web tabs are host-owned; on RPC failure leave local state so the next host snapshot stays authoritative.
-              await createWebRuntimeSessionBrowserTab({
-                worktreeId,
-                environmentId,
-                url: store.browserDefaultUrl ?? 'about:blank'
-              })
-            })()
-            return
-          }
-          store.createBrowserTab(worktreeId, store.browserDefaultUrl ?? 'about:blank', {
-            title: translate('auto.hooks.useIpcEvents.f6300deb8b', 'New Browser Tab'),
-            focusAddressBar: true
-          })
+        if (!worktreeId) {
+          return
         }
+        const targetGroupId =
+          store.activeGroupIdByWorktree[worktreeId] ?? store.groupsByWorktree[worktreeId]?.[0]?.id
+        if (!targetGroupId) {
+          return
+        }
+        void store.openNewBrowserTabInActiveWorkspace(targetGroupId).catch((error) => {
+          toast.error(error instanceof Error ? error.message : String(error))
+        })
       })
     )
 
@@ -2217,7 +2237,9 @@ export function useIpcEvents(): void {
       if (!worktreeId) {
         return
       }
-      void openMobileEmulatorTab(worktreeId, { placement: 'rightSplit' })
+      void openMobileEmulatorTab(worktreeId, { placement: 'rightSplit' }).catch((error) => {
+        toast.error(error instanceof Error ? error.message : String(error))
+      })
     })
     if (unsubscribeNewSimulatorTab) {
       unsubs.push(unsubscribeNewSimulatorTab)
@@ -3072,18 +3094,25 @@ export function useIpcEvents(): void {
       isFlushingAgentStatuses = true
       try {
         const now = Date.now()
-        const remaining: PendingAgentStatusEvent[] = []
-        for (const event of pendingAgentStatusEvents) {
-          if (now - event.firstSeenAt > PENDING_AGENT_STATUS_TTL_MS) {
-            continue
-          }
-          const result = applyAgentStatus(event.data, { retry: true, replay: event.replay })
-          if (result === 'pending') {
-            remaining.push(event)
+        const candidates = pendingAgentStatusEvents
+          .splice(0)
+          .filter((event) => now - event.firstSeenAt <= PENDING_AGENT_STATUS_TTL_MS)
+        let results: AgentStatusApplyResult[]
+        try {
+          results = applyAgentStatusBatch(
+            candidates.map((event) => ({ data: event.data, replay: event.replay, retry: true }))
+          )
+        } catch (err) {
+          // Why: the queue was already spliced, so a throwing fold would drop the whole
+          // burst and strand every pane in it. Requeue ahead of newer arrivals and retry.
+          pendingAgentStatusEvents.unshift(...candidates)
+          throw err
+        }
+        for (let index = 0; index < candidates.length; index += 1) {
+          if (results[index] === 'pending') {
+            pendingAgentStatusEvents.push(candidates[index])
           }
         }
-        pendingAgentStatusEvents.length = 0
-        pendingAgentStatusEvents.push(...remaining)
         if (pendingAgentStatusEvents.length === 0 && pendingAgentStatusRetryTimer !== null) {
           globalThis.clearTimeout(pendingAgentStatusRetryTimer)
           pendingAgentStatusRetryTimer = null
@@ -3096,9 +3125,9 @@ export function useIpcEvents(): void {
 
     const applyAgentStatus = (
       data: AgentStatusIpcPayload,
-      options?: { replay?: boolean; retry?: boolean }
+      options?: AgentStatusApplyOptions
     ): AgentStatusApplyResult => {
-      const store = useAppStore.getState()
+      const store = options?.batch?.transaction.getState() ?? useAppStore.getState()
       if (!store.workspaceSessionReady) {
         return 'dropped'
       }
@@ -3131,12 +3160,25 @@ export function useIpcEvents(): void {
         identityTitle,
         repoConnectionId,
         repoConnectionResolved,
-        owningWorktreeId
-      } = resolvePaneKey(store, paneKey)
+        owningWorktreeId,
+        titleUsesTabTitle
+      } = options?.batch
+        ? resolvePaneKeyFromRoutingIndex(options.batch.routingIndex, paneKey)
+        : resolvePaneKey(store, paneKey)
+      const projectedTitles =
+        titleUsesTabTitle && ownerTabId
+          ? options?.batch?.projectedTitlesByTabId.get(ownerTabId)
+          : undefined
+      if (projectedTitles) {
+        title = projectedTitles.title
+        identityTitle = projectedTitles.identityTitle
+      }
       if (!exists && data.worktreeId && hasRuntimeBackedWorktreeAttribution(data)) {
         // Why: orchestration worker hooks may carry worktree attribution before this renderer has a tab for the pane.
         // Require runtime identity too — worktreeId-only snapshots can be stale rows from closed/remounted panes.
-        const fallbackOwnership = resolveWorktreeConnection(store, data.worktreeId)
+        const fallbackOwnership = options?.batch
+          ? resolveWorktreeConnectionFromRoutingIndex(options.batch.routingIndex, data.worktreeId)
+          : resolveWorktreeConnection(store, data.worktreeId)
         if (fallbackOwnership.worktreeExists) {
           owningWorktreeId = data.worktreeId
           repoConnectionId = fallbackOwnership.repoConnectionId
@@ -3174,7 +3216,7 @@ export function useIpcEvents(): void {
           }
         }
       }
-      // Why: drop in-flight events stamped with a dead connection's id after SSH disconnect/reconnect — see docs/design/agent-status-over-ssh.md §5.
+      // Why: drop in-flight events stamped with a dead connection's id after SSH disconnect/reconnect.
       // Why: startup snapshot replay can beat SSH repo hydration; accept when worktreeId matches the tab until repo ownership resolves.
       // Why: WSL relay stamps a `wsl:<distro>` connectionId but the pane is a local repo (ownership null); normalize so the strict check below doesn't drop it.
       const ownershipConnectionId = isWslHookRelayConnectionId(data.connectionId)
@@ -3210,18 +3252,30 @@ export function useIpcEvents(): void {
         if (!data.providerSession || data.agentType !== 'pi') {
           return 'dropped'
         }
-        store.recordAgentProviderSession(
+        const providerSessionUpdate: AgentStatusBatchUpdate = {
+          kind: 'providerSession',
           paneKey,
-          'pi',
-          data.providerSession,
-          { updatedAt: data.receivedAt },
-          {
+          agent: 'pi',
+          providerSession: data.providerSession,
+          timing: { updatedAt: data.receivedAt },
+          routing: {
             tabId: ownerTabId,
             worktreeId: data.worktreeId ?? owningWorktreeId,
             // Why: persist the WSL-normalized ownership id, not raw relay provenance; a `wsl:*` connectionId would misroute later resumes.
             ...(ownershipConnectionId !== undefined ? { connectionId: ownershipConnectionId } : {})
           },
-          data.launchToken ? { launchToken: data.launchToken } : undefined
+          metadata: data.launchToken ? { launchToken: data.launchToken } : undefined
+        }
+        if (options?.batch) {
+          return options.batch.transaction.apply(providerSessionUpdate) ? 'applied' : 'dropped'
+        }
+        store.recordAgentProviderSession(
+          providerSessionUpdate.paneKey,
+          providerSessionUpdate.agent,
+          providerSessionUpdate.providerSession,
+          providerSessionUpdate.timing,
+          providerSessionUpdate.routing,
+          providerSessionUpdate.metadata
         )
         return 'applied'
       }
@@ -3274,39 +3328,75 @@ export function useIpcEvents(): void {
       }
       const terminalTitle = resolveAgentStatusTerminalTitle(statusPayload, title)
       const statusWorktreeId = data.worktreeId ?? owningWorktreeId
-      store.setAgentStatus(
+      const update: AgentStatusUpdate = {
         paneKey,
-        statusPayloadWithProvenance,
+        payload: statusPayloadWithProvenance,
         terminalTitle,
-        {
+        timing: {
           updatedAt: data.receivedAt,
           stateStartedAt: data.stateStartedAt
         },
-        {
+        routing: {
           tabId: ownerTabId,
           worktreeId: statusWorktreeId,
           terminalHandle: data.terminalHandle,
           ...(ownershipConnectionId !== undefined ? { connectionId: ownershipConnectionId } : {})
         },
-        data.providerSession || data.launchToken
-          ? {
-              ...(data.providerSession ? { providerSession: data.providerSession } : {}),
-              ...(data.launchToken ? { launchToken: data.launchToken } : {})
+        metadata:
+          data.providerSession || data.launchToken
+            ? {
+                ...(data.providerSession ? { providerSession: data.providerSession } : {}),
+                ...(data.launchToken ? { launchToken: data.launchToken } : {})
+              }
+            : undefined
+      }
+      const applyPostCommitNotification = (): void => {
+        if (options?.replay !== true && statusWorktreeId) {
+          // Why: local Codex/Claude hooks arrive via this main-process IPC path, not the PTY OSC fallback, so task-complete notifications must observe accepted hook state here too.
+          const notificationPayload =
+            typeof data.stateStartedAt === 'number'
+              ? { ...resolvedPayload, stateStartedAt: data.stateStartedAt }
+              : resolvedPayload
+          observeAgentHookCompletionForNotification({
+            paneKey,
+            worktreeId: statusWorktreeId,
+            payload: notificationPayload
+          })
+        }
+      }
+      if (options?.batch) {
+        if (!options.batch.transaction.apply(update)) {
+          return 'dropped'
+        }
+        options.batch.notificationEffects.push(applyPostCommitNotification)
+        if (
+          terminalTitle &&
+          shouldApplyResolvedAgentTerminalTitleToTab(store, paneKey, title, terminalTitle)
+        ) {
+          const tabId = parsePaneKey(paneKey)?.tabId
+          if (tabId) {
+            options.batch.tabTitlesByTabId.set(tabId, terminalTitle)
+            if (titleUsesTabTitle) {
+              const titleChanges =
+                !title || !isDecorativeAgentTitleFrameChange(title, terminalTitle)
+              options.batch.projectedTitlesByTabId.set(tabId, {
+                title: titleChanges ? terminalTitle : title,
+                identityTitle: titleChanges ? terminalTitle : identityTitle
+              })
             }
-          : undefined
-      )
-      applyResolvedAgentTerminalTitleToTab(store, paneKey, title, terminalTitle)
-      if (options?.replay !== true && statusWorktreeId) {
-        // Why: local Codex/Claude hooks arrive via this main-process IPC path, not the PTY OSC fallback, so task-complete notifications must observe accepted hook state here too.
-        const notificationPayload =
-          typeof data.stateStartedAt === 'number'
-            ? { ...resolvedPayload, stateStartedAt: data.stateStartedAt }
-            : resolvedPayload
-        observeAgentHookCompletionForNotification({
-          paneKey,
-          worktreeId: statusWorktreeId,
-          payload: notificationPayload
-        })
+          }
+        }
+      } else {
+        store.setAgentStatus(
+          update.paneKey,
+          update.payload,
+          update.terminalTitle,
+          update.timing,
+          update.routing,
+          update.metadata
+        )
+        applyResolvedAgentTerminalTitleToTab(useAppStore.getState(), paneKey, title, terminalTitle)
+        applyPostCommitNotification()
       }
       return 'applied'
     }
@@ -3337,9 +3427,7 @@ export function useIpcEvents(): void {
           if (!current.workspaceSessionReady) {
             return
           }
-          for (const entry of entries) {
-            applyAgentStatus(entry, { replay: true })
-          }
+          applyAgentStatusBatch(entries.map((data) => ({ data, replay: true })))
           const getMigrationUnsupportedSnapshot =
             window.api.agentStatus.getMigrationUnsupportedSnapshot
           if (typeof getMigrationUnsupportedSnapshot !== 'function') {
@@ -3353,8 +3441,12 @@ export function useIpcEvents(): void {
             if (!unsupportedStore.workspaceSessionReady) {
               return
             }
+            const unsupportedRoutingIndex = createAgentStatusPaneRoutingIndex(unsupportedStore)
             for (const entry of unsupportedEntries) {
-              if (entry.paneKey && resolvePaneKey(unsupportedStore, entry.paneKey).exists) {
+              if (
+                entry.paneKey &&
+                resolvePaneKeyFromRoutingIndex(unsupportedRoutingIndex, entry.paneKey).exists
+              ) {
                 unsupportedStore.setMigrationUnsupportedPty(entry)
               }
             }
@@ -3366,19 +3458,51 @@ export function useIpcEvents(): void {
         })
     }
 
+    function applyAgentStatusBatch(
+      events: readonly AgentStatusBatchEvent[]
+    ): AgentStatusApplyResult[] {
+      if (events.length === 0) {
+        return []
+      }
+      return useAppStore.getState().transactAgentStatuses((transaction) => {
+        const batch: AgentStatusBatchContext = {
+          transaction,
+          routingIndex: createAgentStatusPaneRoutingIndex(transaction.getState()),
+          projectedTitlesByTabId: new Map(),
+          tabTitlesByTabId: new Map(),
+          notificationEffects: []
+        }
+        const results = events.map(({ data, replay, retry }) =>
+          applyAgentStatus(data, { batch, replay, retry })
+        )
+        if (batch.tabTitlesByTabId.size > 0) {
+          transaction.afterCommit(() => {
+            useAppStore
+              .getState()
+              .updateTabTitles(
+                [...batch.tabTitlesByTabId].map(([tabId, title]) => ({ tabId, title }))
+              )
+          })
+        }
+        for (const effect of batch.notificationEffects) {
+          transaction.afterCommit(effect)
+        }
+        return results
+      })
+    }
+
+    function applyLiveAgentStatusBatch(batch: readonly AgentStatusIpcPayload[]): boolean {
+      return applyAgentStatusBatch(batch.map((data) => ({ data }))).some(
+        (result) => result === 'applied'
+      )
+    }
+
     function flushLiveAgentStatusBurst(): void {
       liveAgentStatusBurstTimer = null
       lastLiveAgentStatusApplyAt = Date.now()
-      // Why: splice before applying — applyAgentStatus can synchronously
-      // re-enter the queue via subscribers, and it must not see this batch.
+      // Why: splice before publishing — synchronous Zustand subscribers can enqueue the next burst.
       const batch = liveAgentStatusBurstQueue.splice(0)
-      let anyApplied = false
-      for (const data of batch) {
-        if (applyAgentStatus(data) === 'applied') {
-          anyApplied = true
-        }
-      }
-      if (!anyApplied) {
+      if (!applyLiveAgentStatusBatch(batch)) {
         lastLiveAgentStatusApplyAt = 0
       }
     }
@@ -3395,9 +3519,7 @@ export function useIpcEvents(): void {
       }
       liveAgentStatusBurstQueue.length = 0
       liveAgentStatusBurstQueue.push(...remaining)
-      for (const queued of queuedForPane) {
-        applyAgentStatus(queued)
-      }
+      applyLiveAgentStatusBatch(queuedForPane)
     }
 
     function enqueueLiveAgentStatus(data: AgentStatusIpcPayload): void {
@@ -3716,25 +3838,194 @@ function applyResolvedAgentTerminalTitleToTab(
   previousTitle: string | undefined,
   nextTitle: string | undefined
 ): void {
-  if (!nextTitle || nextTitle === previousTitle) {
+  if (
+    !nextTitle ||
+    !shouldApplyResolvedAgentTerminalTitleToTab(store, paneKey, previousTitle, nextTitle)
+  ) {
     return
   }
   const parsed = parsePaneKey(paneKey)
   if (!parsed) {
     return
   }
-  const layout = store.terminalLayoutsByTabId?.[parsed.tabId]
-  if (layout?.root && layout.activeLeafId && layout.activeLeafId !== parsed.leafId) {
-    return
-  }
   // Why: hook completion can arrive while the pane transport is unmounted; keep the tab label synced to the resolved state title.
   store.updateTabTitle(parsed.tabId, nextTitle)
 }
 
+function shouldApplyResolvedAgentTerminalTitleToTab(
+  store: ReturnType<typeof useAppStore.getState>,
+  paneKey: string,
+  previousTitle: string | undefined,
+  nextTitle: string | undefined
+): boolean {
+  if (!nextTitle || nextTitle === previousTitle) {
+    return false
+  }
+  const parsed = parsePaneKey(paneKey)
+  if (!parsed) {
+    return false
+  }
+  const layout = store.terminalLayoutsByTabId?.[parsed.tabId]
+  if (layout?.root && layout.activeLeafId && layout.activeLeafId !== parsed.leafId) {
+    return false
+  }
+  return true
+}
+
+type AgentStatusPaneResolution = {
+  exists: boolean
+  title: string | undefined
+  identityTitle: string | undefined
+  repoConnectionId: string | null
+  repoConnectionResolved: boolean
+  owningWorktreeId: string | undefined
+  titleUsesTabTitle: boolean
+}
+
+type AgentStatusWorktreeConnectionResolution = {
+  worktreeExists: boolean
+  repoConnectionId: string | null
+  repoConnectionResolved: boolean
+}
+
+type IndexedAgentStatusTab = {
+  title: string | undefined
+  unifiedLabel: string | undefined
+  owningWorktreeId: string
+}
+
+type AgentStatusPaneRoutingIndex = {
+  tabsById: Map<string, IndexedAgentStatusTab>
+  layoutsByTabId: AppState['terminalLayoutsByTabId']
+  leafIdsByRoot: WeakMap<TerminalPaneLayoutNode, Set<string>>
+  worktreesById: ReturnType<typeof getWorktreeMapFromState>
+  reposById: ReturnType<typeof getRepoMapFromState>
+}
+
+function createUnifiedTerminalLabelIndex(
+  entries: AppState['unifiedTabsByWorktree'][string] | undefined
+): Map<string, string | undefined> {
+  const labelsByTabId = new Map<string, string | undefined>()
+  for (const entry of entries ?? []) {
+    if (entry.contentType !== 'terminal' || labelsByTabId.has(entry.entityId)) {
+      continue
+    }
+    const rawLabel = entry.label?.trim()
+    labelsByTabId.set(entry.entityId, rawLabel && rawLabel.length > 0 ? rawLabel : undefined)
+  }
+  return labelsByTabId
+}
+
+function createAgentStatusPaneRoutingIndex(
+  store: ReturnType<typeof useAppStore.getState>
+): AgentStatusPaneRoutingIndex {
+  const tabsById = new Map<string, IndexedAgentStatusTab>()
+  for (const [worktreeId, tabs] of Object.entries(store.tabsByWorktree)) {
+    const unifiedLabelsByTabId = createUnifiedTerminalLabelIndex(
+      store.unifiedTabsByWorktree?.[worktreeId]
+    )
+    for (const tab of tabs) {
+      const tabId = tab.id
+      if (!tabsById.has(tabId)) {
+        tabsById.set(tabId, {
+          title: tab.title,
+          unifiedLabel: unifiedLabelsByTabId.get(tabId),
+          owningWorktreeId: worktreeId
+        })
+      }
+    }
+  }
+  return {
+    tabsById,
+    layoutsByTabId: store.terminalLayoutsByTabId,
+    leafIdsByRoot: new WeakMap(),
+    worktreesById: getWorktreeMapFromState(store),
+    reposById: getRepoMapFromState(store)
+  }
+}
+
+function resolveWorktreeConnectionFromRoutingIndex(
+  index: AgentStatusPaneRoutingIndex,
+  worktreeId: string
+): AgentStatusWorktreeConnectionResolution {
+  const worktree = index.worktreesById.get(worktreeId)
+  if (!worktree) {
+    return { worktreeExists: false, repoConnectionId: null, repoConnectionResolved: false }
+  }
+  const repo = index.reposById.get(worktree.repoId)
+  return {
+    worktreeExists: true,
+    repoConnectionId: repo?.connectionId ?? null,
+    repoConnectionResolved: repo !== undefined
+  }
+}
+
+function resolvePaneKeyFromRoutingIndex(
+  index: AgentStatusPaneRoutingIndex,
+  paneKey: string
+): AgentStatusPaneResolution {
+  const parsed = parsePaneKey(paneKey)
+  if (!parsed) {
+    return {
+      exists: false,
+      title: undefined,
+      identityTitle: undefined,
+      repoConnectionId: null,
+      repoConnectionResolved: false,
+      owningWorktreeId: undefined,
+      titleUsesTabTitle: false
+    }
+  }
+  const { tabId, leafId } = parsed
+  const tab = index.tabsById.get(tabId)
+  if (!tab) {
+    return {
+      exists: false,
+      title: undefined,
+      identityTitle: undefined,
+      repoConnectionId: null,
+      repoConnectionResolved: false,
+      owningWorktreeId: undefined,
+      titleUsesTabTitle: false
+    }
+  }
+  const connection = resolveWorktreeConnectionFromRoutingIndex(index, tab.owningWorktreeId)
+  const layout = index.layoutsByTabId?.[tabId]
+  if (layout?.root) {
+    let leafIds = index.leafIdsByRoot.get(layout.root)
+    if (!leafIds) {
+      leafIds = new Set(collectLeafIdsInOrder(layout.root))
+      index.leafIdsByRoot.set(layout.root, leafIds)
+    }
+    if (!leafIds.has(leafId)) {
+      return {
+        exists: false,
+        title: undefined,
+        identityTitle: undefined,
+        repoConnectionId: connection.repoConnectionId,
+        repoConnectionResolved: connection.repoConnectionResolved,
+        owningWorktreeId: tab.owningWorktreeId,
+        titleUsesTabTitle: false
+      }
+    }
+  }
+  const rawPaneTitle = layout?.titlesByLeafId?.[leafId]
+  const paneTitle = rawPaneTitle && rawPaneTitle.length > 0 ? rawPaneTitle : undefined
+  return {
+    exists: true,
+    title: paneTitle ?? tab.title,
+    identityTitle: paneTitle ?? tab.unifiedLabel ?? tab.title,
+    repoConnectionId: connection.repoConnectionId,
+    repoConnectionResolved: connection.repoConnectionResolved,
+    owningWorktreeId: tab.owningWorktreeId,
+    titleUsesTabTitle: paneTitle === undefined
+  }
+}
+
 /** Resolve a paneKey (tabId:leafId) to liveness, current title, owning worktree,
  *  and the owning repo's connectionId. Used for agent-type inference and to drop
- *  status updates for torn-down tabs or dead connections
- *  (see docs/design/agent-status-over-ssh.md §5). */
+ *  status updates for torn-down tabs or dead connections (an SSH reconnect retires the
+ *  old connectionId, so events still in flight under it must not land). */
 function resolvePaneKey(
   store: ReturnType<typeof useAppStore.getState>,
   paneKey: string
@@ -3745,6 +4036,7 @@ function resolvePaneKey(
   repoConnectionId: string | null
   repoConnectionResolved: boolean
   owningWorktreeId: string | undefined
+  titleUsesTabTitle: boolean
 } {
   const parsed = parsePaneKey(paneKey)
   if (!parsed) {
@@ -3754,7 +4046,8 @@ function resolvePaneKey(
       identityTitle: undefined,
       repoConnectionId: null,
       repoConnectionResolved: false,
-      owningWorktreeId: undefined
+      owningWorktreeId: undefined,
+      titleUsesTabTitle: false
     }
   }
   const { tabId, leafId } = parsed
@@ -3800,7 +4093,8 @@ function resolvePaneKey(
       identityTitle: undefined,
       repoConnectionId,
       repoConnectionResolved,
-      owningWorktreeId
+      owningWorktreeId,
+      titleUsesTabTitle: false
     }
   }
   // Why: an empty layout snapshot from a worktree switch (tab/PTY still live) counts as missing metadata; a non-empty layout lacking the leaf still means closed.
@@ -3812,7 +4106,8 @@ function resolvePaneKey(
       identityTitle: undefined,
       repoConnectionId,
       repoConnectionResolved,
-      owningWorktreeId
+      owningWorktreeId,
+      titleUsesTabTitle: false
     }
   }
   // Why: inactive worktrees can have a durable tab and live PTY while the layout is unmounted; hook state must still land there.
@@ -3826,7 +4121,8 @@ function resolvePaneKey(
     identityTitle: paneTitle ?? unifiedTabLabel ?? tabTitle,
     repoConnectionId,
     repoConnectionResolved,
-    owningWorktreeId
+    owningWorktreeId,
+    titleUsesTabTitle: paneTitle === undefined
   }
 }
 
diff --git a/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts b/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
index 498568d1515..6008db31856 100644
--- a/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
+++ b/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
@@ -128,7 +128,13 @@ describe('settings navigation metadata', () => {
   })
 
   it('keeps desktop-only Settings panes out of web metadata', () => {
-    const webIds = ids({ isWebClient: true })
+    const webSections = buildSettingsNavigationMetadata({
+      isMac: false,
+      isWindows: false,
+      isWebClient: true,
+      repos: [repo]
+    })
+    const webIds = webSections.map((section) => section.id)
 
     expect(webIds).not.toContain('browser')
     expect(webIds).not.toContain('ssh')
@@ -138,6 +144,33 @@ describe('settings navigation metadata', () => {
     expect(webIds).not.toContain('advanced')
     expect(webIds).toContain('servers')
     expect(webIds).toContain('repo-repo-1')
+    const floatingWorkspace = webSections.find((section) => section.id === 'floating-workspace')
+    expect(floatingWorkspace?.description).toBe('Global terminal and markdown tabs.')
+    expect(floatingWorkspace?.searchEntries.flatMap((entry) => entry.keywords)).not.toContain(
+      'browser'
+    )
+    const shortcuts = webSections.find((section) => section.id === 'shortcuts')
+    expect(shortcuts?.searchEntries.map((entry) => entry.title)).not.toContain('New browser tab')
+    expect(shortcuts?.searchEntries.map((entry) => entry.title)).not.toContain(
+      'New mobile emulator tab'
+    )
+  })
+
+  it('keeps the Browser shortcut searchable for a capable web runtime', () => {
+    const sections = buildSettingsNavigationMetadata({
+      isMac: false,
+      isWindows: false,
+      isWebClient: true,
+      managedBrowserCreationEnabled: true,
+      mobileEmulatorCreationEnabled: false,
+      repos: [repo]
+    })
+    const shortcutTitles = sections
+      .find((section) => section.id === 'shortcuts')
+      ?.searchEntries.map((entry) => entry.title)
+
+    expect(shortcutTitles).toContain('New browser tab')
+    expect(shortcutTitles).not.toContain('New mobile emulator tab')
   })
 
   it('does not mark installable AI capabilities as beta in the sidebar metadata', () => {
diff --git a/src/renderer/src/hooks/useSettingsNavigationMetadata.ts b/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
index 364d525298b..c0c85b115ed 100644
--- a/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
+++ b/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
@@ -1,6 +1,7 @@
 /* oxlint-disable max-lines */
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useShallow } from 'zustand/react/shallow'
 // Why: this registry mirrors the Settings sidebar in one neutral module so
 // Cmd+J and Settings visibility cannot drift. Keep it free of Settings pane UI
 // imports; the boundary is enforced by a focused architecture test.
@@ -90,6 +91,7 @@ import { useWindowsTerminalCapabilityOwnerKey } from './useWindowsTerminalCapabi
 import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
 import { useLinearProviderConnected } from '@/hooks/useLinearProviderConnected'
 import { translate } from '@/i18n/i18n'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export { isWebClientLocation } from '@/lib/web-client-location'
 
@@ -124,6 +126,8 @@ export function buildSettingsNavigationMetadata({
   isLocalWindowsHost = isWindows,
   isWindowsTerminalHost = isWindows,
   isWebClient,
+  managedBrowserCreationEnabled = !isWebClient,
+  mobileEmulatorCreationEnabled = !isWebClient,
   isDev = import.meta.env.DEV,
   isLinearConnected = false,
   repos
@@ -133,6 +137,8 @@ export function buildSettingsNavigationMetadata({
   isLocalWindowsHost?: boolean
   isWindowsTerminalHost?: boolean
   isWebClient: boolean
+  managedBrowserCreationEnabled?: boolean
+  mobileEmulatorCreationEnabled?: boolean
   isDev?: boolean
   isLinearConnected?: boolean
   repos: readonly Repo[]
@@ -356,7 +362,7 @@ export function buildSettingsNavigationMetadata({
       ),
       description: translate(
         'auto.hooks.useSettingsNavigationMetadata.ab4b21b58e',
-        'Branch naming, base refs, attribution, and Git AI Author.'
+        'Branch naming, base refs, and Git AI Author.'
       ),
       icon: GitBranch,
       // Why: Git AI Author is rendered inside Git, so shared
@@ -437,12 +443,19 @@ export function buildSettingsNavigationMetadata({
     {
       id: 'floating-workspace',
       title: translate('auto.hooks.useSettingsNavigationMetadata.65b19f5bde', 'Floating Workspace'),
-      description: translate(
-        'auto.hooks.useSettingsNavigationMetadata.2d0659f6f0',
-        'Global terminal, browser, and markdown tabs.'
-      ),
+      description: showDesktopOnlySettings
+        ? translate(
+            'auto.hooks.useSettingsNavigationMetadata.2d0659f6f0',
+            'Global terminal, browser, and markdown tabs.'
+          )
+        : translate(
+            'auto.hooks.useSettingsNavigationMetadata.floatingWorkspaceWebDescription',
+            'Global terminal and markdown tabs.'
+          ),
       icon: PanelsTopLeft,
-      searchEntries: getFloatingWorkspaceSearchEntries(),
+      searchEntries: getFloatingWorkspaceSearchEntries({
+        includeBrowser: showDesktopOnlySettings
+      }),
       group: 'workflows'
     },
     {
@@ -497,7 +510,10 @@ export function buildSettingsNavigationMetadata({
         'Keyboard shortcuts for common actions.'
       ),
       icon: Keyboard,
-      searchEntries: getShortcutsPaneSearchEntries(),
+      searchEntries: getShortcutsPaneSearchEntries({
+        includeManagedBrowser: managedBrowserCreationEnabled,
+        includeMobileEmulator: mobileEmulatorCreationEnabled
+      }),
       group: 'interface'
     },
     {
@@ -669,6 +685,15 @@ export function useSettingsNavigationMetadata(): SettingsNavSection[] {
   const activeLocale = i18n.language
   const repos = useAppStore((state) => state.repos)
   const settings = useAppStore((state) => state.settings)
+  const [managedBrowserCreationEnabled, mobileEmulatorCreationEnabled] = useAppStore(
+    useShallow((state) => {
+      const policy = getClientCreationActionPolicy(state, state.activeWorktreeId)
+      return [
+        policy['managed-browser'].state === 'enabled',
+        policy['mobile-emulator'].state === 'enabled'
+      ] as const
+    })
+  )
   const isMac = isMacUserAgent()
   const isWindows = isWindowsUserAgent()
   const isWebClient = isWebClientLocation()
@@ -711,6 +736,8 @@ export function useSettingsNavigationMetadata(): SettingsNavSection[] {
         isLocalWindowsHost,
         isWindowsTerminalHost,
         isWebClient,
+        managedBrowserCreationEnabled,
+        mobileEmulatorCreationEnabled,
         isDev: import.meta.env.DEV,
         isLinearConnected,
         repos
@@ -722,6 +749,8 @@ export function useSettingsNavigationMetadata(): SettingsNavSection[] {
       isLocalWindowsHost,
       isWindowsTerminalHost,
       isWebClient,
+      managedBrowserCreationEnabled,
+      mobileEmulatorCreationEnabled,
       isLinearConnected,
       repos,
       activeLocale
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index 38e01ec0f26..ef59f068538 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -115,6 +115,13 @@
       "port": "Port",
       "pr": "PR"
     },
+    "linearIssue": {
+      "createLabel": "Create worktree from Linear issue {{value0}}: {{value1}}",
+      "pendingLabel": "Create worktree from Linear issue {{value0}}",
+      "loadingLabel": "Loading Linear issue {{value0}}",
+      "createHint": "Create worktree from Linear issue",
+      "loadingHint": "Loading Linear issue…"
+    },
     "renderCapOverflow": "{{value0}} more — scroll or keep typing to narrow",
     "filter": {
       "emptyTitle": "No results match the active filter",
@@ -141,6 +148,10 @@
       "clearProjects": "Clear projects",
       "back": "Back",
       "ariaActive": "Filter: {{value0}} active."
+    },
+    "taskUrl": {
+      "loadingHint": "Loading {{value0}}…",
+      "createHint": "Create worktree from {{value0}}"
     }
   },
   "auto": {
@@ -756,7 +767,8 @@
           "import": {
             "toast": {
               "restartFallbackUnavailableNone": "None of the {{value0}} cookies could be loaded, and the restart fallback was unavailable. The previous cookies for this profile were replaced. Try the import again.",
-              "restartFallbackUnavailablePartial": "Imported {{value0}} of {{value1}} cookies. The rest could not be loaded, and the restart fallback was unavailable. Try the import again."
+              "restartFallbackUnavailablePartial": "Imported {{value0}} of {{value1}} cookies. The rest could not be loaded, and the restart fallback was unavailable. Try the import again.",
+              "googleCookiesSkipped": "Google cookies were not imported. Open a browser in Orca on {{value0}} with this profile, then sign into Google."
             }
           }
         }
@@ -867,7 +879,7 @@
         "a9fb10afca": "Terminal",
         "5235c215ca": "Choose which task providers appear in the Tasks page and sidebar.",
         "85f4fd7710": "Task Sources",
-        "ab4b21b58e": "Branch naming, base refs, attribution, and Git AI Author.",
+        "ab4b21b58e": "Branch naming, base refs, and Git AI Author.",
         "09607cb0fe": "Git & Source Control",
         "33a5e1d597": "Connect GitHub, GitLab, Linear, and source-hosting services.",
         "2b043783ef": "Integrations",
@@ -909,7 +921,8 @@
         "artifactsTitle": "Artifacts",
         "artifactsDescription": "Share HTML and Markdown files with your team and manage their public links.",
         "automationsTitle": "Automations",
-        "automationsDescription": "Schedule agent work and choose whether Automations appears in the sidebar."
+        "automationsDescription": "Schedule agent work and choose whether Automations appears in the sidebar.",
+        "floatingWorkspaceWebDescription": "Global terminal and markdown tabs."
       },
       "useAppMenuPaste": {
         "pasteTooLarge": "Paste is too large."
@@ -925,6 +938,10 @@
       }
     },
     "components": {
+      "BrowserCookieImportDisclosure": {
+        "title": "Google logins aren't imported",
+        "description": "Sign in to Google directly in Orca."
+      },
       "CodexRestartChip": {
         "a4c8e1b2f7": "Codex is still signed in as {{value0}}",
         "c72a5fb234": "Restart",
@@ -2991,16 +3008,20 @@
             "removedBody": "The SSH host for this workspace was removed, so it can no longer connect. Remove the workspace to clear it — remote files are left untouched.",
             "removeWorkspaceButton": "Remove workspace"
           },
-          "TerminalRemoteRuntimeReconnectBanner": {
+          "TerminalQuickCommandsSubmenu": {
+            "3ccc7981bb": "Host unavailable",
+            "54f29b7c0d": "Loading host…"
+          },
+          "TerminalPaneDisconnectedBanner": {
+            "sshPaneTitle": "Terminal disconnected",
+            "sshPaneBody": "Orca cannot reach this terminal right now. The shell may still be running on the host, so starting a new one leaves it alone.",
+            "tryAgainButton": "Try again",
+            "startNewTerminalButton": "Start a new terminal",
             "retryingTitle": "Reconnecting to remote runtime",
             "disconnectedTitle": "Remote runtime disconnected",
             "retryingBody": "Orca will retry for up to one minute. This terminal will resume if the connection returns.",
             "disconnectedBody": "Automatic retries stopped. Reconnect to resume this terminal session.",
             "reconnectButton": "Reconnect"
-          },
-          "TerminalQuickCommandsSubmenu": {
-            "3ccc7981bb": "Host unavailable",
-            "54f29b7c0d": "Loading host…"
           }
         }
       },
@@ -4894,14 +4915,28 @@
           "bff3bdd00c": "Rename workspace",
           "8df295a78d": "Failed to rename workspace."
         },
+        "WorktreeVisibilityHelpPopover": {
+          "c41f2d7e90": "Which worktrees are hidden by default?",
+          "8db4e19a26": "This setting never hides worktrees created through Orca.",
+          "54a7c2f183": "For newly added repositories, worktrees created manually or by another tool are hidden by default to avoid unexpected sidebar clutter.",
+          "b9e0d43675": "Always show includes current and future non-Orca worktrees, including agent worktrees under .claude/worktrees/* and .gsd-workspaces/*. When it is off, use Show below to add one individually."
+        },
         "WorktreeVisibilityDialog": {
           "83a5ba8dd1": "Non-Orca worktrees",
-          "f1f71b9f02": "Import",
+          "f1f71b9f02": "Always show",
           "759371df43": "Hide",
-          "25ddf19920": "{{value0}} available to import",
+          "25ddf19920": "{{value0}} currently hidden",
           "8372e4bbd9": "{{value0}} currently shown",
           "5d02a5647f": "Hidden from sidebar",
-          "3e045d4cb8": "Shown in sidebar"
+          "3e045d4cb8": "Shown in sidebar",
+          "a3f19c07d2": "Checking…",
+          "b8d24e61f5": "Could not list this repo's worktrees.",
+          "c5e70a93b1": "Try again",
+          "7d21c5e848": "Hidden worktrees ({{value0}})",
+          "9b53f7a160": "Choose which hidden worktrees to show individually.",
+          "2f80cd4b97": "Showing…",
+          "e64b81d3a9": "Show",
+          "d40d436fc2": "Could not update worktree visibility. Try again."
         },
         "add": {
           "repo": {
@@ -5857,8 +5892,7 @@
           "a3f8c2d1e0b4": "Imported {{value0}} cookies from {{value1}} ({{value2}}) into {{value3}}.",
           "b4e9d3f2a1c5": "Imported {{value0}} cookies from {{value1}} into {{value2}}.",
           "c5a273a809": "From {{value0}}",
-          "b5c0479e21": "Unmodified user agent",
-          "654a0c2073": "Google requires signing in directly - imports skip it."
+          "b5c0479e21": "Unmodified user agent"
         },
         "BrowserUseComputerUseNotice": {
           "15b5e680ba": "Open Computer Use",
@@ -6338,14 +6372,6 @@
           "808f9a726e": "No prefix will be applied"
         },
         "GitPane": {
-          "d2eede4c54": "Add Orca attribution to commits, PRs, and issues.",
-          "e02ea23a32": "Orca Attribution",
-          "e71ce09c42": "orca",
-          "b9b5771bb1": "attribution",
-          "b5f534717a": "coauthored",
-          "9838c921ed": "co-author",
-          "afada55042": "issue",
-          "b4ef5428a7": "pr",
           "895d3f70b8": "gh",
           "32dca11189": "github",
           "c4f610d057": "Current GitLab CLI REST rate-limit headers when available.",
@@ -6781,6 +6807,12 @@
           "8bfdd23a88": "Help us figure out what to build next. Orca sends anonymous counts of which features you use and where things break.",
           "afec8b03be": "ci"
         },
+        "QuickCommandsList": {
+          "noSearchMatches": "No commands match this search."
+        },
+        "QuickCommandsToolbar": {
+          "searchLabel": "Search commands"
+        },
         "QuickCommandsPane": {
           "8764c6e9e4": "Remove {{value0}}",
           "7d90fd5299": "Edit {{value0}}",
@@ -7252,7 +7284,7 @@
           "3de4bbb841": "Terminal",
           "dd72ed437a": "Choose which task providers appear in the Tasks page and sidebar.",
           "11faa2f7dd": "Task Sources",
-          "cfa34f4465": "Branch naming, base refs, attribution, and Git AI Author.",
+          "cfa34f4465": "Branch naming, base refs, and Git AI Author.",
           "70100f94c7": "Git & Source Control",
           "b07041697f": "Connect GitHub, GitLab, Linear, and source-hosting services.",
           "c9ca101a3b": "Integrations",
@@ -8638,16 +8670,8 @@
         },
         "git": {
           "search": {
-            "61eab13403": "orca",
-            "1b93c1143c": "attribution",
-            "8461c908ae": "coauthored",
-            "61f9f5d1fc": "co-author",
-            "af0a144bfb": "issue",
-            "6bdea421bb": "pr",
             "16f53f7323": "gh",
             "d088806071": "github",
-            "118c23484b": "Add Orca attribution to commits, PRs, and issues.",
-            "bc7d9f69ce": "Orca Attribution",
             "40f9b815fd": "api budget",
             "b7e52124c7": "rate limit",
             "ead733645f": "glab",
@@ -12378,7 +12402,8 @@
             "searchJira": "Search Jira issues or paste an issue URL",
             "jiraMode": "Jira",
             "jiraSelectBindFailed": "Couldn’t link this Jira issue. Pick the matching site or reconnect Jira, then try again.",
-            "emoji": "Emoji"
+            "emoji": "Emoji",
+            "loadingLinearIssue": "Loading Linear issue…"
           },
           "ProjectCombobox": {
             "empty": "No projects match your search.",
@@ -14212,8 +14237,7 @@
             "bf648471c5": "Creating…",
             "53bbe3dab4": "Imported {{value0}} cookies from file.",
             "c5f0e4d3b2a1": "Imported {{value0}} cookies from {{value1}} ({{value2}}).",
-            "d6a1f5e4c3b2": "Imported {{value0}} cookies from {{value1}}.",
-            "c186b4d890": "Google requires signing in directly - imports skip it."
+            "d6a1f5e4c3b2": "Imported {{value0}} cookies from {{value1}}."
           },
           "GrabConfirmationSheet": {
             "314a0aaa5b": "Attach to AI",
@@ -14355,9 +14379,7 @@
           "33741dd973": "Back to runs"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "AM or PM",
           "9e677335b0": "Minute",
-          "6b802ecc99": "Hour",
           "d90981f766": "Time",
           "6b914c5fbb": "Day",
           "233b8c94b6": "Cadence",
@@ -14367,6 +14389,11 @@
           "837d902bba": "Weekly",
           "ddba78647e": "Custom cron"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "AM or PM",
+          "32a5e4e35e": "Minute",
+          "aa593eb5e2": "Hour"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "Reuse",
           "c90888ee94": "Fresh",
@@ -14465,7 +14492,9 @@
           "tableStatus": "Status",
           "tableActions": "Actions",
           "newAutomation": "New Automation",
-          "rowActions": "Automation actions"
+          "rowActions": "Automation actions",
+          "tableLastRun": "Last run",
+          "noListMatches": "No automations match."
         },
         "AutomationsPageSkeleton": {
           "55527b7bcf": "Loading automations"
@@ -14559,6 +14588,14 @@
               "name": "Hourly maintenance check",
               "prompt": "Check for stuck work, stale generated files, failing validation, and anything that needs human attention. Report only actionable issues."
             }
+          },
+          "list": {
+            "last": {
+              "run": {
+                "done": "Done",
+                "failed": "Failed"
+              }
+            }
           }
         },
         "external": {
@@ -14591,6 +14628,19 @@
         },
         "AutomationListLocalRows": {
           "c92c9463c6": "Automation actions"
+        },
+        "AutomationListFilterMenu": {
+          "removeFilter": "Remove {{value0}} filter",
+          "failed": "Failed",
+          "succeeded": "Succeeded",
+          "neverRan": "Never ran",
+          "filters": "Filters",
+          "all": "All",
+          "clear": "Clear filters"
+        },
+        "AutomationListSortHeader": {
+          "sortedAscending": "{{value0}}, sorted ascending",
+          "sortedDescending": "{{value0}}, sorted descending"
         }
       },
       "agent": {
@@ -15412,7 +15462,13 @@
       "clear": "Clear search",
       "results": "{{shown}} of {{total}} shown"
     },
-    "settingsLabel": "Agent Dashboard settings"
+    "settingsLabel": "Agent Dashboard settings",
+    "host": {
+      "sshNamed": "SSH host · {{host}}",
+      "ssh": "SSH host",
+      "remoteNamed": "Remote Orca host · {{host}}",
+      "remote": "Remote Orca host"
+    }
   },
   "dashboard": {
     "sidebar": {
diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json
index a14e64ec424..af1bea520bd 100644
--- a/src/renderer/src/i18n/locales/es.json
+++ b/src/renderer/src/i18n/locales/es.json
@@ -786,7 +786,7 @@
         "a9fb10afca": "Terminal",
         "5235c215ca": "Elige qué proveedores de tareas aparecen en la página Tareas y en la barra lateral.",
         "85f4fd7710": "Fuentes de tareas",
-        "ab4b21b58e": "Nombres de ramas, refs base, atribución y Git AI Author.",
+        "ab4b21b58e": "Nombres de rama, refs base y Git AI Author.",
         "09607cb0fe": "Git y Source Control",
         "33a5e1d597": "Conecta GitHub, GitLab, Linear y servicios de hosting de código.",
         "2b043783ef": "Integraciones",
@@ -2859,7 +2859,7 @@
             "removedBody": "El host SSH de este espacio de trabajo fue eliminado, por lo que ya no puede conectarse. Elimina el espacio de trabajo para limpiarlo — los archivos remotos permanecen intactos.",
             "removeWorkspaceButton": "Eliminar espacio de trabajo"
           },
-          "TerminalRemoteRuntimeReconnectBanner": {
+          "TerminalPaneDisconnectedBanner": {
             "retryingTitle": "Reconnecting to remote runtime",
             "disconnectedTitle": "Remote runtime disconnected",
             "retryingBody": "Orca will retry for up to one minute. This terminal will resume if the connection returns.",
@@ -4697,14 +4697,28 @@
           "bff3bdd00c": "Cambiar nombre del espacio de trabajo",
           "8df295a78d": "No se pudo cambiar el nombre del espacio de trabajo."
         },
+        "WorktreeVisibilityHelpPopover": {
+          "c41f2d7e90": "¿Qué worktrees se ocultan de forma predeterminada?",
+          "8db4e19a26": "Este ajuste nunca oculta los worktrees creados mediante Orca.",
+          "54a7c2f183": "En los repositorios recién añadidos, los worktrees creados manualmente o con otra herramienta se ocultan de forma predeterminada para evitar elementos inesperados en la barra lateral.",
+          "b9e0d43675": "«Mostrar siempre» incluye los worktrees ajenos a Orca actuales y futuros, incluidos los worktrees de agentes en .claude/worktrees/* y .gsd-workspaces/*. Cuando está desactivado, usa «Mostrar» abajo para añadir uno individualmente."
+        },
         "WorktreeVisibilityDialog": {
           "83a5ba8dd1": "Worktrees que no son de Orca",
-          "f1f71b9f02": "Importar",
+          "f1f71b9f02": "Mostrar siempre",
           "759371df43": "Ocultar",
-          "25ddf19920": "{{value0}} disponible para importar",
+          "25ddf19920": "{{value0}} oculto actualmente",
           "8372e4bbd9": "{{value0}} mostrado actualmente",
           "5d02a5647f": "Oculto de la barra lateral",
-          "3e045d4cb8": "Mostrado en la barra lateral"
+          "3e045d4cb8": "Mostrado en la barra lateral",
+          "a3f19c07d2": "Comprobando…",
+          "b8d24e61f5": "No se pudieron listar los worktrees de este repositorio.",
+          "c5e70a93b1": "Reintentar",
+          "7d21c5e848": "Worktrees ocultos ({{value0}})",
+          "9b53f7a160": "Elige qué worktrees ocultos mostrar de forma individual.",
+          "2f80cd4b97": "Mostrando…",
+          "e64b81d3a9": "Mostrar",
+          "d40d436fc2": "No se pudo actualizar la visibilidad de los worktrees. Inténtalo de nuevo."
         },
         "add": {
           "repo": {
@@ -5979,14 +5993,6 @@
           "808f9a726e": "No se aplicará ningún prefijo"
         },
         "GitPane": {
-          "d2eede4c54": "Agrega la atribución de Orca a commits, PR e issues.",
-          "e02ea23a32": "Atribución de Orca",
-          "e71ce09c42": "orca",
-          "b9b5771bb1": "atribución",
-          "b5f534717a": "coautor",
-          "9838c921ed": "coautor",
-          "afada55042": "issue",
-          "b4ef5428a7": "pr",
           "895d3f70b8": "gh",
           "32dca11189": "github",
           "c4f610d057": "Encabezados actuales de límite de tasa REST de GitLab CLI cuando estén disponibles.",
@@ -6875,7 +6881,7 @@
           "3de4bbb841": "Terminal",
           "dd72ed437a": "Elige qué proveedores de tareas aparecen en la página Tareas y en la barra lateral.",
           "11faa2f7dd": "Fuentes de tareas",
-          "cfa34f4465": "Nombres de rama, refs base, atribución y Git AI Author.",
+          "cfa34f4465": "Nombres de rama, refs base y Git AI Author.",
           "70100f94c7": "Git y control de código fuente",
           "b07041697f": "Conecta GitHub, GitLab, Linear y servicios de alojamiento de código fuente.",
           "c9ca101a3b": "Integraciones",
@@ -8253,16 +8259,8 @@
         },
         "git": {
           "search": {
-            "61eab13403": "orca",
-            "1b93c1143c": "atribución",
-            "8461c908ae": "coautor",
-            "61f9f5d1fc": "coautor",
-            "af0a144bfb": "issue",
-            "6bdea421bb": "PR",
             "16f53f7323": "gh",
             "d088806071": "github",
-            "118c23484b": "Agrega la atribución de Orca a commits, PR e issues.",
-            "bc7d9f69ce": "Atribución de Orca",
             "40f9b815fd": "presupuesto API",
             "b7e52124c7": "límite de tasa",
             "ead733645f": "glab",
@@ -13647,9 +13645,7 @@
           "33741dd973": "Volver a carreras"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "mañana o tarde",
           "9e677335b0": "Minuto",
-          "6b802ecc99": "Hora",
           "d90981f766": "Tiempo",
           "6b914c5fbb": "Día",
           "233b8c94b6": "Cadencia",
@@ -13659,6 +13655,11 @@
           "837d902bba": "Semanal",
           "ddba78647e": "Cron personalizado"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "mañana o tarde",
+          "32a5e4e35e": "Minuto",
+          "aa593eb5e2": "Hora"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "Reutilizar",
           "c90888ee94": "Fresco",
diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json
index 8e9b313dd4c..d52093438a4 100644
--- a/src/renderer/src/i18n/locales/ja.json
+++ b/src/renderer/src/i18n/locales/ja.json
@@ -786,7 +786,7 @@
         "a9fb10afca": "ターミナル",
         "5235c215ca": "「タスク」ページとサイドバーに表示するタスクプロバイダーを選択します。",
         "85f4fd7710": "タスクソース",
-        "ab4b21b58e": "ブランチの名前、基本参照、帰属、および Git AI 作成者。",
+        "ab4b21b58e": "ブランチの名前、基本参照、および Git AI 作成者。",
         "09607cb0fe": "Git とソース管理",
         "33a5e1d597": "GitHub、GitLab、Linear、およびソースホスティングサービスを接続します。",
         "2b043783ef": "連携",
@@ -2859,7 +2859,7 @@
             "removedBody": "このワークスペースの SSH ホストが削除されたため、接続できません。ワークスペースを削除してクリアしてください — リモートファイルはそのまま残ります。",
             "removeWorkspaceButton": "ワークスペースを削除"
           },
-          "TerminalRemoteRuntimeReconnectBanner": {
+          "TerminalPaneDisconnectedBanner": {
             "retryingTitle": "リモートランタイムに再接続中",
             "disconnectedTitle": "リモートランタイムが切断されました",
             "retryingBody": "Orca は最大1分間再試行します。接続が復元されると、このターミナルが再開されます。",
@@ -4678,14 +4678,28 @@
           "bff3bdd00c": "ワークスペースの名前を変更する",
           "8df295a78d": "ワークスペースの名前を変更できませんでした。"
         },
+        "WorktreeVisibilityHelpPopover": {
+          "c41f2d7e90": "デフォルトで非表示になるワークツリー",
+          "8db4e19a26": "この設定では、Orca で作成されたワークツリーが非表示になることはありません。",
+          "54a7c2f183": "新しく追加したリポジトリでは、手動または別のツールで作成したワークツリーは、意図しない項目でサイドバーが埋まらないよう、デフォルトでは非表示です。",
+          "b9e0d43675": "「常に表示」では、.claude/worktrees/* および .gsd-workspaces/* にある Agent ワークツリーを含む、Orca 以外で作成された現在および今後のワークツリーが表示されます。オフの場合は、下の「表示」を使用して個別に追加できます。"
+        },
         "WorktreeVisibilityDialog": {
           "83a5ba8dd1": "Orca 以外のワークツリー",
-          "f1f71b9f02": "インポート",
+          "f1f71b9f02": "常に表示",
           "759371df43": "非表示",
-          "25ddf19920": "{{value0}} をインポートできます",
+          "25ddf19920": "{{value0}} は現在非表示",
           "8372e4bbd9": "現在表示されている{{value0}}",
           "5d02a5647f": "サイドバーから非表示",
-          "3e045d4cb8": "サイドバーに表示"
+          "3e045d4cb8": "サイドバーに表示",
+          "a3f19c07d2": "確認中…",
+          "b8d24e61f5": "このリポジトリのワークツリーを一覧できませんでした。",
+          "c5e70a93b1": "再試行",
+          "7d21c5e848": "非表示のワークツリー（{{value0}}）",
+          "9b53f7a160": "個別にサイドバーへ表示する非表示のワークツリーを選択します。",
+          "2f80cd4b97": "表示中…",
+          "e64b81d3a9": "表示",
+          "d40d436fc2": "ワークツリーの表示設定を更新できませんでした。もう一度お試しください。"
         },
         "add": {
           "repo": {
@@ -6001,14 +6015,6 @@
           "808f9a726e": "プレフィックスは適用されません"
         },
         "GitPane": {
-          "d2eede4c54": "Orca の帰属をコミット、PR、Issue に追加します。",
-          "e02ea23a32": "Orca の帰属",
-          "e71ce09c42": "orca",
-          "b9b5771bb1": "帰属",
-          "b5f534717a": "共著",
-          "9838c921ed": "共著者",
-          "afada55042": "Issue",
-          "b4ef5428a7": "PR",
           "895d3f70b8": "gh",
           "32dca11189": "GitHub",
           "c4f610d057": "現在の GitLab CLI REST レート制限ヘッダー (利用可能な場合)。",
@@ -6897,7 +6903,7 @@
           "3de4bbb841": "ターミナル",
           "dd72ed437a": "「タスク」ページとサイドバーに表示するタスクプロバイダーを選択します。",
           "11faa2f7dd": "タスクソース",
-          "cfa34f4465": "ブランチの名前、基本参照、帰属、および Git AI 作成者。",
+          "cfa34f4465": "ブランチの名前、基本参照、および Git AI 作成者。",
           "70100f94c7": "Git とソース管理",
           "b07041697f": "GitHub、GitLab、Linear、およびソースホスティングサービスを接続します。",
           "c9ca101a3b": "連携",
@@ -8275,16 +8281,8 @@
         },
         "git": {
           "search": {
-            "61eab13403": "orca",
-            "1b93c1143c": "帰属",
-            "8461c908ae": "共著",
-            "61f9f5d1fc": "共著者",
-            "af0a144bfb": "Issue",
-            "6bdea421bb": "PR",
             "16f53f7323": "gh",
             "d088806071": "GitHub",
-            "118c23484b": "Orca の帰属をコミット、PR、Issue に追加します。",
-            "bc7d9f69ce": "Orca の帰属",
             "40f9b815fd": "APIの予算",
             "b7e52124c7": "レート制限",
             "ead733645f": "glab",
@@ -13647,9 +13645,7 @@
           "33741dd973": "実行一覧に戻る"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "午前または午後",
           "9e677335b0": "分",
-          "6b802ecc99": "時間",
           "d90981f766": "時間",
           "6b914c5fbb": "日",
           "233b8c94b6": "ケイデンス",
@@ -13659,6 +13655,11 @@
           "837d902bba": "毎週",
           "ddba78647e": "カスタム cron"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "午前または午後",
+          "32a5e4e35e": "分",
+          "aa593eb5e2": "時間"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "再利用",
           "c90888ee94": "新規",
diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json
index 364bc1860a0..736e1af821b 100644
--- a/src/renderer/src/i18n/locales/ko.json
+++ b/src/renderer/src/i18n/locales/ko.json
@@ -786,7 +786,7 @@
         "a9fb10afca": "터미널",
         "5235c215ca": "작업 페이지와 사이드바에 표시할 작업 제공자를 선택합니다.",
         "85f4fd7710": "작업 소스",
-        "ab4b21b58e": "브랜치 이름 지정, 기본 참조, 속성 및 Git AI Author.",
+        "ab4b21b58e": "브랜치 이름 지정, 기본 참조 및 Git AI Author.",
         "09607cb0fe": "Git 및 소스 제어",
         "33a5e1d597": "GitHub, GitLab, Linear 및 소스 호스팅 서비스를 연결하세요.",
         "2b043783ef": "연동",
@@ -2859,7 +2859,7 @@
             "removedBody": "이 워크트리의 SSH 호스트가 제거되어 더 이상 연결할 수 없습니다. 워크트리를 제거하여 정리하세요 — 원격 파일은 그대로 남아 있습니다.",
             "removeWorkspaceButton": "워크트리 제거"
           },
-          "TerminalRemoteRuntimeReconnectBanner": {
+          "TerminalPaneDisconnectedBanner": {
             "retryingTitle": "원격 런타임에 다시 연결 중",
             "disconnectedTitle": "원격 런타임 연결 끊김",
             "retryingBody": "Orca는 최대 1분간 재시도합니다. 연결이 복원되면 이 터미널이 재개됩니다.",
@@ -4678,14 +4678,28 @@
           "bff3bdd00c": "워크스페이스 이름 바꾸기",
           "8df295a78d": "워크스페이스 이름을 바꾸지 못했습니다."
         },
+        "WorktreeVisibilityHelpPopover": {
+          "c41f2d7e90": "기본적으로 숨겨지는 워크트리",
+          "8db4e19a26": "이 설정은 Orca에서 만든 워크트리를 숨기지 않습니다.",
+          "54a7c2f183": "새로 추가한 저장소에서는 직접 만들거나 다른 도구에서 만든 워크트리가 예기치 않은 항목으로 사이드바를 복잡하게 하지 않도록 기본적으로 숨겨집니다.",
+          "b9e0d43675": "'항상 표시'는 .claude/worktrees/* 및 .gsd-workspaces/* 아래의 에이전트 워크트리를 포함하여 현재와 앞으로 생성되는 Orca 외부 워크트리를 표시합니다. 꺼져 있을 때는 아래의 '표시'를 사용해 하나씩 추가할 수 있습니다."
+        },
         "WorktreeVisibilityDialog": {
           "83a5ba8dd1": "Orca 외부 워크트리",
-          "f1f71b9f02": "가져오기",
+          "f1f71b9f02": "항상 표시",
           "759371df43": "숨기기",
-          "25ddf19920": "{{value0}} 가져오기 가능",
+          "25ddf19920": "{{value0}} 현재 숨겨짐",
           "8372e4bbd9": "{{value0}} 현재 표시됨",
           "5d02a5647f": "사이드바에서 숨겨짐",
-          "3e045d4cb8": "사이드바에 표시됨"
+          "3e045d4cb8": "사이드바에 표시됨",
+          "a3f19c07d2": "확인 중…",
+          "b8d24e61f5": "이 저장소의 워크트리를 나열할 수 없습니다.",
+          "c5e70a93b1": "다시 시도",
+          "7d21c5e848": "숨겨진 워크트리({{value0}})",
+          "9b53f7a160": "개별적으로 사이드바에 표시할 숨겨진 워크트리를 선택하세요.",
+          "2f80cd4b97": "표시 중…",
+          "e64b81d3a9": "표시",
+          "d40d436fc2": "워크트리 표시 설정을 업데이트하지 못했습니다. 다시 시도하세요."
         },
         "add": {
           "repo": {
@@ -5964,14 +5978,6 @@
           "808f9a726e": "접두사가 적용되지 않습니다"
         },
         "GitPane": {
-          "d2eede4c54": "commits, PR 및 이슈에 Orca 속성을 추가합니다.",
-          "e02ea23a32": "Orca 표기",
-          "e71ce09c42": "orca",
-          "b9b5771bb1": "표기",
-          "b5f534717a": "공동 작성",
-          "9838c921ed": "공저자",
-          "afada55042": "이슈",
-          "b4ef5428a7": "PR",
           "895d3f70b8": "gh",
           "32dca11189": "GitHub",
           "c4f610d057": "사용 가능한 경우 현재 GitLab CLI REST 속도 제한 헤더입니다.",
@@ -6860,7 +6866,7 @@
           "3de4bbb841": "터미널",
           "dd72ed437a": "작업 페이지와 사이드바에 표시할 작업 제공자를 선택합니다.",
           "11faa2f7dd": "작업 소스",
-          "cfa34f4465": "브랜치 이름 지정, 기본 참조, 속성 및 Git AI Author.",
+          "cfa34f4465": "브랜치 이름 지정, 기본 참조 및 Git AI Author.",
           "70100f94c7": "Git 및 소스 제어",
           "b07041697f": "GitHub, GitLab, Linear 및 소스 호스팅 서비스를 연결하세요.",
           "c9ca101a3b": "연동",
@@ -8238,16 +8244,8 @@
         },
         "git": {
           "search": {
-            "61eab13403": "orca",
-            "1b93c1143c": "속성",
-            "8461c908ae": "공동 집필",
-            "61f9f5d1fc": "공저자",
-            "af0a144bfb": "이슈",
-            "6bdea421bb": "PR",
             "16f53f7323": "gh",
             "d088806071": "GitHub",
-            "118c23484b": "commits, PR 및 이슈에 Orca 속성을 추가합니다.",
-            "bc7d9f69ce": "Orca 속성",
             "40f9b815fd": "API 예산",
             "b7e52124c7": "속도 제한",
             "ead733645f": "glab",
@@ -13658,9 +13656,7 @@
           "33741dd973": "실행으로 돌아가기"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "오전 또는 오후",
           "9e677335b0": "분",
-          "6b802ecc99": "시간",
           "d90981f766": "시간",
           "6b914c5fbb": "요일",
           "233b8c94b6": "반복 주기",
@@ -13670,6 +13666,11 @@
           "837d902bba": "매주",
           "ddba78647e": "사용자 지정 cron"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "오전 또는 오후",
+          "32a5e4e35e": "분",
+          "aa593eb5e2": "시간"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "재사용",
           "c90888ee94": "새로 시작",
diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json
index 2e85a5074b1..116a0fac453 100644
--- a/src/renderer/src/i18n/locales/zh.json
+++ b/src/renderer/src/i18n/locales/zh.json
@@ -786,7 +786,7 @@
         "a9fb10afca": "终端",
         "5235c215ca": "选择在“任务”页面和侧栏中显示的任务提供者。",
         "85f4fd7710": "任务来源",
-        "ab4b21b58e": "分支命名、基础引用、署名和 Git AI Author。",
+        "ab4b21b58e": "分支命名、基础引用和 Git AI Author。",
         "09607cb0fe": "Git 和源代码控制",
         "33a5e1d597": "连接 GitHub、GitLab、Linear 和源托管服务。",
         "2b043783ef": "集成",
@@ -2871,7 +2871,7 @@
             "removedBody": "此工作区的 SSH 主机已被移除，无法再连接。请移除工作区以清理 — 远程文件不会受影响。",
             "removeWorkspaceButton": "移除工作区"
           },
-          "TerminalRemoteRuntimeReconnectBanner": {
+          "TerminalPaneDisconnectedBanner": {
             "retryingTitle": "正在重新连接到远程运行时",
             "disconnectedTitle": "远程运行时已断开连接",
             "retryingBody": "Orca 将重试最多一分钟。如果连接恢复，此终端将恢复。",
@@ -4690,14 +4690,28 @@
           "bff3bdd00c": "重命名工作区",
           "8df295a78d": "无法重命名工作区。"
         },
+        "WorktreeVisibilityHelpPopover": {
+          "c41f2d7e90": "哪些工作树默认隐藏？",
+          "8db4e19a26": "此设置不会隐藏通过 Orca 创建的工作树。",
+          "54a7c2f183": "对于新添加的仓库，手动或通过其他工具创建的工作树默认隐藏，以免侧边栏出现意外内容。",
+          "b9e0d43675": "“始终显示”会显示当前及以后创建的非 Orca 工作树，包括 .claude/worktrees/* 和 .gsd-workspaces/* 下的智能体工作树。关闭时，可使用下方的“显示”逐个添加。"
+        },
         "WorktreeVisibilityDialog": {
           "83a5ba8dd1": "非 Orca 工作树",
-          "f1f71b9f02": "导入",
+          "f1f71b9f02": "始终显示",
           "759371df43": "隐藏",
-          "25ddf19920": "{{value0}} 可导入",
+          "25ddf19920": "当前隐藏 {{value0}}",
           "8372e4bbd9": "当前显示 {{value0}}",
           "5d02a5647f": "从侧边栏隐藏",
-          "3e045d4cb8": "显示在侧边栏中"
+          "3e045d4cb8": "显示在侧边栏中",
+          "a3f19c07d2": "检查中…",
+          "b8d24e61f5": "无法列出此仓库的工作树。",
+          "c5e70a93b1": "重试",
+          "7d21c5e848": "已隐藏的工作树（{{value0}}）",
+          "9b53f7a160": "选择要单独显示的隐藏工作树。",
+          "2f80cd4b97": "显示中…",
+          "e64b81d3a9": "显示",
+          "d40d436fc2": "无法更新工作树可见性。请重试。"
         },
         "add": {
           "repo": {
@@ -5976,14 +5990,6 @@
           "808f9a726e": "不会应用前缀"
         },
         "GitPane": {
-          "d2eede4c54": "将 Orca 署名添加到 commits、PR 和议题。",
-          "e02ea23a32": "Orca 署名",
-          "e71ce09c42": "orca",
-          "b9b5771bb1": "署名",
-          "b5f534717a": "合着的",
-          "9838c921ed": "共同作者",
-          "afada55042": "议题",
-          "b4ef5428a7": "PR",
           "895d3f70b8": "gh",
           "32dca11189": "github",
           "c4f610d057": "当前 GitLab CLI REST 速率限制标头（如果可用）。",
@@ -6872,7 +6878,7 @@
           "3de4bbb841": "终端",
           "dd72ed437a": "选择在“任务”页面和侧栏中显示的任务提供者。",
           "11faa2f7dd": "任务来源",
-          "cfa34f4465": "分支命名、基础引用、署名和 Git AI Author。",
+          "cfa34f4465": "分支命名、基础引用和 Git AI Author。",
           "70100f94c7": "Git 和源代码控制",
           "b07041697f": "连接 GitHub、GitLab、Linear 和源托管服务。",
           "c9ca101a3b": "集成",
@@ -8250,16 +8256,8 @@
         },
         "git": {
           "search": {
-            "61eab13403": "orca",
-            "1b93c1143c": "署名",
-            "8461c908ae": "合着的",
-            "61f9f5d1fc": "共同作者",
-            "af0a144bfb": "议题",
-            "6bdea421bb": "PR",
             "16f53f7323": "gh",
             "d088806071": "GitHub",
-            "118c23484b": "将 Orca 署名添加到 commits、PR 和议题。",
-            "bc7d9f69ce": "Orca 署名",
             "40f9b815fd": "API预算",
             "b7e52124c7": "速率限制",
             "ead733645f": "光亮的",
@@ -13667,9 +13665,7 @@
           "33741dd973": "返回执行"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "上午或下午",
           "9e677335b0": "分钟",
-          "6b802ecc99": "小时",
           "d90981f766": "时间",
           "6b914c5fbb": "天",
           "233b8c94b6": "节奏",
@@ -13679,6 +13675,11 @@
           "837d902bba": "每周",
           "ddba78647e": "自定义 cron"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "上午或下午",
+          "32a5e4e35e": "分钟",
+          "aa593eb5e2": "小时"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "重复利用",
           "c90888ee94": "新鲜的",
diff --git a/src/renderer/src/lib/agent-hibernation-planner.ts b/src/renderer/src/lib/agent-hibernation-planner.ts
index 6920d18ed1e..f5631ffc8ed 100644
--- a/src/renderer/src/lib/agent-hibernation-planner.ts
+++ b/src/renderer/src/lib/agent-hibernation-planner.ts
@@ -267,10 +267,7 @@ export function planAgentHibernationCandidates(
     }
     if (
       runtimeLivenessRequiredWorktreeIds.has(worktreeId) &&
-      !Object.prototype.hasOwnProperty.call(
-        snapshot.runtimeLivePtyIdsByWorktreeId ?? {},
-        worktreeId
-      )
+      !Object.hasOwn(snapshot.runtimeLivePtyIdsByWorktreeId ?? {}, worktreeId)
     ) {
       continue
     }
diff --git a/src/renderer/src/lib/agent-send-title-status.test.ts b/src/renderer/src/lib/agent-send-title-status.test.ts
new file mode 100644
index 00000000000..befa6e33cb1
--- /dev/null
+++ b/src/renderer/src/lib/agent-send-title-status.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import { detectAgentSendTitleStatus } from './agent-send-title-status'
+
+describe('detectAgentSendTitleStatus', () => {
+  it.each([
+    'OC | Native session',
+    'OC | ✦ Gemini CLI',
+    'OC | ✋ review Gemini permission handling',
+    'ssh build-host | OC | Native session',
+    'user@host: ~/code | OC | Native session',
+    '▣ OC | Native session',
+    'OC |   Native session',
+    'OC |\tNative session'
+  ])('accepts OpenCode native idle title %j', (title) => {
+    expect(detectAgentSendTitleStatus(title)).toBe('idle')
+  })
+
+  it('preserves spinner working state for OpenCode', () => {
+    expect(detectAgentSendTitleStatus('⠋ OC | Native session')).toBe('working')
+    expect(detectAgentSendTitleStatus('ssh build-host | ⠋ OC | Native session')).toBe('working')
+  })
+
+  it.each(['OC |', 'OC |Native session', 'oc | Native session', 'OCTOPUS | Native session'])(
+    'rejects incomplete or lookalike OpenCode title %j',
+    (title) => {
+      expect(detectAgentSendTitleStatus(title)).toBeNull()
+    }
+  )
+
+  it('preserves non-OpenCode title behavior', () => {
+    expect(detectAgentSendTitleStatus('✦ Gemini CLI')).toBe('working')
+    expect(detectAgentSendTitleStatus('Codex ready')).toBe('idle')
+    expect(detectAgentSendTitleStatus('zsh')).toBeNull()
+  })
+})
diff --git a/src/renderer/src/lib/agent-send-title-status.ts b/src/renderer/src/lib/agent-send-title-status.ts
index 9ae50293693..4e03d70b174 100644
--- a/src/renderer/src/lib/agent-send-title-status.ts
+++ b/src/renderer/src/lib/agent-send-title-status.ts
@@ -1,4 +1,5 @@
 import type { AgentStatus } from './agent-status'
+import { isOpenCodeNativeTitle } from '../../../shared/opencode-terminal-title'
 import { classifyTitleActivity, resolveTitleActivityLabel } from '@/lib/pane-agent-evidence'
 
 const EXPLICIT_IDLE_SEND_TITLE_RE = /(^|\s)(ready|idle|done)(\s|$|[.!?])/i
@@ -24,6 +25,9 @@ export function detectAgentSendTitleStatus(title: string | null | undefined): Ag
 function isExplicitIdleSendTitle(title: string): boolean {
   return (
     EXPLICIT_IDLE_SEND_TITLE_RE.test(title) ||
+    // Why: this title-level filter exposes hookless OpenCode targets; the runtime
+    // still requires launch or foreground-process evidence before writing.
+    isOpenCodeNativeTitle(title) ||
     title.startsWith(CLAUDE_IDLE_PREFIX) ||
     title.startsWith('* ') ||
     title.includes(GEMINI_IDLE_PREFIX) ||
diff --git a/src/renderer/src/lib/agent-status.ts b/src/renderer/src/lib/agent-status.ts
index e49e3c002fa..11d966cb8bf 100644
--- a/src/renderer/src/lib/agent-status.ts
+++ b/src/renderer/src/lib/agent-status.ts
@@ -139,9 +139,7 @@ export function agentTypeToIconAgent(agentType: AgentType | null | undefined): T
   if (!agentType || agentType === 'unknown') {
     return null
   }
-  return Object.prototype.hasOwnProperty.call(ICONABLE_AGENT_TYPES, agentType)
-    ? (agentType as TuiAgent)
-    : null
+  return Object.hasOwn(ICONABLE_AGENT_TYPES, agentType) ? (agentType as TuiAgent) : null
 }
 
 // Why: shared resolver so all send paths stamp identical agent_kind on agent_prompt_sent telemetry.
diff --git a/src/renderer/src/lib/ai-vault-resume-command.ts b/src/renderer/src/lib/ai-vault-resume-command.ts
index e8d05f61140..92e826f83a9 100644
--- a/src/renderer/src/lib/ai-vault-resume-command.ts
+++ b/src/renderer/src/lib/ai-vault-resume-command.ts
@@ -241,10 +241,32 @@ function resolveAiVaultResumeShell(args: AiVaultResumeWorktreeArgs): AgentStartu
     state: args.state,
     worktreeId: args.worktreeId,
     platform,
-    isLocalSession
+    isLocalSession,
+    parsedByClientLoginShell: isLocalSession && runsOnClientLoginShell(args, platform)
   })
 }
 
+/**
+ * Whether the resume line is handed to THIS machine's login shell.
+ *
+ * Why not `isLocalSession`: that only says the session file was scanned locally
+ * (no executionHostId), which is still true when the worktree lives on an SSH
+ * or runtime host — the command then goes to that host's shell. The WSL case is
+ * caught by the platform mismatch (a WSL worktree resolves to 'linux' on win32).
+ */
+function runsOnClientLoginShell(
+  args: AiVaultResumeWorktreeArgs,
+  platform: NodeJS.Platform
+): boolean {
+  const executionHost = parseExecutionHostId(
+    getExecutionHostIdForWorktree(args.state, args.worktreeId ?? args.state.activeWorktreeId)
+  )
+  if (executionHost?.kind === 'ssh' || executionHost?.kind === 'runtime') {
+    return false
+  }
+  return platform === CLIENT_PLATFORM
+}
+
 export function getAiVaultAgentProviderSession(
   session: Pick<AiVaultSession, 'agent' | 'sessionId'> & { filePath?: string }
 ): AgentProviderSessionMetadata | null {
diff --git a/src/renderer/src/lib/ai-vault-resume-shell.test.ts b/src/renderer/src/lib/ai-vault-resume-shell.test.ts
new file mode 100644
index 00000000000..e2ab4b9a173
--- /dev/null
+++ b/src/renderer/src/lib/ai-vault-resume-shell.test.ts
@@ -0,0 +1,150 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { AppState } from '@/store/types'
+
+vi.mock('@/lib/new-workspace', () => ({
+  CLIENT_PLATFORM: 'darwin'
+}))
+
+const clientLoginShell = vi.hoisted(() => ({ value: '' }))
+
+vi.mock('@/lib/client-login-shell', () => ({
+  getClientLoginShell: () => clientLoginShell.value
+}))
+
+import { buildAiVaultResumeCopyCommandForWorktree } from './ai-vault-resume-command'
+import { resolveAiVaultResumeStartupShell } from './ai-vault-resume-shell'
+
+type ResumeShellState = Parameters<typeof buildAiVaultResumeCopyCommandForWorktree>[0]['state']
+
+function makeState(worktreeHostId?: string): ResumeShellState {
+  return {
+    activeRepoId: 'repo-1',
+    activeWorktreeId: 'repo-1::worktree-1',
+    folderWorkspaces: [],
+    projectGroups: [],
+    repos: [{ id: 'repo-1', path: '/home/alice/repo' }],
+    projects: [{ id: 'repo-1', sourceRepoIds: ['repo-1'] }],
+    settings: {
+      agentDefaultArgs: { codex: '' },
+      agentDefaultEnv: { codex: {} }
+    },
+    worktreesByRepo: {
+      'repo-1': [
+        {
+          id: 'repo-1::worktree-1',
+          repoId: 'repo-1',
+          path: '/home/alice/repo',
+          ...(worktreeHostId ? { hostId: worktreeHostId } : {})
+        }
+      ]
+    }
+  } as unknown as AppState
+}
+
+function withLoginShell<T>(shell: string, run: () => T): T {
+  clientLoginShell.value = shell
+  try {
+    return run()
+  } finally {
+    clientLoginShell.value = ''
+  }
+}
+
+describe('resolveAiVaultResumeStartupShell', () => {
+  it('reports the fish dialect for a local session under a fish login shell', () => {
+    expect(
+      withLoginShell('/opt/homebrew/bin/fish', () =>
+        resolveAiVaultResumeStartupShell({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          platform: 'darwin',
+          isLocalSession: true,
+          parsedByClientLoginShell: true
+        })
+      )
+    ).toBe('fish')
+  })
+
+  it('stays on sh for zsh users', () => {
+    expect(
+      withLoginShell('/bin/zsh', () =>
+        resolveAiVaultResumeStartupShell({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          platform: 'darwin',
+          isLocalSession: true,
+          parsedByClientLoginShell: true
+        })
+      )
+    ).toBe('posix')
+  })
+
+  it('stays on sh for a LOCAL session whose command a remote host parses', () => {
+    // The reachable case: a locally scanned session has no executionHostId, so
+    // isLocalSession stays true while the command is bound for an SSH host.
+    expect(
+      withLoginShell('/opt/homebrew/bin/fish', () =>
+        resolveAiVaultResumeStartupShell({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          platform: 'linux',
+          isLocalSession: true,
+          parsedByClientLoginShell: false
+        })
+      )
+    ).toBe('posix')
+  })
+})
+
+describe('copied real-home Codex resume command', () => {
+  const session = {
+    agent: 'codex' as const,
+    sessionId: 'session one',
+    cwd: '/home/alice/repo',
+    codexHome: null
+  }
+
+  it('clears inherited Codex homes with fish syntax under a fish login shell', () => {
+    expect(
+      withLoginShell('/opt/homebrew/bin/fish', () =>
+        buildAiVaultResumeCopyCommandForWorktree({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          session
+        })
+      )
+    ).toBe(
+      "set -e CODEX_HOME; set -e ORCA_CODEX_HOME; cd '/home/alice/repo' && codex 'resume' 'session one'"
+    )
+  })
+
+  it('keeps `unset` when a fish client targets an SSH worktree', () => {
+    // The session was scanned locally (no executionHostId), but the worktree lives
+    // on an SSH host: `set -e CODEX_HOME` would enable errexit there, not clear it.
+    expect(
+      withLoginShell('/opt/homebrew/bin/fish', () =>
+        buildAiVaultResumeCopyCommandForWorktree({
+          state: makeState('ssh:target-1'),
+          worktreeId: 'repo-1::worktree-1',
+          session
+        })
+      )
+    ).toBe(
+      "unset CODEX_HOME; unset ORCA_CODEX_HOME; cd '/home/alice/repo' && codex 'resume' 'session one'"
+    )
+  })
+
+  it('keeps `unset` for sh-family login shells', () => {
+    expect(
+      withLoginShell('/bin/bash', () =>
+        buildAiVaultResumeCopyCommandForWorktree({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          session
+        })
+      )
+    ).toBe(
+      "unset CODEX_HOME; unset ORCA_CODEX_HOME; cd '/home/alice/repo' && codex 'resume' 'session one'"
+    )
+  })
+})
diff --git a/src/renderer/src/lib/ai-vault-resume-shell.ts b/src/renderer/src/lib/ai-vault-resume-shell.ts
index d1ab726484e..9b6214fb247 100644
--- a/src/renderer/src/lib/ai-vault-resume-shell.ts
+++ b/src/renderer/src/lib/ai-vault-resume-shell.ts
@@ -4,9 +4,11 @@ import { CLIENT_PLATFORM } from '@/lib/new-workspace'
 import { resolveLocalWindowsTerminalShellOverrideForTab } from '../../../shared/local-windows-terminal-runtime'
 import { resolveWindowsShellStartupFamily } from '../../../shared/windows-terminal-shell'
 import {
+  resolveLoginShellStartupDialect,
   resolveStartupShell,
   type AgentStartupShell
 } from '../../../shared/tui-agent-startup-shell'
+import { getClientLoginShell } from '@/lib/client-login-shell'
 import { parseWorkspaceKey } from '../../../shared/workspace-scope'
 import { parseWslUncPath } from '../../../shared/wsl-paths'
 
@@ -26,24 +28,35 @@ export function resolveAiVaultResumeStartupShell(args: {
   worktreeId?: string | null
   platform: NodeJS.Platform
   isLocalSession: boolean
+  /**
+   * True only when this machine's own login shell parses the command. A local
+   * session is NOT enough: a locally scanned session carries no executionHostId
+   * yet can target an SSH/runtime/WSL worktree, whose shell is unrelated.
+   */
+  parsedByClientLoginShell?: boolean
 }): AgentStartupShell {
-  const projectRuntime =
-    args.platform === 'win32' && args.isLocalSession
-      ? getLocalProjectExecutionRuntimeContext(args.state, args.worktreeId, CLIENT_PLATFORM)
-      : undefined
+  // Why: fish rejects `unset`, so the client's login shell decides the dialect —
+  // but only when it is the shell that reads the line; otherwise it stays sh.
+  if (args.platform !== 'win32') {
+    return args.parsedByClientLoginShell
+      ? resolveLoginShellStartupDialect(getClientLoginShell())
+      : 'posix'
+  }
+  const projectRuntime = args.isLocalSession
+    ? getLocalProjectExecutionRuntimeContext(args.state, args.worktreeId, CLIENT_PLATFORM)
+    : undefined
   const workspacePath = getAiVaultResumeWorkspacePath(
     args.state,
     args.worktreeId ?? args.state.activeWorktreeId
   )
-  const shellOverride =
-    args.platform === 'win32' && args.isLocalSession
-      ? resolveLocalWindowsTerminalShellOverrideForTab({
-          explicitShellOverride: undefined,
-          defaultWindowsShell: args.state.settings?.terminalWindowsShell,
-          isWslWorktree: Boolean(workspacePath && parseWslUncPath(workspacePath)),
-          projectRuntime
-        })
-      : undefined
+  const shellOverride = args.isLocalSession
+    ? resolveLocalWindowsTerminalShellOverrideForTab({
+        explicitShellOverride: undefined,
+        defaultWindowsShell: args.state.settings?.terminalWindowsShell,
+        isWslWorktree: Boolean(workspacePath && parseWslUncPath(workspacePath)),
+        projectRuntime
+      })
+    : undefined
   const shell = shellOverride ? resolveWindowsShellStartupFamily(shellOverride) : undefined
   return resolveStartupShell(args.platform, shell)
 }
diff --git a/src/renderer/src/lib/browser-cookie-import-toast.test.ts b/src/renderer/src/lib/browser-cookie-import-toast.test.ts
index a59c7a93f03..40f2800102e 100644
--- a/src/renderer/src/lib/browser-cookie-import-toast.test.ts
+++ b/src/renderer/src/lib/browser-cookie-import-toast.test.ts
@@ -35,7 +35,8 @@ describe('emitBrowserCookieImportToast', () => {
           failedCookies: 3
         }
       },
-      'Imported 3 cookies.'
+      'Imported 3 cookies.',
+      'Local Mac'
     )
 
     expect(warningToastMock).toHaveBeenCalledWith(
@@ -44,29 +45,67 @@ describe('emitBrowserCookieImportToast', () => {
     expect(successToastMock).not.toHaveBeenCalled()
   })
 
-  it('shows the localized partial-failure warning', () => {
-    emitBrowserCookieImportToast(
-      {
-        ...summary,
-        warning: {
-          code: 'restart-fallback-unavailable',
-          loadedCookies: 2,
-          failedCookies: 1
-        }
-      },
-      'Imported 3 cookies.'
-    )
-
-    expect(warningToastMock).toHaveBeenCalledWith(
-      'Imported 2 of 3 cookies. The rest could not be loaded, and the restart fallback was unavailable. Try the import again.'
-    )
-    expect(successToastMock).not.toHaveBeenCalled()
-  })
-
   it('shows success when the import has no warning', () => {
-    emitBrowserCookieImportToast(summary, 'Imported 3 cookies.')
+    emitBrowserCookieImportToast(summary, 'Imported 3 cookies.', 'Local Mac')
 
     expect(successToastMock).toHaveBeenCalledWith('Imported 3 cookies.')
     expect(warningToastMock).not.toHaveBeenCalled()
   })
+
+  it('shows separate host-specific Google guidance after success', () => {
+    emitBrowserCookieImportToast(
+      { ...summary, importedCookies: 2, skippedCookies: 1, googleCookiesSkipped: 1 },
+      'Imported 2 cookies.',
+      'Remote Mac'
+    )
+
+    expect(successToastMock).toHaveBeenCalledWith('Imported 2 cookies.')
+    expect(warningToastMock).toHaveBeenCalledWith(
+      'Google cookies were not imported. Open a browser in Orca on Remote Mac with this profile, then sign into Google.',
+      { duration: 12000 }
+    )
+    expect(successToastMock.mock.invocationCallOrder[0]).toBeLessThan(
+      warningToastMock.mock.invocationCallOrder[0]
+    )
+  })
+
+  it('does not infer a Google warning from generic skipped cookies', () => {
+    emitBrowserCookieImportToast(
+      { ...summary, importedCookies: 2, skippedCookies: 1 },
+      'Imported 2 cookies.',
+      'Local Mac'
+    )
+
+    expect(successToastMock).toHaveBeenCalledWith('Imported 2 cookies.')
+    expect(warningToastMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps both applicable warnings when restart fallback is unavailable', () => {
+    emitBrowserCookieImportToast(
+      {
+        ...summary,
+        importedCookies: 1,
+        skippedCookies: 2,
+        googleCookiesSkipped: 1,
+        warning: {
+          code: 'restart-fallback-unavailable',
+          loadedCookies: 1,
+          failedCookies: 1
+        }
+      },
+      'Imported 1 cookie.',
+      'Remote Mac'
+    )
+
+    expect(successToastMock).not.toHaveBeenCalled()
+    expect(warningToastMock.mock.calls).toEqual([
+      [
+        'Imported 1 of 2 cookies. The rest could not be loaded, and the restart fallback was unavailable. Try the import again.'
+      ],
+      [
+        'Google cookies were not imported. Open a browser in Orca on Remote Mac with this profile, then sign into Google.',
+        { duration: 12000 }
+      ]
+    ])
+  })
 })
diff --git a/src/renderer/src/lib/browser-cookie-import-toast.ts b/src/renderer/src/lib/browser-cookie-import-toast.ts
index 4bdd031f83f..ced4c3cfdbd 100644
--- a/src/renderer/src/lib/browser-cookie-import-toast.ts
+++ b/src/renderer/src/lib/browser-cookie-import-toast.ts
@@ -24,16 +24,35 @@ function formatCookieImportWarning(warning: CookieImportWarning): string {
   }
 }
 
+function emitGoogleCookieImportWarning(
+  summary: BrowserCookieImportSummary,
+  executionHostLabel: string
+): void {
+  if (!summary.googleCookiesSkipped) {
+    return
+  }
+  toast.warning(
+    translate(
+      'auto.lib.browser.cookie.import.toast.googleCookiesSkipped',
+      'Google cookies were not imported. Open a browser in Orca on {{value0}} with this profile, then sign into Google.',
+      { value0: executionHostLabel }
+    ),
+    { duration: 12000 }
+  )
+}
+
 // Why: a degraded import returns ok:true with a warning, so every call site must route it to a
 // warning toast instead of reporting an unqualified success (#9355).
 export function emitBrowserCookieImportToast(
   summary: BrowserCookieImportSummary,
-  successMessage: string
+  successMessage: string,
+  executionHostLabel: string
 ): void {
   const warning = summary.warning
   if (warning) {
     toast.warning(formatCookieImportWarning(warning))
-    return
+  } else {
+    toast.success(successMessage)
   }
-  toast.success(successMessage)
+  emitGoogleCookieImportWarning(summary, executionHostLabel)
 }
diff --git a/src/renderer/src/lib/client-creation-action-policy.test.ts b/src/renderer/src/lib/client-creation-action-policy.test.ts
new file mode 100644
index 00000000000..b0edc2add67
--- /dev/null
+++ b/src/renderer/src/lib/client-creation-action-policy.test.ts
@@ -0,0 +1,210 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
+import type { RuntimeStatus } from '../../../shared/runtime-types'
+import { toRuntimeExecutionHostId, toSshExecutionHostId } from '../../../shared/execution-host'
+import { folderWorkspaceKey } from '../../../shared/workspace-scope'
+import {
+  FLOATING_BROWSER_UNAVAILABLE_MESSAGE,
+  LOCAL_BROWSER_UNAVAILABLE_MESSAGE,
+  MANAGED_BROWSER_UNAVAILABLE_MESSAGE,
+  MOBILE_EMULATOR_UNAVAILABLE_MESSAGE,
+  assertClientCreationActionAvailable,
+  assertManagedBrowserMaterializationAllowed,
+  getClientCreationActionPolicy,
+  resolveClientCreationActionPolicy
+} from './client-creation-action-policy'
+
+function runtimeStatus(capabilities?: string[]): RuntimeStatus {
+  return {
+    runtimeId: 'runtime-1',
+    rendererGraphEpoch: 1,
+    graphStatus: 'ready',
+    authoritativeWindowId: null,
+    liveTabCount: 0,
+    liveLeafCount: 0,
+    hostPlatform: 'darwin',
+    capabilities
+  }
+}
+
+afterEach(() => vi.unstubAllGlobals())
+
+describe('resolveClientCreationActionPolicy', () => {
+  it('preserves Electron creation behavior without negotiated runtime signals', () => {
+    expect(resolveClientCreationActionPolicy({ surface: 'electron', runtimeStatus: null })).toEqual(
+      {
+        'managed-browser': { state: 'enabled', provider: 'local-client' },
+        'mobile-emulator': { state: 'enabled', provider: 'local-client' }
+      }
+    )
+  })
+
+  it('selects the provider that the browser action path can actually consume', () => {
+    const desktopHost = runtimeStatus(['browser.screencast.v1'])
+    const npmHostWithoutDisplay = { ...runtimeStatus(), hostPlatform: 'linux' as const }
+    const npmHostWithDisplay = {
+      ...runtimeStatus(['browser.screencast.v1', 'browser.headless.v1']),
+      hostPlatform: 'linux' as const
+    }
+
+    expect(
+      resolveClientCreationActionPolicy({ surface: 'electron', runtimeStatus: desktopHost })
+    ).toEqual({
+      'managed-browser': { state: 'enabled', provider: 'paired-runtime' },
+      'mobile-emulator': { state: 'enabled', provider: 'local-client' }
+    })
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'electron',
+        runtimeStatus: npmHostWithoutDisplay
+      })
+    ).toEqual({
+      'managed-browser': { state: 'enabled', provider: 'local-client' },
+      'mobile-emulator': { state: 'enabled', provider: 'local-client' }
+    })
+    expect(
+      resolveClientCreationActionPolicy({ surface: 'paired-web', runtimeStatus: desktopHost })
+    ).toEqual({
+      'managed-browser': { state: 'enabled', provider: 'paired-runtime' },
+      'mobile-emulator': { state: 'hidden', reason: MOBILE_EMULATOR_UNAVAILABLE_MESSAGE }
+    })
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'paired-web',
+        runtimeStatus: npmHostWithoutDisplay
+      })
+    ).toEqual({
+      'managed-browser': { state: 'hidden', reason: MANAGED_BROWSER_UNAVAILABLE_MESSAGE },
+      'mobile-emulator': { state: 'hidden', reason: MOBILE_EMULATOR_UNAVAILABLE_MESSAGE }
+    })
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'paired-web',
+        runtimeStatus: npmHostWithDisplay
+      })['managed-browser']
+    ).toEqual({ state: 'enabled', provider: 'paired-runtime' })
+  })
+
+  it('enables paired-web browser creation only with negotiated streaming support', () => {
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'paired-web',
+        runtimeStatus: runtimeStatus(['browser.screencast.v1'])
+      })['managed-browser']
+    ).toEqual({ state: 'enabled', provider: 'paired-runtime' })
+
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'paired-web',
+        runtimeStatus: runtimeStatus()
+      })['managed-browser']
+    ).toEqual({ state: 'hidden', reason: MANAGED_BROWSER_UNAVAILABLE_MESSAGE })
+  })
+
+  it('hides web-client floating browsers and mobile emulators as impossible surfaces', () => {
+    const policy = resolveClientCreationActionPolicy({
+      surface: 'paired-web',
+      runtimeStatus: runtimeStatus(['browser.screencast.v1', 'mobile.tasks.v1']),
+      floatingWorkspace: true
+    })
+
+    expect(policy['managed-browser']).toEqual({
+      state: 'hidden',
+      reason: FLOATING_BROWSER_UNAVAILABLE_MESSAGE
+    })
+    expect(policy['mobile-emulator']).toEqual({
+      state: 'hidden',
+      reason: MOBILE_EMULATOR_UNAVAILABLE_MESSAGE
+    })
+  })
+})
+
+describe('client creation action guards', () => {
+  it('fails closed for an older paired runtime and rejects local browser materialization', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const state = {
+      settings: { activeRuntimeEnvironmentId: 'runtime-1' },
+      runtimeStatusByEnvironmentId: new Map([
+        ['runtime-1', { status: runtimeStatus(), checkedAt: 1 }]
+      ])
+    }
+
+    expect(getClientCreationActionPolicy(state as never, null)['managed-browser'].state).toBe(
+      'hidden'
+    )
+    expect(() =>
+      assertClientCreationActionAvailable(state as never, null, 'managed-browser')
+    ).toThrow(MANAGED_BROWSER_UNAVAILABLE_MESSAGE)
+    expect(() => assertManagedBrowserMaterializationAllowed(state as never, null)).toThrow(
+      LOCAL_BROWSER_UNAVAILABLE_MESSAGE
+    )
+  })
+
+  it('permits host-confirmed remote browser materialization in paired web', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const state = {
+      runtimeStatusByEnvironmentId: new Map([
+        ['runtime-1', { status: runtimeStatus(['browser.screencast.v1']), checkedAt: 1 }]
+      ])
+    }
+    expect(() =>
+      assertManagedBrowserMaterializationAllowed(state as never, 'runtime-1')
+    ).not.toThrow()
+  })
+
+  it('treats the floating workspace as local even with an active capable runtime', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const state = {
+      settings: { activeRuntimeEnvironmentId: 'runtime-1' },
+      runtimeStatusByEnvironmentId: new Map([
+        ['runtime-1', { status: runtimeStatus(['browser.screencast.v1']), checkedAt: 1 }]
+      ])
+    }
+
+    expect(
+      getClientCreationActionPolicy(state as never, FLOATING_TERMINAL_WORKTREE_ID)[
+        'managed-browser'
+      ]
+    ).toEqual({ state: 'hidden', reason: FLOATING_BROWSER_UNAVAILABLE_MESSAGE })
+  })
+
+  it('uses folder and SSH workspace ownership instead of the focused runtime', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const capableStatus = runtimeStatus(['browser.screencast.v1'])
+    const state = {
+      settings: { activeRuntimeEnvironmentId: 'focused-runtime' },
+      folderWorkspaces: [
+        {
+          id: 'remote-folder',
+          projectGroupId: 'remote-group',
+          executionHostId: toRuntimeExecutionHostId('folder-owner')
+        }
+      ],
+      projectGroups: [
+        { id: 'remote-group', executionHostId: toRuntimeExecutionHostId('folder-owner') }
+      ],
+      worktreesByRepo: {
+        repo: [
+          {
+            id: 'ssh-worktree',
+            repoId: 'repo',
+            hostId: toSshExecutionHostId('ssh-owner')
+          }
+        ]
+      },
+      runtimeStatusByEnvironmentId: new Map([
+        ['folder-owner', { status: capableStatus, checkedAt: 1 }],
+        ['focused-runtime', { status: capableStatus, checkedAt: 1 }]
+      ])
+    }
+
+    expect(
+      getClientCreationActionPolicy(state as never, folderWorkspaceKey('remote-folder'))[
+        'managed-browser'
+      ]
+    ).toEqual({ state: 'enabled', provider: 'paired-runtime' })
+    expect(
+      getClientCreationActionPolicy(state as never, 'ssh-worktree')['managed-browser']
+    ).toEqual({ state: 'hidden', reason: MANAGED_BROWSER_UNAVAILABLE_MESSAGE })
+  })
+})
diff --git a/src/renderer/src/lib/client-creation-action-policy.ts b/src/renderer/src/lib/client-creation-action-policy.ts
new file mode 100644
index 00000000000..4f4b5388590
--- /dev/null
+++ b/src/renderer/src/lib/client-creation-action-policy.ts
@@ -0,0 +1,116 @@
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
+import { BROWSER_SCREENCAST_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import type { RuntimeStatus } from '../../../shared/runtime-types'
+import type { AppState } from '@/store/types'
+import { isPairedWebClientWindow } from './desktop-window-chrome'
+import { getRuntimeEnvironmentIdForWorktree } from './worktree-runtime-owner'
+
+export const MANAGED_BROWSER_UNAVAILABLE_MESSAGE =
+  "Managed browser tabs are unavailable because this web client's paired runtime does not support browser streaming."
+export const RUNTIME_BROWSER_UNAVAILABLE_MESSAGE =
+  'Managed browser tabs are unavailable because the paired runtime does not support browser streaming.'
+export const FLOATING_BROWSER_UNAVAILABLE_MESSAGE =
+  'Managed browser tabs are unavailable in the web client floating workspace.'
+export const LOCAL_BROWSER_UNAVAILABLE_MESSAGE =
+  'Managed browser tabs in the web client must be created by a capable paired runtime.'
+export const MOBILE_EMULATOR_UNAVAILABLE_MESSAGE =
+  'Mobile Emulator is unavailable in the web client.'
+
+export type ClientCreationAction = 'managed-browser' | 'mobile-emulator'
+export type ClientCreationActionProvider = 'local-client' | 'paired-runtime'
+
+export type ClientCreationActionAvailability =
+  | { state: 'enabled'; provider: ClientCreationActionProvider }
+  | { state: 'hidden'; reason: string }
+
+export type ClientCreationActionPolicy = Record<
+  ClientCreationAction,
+  ClientCreationActionAvailability
+>
+
+export function resolveClientCreationActionPolicy(args: {
+  surface: 'electron' | 'paired-web'
+  runtimeStatus: Pick<RuntimeStatus, 'capabilities' | 'hostPlatform'> | null
+  floatingWorkspace?: boolean
+}): ClientCreationActionPolicy {
+  const browserStreamingAvailable = args.runtimeStatus?.capabilities?.includes(
+    BROWSER_SCREENCAST_RUNTIME_CAPABILITY
+  )
+
+  if (args.surface === 'electron') {
+    return {
+      'managed-browser': {
+        state: 'enabled',
+        provider: browserStreamingAvailable ? 'paired-runtime' : 'local-client'
+      },
+      'mobile-emulator': { state: 'enabled', provider: 'local-client' }
+    }
+  }
+
+  return {
+    'managed-browser': args.floatingWorkspace
+      ? { state: 'hidden', reason: FLOATING_BROWSER_UNAVAILABLE_MESSAGE }
+      : browserStreamingAvailable
+        ? { state: 'enabled', provider: 'paired-runtime' }
+        : { state: 'hidden', reason: MANAGED_BROWSER_UNAVAILABLE_MESSAGE },
+    // The web preload cannot stream emulator frames, even when the host can run emulator tasks.
+    'mobile-emulator': { state: 'hidden', reason: MOBILE_EMULATOR_UNAVAILABLE_MESSAGE }
+  }
+}
+
+export function getClientCreationActionPolicy(
+  state: AppState,
+  worktreeId: string | null
+): ClientCreationActionPolicy {
+  const floatingWorkspace = worktreeId === FLOATING_TERMINAL_WORKTREE_ID
+  const runtimeEnvironmentId = floatingWorkspace
+    ? null
+    : worktreeId
+      ? getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+      : (state.settings?.activeRuntimeEnvironmentId?.trim() ?? null)
+  const runtimeStatus = runtimeEnvironmentId
+    ? (state.runtimeStatusByEnvironmentId?.get(runtimeEnvironmentId)?.status ?? null)
+    : null
+
+  return resolveClientCreationActionPolicy({
+    surface: isPairedWebClientWindow() ? 'paired-web' : 'electron',
+    runtimeStatus,
+    floatingWorkspace
+  })
+}
+
+export function assertClientCreationActionAvailable(
+  state: AppState,
+  worktreeId: string | null,
+  action: ClientCreationAction
+): void {
+  const availability = getClientCreationActionPolicy(state, worktreeId)[action]
+  if (availability.state !== 'enabled') {
+    throw new Error(availability.reason)
+  }
+}
+
+export function assertRuntimeManagedBrowserCreationAvailable(
+  state: AppState,
+  runtimeEnvironmentId: string
+): void {
+  const capabilities =
+    state.runtimeStatusByEnvironmentId?.get(runtimeEnvironmentId)?.status?.capabilities
+  if (!capabilities?.includes(BROWSER_SCREENCAST_RUNTIME_CAPABILITY)) {
+    throw new Error(RUNTIME_BROWSER_UNAVAILABLE_MESSAGE)
+  }
+}
+
+export function assertManagedBrowserMaterializationAllowed(
+  state: AppState,
+  browserRuntimeEnvironmentId: string | null | undefined
+): void {
+  if (!isPairedWebClientWindow()) {
+    return
+  }
+  const runtimeEnvironmentId = browserRuntimeEnvironmentId?.trim()
+  if (!runtimeEnvironmentId) {
+    throw new Error(LOCAL_BROWSER_UNAVAILABLE_MESSAGE)
+  }
+  assertRuntimeManagedBrowserCreationAvailable(state, runtimeEnvironmentId)
+}
diff --git a/src/renderer/src/lib/client-login-shell.ts b/src/renderer/src/lib/client-login-shell.ts
new file mode 100644
index 00000000000..b0e0cca1fb8
--- /dev/null
+++ b/src/renderer/src/lib/client-login-shell.ts
@@ -0,0 +1,15 @@
+/**
+ * Login shell (`$SHELL`) of the machine running this client, or '' when
+ * unknown (web build, preload unavailable).
+ *
+ * Why: commands Orca hands the user to paste — or types into a locally
+ * spawned pane — are parsed by that shell, and fish does not share the sh
+ * grammar for every construct.
+ */
+export function getClientLoginShell(): string {
+  try {
+    return window.api?.platform?.get?.().shell ?? ''
+  } catch {
+    return ''
+  }
+}
diff --git a/src/renderer/src/lib/cmd-j-github-url-lookup.test.ts b/src/renderer/src/lib/cmd-j-github-url-lookup.test.ts
new file mode 100644
index 00000000000..82b533c859d
--- /dev/null
+++ b/src/renderer/src/lib/cmd-j-github-url-lookup.test.ts
@@ -0,0 +1,73 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GitHubWorkItem } from '../../../shared/types'
+
+const { lookupGitHubWorkItemByOwnerRepoForSource } = vi.hoisted(() => ({
+  lookupGitHubWorkItemByOwnerRepoForSource: vi.fn()
+}))
+
+vi.mock('./github-work-item-source-lookup', () => ({
+  lookupGitHubWorkItemByOwnerRepoForSource
+}))
+
+import { lookupCmdJGitHubUrlWorkItem } from './cmd-j-github-url-lookup'
+
+const item = {
+  id: 'issue-14198',
+  type: 'issue',
+  number: 14198,
+  title: 'Agent terminals disappearing randomly',
+  state: 'open',
+  url: 'https://github.com/stablyai/orca/issues/14198',
+  labels: [],
+  updatedAt: '2026-08-12T12:00:00.000Z',
+  author: 'nwparker',
+  repoId: 'repo-1'
+} satisfies GitHubWorkItem
+
+describe('lookupCmdJGitHubUrlWorkItem', () => {
+  beforeEach(() => {
+    lookupGitHubWorkItemByOwnerRepoForSource.mockReset()
+  })
+
+  it('looks up by owner/repo and returns null without a repo or on failure', async () => {
+    const link = {
+      slug: { owner: 'stablyai', repo: 'orca', host: 'github.com' },
+      type: 'issue' as const,
+      number: 14198
+    }
+    expect(
+      await lookupCmdJGitHubUrlWorkItem({
+        link,
+        repo: null,
+        sourceContext: null
+      })
+    ).toBeNull()
+
+    lookupGitHubWorkItemByOwnerRepoForSource.mockResolvedValue(item)
+    expect(
+      await lookupCmdJGitHubUrlWorkItem({
+        link,
+        repo: { id: 'repo-1', path: '/repos/repo-1' },
+        sourceContext: null
+      })
+    ).toEqual(item)
+    expect(lookupGitHubWorkItemByOwnerRepoForSource).toHaveBeenCalledWith(
+      expect.objectContaining({
+        owner: 'stablyai',
+        repo: 'orca',
+        host: 'github.com',
+        number: 14198,
+        type: 'issue'
+      })
+    )
+
+    lookupGitHubWorkItemByOwnerRepoForSource.mockRejectedValue(new Error('offline'))
+    expect(
+      await lookupCmdJGitHubUrlWorkItem({
+        link,
+        repo: { id: 'repo-1', path: '/repos/repo-1' },
+        sourceContext: null
+      })
+    ).toBeNull()
+  })
+})
diff --git a/src/renderer/src/lib/cmd-j-github-url-lookup.ts b/src/renderer/src/lib/cmd-j-github-url-lookup.ts
new file mode 100644
index 00000000000..bbc7b0e3f10
--- /dev/null
+++ b/src/renderer/src/lib/cmd-j-github-url-lookup.ts
@@ -0,0 +1,28 @@
+import type { GitHubIssueOrPRLink } from '../../../shared/github-links'
+import type { GitHubWorkItem, Repo } from '../../../shared/types'
+import type { TaskSourceContext } from '../../../shared/task-source-context'
+import { lookupGitHubWorkItemByOwnerRepoForSource } from './github-work-item-source-lookup'
+
+export async function lookupCmdJGitHubUrlWorkItem(args: {
+  link: GitHubIssueOrPRLink
+  repo: Pick<Repo, 'id' | 'path'> | null
+  sourceContext: TaskSourceContext | null
+}): Promise<GitHubWorkItem | null> {
+  if (!args.repo) {
+    return null
+  }
+  try {
+    return await lookupGitHubWorkItemByOwnerRepoForSource({
+      repoPath: args.repo.path,
+      repoId: args.repo.id,
+      sourceContext: args.sourceContext,
+      owner: args.link.slug.owner,
+      repo: args.link.slug.repo,
+      ...(args.link.slug.host ? { host: args.link.slug.host } : {}),
+      number: args.link.number,
+      type: args.link.type
+    })
+  } catch {
+    return null
+  }
+}
diff --git a/src/renderer/src/lib/cmd-j-linear-issue-intent.test.ts b/src/renderer/src/lib/cmd-j-linear-issue-intent.test.ts
new file mode 100644
index 00000000000..124294f5e4f
--- /dev/null
+++ b/src/renderer/src/lib/cmd-j-linear-issue-intent.test.ts
@@ -0,0 +1,112 @@
+import { describe, expect, it } from 'vitest'
+import {
+  findLinearIssueWorkspaceId,
+  findLinearIssueWorkspaceLookupIds,
+  isLinearIssueUrlResolutionMatch,
+  parseLinearIssueUrlIntent
+} from '../../../shared/linear-links'
+
+describe('Cmd+J Linear issue intent', () => {
+  it('accepts canonical Linear issue URLs with optional slugs', () => {
+    expect(
+      parseLinearIssueUrlIntent(
+        'https://linear.app/stably/issue/STA-4052/agent-terminals-disappearing-randomly'
+      )
+    ).toEqual({ identifier: 'STA-4052', organizationUrlKey: 'stably' })
+    expect(
+      parseLinearIssueUrlIntent(
+        ' https://linear.app/stably/issue/sta-4084/restore-shell-integration '
+      )
+    ).toEqual({ identifier: 'STA-4084', organizationUrlKey: 'stably' })
+    expect(parseLinearIssueUrlIntent('http://linear.app/acme/issue/ENG-1')).toEqual({
+      identifier: 'ENG-1',
+      organizationUrlKey: 'acme'
+    })
+  })
+
+  it('does not classify names, bare issue keys, or ambiguous URLs as decisive intent', () => {
+    expect(parseLinearIssueUrlIntent('restore-shell-integration')).toBeNull()
+    expect(parseLinearIssueUrlIntent('STA-4084')).toBeNull()
+    expect(parseLinearIssueUrlIntent('https://linear.app/stably/team/STA/all')).toBeNull()
+    expect(
+      parseLinearIssueUrlIntent('https://linear.app.evil.test/stably/issue/STA-4084')
+    ).toBeNull()
+    expect(parseLinearIssueUrlIntent('https://linear.app/foo/bar/issue/STA-4084')).toBeNull()
+    expect(
+      parseLinearIssueUrlIntent('https://linear.app/stably/issue/STA-4084/title/activity')
+    ).toBeNull()
+    expect(
+      parseLinearIssueUrlIntent('https://linear.app/stably/issue/STA-4084%2Fnot-the-identifier')
+    ).toBeNull()
+    expect(
+      parseLinearIssueUrlIntent('https://user@linear.app/stably/issue/STA-4084/title')
+    ).toBeNull()
+  })
+
+  it('targets the workspace named by the URL before falling back to all workspaces', () => {
+    const intent = { identifier: 'STA-4084', organizationUrlKey: 'stably' }
+    const workspaces = [
+      { id: 'workspace-other', organizationUrlKey: 'other' },
+      { id: 'workspace-stably', organizationUrlKey: 'Stably' }
+    ]
+
+    expect(findLinearIssueWorkspaceId(intent, workspaces)).toBe('workspace-stably')
+    expect(findLinearIssueWorkspaceId(intent, workspaces.slice(0, 1))).toBeNull()
+    expect(findLinearIssueWorkspaceId(intent, undefined)).toBeNull()
+  })
+
+  it('includes legacy workspaces that omitted their organization URL key', () => {
+    const intent = { identifier: 'STA-4052', organizationUrlKey: 'stably' }
+
+    expect(
+      findLinearIssueWorkspaceLookupIds(intent, {
+        viewer: {
+          displayName: 'Linear User',
+          email: null,
+          organizationName: 'Saved Linear workspace'
+        },
+        activeWorkspaceId: 'legacy',
+        selectedWorkspaceId: 'legacy',
+        workspaces: [{ id: 'legacy' } as never]
+      })
+    ).toEqual(['legacy'])
+    expect(
+      findLinearIssueWorkspaceLookupIds(intent, {
+        viewer: null,
+        workspaces: [{ id: 'other-workspace', organizationUrlKey: 'other' } as never]
+      })
+    ).toEqual([])
+  })
+
+  it('rejects a lookup from a different identifier or known Linear organization', () => {
+    const intent = { identifier: 'STA-4084', organizationUrlKey: 'stably' }
+
+    expect(
+      isLinearIssueUrlResolutionMatch(intent, {
+        identifier: 'STA-4084',
+        url: 'https://linear.app/stably/issue/STA-4084/title'
+      })
+    ).toBe(true)
+    expect(
+      isLinearIssueUrlResolutionMatch(intent, {
+        identifier: 'STA-9999',
+        url: 'https://linear.app/stably/issue/STA-9999/title'
+      })
+    ).toBe(false)
+    expect(
+      isLinearIssueUrlResolutionMatch(intent, {
+        identifier: 'STA-4084',
+        url: 'https://linear.app/other/issue/STA-4084/title'
+      })
+    ).toBe(false)
+  })
+
+  it('rejects a matching identifier when the result URL has no usable organization key', () => {
+    expect(
+      isLinearIssueUrlResolutionMatch(
+        { identifier: 'STA-4084', organizationUrlKey: 'stably' },
+        { identifier: 'STA-4084', url: 'https://linear.example.test/STA-4084' }
+      )
+    ).toBe(false)
+  })
+})
diff --git a/src/renderer/src/lib/crash-diagnostics.ts b/src/renderer/src/lib/crash-diagnostics.ts
index 95c9bfe213c..78d1daa76c6 100644
--- a/src/renderer/src/lib/crash-diagnostics.ts
+++ b/src/renderer/src/lib/crash-diagnostics.ts
@@ -74,7 +74,7 @@ function disposeRendererCrashDiagnostics(): void {
   rendererSurface = 'main'
 }
 
-if (typeof import.meta !== 'undefined' && import.meta.hot) {
+if (import.meta !== undefined && import.meta.hot) {
   // Why: Vite can replace this module without a full renderer reload. Remove
   // global diagnostics hooks so dev sessions do not accumulate listeners.
   import.meta.hot.dispose(disposeRendererCrashDiagnostics)
diff --git a/src/renderer/src/lib/explicit-file-link-target.ts b/src/renderer/src/lib/explicit-file-link-target.ts
index 912119a9f70..c6188ca7518 100644
--- a/src/renderer/src/lib/explicit-file-link-target.ts
+++ b/src/renderer/src/lib/explicit-file-link-target.ts
@@ -1,14 +1,14 @@
+import {
+  parseFileLinkLocation,
+  type ParsedFileLinkLocation
+} from '../../../shared/file-link-location'
 import {
   joinAbsolutePath,
   normalizeAbsolutePath,
   resolveTildePath
 } from './terminal-path-normalization'
 
-export type ParsedExplicitFileLinkTarget = {
-  pathText: string
-  line: number | null
-  column: number | null
-}
+export type ParsedExplicitFileLinkTarget = ParsedFileLinkLocation
 
 export type ResolvedExplicitFileLinkTarget = Pick<
   ParsedExplicitFileLinkTarget,
@@ -34,15 +34,12 @@ export function parseExplicitFileLinkTarget(
   value: string,
   options: ParseExplicitFileLinkTargetOptions = {}
 ): ParsedExplicitFileLinkTarget | null {
-  const match = /^(.*?)(?::(\d+))?(?::(\d+))?$/.exec(value)
-  if (!match) {
-    return null
-  }
-  const pathText = match[1]
-  const hasLineOrColumn = Boolean(match[2] || match[3])
-  if (!pathText) {
+  const parsed = parseFileLinkLocation(value)
+  if (!parsed) {
     return null
   }
+  const { pathText, line, column } = parsed
+  const hasLineOrColumn = line !== null || column !== null
   if (/^[\\/]\s/.test(pathText)) {
     return null
   }
@@ -53,12 +50,6 @@ export function parseExplicitFileLinkTarget(
     }
   }
 
-  const line = match[2] ? Number.parseInt(match[2], 10) : null
-  const column = match[3] ? Number.parseInt(match[3], 10) : null
-  if ((line !== null && line < 1) || (column !== null && column < 1)) {
-    return null
-  }
-
   return { pathText, line, column }
 }
 
diff --git a/src/renderer/src/lib/feature-education-telemetry.ts b/src/renderer/src/lib/feature-education-telemetry.ts
index 29c07200267..d66fd213722 100644
--- a/src/renderer/src/lib/feature-education-telemetry.ts
+++ b/src/renderer/src/lib/feature-education-telemetry.ts
@@ -133,7 +133,7 @@ export function trackTerminalPaneSplit(args: {
 }
 
 export function readEmittedSetupGuideStepIds(): Set<FeatureWallSetupStepId> {
-  if (typeof globalThis.localStorage === 'undefined') {
+  if (globalThis.localStorage === undefined) {
     return new Set()
   }
   try {
@@ -150,7 +150,7 @@ export function readEmittedSetupGuideStepIds(): Set<FeatureWallSetupStepId> {
 }
 
 export function persistEmittedSetupGuideStepId(id: FeatureWallSetupStepId): void {
-  if (typeof globalThis.localStorage === 'undefined') {
+  if (globalThis.localStorage === undefined) {
     return
   }
   try {
@@ -170,7 +170,7 @@ export function reserveTerminalPaneSplitTelemetry(
   source: TerminalPaneSplitSource,
   direction: 'vertical' | 'horizontal'
 ): boolean {
-  if (typeof globalThis.localStorage === 'undefined') {
+  if (globalThis.localStorage === undefined) {
     return true
   }
   try {
diff --git a/src/renderer/src/lib/file-preview-capability-cleanup.test.ts b/src/renderer/src/lib/file-preview-capability-cleanup.test.ts
new file mode 100644
index 00000000000..1136dd16985
--- /dev/null
+++ b/src/renderer/src/lib/file-preview-capability-cleanup.test.ts
@@ -0,0 +1,91 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { openFilePreviewToSide } from './file-preview'
+
+const mocks = vi.hoisted(() => ({
+  availability: {
+    state: 'enabled' as const,
+    provider: 'paired-runtime' as const
+  } as { state: 'enabled'; provider: 'paired-runtime' } | { state: 'hidden'; reason: string },
+  closeEmptyGroup: vi.fn(),
+  createBrowserTab: vi.fn(),
+  createEmptySplitGroup: vi.fn(() => 'preview-group'),
+  createWebRuntimeSessionBrowserTab: vi.fn(),
+  toastError: vi.fn()
+}))
+
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError } }))
+
+vi.mock('@/lib/client-creation-action-policy', () => ({
+  getClientCreationActionPolicy: () => ({ 'managed-browser': mocks.availability })
+}))
+
+vi.mock('@/lib/connection-context', () => ({
+  getConnectionId: () => null,
+  getConnectionIdForFile: () => null
+}))
+
+vi.mock('@/lib/connection-owner-resolution', () => ({
+  getConnectionIdForFileFromState: () => null
+}))
+
+vi.mock('@/lib/worktree-runtime-owner', () => ({
+  getRuntimeEnvironmentIdForWorktree: () => 'runtime-1'
+}))
+
+vi.mock('@/runtime/web-runtime-session', () => ({
+  createWebRuntimeSessionBrowserTab: mocks.createWebRuntimeSessionBrowserTab
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: {
+    getState: () => ({
+      closeEmptyGroup: mocks.closeEmptyGroup,
+      createBrowserTab: mocks.createBrowserTab,
+      createEmptySplitGroup: mocks.createEmptySplitGroup,
+      groupsByWorktree: {},
+      layoutByWorktree: {},
+      repos: [{ id: 'repo-1', connectionId: null }],
+      worktreesByRepo: { 'repo-1': [{ id: 'wt-1', repoId: 'repo-1' }] }
+    })
+  }
+}))
+
+describe('paired HTML side-preview capability cleanup', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.availability = { state: 'enabled', provider: 'paired-runtime' }
+    mocks.createWebRuntimeSessionBrowserTab.mockRejectedValue(new Error('capability changed'))
+  })
+
+  it('reports capability loss after preflight and removes the new split', async () => {
+    openFilePreviewToSide({
+      language: 'html',
+      filePath: '/srv/repo/example.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'source-group'
+    })
+
+    await vi.waitFor(() =>
+      expect(mocks.toastError).toHaveBeenCalledWith('Unable to open this file in Orca Browser.')
+    )
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('reports known unavailability without creating a split', () => {
+    mocks.availability = { state: 'hidden', reason: 'streaming unavailable' }
+
+    openFilePreviewToSide({
+      language: 'html',
+      filePath: '/srv/repo/example.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'source-group'
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith('streaming unavailable')
+    expect(mocks.createEmptySplitGroup).not.toHaveBeenCalled()
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+    expect(mocks.createWebRuntimeSessionBrowserTab).not.toHaveBeenCalled()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/lib/file-preview.test.ts b/src/renderer/src/lib/file-preview.test.ts
index bea6e40a3be..8196e5b4e05 100644
--- a/src/renderer/src/lib/file-preview.test.ts
+++ b/src/renderer/src/lib/file-preview.test.ts
@@ -1,19 +1,59 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   REMOTE_FILE_BROWSER_UNSUPPORTED_MESSAGE,
+  canShowWorkspaceFileBrowserAction,
   getWorkspaceFileBrowserOpenTarget,
-  openFileInBrowserTab
+  openFileInBrowserTab,
+  openFilePreviewToSide
 } from './file-preview'
+import { folderWorkspaceKey } from '../../../shared/workspace-scope'
+
+function browserActionState(connectionId: string | null = null): never {
+  return {
+    repos: [{ id: 'repo-1', connectionId }],
+    worktreesByRepo: { 'repo-1': [{ id: 'wt-1', repoId: 'repo-1' }] }
+  } as never
+}
 
 const mocks = vi.hoisted(() => ({
+  browserAvailability: {
+    state: 'enabled' as const,
+    provider: 'local-client' as 'local-client' | 'paired-runtime'
+  } as
+    | { state: 'enabled'; provider: 'local-client' | 'paired-runtime' }
+    | { state: 'hidden'; reason: string },
+  closeEmptyGroup: vi.fn(),
   createBrowserTab: vi.fn(),
-  connectionId: null as string | null
+  createEmptySplitGroup: vi.fn(() => 'group-2'),
+  createWebRuntimeSessionBrowserTab: vi.fn(),
+  environmentId: null as string | null,
+  connectionId: null as string | null,
+  layoutByWorktree: {} as Record<string, unknown>,
+  toastError: vi.fn()
+}))
+
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError } }))
+
+vi.mock('@/lib/client-creation-action-policy', () => ({
+  getClientCreationActionPolicy: () => ({ 'managed-browser': mocks.browserAvailability })
+}))
+
+vi.mock('@/lib/worktree-runtime-owner', () => ({
+  getRuntimeEnvironmentIdForWorktree: () => mocks.environmentId
+}))
+
+vi.mock('@/runtime/web-runtime-session', () => ({
+  createWebRuntimeSessionBrowserTab: mocks.createWebRuntimeSessionBrowserTab
 }))
 
 vi.mock('@/store', () => ({
   useAppStore: {
     getState: () => ({
+      closeEmptyGroup: mocks.closeEmptyGroup,
       createBrowserTab: mocks.createBrowserTab,
+      createEmptySplitGroup: mocks.createEmptySplitGroup,
+      groupsByWorktree: {},
+      layoutByWorktree: mocks.layoutByWorktree,
       repos: [{ id: 'repo-1', connectionId: mocks.connectionId }],
       worktreesByRepo: {
         'repo-1': [{ id: 'wt-1', repoId: 'repo-1' }]
@@ -24,7 +64,11 @@ vi.mock('@/store', () => ({
 
 beforeEach(() => {
   vi.clearAllMocks()
+  mocks.createWebRuntimeSessionBrowserTab.mockResolvedValue(true)
+  mocks.browserAvailability = { state: 'enabled', provider: 'local-client' }
+  mocks.environmentId = null
   mocks.connectionId = null
+  mocks.layoutByWorktree = {}
 })
 
 describe('openFileInBrowserTab', () => {
@@ -40,6 +84,171 @@ describe('openFileInBrowserTab', () => {
     })
   })
 
+  it('creates paired-runtime file browsers at the owning host', () => {
+    mocks.environmentId = 'runtime-1'
+    mocks.browserAvailability = { state: 'enabled', provider: 'paired-runtime' }
+
+    openFileInBrowserTab({ filePath: '/srv/repo/example.html', worktreeId: 'wt-1' })
+
+    expect(mocks.createWebRuntimeSessionBrowserTab).toHaveBeenCalledWith({
+      worktreeId: 'wt-1',
+      environmentId: 'runtime-1',
+      url: 'file:///srv/repo/example.html',
+      stagedTitle: 'example.html',
+      stagedFocusAddressBar: false
+    })
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('creates paired-runtime side previews in the requested split', () => {
+    mocks.environmentId = 'runtime-1'
+    mocks.browserAvailability = { state: 'enabled', provider: 'paired-runtime' }
+
+    openFilePreviewToSide({
+      language: 'html',
+      filePath: '/srv/repo/example.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'group-1'
+    })
+
+    expect(mocks.createWebRuntimeSessionBrowserTab).toHaveBeenCalledWith({
+      worktreeId: 'wt-1',
+      environmentId: 'runtime-1',
+      url: 'file:///srv/repo/example.html',
+      clientTargetGroupId: 'group-2',
+      clientTargetGroupCreated: true,
+      focusOnCreate: false,
+      stagedTitle: 'example.html',
+      stagedFocusAddressBar: false
+    })
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('reports a paired-runtime recovery failure without an unhandled rejection', async () => {
+    mocks.environmentId = 'runtime-1'
+    mocks.browserAvailability = { state: 'enabled', provider: 'paired-runtime' }
+    mocks.createWebRuntimeSessionBrowserTab.mockRejectedValue(new Error('cleanup unknown'))
+
+    openFilePreviewToSide({
+      language: 'html',
+      filePath: '/srv/repo/example.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'group-1'
+    })
+
+    await vi.waitFor(() =>
+      expect(mocks.toastError).toHaveBeenCalledWith('Unable to open this file in Orca Browser.')
+    )
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('does not delete a split owned by an overlapping paired preview', async () => {
+    mocks.environmentId = 'runtime-1'
+    mocks.browserAvailability = { state: 'enabled', provider: 'paired-runtime' }
+    mocks.createEmptySplitGroup.mockImplementationOnce(() => {
+      mocks.layoutByWorktree = {
+        'wt-1': {
+          type: 'split',
+          direction: 'horizontal',
+          first: { type: 'leaf', groupId: 'group-1' },
+          second: { type: 'leaf', groupId: 'group-2' }
+        }
+      }
+      return 'group-2'
+    })
+    let rejectFirst!: (error: Error) => void
+    let resolveSecond!: (created: boolean) => void
+    mocks.createWebRuntimeSessionBrowserTab
+      .mockReturnValueOnce(
+        new Promise<boolean>((_resolve, reject) => {
+          rejectFirst = reject
+        })
+      )
+      .mockReturnValueOnce(
+        new Promise<boolean>((resolve) => {
+          resolveSecond = resolve
+        })
+      )
+
+    const preview = {
+      language: 'html',
+      filePath: '/srv/repo/example.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'group-1'
+    }
+    openFilePreviewToSide(preview)
+    openFilePreviewToSide(preview)
+    expect(mocks.createWebRuntimeSessionBrowserTab).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        clientTargetGroupId: 'group-2',
+        clientTargetGroupCreated: true
+      })
+    )
+    rejectFirst(new Error('first preview failed'))
+
+    await vi.waitFor(() => expect(mocks.toastError).toHaveBeenCalledOnce())
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+    expect(mocks.createWebRuntimeSessionBrowserTab).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        clientTargetGroupId: 'group-2',
+        clientTargetGroupCreated: false
+      })
+    )
+
+    resolveSecond(true)
+    await vi.waitFor(() => expect(mocks.toastError).toHaveBeenCalledOnce())
+  })
+
+  it('does not send a runtime-owned file path to the Electron browser provider', () => {
+    mocks.environmentId = 'runtime-1'
+
+    openFilePreviewToSide({
+      language: 'html',
+      filePath: '/srv/repo/example.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'group-1'
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith('Unable to open this file in Orca Browser.')
+    expect(mocks.createEmptySplitGroup).not.toHaveBeenCalled()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+    expect(mocks.createWebRuntimeSessionBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('rejects unavailable paired-web previews before creating a split', () => {
+    mocks.environmentId = 'runtime-1'
+    mocks.browserAvailability = { state: 'hidden', reason: 'streaming unavailable' }
+
+    openFilePreviewToSide({
+      language: 'html',
+      filePath: '/srv/repo/example.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'group-1'
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith('streaming unavailable')
+    expect(mocks.createEmptySplitGroup).not.toHaveBeenCalled()
+    expect(mocks.createWebRuntimeSessionBrowserTab).not.toHaveBeenCalled()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('does not create a side split for unsupported SSH previews', () => {
+    mocks.connectionId = 'ssh-1'
+
+    openFilePreviewToSide({
+      language: 'html',
+      filePath: '/home/alice/report.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'group-1'
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith(REMOTE_FILE_BROWSER_UNSUPPORTED_MESSAGE)
+    expect(mocks.createEmptySplitGroup).not.toHaveBeenCalled()
+  })
+
   it('returns unsupported for SSH worktrees without creating a local file URL tab', () => {
     mocks.connectionId = 'ssh-1'
 
@@ -57,6 +266,71 @@ describe('openFileInBrowserTab', () => {
   })
 })
 
+describe('canShowWorkspaceFileBrowserAction', () => {
+  it('hides incapable paired providers and permits capable runtime providers', () => {
+    mocks.environmentId = 'runtime-1'
+    mocks.browserAvailability = { state: 'hidden', reason: 'streaming unavailable' }
+    expect(
+      canShowWorkspaceFileBrowserAction(browserActionState(), 'wt-1', '/repo/report.html')
+    ).toBe(false)
+
+    mocks.browserAvailability = { state: 'enabled', provider: 'paired-runtime' }
+    expect(
+      canShowWorkspaceFileBrowserAction(browserActionState(), 'wt-1', '/repo/report.html')
+    ).toBe(true)
+    expect(
+      canShowWorkspaceFileBrowserAction(browserActionState('ssh-1'), 'wt-1', '/repo/report.html')
+    ).toBe(false)
+  })
+
+  it('permits local files but hides SSH paths from the local browser provider', () => {
+    expect(
+      canShowWorkspaceFileBrowserAction(browserActionState(), 'wt-1', '/repo/report.html')
+    ).toBe(true)
+    expect(
+      canShowWorkspaceFileBrowserAction(browserActionState('ssh-1'), 'wt-1', '/repo/report.html')
+    ).toBe(false)
+  })
+
+  it('resolves local and SSH files independently in a mixed folder workspace', () => {
+    const workspaceId = folderWorkspaceKey('folder-1')
+    const state = {
+      folderWorkspaces: [
+        {
+          id: 'folder-1',
+          projectGroupId: 'group-1',
+          folderPath: '/workspace'
+        }
+      ],
+      projectGroups: [{ id: 'group-1', parentGroupId: null }],
+      repos: [
+        {
+          id: 'repo-local',
+          path: '/workspace/local',
+          projectGroupId: 'group-1'
+        },
+        {
+          id: 'repo-ssh',
+          path: '/workspace/remote',
+          projectGroupId: 'group-1',
+          connectionId: 'ssh-1'
+        }
+      ],
+      worktreesByRepo: {}
+    } as never
+
+    expect(
+      canShowWorkspaceFileBrowserAction(state, workspaceId, '/workspace/local/report.html')
+    ).toBe(true)
+    expect(
+      canShowWorkspaceFileBrowserAction(state, workspaceId, '/workspace/remote/report.html')
+    ).toBe(false)
+    expect(
+      canShowWorkspaceFileBrowserAction(state, workspaceId, '/workspace/unknown/report.html')
+    ).toBe(false)
+  })
+})
+
 describe('getWorkspaceFileBrowserOpenTarget', () => {
   it('returns a reusable browser navigation target for local files', () => {
     expect(
diff --git a/src/renderer/src/lib/file-preview.ts b/src/renderer/src/lib/file-preview.ts
index fc23d680ad1..7f50873e3a8 100644
--- a/src/renderer/src/lib/file-preview.ts
+++ b/src/renderer/src/lib/file-preview.ts
@@ -1,12 +1,79 @@
 import { toast } from 'sonner'
 import { absolutePathToFileUri } from '@/components/editor/markdown-internal-links'
-import { getConnectionId } from '@/lib/connection-context'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
+import { useCallback } from 'react'
+import { useShallow } from 'zustand/react/shallow'
+import { getConnectionIdForFile } from '@/lib/connection-context'
+import { getConnectionIdForFileFromState } from '@/lib/connection-owner-resolution'
+import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { createWebRuntimeSessionBrowserTab } from '@/runtime/web-runtime-session'
 import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
 import { findSiblingGroupId } from '@/store/slices/tabs'
 
 export type PreviewableLanguage = 'html'
 export const REMOTE_FILE_BROWSER_UNSUPPORTED_MESSAGE =
   'Open in Orca Browser is only available for local files.'
+const FILE_BROWSER_OPEN_FAILED_MESSAGE = 'Unable to open this file in Orca Browser.'
+
+type WorkspaceFileBrowserActionMode = 'local-client' | 'paired-runtime' | null
+
+function getWorkspaceFileBrowserActionMode(
+  state: AppState,
+  worktreeId: string
+): WorkspaceFileBrowserActionMode {
+  const availability = getClientCreationActionPolicy(state, worktreeId)['managed-browser']
+  if (availability.state !== 'enabled') {
+    return null
+  }
+  const environmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  return environmentId
+    ? availability.provider === 'paired-runtime'
+      ? 'paired-runtime'
+      : null
+    : 'local-client'
+}
+
+export function canShowWorkspaceFileBrowserAction(
+  state: AppState,
+  worktreeId: string,
+  filePath: string
+): boolean {
+  const mode = getWorkspaceFileBrowserActionMode(state, worktreeId)
+  return mode !== null && getConnectionIdForFileFromState(state, worktreeId, filePath) === null
+}
+
+export function useWorkspaceFileBrowserActionPredicate(
+  worktreeId: string | null
+): (filePath: string) => boolean {
+  const inputs = useAppStore(
+    useShallow((state) => ({
+      mode: worktreeId ? getWorkspaceFileBrowserActionMode(state, worktreeId) : null,
+      folderWorkspaces: state.folderWorkspaces,
+      projectGroups: state.projectGroups,
+      repos: state.repos,
+      worktreesByRepo: state.worktreesByRepo
+    }))
+  )
+  return useCallback(
+    (filePath: string) =>
+      inputs.mode !== null &&
+      getConnectionIdForFileFromState(inputs, worktreeId, filePath) === null,
+    [inputs, worktreeId]
+  )
+}
+
+function reportRemoteFileBrowserOpen(result: Promise<boolean>): void {
+  void result
+    .then((created) => {
+      if (!created) {
+        toast.error(FILE_BROWSER_OPEN_FAILED_MESSAGE)
+      }
+    })
+    .catch(() => {
+      toast.error(FILE_BROWSER_OPEN_FAILED_MESSAGE)
+    })
+}
 
 export type WorkspaceFileBrowserOpenTarget =
   | {
@@ -24,7 +91,7 @@ export function getWorkspaceFileBrowserOpenTarget(params: {
   filePath: string
   worktreeId: string
 }): WorkspaceFileBrowserOpenTarget {
-  if (getConnectionId(params.worktreeId)) {
+  if (getConnectionIdForFile(params.worktreeId, params.filePath) !== null) {
     // Why: Chromium resolves file:// URLs on the local machine. Remote files
     // need an Orca-served URL before the browser can render them correctly.
     return {
@@ -51,6 +118,30 @@ export function openFileInBrowserTab(params: {
   }
 
   const state = useAppStore.getState()
+  const browserAvailability = getClientCreationActionPolicy(state, params.worktreeId)[
+    'managed-browser'
+  ]
+  if (browserAvailability.state !== 'enabled') {
+    toast.error(browserAvailability.reason)
+    return target
+  }
+  const environmentId = getRuntimeEnvironmentIdForWorktree(state, params.worktreeId)
+  if (environmentId) {
+    if (browserAvailability.provider !== 'paired-runtime') {
+      toast.error(FILE_BROWSER_OPEN_FAILED_MESSAGE)
+      return target
+    }
+    reportRemoteFileBrowserOpen(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: params.worktreeId,
+        environmentId,
+        url: target.url,
+        stagedTitle: target.title,
+        stagedFocusAddressBar: false
+      })
+    )
+    return target
+  }
 
   state.createBrowserTab(params.worktreeId, target.url, {
     title: target.title,
@@ -79,6 +170,24 @@ export function openFilePreviewToSide(params: {
 
   const state = useAppStore.getState()
   const worktreeId = params.worktreeId
+  const target = getWorkspaceFileBrowserOpenTarget({
+    filePath: params.filePath,
+    worktreeId
+  })
+  if (target.status === 'unsupported') {
+    toast.error(target.message)
+    return
+  }
+  const browserAvailability = getClientCreationActionPolicy(state, worktreeId)['managed-browser']
+  if (browserAvailability.state !== 'enabled') {
+    toast.error(browserAvailability.reason)
+    return
+  }
+  const environmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  if (environmentId && browserAvailability.provider !== 'paired-runtime') {
+    toast.error(FILE_BROWSER_OPEN_FAILED_MESSAGE)
+    return
+  }
 
   // Resolve the group this action originated from. Prefer the caller-supplied
   // id (the tab's own group under split-pane layouts), fall back to the
@@ -105,12 +214,19 @@ export function openFilePreviewToSide(params: {
     return
   }
 
-  const target = getWorkspaceFileBrowserOpenTarget({
-    filePath: params.filePath,
-    worktreeId
-  })
-  if (target.status === 'unsupported') {
-    toast.error(target.message)
+  if (environmentId) {
+    reportRemoteFileBrowserOpen(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId,
+        environmentId,
+        url: target.url,
+        clientTargetGroupId: targetGroupId,
+        clientTargetGroupCreated: !existingSibling,
+        focusOnCreate: false,
+        stagedTitle: target.title,
+        stagedFocusAddressBar: false
+      })
+    )
     return
   }
 
diff --git a/src/renderer/src/lib/floating-workspace-tab-creation.ts b/src/renderer/src/lib/floating-workspace-tab-creation.ts
index d9b6e51b69b..58a22ad9320 100644
--- a/src/renderer/src/lib/floating-workspace-tab-creation.ts
+++ b/src/renderer/src/lib/floating-workspace-tab-creation.ts
@@ -6,6 +6,7 @@ import { detectLanguage } from './language-detect'
 import type { AppState } from '@/store/types'
 import { focusTerminalTabSurface } from './focus-terminal-tab-surface'
 import { translate } from '@/i18n/i18n'
+import { assertClientCreationActionAvailable } from './client-creation-action-policy'
 
 type FloatingWorkspaceTerminalStore = Pick<
   AppState,
@@ -38,6 +39,11 @@ export async function createFloatingWorkspaceTerminalTab(
 export async function createFloatingWorkspaceBrowserTab(
   store: FloatingWorkspaceBrowserStore
 ): Promise<BrowserTab | null> {
+  assertClientCreationActionAvailable(
+    store as AppState,
+    FLOATING_TERMINAL_WORKTREE_ID,
+    'managed-browser'
+  )
   const targetGroupId = store.activeGroupIdByWorktree[FLOATING_TERMINAL_WORKTREE_ID]
   const url = store.browserDefaultUrl ?? 'about:blank'
 
diff --git a/src/renderer/src/lib/folder-workspace-runtime-owner.ts b/src/renderer/src/lib/folder-workspace-runtime-owner.ts
index 4bf99a1b780..fce08c49302 100644
--- a/src/renderer/src/lib/folder-workspace-runtime-owner.ts
+++ b/src/renderer/src/lib/folder-workspace-runtime-owner.ts
@@ -16,7 +16,7 @@ type RuntimeExecutionHost = Extract<ParsedExecutionHost, { kind: 'runtime' }>
 export type FolderWorkspaceRuntimeOwnerState = SingleRuntimeLegacyOwnerState & {
   folderWorkspaces?: readonly Pick<
     FolderWorkspace,
-    'id' | 'projectGroupId' | 'connectionId' | 'executionHostId'
+    'id' | 'projectGroupId' | 'connectionId' | 'executionHostId' | 'diffComments'
   >[]
   projectGroups?: readonly Pick<ProjectGroup, 'id' | 'connectionId' | 'executionHostId'>[]
   restoredRuntimeHostIdByWorkspaceSessionKey?: Record<string, ExecutionHostId>
@@ -41,7 +41,10 @@ export function findFolderWorkspaceOwner(
   state: FolderWorkspaceRuntimeOwnerState,
   folderWorkspaceId: string,
   executionHostId?: ExecutionHostId
-): Pick<FolderWorkspace, 'id' | 'projectGroupId' | 'connectionId' | 'executionHostId'> | null {
+): Pick<
+  FolderWorkspace,
+  'id' | 'projectGroupId' | 'connectionId' | 'executionHostId' | 'diffComments'
+> | null {
   return findIndexedFolderWorkspaceOwner(
     state.folderWorkspaces,
     folderWorkspaceId,
diff --git a/src/renderer/src/lib/http-link-modifier-routing.test.ts b/src/renderer/src/lib/http-link-modifier-routing.test.ts
index c7da95ae4c2..fb3be988a4f 100644
--- a/src/renderer/src/lib/http-link-modifier-routing.test.ts
+++ b/src/renderer/src/lib/http-link-modifier-routing.test.ts
@@ -2,6 +2,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   openHttpLink,
   registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener,
   resolveModifierRouting
 } from './http-link-routing'
 
@@ -58,6 +59,7 @@ describe('modifier routing across link source owners', () => {
   const openUrlMock = vi.fn()
   const setActiveWorktreeMock = vi.fn()
   const createBrowserTabMock = vi.fn()
+  const openRuntimeBrowserTabMock = vi.fn(() => Promise.resolve())
   const storeState = {
     settings: {} as {
       openLinksInApp?: boolean
@@ -71,10 +73,12 @@ describe('modifier routing across link source owners', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     registerHttpLinkStoreAccessor(() => storeState)
+    registerRuntimeHttpLinkBrowserOpener(openRuntimeBrowserTabMock)
     vi.stubGlobal('window', { api: { shell: { openUrl: openUrlMock } } })
   })
 
   afterEach(() => {
+    registerRuntimeHttpLinkBrowserOpener(null)
     vi.unstubAllGlobals()
   })
 
@@ -92,23 +96,40 @@ describe('modifier routing across link source owners', () => {
     })
   })
 
-  it('never lets a modifier pull a runtime-owned link into Orca', () => {
-    for (const inverts of [true, false]) {
-      vi.clearAllMocks()
-      storeState.settings = {
-        openLinksInApp: false,
-        openLinksInAppModifierInverts: inverts,
-        activeRuntimeEnvironmentId: null
-      }
-
-      openHttpLink('https://example.com/', {
-        worktreeId: 'wt-1',
-        modifierHeld: true,
-        sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
-      })
-
-      expect(openUrlMock).toHaveBeenCalledWith('https://example.com/')
-      expect(createBrowserTabMock).not.toHaveBeenCalled()
+  it('lets an inverting modifier reach Orca on the owning runtime', () => {
+    storeState.settings = {
+      openLinksInApp: false,
+      openLinksInAppModifierInverts: true,
+      activeRuntimeEnvironmentId: null
     }
+
+    openHttpLink('https://example.com/', {
+      allowRuntimeInApp: true,
+      worktreeId: 'wt-1',
+      modifierHeld: true,
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedRuntimeEnvironmentId: 'env-1' })
+    )
+    expect(openUrlMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps the legacy modifier on the system browser when inversion is off', () => {
+    storeState.settings = {
+      openLinksInApp: false,
+      openLinksInAppModifierInverts: false,
+      activeRuntimeEnvironmentId: null
+    }
+
+    openHttpLink('https://example.com/', {
+      worktreeId: 'wt-1',
+      modifierHeld: true,
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    expect(openUrlMock).toHaveBeenCalledWith('https://example.com/')
+    expect(openRuntimeBrowserTabMock).not.toHaveBeenCalled()
   })
 })
diff --git a/src/renderer/src/lib/http-link-routing.test.ts b/src/renderer/src/lib/http-link-routing.test.ts
index 64991900a25..1be44f90732 100644
--- a/src/renderer/src/lib/http-link-routing.test.ts
+++ b/src/renderer/src/lib/http-link-routing.test.ts
@@ -4,13 +4,19 @@ import type { WorkspacePortScanResult } from '../../../shared/workspace-ports'
 import {
   openHttpLink,
   registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener,
   resolveLocalhostHttpLinkDisplayUrl
 } from './http-link-routing'
 
+const toastErrorMock = vi.hoisted(() => vi.fn())
+
+vi.mock('sonner', () => ({ toast: { error: toastErrorMock } }))
+
 const openUrlMock = vi.fn()
 const registerLocalhostLabelMock = vi.fn()
 const setActiveWorktreeMock = vi.fn()
 const createBrowserTabMock = vi.fn()
+const openRuntimeBrowserTabMock = vi.fn(() => Promise.resolve())
 
 const storeState = {
   settings: undefined as
@@ -42,6 +48,7 @@ beforeEach(() => {
   storeState.settings = undefined
   storeState.workspacePortScansByKey = {}
   registerHttpLinkStoreAccessor(() => storeState)
+  registerRuntimeHttpLinkBrowserOpener(openRuntimeBrowserTabMock)
   vi.stubGlobal('window', {
     api: {
       shell: {
@@ -55,6 +62,7 @@ beforeEach(() => {
 })
 
 afterEach(() => {
+  registerRuntimeHttpLinkBrowserOpener(null)
   vi.unstubAllGlobals()
 })
 
@@ -155,10 +163,11 @@ describe('openHttpLink', () => {
     expect(openUrlMock).not.toHaveBeenCalled()
   })
 
-  it('routes explicit runtime and SSH document owners to the exact system URL', () => {
+  it('routes runtime and SSH document owners to their distinct destinations', () => {
     storeState.settings = { openLinksInApp: true, localhostWorktreeLabelsEnabled: true }
 
     openHttpLink('http://localhost:5180/runtime', {
+      allowRuntimeInApp: true,
       worktreeId: 'wt-1',
       sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
     })
@@ -167,25 +176,75 @@ describe('openHttpLink', () => {
       sourceOwner: { kind: 'ssh', connectionId: 'ssh-1' }
     })
 
-    expect(openUrlMock).toHaveBeenNthCalledWith(1, 'http://localhost:5180/runtime')
-    expect(openUrlMock).toHaveBeenNthCalledWith(2, 'http://localhost:5180/ssh')
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: 'http://localhost:5180/runtime',
+      intent: { kind: 'url' },
+      expectedRuntimeEnvironmentId: 'env-1'
+    })
+    expect(openUrlMock).toHaveBeenCalledWith('http://localhost:5180/ssh')
     expect(createBrowserTabMock).not.toHaveBeenCalled()
     expect(registerLocalhostLabelMock).not.toHaveBeenCalled()
   })
 
   // Why: runtimes bind per workspace, so activeRuntimeEnvironmentId is commonly
   // null while a pane is remote — ownership must come from the click source.
-  it('keeps a runtime-owned link out of Orca when no runtime is globally active', () => {
+  it('uses the pane runtime owner when no runtime is globally active', () => {
     storeState.settings = { openLinksInApp: true, activeRuntimeEnvironmentId: null }
 
+    openHttpLink('https://example.com/', {
+      allowRuntimeInApp: true,
+      worktreeId: 'wt-1',
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedRuntimeEnvironmentId: 'env-1' })
+    )
+    expect(openUrlMock).not.toHaveBeenCalled()
+    expect(createBrowserTabMock).not.toHaveBeenCalled()
+    expect(setActiveWorktreeMock).not.toHaveBeenCalled()
+  })
+
+  it('fails closed instead of falling back to the client system browser', async () => {
+    storeState.settings = { openLinksInApp: true }
+    openRuntimeBrowserTabMock.mockRejectedValueOnce(new Error('runtime unavailable'))
+
+    openHttpLink('https://example.com/', {
+      allowRuntimeInApp: true,
+      worktreeId: 'wt-1',
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    await vi.waitFor(() => expect(openRuntimeBrowserTabMock).toHaveBeenCalledOnce())
+    expect(openUrlMock).not.toHaveBeenCalled()
+    expect(createBrowserTabMock).not.toHaveBeenCalled()
+    expect(toastErrorMock).toHaveBeenCalledWith('runtime unavailable')
+  })
+
+  it('keeps an explicit runtime system-browser action on the viewing client', () => {
+    storeState.settings = { openLinksInApp: true }
+
+    openHttpLink('https://example.com/', {
+      worktreeId: 'wt-1',
+      forceSystemBrowser: true,
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    expect(openUrlMock).toHaveBeenCalledWith('https://example.com/')
+    expect(openRuntimeBrowserTabMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps generic runtime-owned document links in the system browser', () => {
+    storeState.settings = { openLinksInApp: true }
+
     openHttpLink('https://example.com/', {
       worktreeId: 'wt-1',
       sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
     })
 
     expect(openUrlMock).toHaveBeenCalledWith('https://example.com/')
-    expect(createBrowserTabMock).not.toHaveBeenCalled()
-    expect(setActiveWorktreeMock).not.toHaveBeenCalled()
+    expect(openRuntimeBrowserTabMock).not.toHaveBeenCalled()
   })
 
   it('labels explicit local links from the local scan instead of a merged remote port', async () => {
diff --git a/src/renderer/src/lib/http-link-routing.ts b/src/renderer/src/lib/http-link-routing.ts
index 0f010f05348..3295183d504 100644
--- a/src/renderer/src/lib/http-link-routing.ts
+++ b/src/renderer/src/lib/http-link-routing.ts
@@ -1,3 +1,4 @@
+import { translate } from '@/i18n/i18n'
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 import {
   parseLoopbackUrlWithPort,
@@ -5,9 +6,12 @@ import {
 } from '../../../shared/localhost-worktree-labels'
 import type { GlobalSettings } from '../../../shared/types'
 import type { WorkspacePort, WorkspacePortScanResult } from '../../../shared/workspace-ports'
+import { toast } from 'sonner'
 
 export type OpenHttpLinkOptions = {
   worktreeId?: string | null
+  /** Terminal-only opt-in for routing a runtime-owned source through its managed browser. */
+  allowRuntimeInApp?: boolean
   /** Unconditional: always use the system browser regardless of settings. */
   forceSystemBrowser?: boolean
   /** Unconditional for local sources: open inside Orca regardless of settings. */
@@ -36,13 +40,22 @@ type StoreAccessor = () => {
   setActiveWorktree: (worktreeId: string) => void
   createBrowserTab: (worktreeId: string, url: string, opts: { activate: boolean }) => unknown
   repos?: readonly LocalhostLinkRepo[]
-  projects?: LocalhostLinkProject[]
+  projects?: readonly LocalhostLinkProject[]
   worktreesByRepo?: Record<string, LocalhostLinkWorktree[]>
   allWorktrees?: () => LocalhostLinkWorktree[]
   workspacePortScan?: { result: WorkspacePortScanResult } | null
   workspacePortScansByKey?: Record<string, WorkspacePortScanResult>
 }
 
+type RuntimeHttpLinkBrowserRequest = {
+  workspaceId: string
+  url: string
+  intent: { kind: 'url' }
+  expectedRuntimeEnvironmentId: string
+}
+
+type RuntimeHttpLinkBrowserOpener = (request: RuntimeHttpLinkBrowserRequest) => Promise<void>
+
 type LocalhostLinkRepo = {
   id: string
   displayName: string
@@ -61,11 +74,18 @@ type LocalhostLinkWorktree = {
 // the break, several renderer test files that load this module first see
 // `createEditorSlice` as undefined at store/index.ts initialization.
 let storeAccessor: StoreAccessor | null = null
+let runtimeHttpLinkBrowserOpener: RuntimeHttpLinkBrowserOpener | null = null
 
 export function registerHttpLinkStoreAccessor(fn: StoreAccessor): void {
   storeAccessor = fn
 }
 
+export function registerRuntimeHttpLinkBrowserOpener(
+  fn: RuntimeHttpLinkBrowserOpener | null
+): void {
+  runtimeHttpLinkBrowserOpener = fn
+}
+
 // Scope: http(s) URLs only. file: URIs and in-worktree markdown targets are
 // owned by resolveMarkdownLinkTarget and must stay on that path — this helper
 // is only invoked on target.kind === 'external' (and for the terminal's http
@@ -93,7 +113,14 @@ export function resolveModifierRouting(
 }
 
 export function openHttpLink(url: string, opts: OpenHttpLinkOptions = {}): void {
-  const { worktreeId, forceSystemBrowser, forceInApp, modifierHeld, sourceOwner } = opts
+  const {
+    worktreeId,
+    allowRuntimeInApp,
+    forceSystemBrowser,
+    forceInApp,
+    modifierHeld,
+    sourceOwner
+  } = opts
   if (sourceOwner?.kind === 'unknown') {
     return
   }
@@ -106,14 +133,31 @@ export function openHttpLink(url: string, opts: OpenHttpLinkOptions = {}): void
     openLinksInApp,
     state?.settings?.openLinksInAppModifierInverts === true
   )
-  const routeToOrca =
-    sourceIsLocal &&
+  const wantsOrca =
     !forceSystemBrowser &&
     !modifier.wantsSystemBrowser &&
     Boolean(worktreeId) &&
     (forceInApp || openLinksInApp || modifier.wantsOrca)
 
-  if (routeToOrca && worktreeId && state) {
+  if (wantsOrca && allowRuntimeInApp && worktreeId && sourceOwner?.kind === 'runtime') {
+    if (runtimeHttpLinkBrowserOpener) {
+      void runtimeHttpLinkBrowserOpener({
+        workspaceId: worktreeId,
+        url,
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: sourceOwner.runtimeEnvironmentId
+      }).catch((error) => {
+        toast.error(
+          error instanceof Error
+            ? error.message
+            : translate('auto.lib.workspace.browser.tab.open.urlFailed', 'Unable to open URL.')
+        )
+      })
+    }
+    return
+  }
+
+  if (wantsOrca && sourceIsLocal && worktreeId && state) {
     // Why: http clicks from inside a worktree should not push a worktree-switch
     // history entry — the user isn't changing worktrees, they're opening a tab
     // in the one they're already in. activateAndRevealWorktree is reserved for
diff --git a/src/renderer/src/lib/launch-agent-background-session-remote.test.ts b/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
index 6cf8e9b717d..4066f67522f 100644
--- a/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
+++ b/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
@@ -378,6 +378,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
     )
     expect(mockRuntimeEnvironmentCall).toHaveBeenCalledWith({
       selector: 'env-1',
+      expectedEnvironmentPairingRevision: undefined,
+      expectedRuntimeId: 'remote-runtime',
       method: 'terminal.createAgentSession',
       params: expect.objectContaining({
         clientOperationId: expect.stringMatching(/^\d{13}-[0-9a-f]{32}$/),
@@ -420,7 +422,7 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
             graphStatus: 'ready',
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: []
+            capabilities: ['terminal.attribution-removed.v1']
           }
         })
       }
@@ -442,6 +444,7 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
     expect(mockRuntimeEnvironmentTransportCall).toHaveBeenCalledWith(
       expect.objectContaining({
+        expectedRuntimeId: 'old-runtime',
         method: 'terminal.create',
         params: expect.objectContaining({
           worktree: 'id:wt-1',
diff --git a/src/renderer/src/lib/launch-agent-in-new-tab.test.ts b/src/renderer/src/lib/launch-agent-in-new-tab.test.ts
index 38fb4f1d566..8515379d418 100644
--- a/src/renderer/src/lib/launch-agent-in-new-tab.test.ts
+++ b/src/renderer/src/lib/launch-agent-in-new-tab.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { toAppSshPtyId } from '../../../shared/ssh-pty-id'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 
 const mockCreateTab = vi.fn()
 const mockQueueTabStartupCommand = vi.fn()
@@ -185,6 +186,32 @@ describe('launchAgentInNewTab', () => {
     })
   })
 
+  it('keeps Floating Workspace authority on native Windows beside an active WSL project', async () => {
+    store.projects = [
+      {
+        id: 'repo-1',
+        localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' }
+      }
+    ]
+    const { launchAgentInNewTab } = await import('./launch-agent-in-new-tab')
+
+    const result = launchAgentInNewTab({
+      agent: 'codex',
+      worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+      launchPlatform: 'win32'
+    })
+
+    expect(result).not.toBeNull()
+    expect(mockIsWebRuntimeSessionActive).toHaveBeenLastCalledWith(null)
+    expect(mockCreateWebRuntimeSessionTerminal).not.toHaveBeenCalled()
+    expect(mockCreateTab).toHaveBeenCalledWith(
+      FLOATING_TERMINAL_WORKTREE_ID,
+      undefined,
+      undefined,
+      { launchAgent: 'codex' }
+    )
+  })
+
   it('opens supported submit-after-ready launches in chat and seeds a launch prompt echo', async () => {
     store.settings = {
       agentCmdOverrides: {},
diff --git a/src/renderer/src/lib/linear-issue-url-lookup.test.ts b/src/renderer/src/lib/linear-issue-url-lookup.test.ts
new file mode 100644
index 00000000000..28bc918caed
--- /dev/null
+++ b/src/renderer/src/lib/linear-issue-url-lookup.test.ts
@@ -0,0 +1,148 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { LinearConnectionStatus, LinearIssue } from '../../../shared/types'
+import { lookupLinearIssueUrl } from './linear-issue-url-lookup'
+
+const intent = { identifier: 'STA-4084', organizationUrlKey: 'stably' }
+
+function issue(organizationUrlKey = 'stably'): LinearIssue {
+  return {
+    id: `${organizationUrlKey}-issue`,
+    workspaceId: `${organizationUrlKey}-workspace`,
+    workspaceName: organizationUrlKey,
+    identifier: 'STA-4084',
+    title: 'Restore shell integration',
+    url: `https://linear.app/${organizationUrlKey}/issue/STA-4084/restore-shell-integration`,
+    state: { name: 'Todo', type: 'unstarted', color: '#999999' },
+    team: { id: 'team-sta', name: 'Stably', key: 'STA' },
+    labels: [],
+    labelIds: [],
+    priority: 2,
+    updatedAt: '2026-08-12T00:00:00.000Z'
+  }
+}
+
+describe('Linear issue URL lookup', () => {
+  it('uses the known workspace named by the URL', async () => {
+    const fetchLinearIssue = vi.fn(async () => issue())
+    const readLinearStatus = vi.fn<() => Promise<LinearConnectionStatus>>()
+
+    await expect(
+      lookupLinearIssueUrl({
+        intent,
+        knownStatus: {
+          viewer: null,
+          workspaces: [{ id: 'stably-workspace', organizationUrlKey: 'stably' } as never]
+        },
+        sourceContext: null,
+        fetchLinearIssue,
+        readLinearStatus
+      })
+    ).resolves.toMatchObject({ identifier: 'STA-4084' })
+    expect(fetchLinearIssue).toHaveBeenCalledWith('STA-4084', 'stably-workspace', {
+      sourceContext: null
+    })
+    expect(readLinearStatus).not.toHaveBeenCalled()
+  })
+
+  it('refreshes status from the source owner when the known workspace is stale', async () => {
+    const fetchLinearIssue = vi.fn(async (_identifier: string, workspaceId?: string | null) =>
+      workspaceId === 'remote-stably-workspace' ? issue() : null
+    )
+
+    await expect(
+      lookupLinearIssueUrl({
+        intent,
+        knownStatus: {
+          viewer: null,
+          workspaces: [{ id: 'stale-workspace', organizationUrlKey: 'stably' } as never]
+        },
+        sourceContext: null,
+        fetchLinearIssue,
+        readLinearStatus: async () => ({
+          connected: true,
+          viewer: null,
+          workspaces: [
+            {
+              id: 'remote-stably-workspace',
+              organizationUrlKey: 'stably'
+            } as never
+          ]
+        })
+      })
+    ).resolves.toMatchObject({ workspaceId: 'stably-workspace' })
+    expect(fetchLinearIssue).toHaveBeenCalledTimes(2)
+  })
+
+  it('uses legacy viewer status when mixed versions omit the workspace list', async () => {
+    const fetchLinearIssue = vi.fn(async () => issue())
+
+    await expect(
+      lookupLinearIssueUrl({
+        intent,
+        knownStatus: {
+          viewer: {
+            displayName: 'Linear User',
+            email: null,
+            organizationName: 'Stably',
+            organizationUrlKey: 'stably'
+          },
+          activeWorkspaceId: 'legacy-workspace'
+        },
+        sourceContext: null,
+        fetchLinearIssue,
+        readLinearStatus: vi.fn()
+      })
+    ).resolves.toMatchObject({ identifier: 'STA-4084' })
+    expect(fetchLinearIssue).toHaveBeenCalledWith('STA-4084', 'legacy-workspace', {
+      sourceContext: null
+    })
+  })
+
+  it('probes a legacy workspace that omitted its organization URL key', async () => {
+    const fetchLinearIssue = vi.fn(async () => issue())
+
+    await expect(
+      lookupLinearIssueUrl({
+        intent,
+        knownStatus: {
+          viewer: {
+            displayName: 'Linear User',
+            email: null,
+            organizationName: 'Saved Linear workspace'
+          },
+          activeWorkspaceId: 'legacy',
+          selectedWorkspaceId: 'legacy',
+          workspaces: [{ id: 'legacy', organizationName: 'Saved Linear workspace' } as never]
+        },
+        sourceContext: null,
+        fetchLinearIssue,
+        readLinearStatus: vi.fn()
+      })
+    ).resolves.toMatchObject({ identifier: 'STA-4084' })
+    expect(fetchLinearIssue).toHaveBeenCalledWith('STA-4084', 'legacy', {
+      sourceContext: null
+    })
+  })
+
+  it('does not fall back to an all-workspaces lookup that can collide across organizations', async () => {
+    const fetchLinearIssue = vi.fn(async () => issue('other'))
+
+    await expect(
+      lookupLinearIssueUrl({
+        intent,
+        knownStatus: {
+          viewer: null,
+          workspaces: [{ id: 'other-workspace', organizationUrlKey: 'other' } as never]
+        },
+        sourceContext: null,
+        fetchLinearIssue,
+        readLinearStatus: async () => ({
+          connected: true,
+          viewer: null,
+          workspaces: [{ id: 'other-workspace', organizationUrlKey: 'other' } as never]
+        })
+      })
+    ).resolves.toBeNull()
+    expect(fetchLinearIssue).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/lib/linear-issue-url-lookup.ts b/src/renderer/src/lib/linear-issue-url-lookup.ts
new file mode 100644
index 00000000000..03e2a1d56f9
--- /dev/null
+++ b/src/renderer/src/lib/linear-issue-url-lookup.ts
@@ -0,0 +1,78 @@
+import { linearStatus } from '@/runtime/runtime-linear-client'
+import {
+  findLinearIssueWorkspaceLookupIds,
+  isLinearIssueUrlResolutionMatch,
+  type LinearIssueUrlIntent
+} from '../../../shared/linear-links'
+import type { LinearConnectionStatus, LinearIssue } from '../../../shared/types'
+import type { TaskSourceContext } from '../../../shared/task-source-context'
+
+type FetchLinearIssue = (
+  identifier: string,
+  workspaceId?: string | null,
+  options?: { sourceContext?: TaskSourceContext | null }
+) => Promise<LinearIssue | null>
+
+async function fetchMatchingLinearIssue(
+  intent: LinearIssueUrlIntent,
+  workspaceId: string,
+  sourceContext: TaskSourceContext | null,
+  fetchLinearIssue: FetchLinearIssue
+): Promise<LinearIssue | null> {
+  try {
+    const issue = await fetchLinearIssue(intent.identifier, workspaceId, { sourceContext })
+    return issue && isLinearIssueUrlResolutionMatch(intent, issue) ? issue : null
+  } catch {
+    return null
+  }
+}
+
+export async function lookupLinearIssueUrl({
+  intent,
+  knownStatus,
+  sourceContext,
+  fetchLinearIssue,
+  readLinearStatus = linearStatus
+}: {
+  intent: LinearIssueUrlIntent
+  knownStatus: Pick<
+    LinearConnectionStatus,
+    'workspaces' | 'viewer' | 'activeWorkspaceId' | 'selectedWorkspaceId'
+  >
+  sourceContext: TaskSourceContext | null
+  fetchLinearIssue: FetchLinearIssue
+  readLinearStatus?: (sourceContext: TaskSourceContext | null) => Promise<LinearConnectionStatus>
+}): Promise<LinearIssue | null> {
+  const triedWorkspaceIds = new Set<string>()
+  const lookupInStatus = async (
+    status: Pick<
+      LinearConnectionStatus,
+      'workspaces' | 'viewer' | 'activeWorkspaceId' | 'selectedWorkspaceId'
+    >
+  ): Promise<LinearIssue | null> => {
+    for (const workspaceId of findLinearIssueWorkspaceLookupIds(intent, status)) {
+      if (triedWorkspaceIds.has(workspaceId)) {
+        continue
+      }
+      triedWorkspaceIds.add(workspaceId)
+      const issue = await fetchMatchingLinearIssue(
+        intent,
+        workspaceId,
+        sourceContext,
+        fetchLinearIssue
+      )
+      if (issue) {
+        return issue
+      }
+    }
+    return null
+  }
+
+  const knownIssue = await lookupInStatus(knownStatus)
+  if (knownIssue) {
+    return knownIssue
+  }
+
+  const currentStatus = await readLinearStatus(sourceContext).catch(() => null)
+  return currentStatus ? lookupInStatus(currentStatus) : null
+}
diff --git a/src/renderer/src/lib/local-preflight-context.test.ts b/src/renderer/src/lib/local-preflight-context.test.ts
index 287376bb548..69d38f9ced6 100644
--- a/src/renderer/src/lib/local-preflight-context.test.ts
+++ b/src/renderer/src/lib/local-preflight-context.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 import type { Repo, Worktree } from '../../../shared/types'
 import type { AppState } from '@/store/types'
 import {
@@ -474,6 +475,55 @@ describe('local preflight context', () => {
     })
   })
 
+  it('does not assign the active project runtime to the floating workspace', () => {
+    const state = {
+      ...makeState({ repoPath: 'C:\\Users\\alice\\repo', worktreePath: 'C:\\Users\\alice\\repo' }),
+      projects: [{ id: 'repo-1', localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' } }]
+    } as unknown as AppState
+
+    expect(
+      getLocalProjectExecutionRuntimeContext(state, FLOATING_TERMINAL_WORKTREE_ID, 'win32')
+    ).toBeUndefined()
+  })
+
+  it('keeps Floating on the host despite global and explicit WSL agent settings', () => {
+    const state = {
+      ...makeState({ repoPath: 'C:\\Users\\alice\\repo' }),
+      settings: {
+        terminalWindowsShell: 'wsl.exe',
+        terminalWindowsWslDistro: 'Debian',
+        localWindowsRuntimeDefault: { kind: 'wsl', distro: 'Debian' },
+        localAgentRuntime: 'wsl',
+        localAgentWslDistro: 'Ubuntu'
+      }
+    } as AppState
+
+    expect(
+      getLocalAgentPreflightContext(state, 'win32', {}, FLOATING_TERMINAL_WORKTREE_ID)
+    ).toBeUndefined()
+  })
+
+  it('keeps the active project runtime fallback for a detected-only worktree', () => {
+    const state = {
+      ...makeState({ repoPath: 'C:\\Users\\alice\\repo' }),
+      detectedWorktreesByRepo: {
+        'repo-1': {
+          repoId: 'repo-1',
+          authoritative: true,
+          source: 'git',
+          worktrees: [{ id: 'repo-1::detected', repoId: 'repo-1', path: 'C:\\detected' }]
+        }
+      },
+      projects: [{ id: 'repo-1', localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' } }]
+    } as unknown as AppState
+
+    expect(
+      getLocalProjectExecutionRuntimeContext(state, 'repo-1::detected', 'win32')
+    ).toMatchObject({
+      runtime: { kind: 'wsl', distro: 'Ubuntu', projectId: 'repo-1' }
+    })
+  })
+
   it('resolves WSL UNC worktrees to their owning distro when the project inherits host default', () => {
     const state = makeState({
       repoPath: 'C:\\Users\\alice\\repo',
diff --git a/src/renderer/src/lib/local-preflight-context.ts b/src/renderer/src/lib/local-preflight-context.ts
index ddabde956e5..28da8a3d5bd 100644
--- a/src/renderer/src/lib/local-preflight-context.ts
+++ b/src/renderer/src/lib/local-preflight-context.ts
@@ -1,4 +1,5 @@
 import type { AppState } from '@/store/types'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 import { parseWslUncPath } from '../../../shared/wsl-paths'
 import {
   deriveGlobalWindowsRuntimeDefaultFromLegacySettings,
@@ -39,10 +40,12 @@ type LocalProjectRuntimeWslContext = {
   availableWslDistros?: readonly string[] | null
 }
 
+/** Extracts a WSL distribution name from supported UNC path forms. */
 export function getWslDistroFromPath(path?: string | null): string | null {
   return path ? (parseWslUncPath(path)?.distro ?? null) : null
 }
 
+/** Resolves the owning local project's Windows runtime for project-scoped targets. */
 export function getLocalProjectExecutionRuntimeContext(
   state: LocalProjectRuntimeState,
   worktreeId?: string | null,
@@ -53,6 +56,9 @@ export function getLocalProjectExecutionRuntimeContext(
     return undefined
   }
 
+  if (worktreeId === FLOATING_TERMINAL_WORKTREE_ID) {
+    return undefined
+  }
   const worktree = getLocalWorktree(state, worktreeId)
   const repo = getLocalRuntimeRepoForWorktree(state, worktree)
   if (!isLocalRuntimeRepo(repo) || !isLocalRuntimeWorktree(worktree)) {
@@ -163,6 +169,10 @@ export function getLocalAgentPreflightContext(
   wslContext: LocalProjectRuntimeWslContext = getCachedLocalProjectRuntimeWslContext(),
   worktreeId?: string | null
 ): LocalPreflightContext {
+  // Why: Floating owns native host authority and must not inherit any agent runtime fallback.
+  if (worktreeId === FLOATING_TERMINAL_WORKTREE_ID) {
+    return undefined
+  }
   const projectRuntime = getLocalProjectExecutionRuntimeContext(
     state,
     worktreeId,
diff --git a/src/renderer/src/lib/markdown-document-templates.ts b/src/renderer/src/lib/markdown-document-templates.ts
index 1fadcd2613f..60414d481f0 100644
--- a/src/renderer/src/lib/markdown-document-templates.ts
+++ b/src/renderer/src/lib/markdown-document-templates.ts
@@ -126,7 +126,7 @@ export function applyMarkdownTemplatePlaceholders(
   }
 
   return content.replace(/\{\{\s*([a-zA-Z][a-zA-Z0-9_-]*)\s*\}\}/g, (match, key: string) => {
-    return Object.prototype.hasOwnProperty.call(replacements, key) ? replacements[key] : match
+    return Object.hasOwn(replacements, key) ? replacements[key] : match
   })
 }
 
diff --git a/src/renderer/src/lib/native-chat-telemetry.ts b/src/renderer/src/lib/native-chat-telemetry.ts
index 0d6f96584d2..1299204b6db 100644
--- a/src/renderer/src/lib/native-chat-telemetry.ts
+++ b/src/renderer/src/lib/native-chat-telemetry.ts
@@ -15,7 +15,7 @@ import type { TuiAgent } from '../../../shared/types'
  *  the broader `AgentType` string carried by the chat view. Narrowing to the
  *  closed `agent_kind` enum (with an `'other'` fallback) happens here so call
  *  sites never need an unsound `as TuiAgent` cast. */
-export type NativeChatTelemetryAgent = TuiAgent | string | null | undefined
+export type NativeChatTelemetryAgent = TuiAgent | (string & {}) | null | undefined
 
 // `launchAgent` is optional on terminal tabs (plain shells, manually-started
 // agents) and the chat view's `AgentType` may carry a string outside the
diff --git a/src/renderer/src/lib/notes-send-agent-targets.test.ts b/src/renderer/src/lib/notes-send-agent-targets.test.ts
index e7b4178df2b..0b24234c3bf 100644
--- a/src/renderer/src/lib/notes-send-agent-targets.test.ts
+++ b/src/renderer/src/lib/notes-send-agent-targets.test.ts
@@ -653,4 +653,51 @@ describe('notes send agent targets', () => {
       })
     ])
   })
+
+  // Why: OpenCode publishes `OC | <session>` and no status word, so a hookless
+  // OpenCode pane used to be invisible in the send menu no matter how live it was.
+  it('lists a manual OpenCode pane by its native session title', () => {
+    const targets = deriveNotesSendAgentTargets(
+      state({
+        tabsByWorktree: { [WORKTREE_ID]: [tab(MANUAL_TAB_ID, { title: 'Terminal 2' })] },
+        terminalLayoutsByTabId: { [MANUAL_TAB_ID]: leafLayout(LEAF_B, 'pty-b') },
+        runtimePaneTitlesByTabId: { [MANUAL_TAB_ID]: { 1: 'OC | Ad hoc build' } }
+      }),
+      WORKTREE_ID,
+      NOW
+    )
+
+    expect(targets).toEqual([
+      {
+        paneKey: makePaneKey(MANUAL_TAB_ID, LEAF_B),
+        tabId: MANUAL_TAB_ID,
+        leafId: LEAF_B,
+        agentType: 'opencode',
+        tabTitle: 'Terminal 2',
+        status: 'eligible'
+      }
+    ])
+  })
+
+  it('promotes a stale OpenCode status row from the native title hint', () => {
+    const paneKey = makePaneKey(LAUNCH_TAB_ID, LEAF_A)
+    const targets = deriveNotesSendAgentTargets(
+      state({
+        agentStatusByPaneKey: {
+          [paneKey]: entry(paneKey, 'done', OLD_STATUS_UPDATED_AT, { agentType: 'opencode' })
+        },
+        tabsByWorktree: {
+          [WORKTREE_ID]: [tab(LAUNCH_TAB_ID, { title: 'Terminal 1', launchAgent: 'opencode' })]
+        },
+        terminalLayoutsByTabId: { [LAUNCH_TAB_ID]: leafLayout(LEAF_A, 'pty-a') },
+        runtimePaneTitlesByTabId: { [LAUNCH_TAB_ID]: { 1: 'OC | Ad hoc build' } }
+      }),
+      WORKTREE_ID,
+      NOW
+    )
+
+    expect(targets).toEqual([
+      expect.objectContaining({ paneKey, agentType: 'opencode', status: 'eligible' })
+    ])
+  })
 })
diff --git a/src/renderer/src/lib/notes-send-agent-targets.ts b/src/renderer/src/lib/notes-send-agent-targets.ts
index 163907d99fc..3c2f6d412c4 100644
--- a/src/renderer/src/lib/notes-send-agent-targets.ts
+++ b/src/renderer/src/lib/notes-send-agent-targets.ts
@@ -59,10 +59,8 @@ function detectTitleHintPaneEvidence(
  * CLIs do not have that owner bit, so their runtime title is the only pre-hook
  * signal available.
  *
- * The title hint is gated on a recognized agent title (pane or tab) — the same
- * signal isTerminalRunningAgent checks — so a freshly spawned tab is only listed
- * once the runtime would actually accept the send. Without that gate, clicking a
- * still-booting pane fails with "not a recognized agent session".
+ * The title hint gates discoverability only. The runtime independently checks
+ * current hook/process evidence before any guarded write.
  */
 export function deriveNotesSendAgentTargets(
   state: NotesSendAgentTargetState,
@@ -129,9 +127,8 @@ function deriveTitleHintAgentTarget(
   const paneTitleResolution = resolveRuntimePaneTitleLeafResolution(layout, paneTitles, leafId)
   const titleEvidence = detectTitleHintPaneEvidence(paneTitleResolution, tab.title)
   if (!titleEvidence) {
-    // Why: launchAgent is set the instant Orca spawns the tab, but the runtime
-    // only accepts a send once the pane reads as an agent; manually started
-    // CLIs need the same title proof before appearing in the send menu.
+    // Why: launch metadata predates TUI identity; require a matching current title
+    // before listing either launched or manually started panes.
     return null
   }
   const disabledReason =
diff --git a/src/renderer/src/lib/open-mobile-emulator-tab.test.ts b/src/renderer/src/lib/open-mobile-emulator-tab.test.ts
index a3d942785b1..578473b5f36 100644
--- a/src/renderer/src/lib/open-mobile-emulator-tab.test.ts
+++ b/src/renderer/src/lib/open-mobile-emulator-tab.test.ts
@@ -14,7 +14,11 @@ const mockStoreState = vi.hoisted(() => ({
   activeGroupIdByWorktree: { 'wt-1': 'group-1' } as Record<string, string>,
   groupsByWorktree: { 'wt-1': [{ id: 'group-1' }] } as Record<string, { id: string }[]>,
   unifiedTabsByWorktree: {} as Record<string, { id: string; contentType: string }[]>,
-  settings: { mobileEmulatorEnabled: true } as { mobileEmulatorEnabled?: boolean }
+  settings: { mobileEmulatorEnabled: true } as {
+    mobileEmulatorEnabled?: boolean
+    activeRuntimeEnvironmentId?: string | null
+  },
+  runtimeStatusByEnvironmentId: new Map()
 }))
 
 vi.mock('@/store', () => ({
@@ -68,6 +72,22 @@ describe('openMobileEmulatorTab', () => {
   afterEach(() => {
     cancelPendingSimulatorPaneShutdown('wt-1')
     vi.useRealTimers()
+    vi.unstubAllGlobals()
+  })
+
+  it('rejects web-client invocation before creating a tab or attaching', async () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    mockStoreState.settings = {
+      mobileEmulatorEnabled: true,
+      activeRuntimeEnvironmentId: 'runtime-1'
+    }
+
+    await expect(openMobileEmulatorTab('wt-1')).rejects.toThrow(
+      'Mobile Emulator is unavailable in the web client.'
+    )
+
+    expect(ensureSimulatorTab).not.toHaveBeenCalled()
+    expect(callRuntimeRpc).not.toHaveBeenCalled()
   })
 
   it('surfaces the simulator tab before attaching the emulator stream', async () => {
diff --git a/src/renderer/src/lib/open-mobile-emulator-tab.ts b/src/renderer/src/lib/open-mobile-emulator-tab.ts
index 45f565e0408..6991c42ef13 100644
--- a/src/renderer/src/lib/open-mobile-emulator-tab.ts
+++ b/src/renderer/src/lib/open-mobile-emulator-tab.ts
@@ -16,6 +16,7 @@ import {
   cancelPendingSimulatorPaneShutdown,
   shutdownManagedSimulatorIfNoPane
 } from './simulator-pane-shutdown-scheduler'
+import { assertClientCreationActionAvailable } from './client-creation-action-policy'
 
 type OpenMobileEmulatorTabOptions = {
   targetGroupId?: string
@@ -55,6 +56,7 @@ export async function openMobileEmulatorTab(
   options: OpenMobileEmulatorTabOptions = {}
 ): Promise<string | null> {
   const store = useAppStore.getState()
+  assertClientCreationActionAvailable(store, worktreeId, 'mobile-emulator')
   if (store.settings?.mobileEmulatorEnabled === false) {
     return null
   }
diff --git a/src/renderer/src/lib/pane-manager/pane-fit.ts b/src/renderer/src/lib/pane-manager/pane-fit.ts
index f7165c3aad6..05e71b294dc 100644
--- a/src/renderer/src/lib/pane-manager/pane-fit.ts
+++ b/src/renderer/src/lib/pane-manager/pane-fit.ts
@@ -141,6 +141,7 @@ function performSafeFit(pane: ManagedPane): boolean {
     if (shouldRestoreScroll) {
       try {
         if (resumePendingFitScrollRestoreAfterFit(pane.terminal)) {
+          // Resume consumed the pending restore; the fallbacks below must not also run.
         } else if (pinnedScrollState) {
           const state: ScrollState = pinnedScrollState
           pinnedScrollState = null
diff --git a/src/renderer/src/lib/pane-manager/pane-identity-registry.ts b/src/renderer/src/lib/pane-manager/pane-identity-registry.ts
index 0c1951e979f..709ff30ec5f 100644
--- a/src/renderer/src/lib/pane-manager/pane-identity-registry.ts
+++ b/src/renderer/src/lib/pane-manager/pane-identity-registry.ts
@@ -3,9 +3,9 @@ import { mintStablePaneId } from './mint-stable-pane-id'
 import type { ManagedPaneInternal } from './pane-manager-types'
 
 export class PaneIdentityRegistry {
-  private leafIdByNumericId: Map<number, TerminalLeafId> = new Map()
-  private numericIdByLeafId: Map<TerminalLeafId, number> = new Map()
-  private publishedPaneIds: Set<number> = new Set()
+  private leafIdByNumericId = new Map<number, TerminalLeafId>()
+  private numericIdByLeafId = new Map<TerminalLeafId, number>()
+  private publishedPaneIds = new Set<number>()
 
   claimLeafId(leafIdHint?: string): TerminalLeafId {
     if (leafIdHint && isTerminalLeafId(leafIdHint) && !this.numericIdByLeafId.has(leafIdHint)) {
diff --git a/src/renderer/src/lib/pane-manager/pane-manager.ts b/src/renderer/src/lib/pane-manager/pane-manager.ts
index fbdbe1f5afe..f6d59594d01 100644
--- a/src/renderer/src/lib/pane-manager/pane-manager.ts
+++ b/src/renderer/src/lib/pane-manager/pane-manager.ts
@@ -66,7 +66,7 @@ export type {
 
 export class PaneManager {
   private root: HTMLElement
-  private panes: Map<number, ManagedPaneInternal> = new Map()
+  private panes = new Map<number, ManagedPaneInternal>()
   private activePaneId: number | null = null
   private nextPaneId = FIRST_PANE_ID
   private options: PaneManagerOptions
diff --git a/src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts b/src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts
index 4dff8e4f964..caf3da45092 100644
--- a/src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts
@@ -38,7 +38,7 @@ function createMockElement(className = ''): TestElement {
     },
     replaceChild: (nextChild: TestElement, oldChild: TestElement): TestElement => {
       const index = element.children.indexOf(oldChild)
-      if (index >= 0) {
+      if (index !== -1) {
         element.children[index] = nextChild
       } else {
         element.children.push(nextChild)
diff --git a/src/renderer/src/lib/runtime-agent-background-create.ts b/src/renderer/src/lib/runtime-agent-background-create.ts
index 70915ae63d4..a6c430f172b 100644
--- a/src/renderer/src/lib/runtime-agent-background-create.ts
+++ b/src/renderer/src/lib/runtime-agent-background-create.ts
@@ -3,6 +3,11 @@ import type { StartupCommandDelivery } from '../../../shared/codex-startup-deliv
 import type { SessionOptionValue } from '../../../shared/native-chat-session-options'
 import type { RuntimeTerminalCreate } from '../../../shared/runtime-types'
 import type { TuiAgent } from '../../../shared/types'
+import { TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  withLegacyTerminalAttributionDisabledEnv
+} from '../../../shared/legacy-terminal-attribution-env'
 import {
   createAgentSessionCreateOperation,
   toAgentLaunchPreferences,
@@ -33,7 +38,8 @@ export async function createRuntimeAgentBackgroundTerminal(args: {
   const launchPreferences = toAgentLaunchPreferences(args.sessionOptions)
   return await runRemoteAgentSessionLaunch({
     environmentId: args.environmentId,
-    hostAuthority: () =>
+    requiredHostAuthorityCapabilities: [TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY],
+    hostAuthority: (authority) =>
       operation.run((clientOperationId) =>
         callRuntimeRpc<{ terminal: RuntimeTerminalCreate }>(
           { kind: 'environment', environmentId: args.environmentId },
@@ -52,10 +58,14 @@ export async function createRuntimeAgentBackgroundTerminal(args: {
             },
             clientOperationId
           ),
-          { timeoutMs: 15_000 }
+          {
+            timeoutMs: 15_000,
+            expectedEnvironmentPairingRevision: authority.expectedEnvironmentPairingRevision,
+            expectedRuntimeId: authority.runtimeId
+          }
         )
       ),
-    legacy: ({ skipCompatibilityCheck }) =>
+    legacy: ({ skipCompatibilityCheck, authority }) =>
       callRuntimeRpc<{ terminal: RuntimeTerminalCreate }>(
         { kind: 'environment', environmentId: args.environmentId },
         'terminal.create',
@@ -65,7 +75,8 @@ export async function createRuntimeAgentBackgroundTerminal(args: {
           ...(args.legacy.startupCommandDelivery
             ? { startupCommandDelivery: args.legacy.startupCommandDelivery }
             : {}),
-          env: args.legacy.env,
+          env: withLegacyTerminalAttributionDisabledEnv(args.legacy.env),
+          envToDelete: addLegacyTerminalAttributionDisableRequest(undefined),
           launchConfig: args.legacy.launchConfig,
           launchToken: args.legacy.launchToken,
           launchAgent: args.agent,
@@ -74,7 +85,12 @@ export async function createRuntimeAgentBackgroundTerminal(args: {
           leafId: args.leafId,
           presentation: 'background'
         },
-        { timeoutMs: 15_000, skipCompatibilityCheck }
+        {
+          timeoutMs: 15_000,
+          skipCompatibilityCheck,
+          expectedEnvironmentPairingRevision: authority.expectedEnvironmentPairingRevision,
+          expectedRuntimeId: authority.runtimeId
+        }
       )
   })
 }
diff --git a/src/renderer/src/lib/runtime-pane-title-leaf-id.ts b/src/renderer/src/lib/runtime-pane-title-leaf-id.ts
index 0847f1e3de2..c18e752e883 100644
--- a/src/renderer/src/lib/runtime-pane-title-leaf-id.ts
+++ b/src/renderer/src/lib/runtime-pane-title-leaf-id.ts
@@ -78,7 +78,7 @@ export function resolveRuntimePaneTitleLeafResolution(
   let hasMultiplePaneTitles = false
 
   for (const runtimePaneId in titlesByPaneId) {
-    if (!Object.prototype.hasOwnProperty.call(titlesByPaneId, runtimePaneId)) {
+    if (!Object.hasOwn(titlesByPaneId, runtimePaneId)) {
       continue
     }
 
diff --git a/src/renderer/src/lib/setup-script-prompt.test.ts b/src/renderer/src/lib/setup-script-prompt.test.ts
index 70d226bc0cf..3ce55848f1c 100644
--- a/src/renderer/src/lib/setup-script-prompt.test.ts
+++ b/src/renderer/src/lib/setup-script-prompt.test.ts
@@ -202,6 +202,56 @@ describe('setup script prompt inspection', () => {
     ).toEqual([getSetupScriptPromptDismissalKey(localIdentity)])
   })
 
+  it('reuses the input array when it is empty', () => {
+    const input: string[] = []
+    expect(
+      filterSetupScriptPromptDismissalsToValidRepos(
+        input,
+        new Set([getRepoHostIdentityForParts('repo-1', 'local')])
+      )
+    ).toBe(input)
+  })
+
+  it('reuses the input array when every dismissal is already a valid host-identity key', () => {
+    const localIdentity = getRepoHostIdentityForParts('repo-1', 'local')
+    const remoteIdentity = getRepoHostIdentityForParts('repo-2', 'ssh:host-a')
+    const input = [
+      getSetupScriptPromptDismissalKey(localIdentity),
+      getSetupScriptPromptDismissalKey(remoteIdentity)
+    ]
+    expect(
+      filterSetupScriptPromptDismissalsToValidRepos(input, new Set([localIdentity, remoteIdentity]))
+    ).toBe(input)
+  })
+
+  it('allocates when a legacy repo-id dismissal is rewritten to a host identity', () => {
+    const localIdentity = getRepoHostIdentityForParts('repo-1', 'local')
+    const input = [getSetupScriptPromptDismissalKey('repo-1')]
+    const result = filterSetupScriptPromptDismissalsToValidRepos(input, new Set([localIdentity]))
+    expect(result).not.toBe(input)
+    expect(result).toEqual([getSetupScriptPromptDismissalKey(localIdentity)])
+  })
+
+  it('allocates when a stale dismissal is dropped', () => {
+    const localIdentity = getRepoHostIdentityForParts('repo-1', 'local')
+    const input = [
+      getSetupScriptPromptDismissalKey(localIdentity),
+      getSetupScriptPromptDismissalKey(getRepoHostIdentityForParts('gone', 'local'))
+    ]
+    const result = filterSetupScriptPromptDismissalsToValidRepos(input, new Set([localIdentity]))
+    expect(result).not.toBe(input)
+    expect(result).toEqual([getSetupScriptPromptDismissalKey(localIdentity)])
+  })
+
+  it('allocates when a duplicate valid dismissal is deduped', () => {
+    const localIdentity = getRepoHostIdentityForParts('repo-1', 'local')
+    const key = getSetupScriptPromptDismissalKey(localIdentity)
+    const input = [key, key]
+    const result = filterSetupScriptPromptDismissalsToValidRepos(input, new Set([localIdentity]))
+    expect(result).not.toBe(input)
+    expect(result).toEqual([key])
+  })
+
   it('drops a legacy repo-id dismissal when that id exists on multiple hosts', () => {
     const localIdentity = getRepoHostIdentityForParts('repo-1', 'local')
     const remoteIdentity = getRepoHostIdentityForParts('repo-1', 'runtime:windows')
diff --git a/src/renderer/src/lib/setup-script-prompt.ts b/src/renderer/src/lib/setup-script-prompt.ts
index f25b806d1ef..6adbc04b092 100644
--- a/src/renderer/src/lib/setup-script-prompt.ts
+++ b/src/renderer/src/lib/setup-script-prompt.ts
@@ -90,14 +90,25 @@ export function isSetupScriptPromptDismissed(
   return dismissedEntries.includes(getSetupScriptPromptDismissalKey(repoHostIdentity))
 }
 
+function isUnchangedDismissalList(
+  value: unknown,
+  next: readonly string[]
+): value is readonly string[] {
+  return (
+    Array.isArray(value) &&
+    value.length === next.length &&
+    value.every((entry, index) => entry === next[index])
+  )
+}
+
 export function filterSetupScriptPromptDismissalsToValidRepos(
   value: unknown,
   validRepoHostIdentities: Set<string>
-): string[] {
+): readonly string[] {
   const unambiguousIdentityByRepoId = new Map<string, string | null>()
   for (const identity of validRepoHostIdentities) {
     const separatorIndex = identity.indexOf('\0')
-    const repoId = separatorIndex >= 0 ? identity.slice(separatorIndex + 1) : identity
+    const repoId = separatorIndex !== -1 ? identity.slice(separatorIndex + 1) : identity
     unambiguousIdentityByRepoId.set(
       repoId,
       unambiguousIdentityByRepoId.has(repoId) ? null : identity
@@ -117,10 +128,18 @@ export function filterSetupScriptPromptDismissalsToValidRepos(
       }
     }
   }
+  // Why: fetchRepos / fetchRuntimeEnvironmentRepos / validateRepoScopedUi assign
+  // this into set() on every catalog refresh. SetupScriptPromptCard Object.is-
+  // subscribes to the array, so a fresh copy on a no-op prune is a guaranteed miss.
+  // Compare against the original input, not the sanitize copy — sanitize always
+  // allocates, including for [] and already-valid host-identity keys.
+  if (isUnchangedDismissalList(value, next)) {
+    return value
+  }
   return next
 }
 
-export function sanitizeSetupScriptPromptDismissals(value: unknown): string[] {
+export function sanitizeSetupScriptPromptDismissals(value: unknown): readonly string[] {
   if (!Array.isArray(value)) {
     return []
   }
diff --git a/src/renderer/src/lib/simulator-pane-shutdown-scheduler.ts b/src/renderer/src/lib/simulator-pane-shutdown-scheduler.ts
index 722f322d80a..907ccee5093 100644
--- a/src/renderer/src/lib/simulator-pane-shutdown-scheduler.ts
+++ b/src/renderer/src/lib/simulator-pane-shutdown-scheduler.ts
@@ -9,7 +9,7 @@ type SimulatorTabReference = {
 
 type SimulatorPaneShutdownOptions = {
   getTabsForWorktree?: (worktreeId: string) => SimulatorTabReference[]
-  shutdownManagedSimulator?: (worktreeId: string) => Promise<unknown> | unknown
+  shutdownManagedSimulator?: (worktreeId: string) => unknown
 }
 
 type ScheduleSimulatorPaneShutdownOptions = SimulatorPaneShutdownOptions & {
diff --git a/src/renderer/src/lib/source-control-launch-agent-selection.ts b/src/renderer/src/lib/source-control-launch-agent-selection.ts
index e8c00812590..c72098c9481 100644
--- a/src/renderer/src/lib/source-control-launch-agent-selection.ts
+++ b/src/renderer/src/lib/source-control-launch-agent-selection.ts
@@ -110,7 +110,7 @@ function hasActionOverride(
   overrides: NormalizedRepoSourceControlAiOverrides['actionOverrides'] | undefined,
   actionId: SourceControlActionId
 ): boolean {
-  return Object.prototype.hasOwnProperty.call(overrides ?? {}, actionId)
+  return Object.hasOwn(overrides ?? {}, actionId)
 }
 
 function readRecipeOverrideFields(
@@ -120,13 +120,13 @@ function readRecipeOverrideFields(
     | undefined
 ): SourceControlActionRecipeOverrideField[] {
   const fields: SourceControlActionRecipeOverrideField[] = []
-  if (Object.prototype.hasOwnProperty.call(recipe ?? {}, 'agentId')) {
+  if (Object.hasOwn(recipe ?? {}, 'agentId')) {
     fields.push('agent')
   }
-  if (Object.prototype.hasOwnProperty.call(recipe ?? {}, 'commandInputTemplate')) {
+  if (Object.hasOwn(recipe ?? {}, 'commandInputTemplate')) {
     fields.push('commandTemplate')
   }
-  if (Object.prototype.hasOwnProperty.call(recipe ?? {}, 'agentArgs')) {
+  if (Object.hasOwn(recipe ?? {}, 'agentArgs')) {
     fields.push('agentArgs')
   }
   return fields
diff --git a/src/renderer/src/lib/terminal-contrast-correction.test.ts b/src/renderer/src/lib/terminal-contrast-correction.test.ts
index 7f5cd76cbfe..2197bdf903c 100644
--- a/src/renderer/src/lib/terminal-contrast-correction.test.ts
+++ b/src/renderer/src/lib/terminal-contrast-correction.test.ts
@@ -12,7 +12,7 @@ function contrastRatio(a: string, b: string): number {
     const n = Number.parseInt(hex.replace('#', ''), 16)
     const toLinear = (channel: number): number => {
       const c = channel / 255
-      return c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4)
+      return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4
     }
     const r = toLinear((n >> 16) & 0xff)
     const g = toLinear((n >> 8) & 0xff)
diff --git a/src/renderer/src/lib/terminal-layout-equality.ts b/src/renderer/src/lib/terminal-layout-equality.ts
index ce11907bed1..716482764e8 100644
--- a/src/renderer/src/lib/terminal-layout-equality.ts
+++ b/src/renderer/src/lib/terminal-layout-equality.ts
@@ -10,9 +10,7 @@ function sameStringRecord(
   const rightKeys = Object.keys(right)
   return (
     leftKeys.length === rightKeys.length &&
-    leftKeys.every(
-      (key) => Object.prototype.hasOwnProperty.call(right, key) && left[key] === right[key]
-    )
+    leftKeys.every((key) => Object.hasOwn(right, key) && left[key] === right[key])
   )
 }
 
diff --git a/src/renderer/src/lib/terminal-quick-command-search.ts b/src/renderer/src/lib/terminal-quick-command-search.ts
index 09027cbfd16..8530e915d07 100644
--- a/src/renderer/src/lib/terminal-quick-command-search.ts
+++ b/src/renderer/src/lib/terminal-quick-command-search.ts
@@ -93,11 +93,11 @@ function scoreCandidate(query: string, rawCandidate: string, baseScore: number):
     return baseScore + 50
   }
   const wordIndex = candidate.indexOf(` ${query}`)
-  if (wordIndex >= 0) {
+  if (wordIndex !== -1) {
     return baseScore + 100 + wordIndex
   }
   const index = candidate.indexOf(query)
-  if (index >= 0) {
+  if (index !== -1) {
     return baseScore + 200 + index
   }
   return NO_MATCH
diff --git a/src/renderer/src/lib/terminal-themes/shared.ts b/src/renderer/src/lib/terminal-themes/shared.ts
index 023213a6605..3d3ee17abba 100644
--- a/src/renderer/src/lib/terminal-themes/shared.ts
+++ b/src/renderer/src/lib/terminal-themes/shared.ts
@@ -7,7 +7,7 @@ export function mergeTerminalThemeCatalogs(
 
   for (const catalog of catalogs) {
     for (const [name, theme] of Object.entries(catalog)) {
-      if (Object.prototype.hasOwnProperty.call(merged, name)) {
+      if (Object.hasOwn(merged, name)) {
         throw new Error(`Duplicate terminal theme name: ${name}`)
       }
       merged[name] = theme
diff --git a/src/renderer/src/lib/terminal-title-contrast.ts b/src/renderer/src/lib/terminal-title-contrast.ts
index a54a4819092..38afe002ed2 100644
--- a/src/renderer/src/lib/terminal-title-contrast.ts
+++ b/src/renderer/src/lib/terminal-title-contrast.ts
@@ -183,7 +183,7 @@ function compositeRgb(foreground: RgbaColor, background: RgbaColor, alpha: numbe
 function relativeLuminance(rgb: Pick<RgbaColor, 'r' | 'g' | 'b'>): number {
   const toLinear = (channel: number): number => {
     const normalized = channel / 255
-    return normalized <= 0.03928 ? normalized / 12.92 : Math.pow((normalized + 0.055) / 1.055, 2.4)
+    return normalized <= 0.03928 ? normalized / 12.92 : ((normalized + 0.055) / 1.055) ** 2.4
   }
   return 0.2126 * toLinear(rgb.r) + 0.7152 * toLinear(rgb.g) + 0.0722 * toLinear(rgb.b)
 }
diff --git a/src/renderer/src/lib/ui-zoom.ts b/src/renderer/src/lib/ui-zoom.ts
index 7ab1a00e19f..eb1749f222c 100644
--- a/src/renderer/src/lib/ui-zoom.ts
+++ b/src/renderer/src/lib/ui-zoom.ts
@@ -6,7 +6,7 @@ const isMac = navigator.userAgent.includes('Mac')
  * and repositions the native macOS traffic lights to stay aligned.
  */
 export function applyUIZoom(level: number): void {
-  const zoomFactor = Math.pow(1.2, level)
+  const zoomFactor = 1.2 ** level
   window.api.ui.setZoomLevel(level)
   document.documentElement.style.setProperty('--ui-zoom-factor', String(zoomFactor))
   if (isMac) {
@@ -20,7 +20,7 @@ export function applyUIZoom(level: number): void {
  */
 export function syncZoomCSSVar(): void {
   const level = window.api.ui.getZoomLevel()
-  const zoomFactor = Math.pow(1.2, level)
+  const zoomFactor = 1.2 ** level
   document.documentElement.style.setProperty('--ui-zoom-factor', String(zoomFactor))
   if (isMac) {
     window.api.ui.syncTrafficLights(zoomFactor)
diff --git a/src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts b/src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts
index 0b30b90bbc1..abf724a67c1 100644
--- a/src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts
+++ b/src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts
@@ -23,7 +23,8 @@ const identityScenarios: [
 ][] = [
   ['live local', { isRemote: false }],
   ['inactive local split', { isRemote: false, siblingHookAgent: 'claude' }],
-  ['inactive SSH/tmux', { isRemote: true, title: 'tmux | OC | Greeting' }]
+  ['inactive SSH/tmux', { isRemote: true, title: 'tmux | OC | Greeting' }],
+  ['multi-token SSH wrapper', { isRemote: true, title: 'ssh build-host | OC | Greeting' }]
 ]
 
 function HookProbe({ tab }: { tab: TerminalTab }): null {
@@ -255,7 +256,6 @@ describe('OpenCode native title tab identity', () => {
     for (const title of [
       'OpenCode ready',
       'oc | Greeting',
-      'my session | OC | Greeting',
       '⠋ Fix foo | OC | Greeting',
       '✦ Gemini CLI',
       '⠋ Codex',
diff --git a/src/renderer/src/lib/window-visibility-interval.ts b/src/renderer/src/lib/window-visibility-interval.ts
index bdd250d5c16..aa1337fc095 100644
--- a/src/renderer/src/lib/window-visibility-interval.ts
+++ b/src/renderer/src/lib/window-visibility-interval.ts
@@ -3,7 +3,7 @@ export type WindowVisibilityIntervalTimer = ReturnType<typeof setInterval>
 export function isWindowVisible(): boolean {
   return (
     typeof document === 'undefined' ||
-    typeof document.visibilityState === 'undefined' ||
+    document.visibilityState === undefined ||
     document.visibilityState === 'visible'
   )
 }
diff --git a/src/renderer/src/lib/workspace-browser-tab-open.test.ts b/src/renderer/src/lib/workspace-browser-tab-open.test.ts
index 7435629a645..936bed7bb2c 100644
--- a/src/renderer/src/lib/workspace-browser-tab-open.test.ts
+++ b/src/renderer/src/lib/workspace-browser-tab-open.test.ts
@@ -4,11 +4,17 @@ import {
   toRuntimeExecutionHostId,
   toSshExecutionHostId
 } from '../../../shared/execution-host'
-import { openWorkspaceBrowserTab } from './workspace-browser-tab-open'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
+import { BROWSER_SCREENCAST_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import {
+  canOpenWorkspaceBrowserTabOnRuntime,
+  openWorkspaceBrowserTab
+} from './workspace-browser-tab-open'
 
 const mocks = vi.hoisted(() => ({
   createRemote: vi.fn(),
   getState: vi.fn(),
+  pairedWeb: false,
   state: {} as Record<string, unknown>
 }))
 
@@ -20,6 +26,10 @@ vi.mock('@/runtime/web-runtime-session', () => ({
   createWebRuntimeSessionBrowserTab: (...args: unknown[]) => mocks.createRemote(...args)
 }))
 
+vi.mock('./desktop-window-chrome', () => ({
+  isPairedWebClientWindow: () => mocks.pairedWeb
+}))
+
 const WORKSPACE_ID = 'repo-1::/repo/worktree'
 
 function ownerState(hostId?: string, runtimeOwnerEnvironmentId?: string): Record<string, unknown> {
@@ -37,9 +47,21 @@ function ownerState(hostId?: string, runtimeOwnerEnvironmentId?: string): Record
   }
 }
 
+function browserCapableRuntime(environmentId: string): Record<string, unknown> {
+  return {
+    runtimeStatusByEnvironmentId: new Map([
+      [
+        environmentId,
+        { status: { capabilities: [BROWSER_SCREENCAST_RUNTIME_CAPABILITY] }, checkedAt: 1 }
+      ]
+    ])
+  }
+}
+
 beforeEach(() => {
   mocks.createRemote.mockReset().mockResolvedValue(true)
   mocks.getState.mockReset().mockImplementation(() => mocks.state)
+  mocks.pairedWeb = false
   mocks.state = {}
 })
 
@@ -80,11 +102,16 @@ describe('openWorkspaceBrowserTab', () => {
     const createBrowserTab = vi.fn()
     mocks.state = {
       ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      ...browserCapableRuntime('hub-a'),
       createBrowserTab,
       defaultBrowserSessionProfileId: 'client-profile',
       defaultBrowserSessionProfileIdByHostId: {}
     }
 
+    expect(canOpenWorkspaceBrowserTabOnRuntime(mocks.state as never, WORKSPACE_ID, 'hub-a')).toBe(
+      true
+    )
+
     await openWorkspaceBrowserTab({
       workspaceId: WORKSPACE_ID,
       url: 'https://example.com/docs?token=secret',
@@ -104,6 +131,188 @@ describe('openWorkspaceBrowserTab', () => {
     expect(createBrowserTab).not.toHaveBeenCalled()
   })
 
+  it('fails closed when the workspace route swaps away from the pane runtime before opening', async () => {
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+    const paneRuntimeEnvironmentId = 'hub-a'
+
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-b')),
+      ...browserCapableRuntime('hub-b'),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: WORKSPACE_ID,
+        url: 'https://example.com/',
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: paneRuntimeEnvironmentId
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('fails closed for a blank asserted runtime owner', async () => {
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: WORKSPACE_ID,
+        url: 'https://example.com/',
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: '   '
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('routes an asserted paired-HUB SSH owner through that runtime', async () => {
+    const sshHost = toSshExecutionHostId('ssh-target')
+    mocks.state = {
+      ...ownerState(sshHost, 'hub-a'),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    await openWorkspaceBrowserTab({
+      workspaceId: WORKSPACE_ID,
+      url: 'http://localhost:3000/',
+      intent: { kind: 'url' },
+      expectedRuntimeEnvironmentId: 'hub-a'
+    })
+
+    expect(mocks.createRemote).toHaveBeenCalledWith(
+      expect.objectContaining({ environmentId: 'hub-a', worktreeId: WORKSPACE_ID })
+    )
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('does not fall back to a client browser for an incapable asserted runtime', async () => {
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    expect(canOpenWorkspaceBrowserTabOnRuntime(mocks.state as never, WORKSPACE_ID, 'hub-a')).toBe(
+      false
+    )
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: WORKSPACE_ID,
+        url: 'https://example.com/',
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: 'hub-a'
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('does not fall back to a client browser when asserted runtime creation fails', async () => {
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+    mocks.createRemote.mockResolvedValue(false)
+
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: WORKSPACE_ID,
+        url: 'https://example.com/',
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: 'hub-a'
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.createRemote).toHaveBeenCalledWith(
+      expect.objectContaining({ environmentId: 'hub-a' })
+    )
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('does not route an asserted floating-terminal source to either runtime or local browser', async () => {
+    const createBrowserTab = vi.fn()
+    mocks.state = {
+      activeWorktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+      activeWorkspaceExecutionHostId: toRuntimeExecutionHostId('hub-a'),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab,
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    expect(
+      canOpenWorkspaceBrowserTabOnRuntime(
+        mocks.state as never,
+        FLOATING_TERMINAL_WORKTREE_ID,
+        'hub-a'
+      )
+    ).toBe(false)
+
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: FLOATING_TERMINAL_WORKTREE_ID,
+        url: 'http://localhost:3000/',
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: 'hub-a'
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+    expect(createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('keeps runtime browser actions unavailable in a paired-web floating workspace', async () => {
+    mocks.pairedWeb = true
+    mocks.state = {
+      activeWorktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+      activeWorkspaceExecutionHostId: toRuntimeExecutionHostId('hub-a'),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    expect(
+      canOpenWorkspaceBrowserTabOnRuntime(
+        mocks.state as never,
+        FLOATING_TERMINAL_WORKTREE_ID,
+        'hub-a'
+      )
+    ).toBe(false)
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: FLOATING_TERMINAL_WORKTREE_ID,
+        url: 'http://localhost:3000/',
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: 'hub-a'
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+
   // Two dev servers on one host must not share a tab title.
   it('keeps the port in local-dev tab titles', async () => {
     const createBrowserTab = vi.fn()
@@ -124,7 +333,7 @@ describe('openWorkspaceBrowserTab', () => {
     ])
   })
 
-  it('keeps the worktree session profile when a runtime open soft-fails', async () => {
+  it('uses the desktop provider when the runtime cannot stream browsers', async () => {
     const createBrowserTab = vi.fn()
     const sshHost = toSshExecutionHostId('ssh-target')
     mocks.state = {
@@ -141,7 +350,7 @@ describe('openWorkspaceBrowserTab', () => {
       intent: { kind: 'search', engine: 'google' }
     })
 
-    expect(mocks.createRemote).toHaveBeenCalledOnce()
+    expect(mocks.createRemote).not.toHaveBeenCalled()
     expect(createBrowserTab).toHaveBeenCalledWith(
       WORKSPACE_ID,
       'https://www.google.com/search?q=hooks',
@@ -149,6 +358,28 @@ describe('openWorkspaceBrowserTab', () => {
     )
   })
 
+  it('does not fall back locally when the runtime create outcome is unknown', async () => {
+    const createBrowserTab = vi.fn()
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab,
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+    mocks.createRemote.mockRejectedValue(new Error('create outcome unknown'))
+
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: WORKSPACE_ID,
+        url: 'https://example.com/',
+        intent: { kind: 'url' }
+      })
+    ).rejects.toThrow('Unable to open URL.')
+
+    expect(createBrowserTab).not.toHaveBeenCalled()
+  })
+
   it('fails closed for invalid targets and unresolved owners, then falls back locally', async () => {
     const secretUrl = 'https://example.com/?q=secret-value'
     const request = {
@@ -184,19 +415,13 @@ describe('openWorkspaceBrowserTab', () => {
 
     mocks.state = {
       ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      ...browserCapableRuntime('hub-a'),
       createBrowserTab: vi.fn(),
       defaultBrowserSessionProfileId: 'focused-profile',
       defaultBrowserSessionProfileIdByHostId: { local: 'local-profile' }
     }
     mocks.createRemote.mockResolvedValue(false)
-    await openWorkspaceBrowserTab(request)
-    expect(mocks.state.createBrowserTab).toHaveBeenCalledWith(WORKSPACE_ID, secretUrl, {
-      activate: true,
-      browserRuntimeEnvironmentId: null,
-      focusAddressBar: false,
-      sessionProfileId: 'local-profile',
-      targetGroupId: undefined,
-      title: 'Search Kagi'
-    })
+    await expect(openWorkspaceBrowserTab(request)).rejects.toThrow('Unable to search with Kagi.')
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
   })
 })
diff --git a/src/renderer/src/lib/workspace-browser-tab-open.ts b/src/renderer/src/lib/workspace-browser-tab-open.ts
index 9fb13891c86..cc6adbb5669 100644
--- a/src/renderer/src/lib/workspace-browser-tab-open.ts
+++ b/src/renderer/src/lib/workspace-browser-tab-open.ts
@@ -8,6 +8,12 @@ import {
   type ExecutionHostId
 } from '../../../shared/execution-host'
 import { SEARCH_ENGINE_LABELS, type SearchEngine } from '../../../shared/browser-url'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
+import { BROWSER_SCREENCAST_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import {
+  getClientCreationActionPolicy,
+  type ClientCreationActionAvailability
+} from './client-creation-action-policy'
 import { resolveWorktreeOperationRoute } from './worktree-operation-route'
 
 export type WorkspaceBrowserTabIntent = { kind: 'url' } | { kind: 'search'; engine: SearchEngine }
@@ -17,6 +23,50 @@ export type OpenWorkspaceBrowserTabRequest = {
   targetGroupId?: string
   url: string
   intent: WorkspaceBrowserTabIntent
+  expectedRuntimeEnvironmentId?: string
+}
+
+function isExpectedRuntimeBrowserRoute(
+  state: AppState,
+  availability: ClientCreationActionAvailability,
+  route: ReturnType<typeof resolveWorktreeOperationRoute>,
+  workspaceId: string,
+  expectedRuntimeEnvironmentId: string
+): boolean {
+  if (availability.state !== 'enabled' || workspaceId === FLOATING_TERMINAL_WORKTREE_ID || !route) {
+    return false
+  }
+  const expectedEnvironmentId = expectedRuntimeEnvironmentId.trim()
+  const environmentId = route.runtimeEnvironmentId?.trim() || null
+  const capabilities =
+    state.runtimeStatusByEnvironmentId?.get(expectedEnvironmentId)?.status?.capabilities
+  if (
+    environmentId !== expectedEnvironmentId ||
+    !capabilities?.includes(BROWSER_SCREENCAST_RUNTIME_CAPABILITY)
+  ) {
+    return false
+  }
+  const host = parseExecutionHostId(route.executionHostId)
+  return (
+    !route.executionHostId ||
+    Boolean(host && (host.kind !== 'runtime' || host.environmentId === environmentId))
+  )
+}
+
+export function canOpenWorkspaceBrowserTabOnRuntime(
+  state: AppState,
+  workspaceId: string,
+  expectedRuntimeEnvironmentId: string
+): boolean {
+  const availability = getClientCreationActionPolicy(state, workspaceId)['managed-browser']
+  const route = resolveWorktreeOperationRoute(state, workspaceId)
+  return isExpectedRuntimeBrowserRoute(
+    state,
+    availability,
+    route,
+    workspaceId,
+    expectedRuntimeEnvironmentId
+  )
 }
 
 // Why: concurrent URL tabs are indistinguishable under a shared "Open URL"
@@ -105,6 +155,15 @@ function createClientBrowserTab(
   }
 }
 
+function assertManagedBrowserEnabled(
+  availability: ClientCreationActionAvailability,
+  presentation: { error: string }
+): asserts availability is Extract<ClientCreationActionAvailability, { state: 'enabled' }> {
+  if (availability.state !== 'enabled') {
+    throw openFailure(presentation.error, availability.reason)
+  }
+}
+
 export async function openWorkspaceBrowserTab(
   request: OpenWorkspaceBrowserTabRequest
 ): Promise<void> {
@@ -113,11 +172,29 @@ export async function openWorkspaceBrowserTab(
     throw openFailure(presentation.error, 'target is not an http(s) URL')
   }
   const state = useAppStore.getState()
+  const availability = getClientCreationActionPolicy(state, request.workspaceId)['managed-browser']
+  assertManagedBrowserEnabled(availability, presentation)
   const route = resolveWorktreeOperationRoute(state, request.workspaceId)
   if (!route) {
     throw openFailure(presentation.error, 'no active worktree route')
   }
   const environmentId = route.runtimeEnvironmentId?.trim() || null
+  const expectedEnvironmentId =
+    request.expectedRuntimeEnvironmentId === undefined
+      ? null
+      : request.expectedRuntimeEnvironmentId.trim()
+  if (
+    expectedEnvironmentId !== null &&
+    !isExpectedRuntimeBrowserRoute(
+      state,
+      availability,
+      route,
+      request.workspaceId,
+      expectedEnvironmentId
+    )
+  ) {
+    throw openFailure(presentation.error, 'asserted runtime cannot provide this managed browser')
+  }
   const host = parseExecutionHostId(route.executionHostId)
   if (!environmentId) {
     if (!host || host.kind === 'runtime') {
@@ -135,6 +212,11 @@ export async function openWorkspaceBrowserTab(
       `host ${route.executionHostId} does not own runtime ${environmentId}`
     )
   }
+  if (availability.provider === 'local-client') {
+    const localHostId = host && host.kind !== 'runtime' ? host.id : LOCAL_EXECUTION_HOST_ID
+    createClientBrowserTab(state, request, localHostId, presentation)
+    return
+  }
   let created = false
   try {
     created = await createWebRuntimeSessionBrowserTab({
@@ -153,10 +235,6 @@ export async function openWorkspaceBrowserTab(
     throw openFailure(presentation.error, 'runtime browser tab creation failed', error)
   }
   if (!created) {
-    // Why: a soft runtime failure still opens client-side, so keep the
-    // workspace's own session profile rather than collapsing every remote
-    // host onto the local cookie jar.
-    const fallbackHostId = host && host.kind !== 'runtime' ? host.id : LOCAL_EXECUTION_HOST_ID
-    createClientBrowserTab(state, request, fallbackHostId, presentation)
+    throw openFailure(presentation.error, 'runtime browser tab creation was unavailable')
   }
 }
diff --git a/src/renderer/src/lib/workspace-emoji-shortcodes.ts b/src/renderer/src/lib/workspace-emoji-shortcodes.ts
index 23feeb735e0..29e06dc74c9 100644
--- a/src/renderer/src/lib/workspace-emoji-shortcodes.ts
+++ b/src/renderer/src/lib/workspace-emoji-shortcodes.ts
@@ -25,7 +25,7 @@ const MATCH_TIER = { exact: 0, prefix: 1, wordStart: 2, substring: 3 } as const
 
 function matchTier(shortcode: string, query: string): number | null {
   const index = shortcode.indexOf(query)
-  if (index < 0) {
+  if (index === -1) {
     return null
   }
   if (index === 0) {
diff --git a/src/renderer/src/lib/workspace-port-actions.ts b/src/renderer/src/lib/workspace-port-actions.ts
index 07643a186a8..a529bc2d31b 100644
--- a/src/renderer/src/lib/workspace-port-actions.ts
+++ b/src/renderer/src/lib/workspace-port-actions.ts
@@ -1,6 +1,7 @@
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
 import type { useAppStore } from '@/store'
 import {
+  assertRuntimeEnvironmentCapability,
   callRuntimeRpc,
   RuntimeRpcCallError,
   type RuntimeClientTarget
@@ -15,6 +16,8 @@ import type {
 import type { LocalhostWorktreeLabelRoute } from '../../../shared/localhost-worktree-labels'
 import { runWorkspacePortScanForTarget } from './workspace-port-scan-client'
 import { browserUrlForPort } from './workspace-port-urls'
+import { BROWSER_SCREENCAST_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import { RUNTIME_BROWSER_UNAVAILABLE_MESSAGE } from './client-creation-action-policy'
 
 export { addressForPort } from './workspace-port-urls'
 
@@ -124,13 +127,21 @@ export async function openWorkspacePortInBrowser(args: {
   activateAndRevealWorktree(worktreeId)
   if (args.runtimeTarget.kind === 'environment') {
     try {
+      await assertRuntimeEnvironmentCapability(
+        args.runtimeTarget.environmentId,
+        BROWSER_SCREENCAST_RUNTIME_CAPABILITY,
+        RUNTIME_BROWSER_UNAVAILABLE_MESSAGE
+      )
       const remotePage = await callRuntimeRpc<{ browserPageId: string }>(
         args.runtimeTarget,
         'browser.tabCreate',
         { worktree: toRuntimeWorktreeSelector(worktreeId), url },
         { timeoutMs: 30_000 }
       )
-      const tab = args.createBrowserTab(worktreeId, url, { activate: true })
+      const tab = args.createBrowserTab(worktreeId, url, {
+        activate: true,
+        browserRuntimeEnvironmentId: args.runtimeTarget.environmentId
+      })
       if (!tab.activePageId) {
         return { ok: false, reason: 'Failed to create a browser page.' }
       }
@@ -144,8 +155,13 @@ export async function openWorkspacePortInBrowser(args: {
       return { ok: false, reason: message || 'Failed to open remote browser.' }
     }
   }
-  args.createBrowserTab(worktreeId, url, { activate: true })
-  return { ok: true }
+  try {
+    args.createBrowserTab(worktreeId, url, { activate: true })
+    return { ok: true }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    return { ok: false, reason: message || 'Failed to open browser.' }
+  }
 }
 
 export async function refreshWorkspacePortScanAfterStop(args: {
diff --git a/src/renderer/src/lib/worktree-activation-created-agent.test.ts b/src/renderer/src/lib/worktree-activation-created-agent.test.ts
index cc2af6e7d7c..e8a1ef3f052 100644
--- a/src/renderer/src/lib/worktree-activation-created-agent.test.ts
+++ b/src/renderer/src/lib/worktree-activation-created-agent.test.ts
@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { getDefaultSettings } from '../../../shared/constants'
+import { TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
 import { useAppStore } from '@/store'
 import {
   activateAndRevealWorktree,
@@ -23,6 +24,35 @@ function makeWebRuntimeWorktree() {
   }
 }
 
+function makeWakeTerminalRuntimeCall(worktreeId: string) {
+  return vi.fn(async (args: { method?: string }) => {
+    if (args.method === 'status.get') {
+      return {
+        ok: true,
+        result: { capabilities: [TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY] }
+      }
+    }
+    if (args.method === 'session.tabs.list') {
+      return {
+        ok: true,
+        result: {
+          worktree: worktreeId,
+          publicationEpoch: 'epoch-1',
+          snapshotVersion: 1,
+          activeGroupId: null,
+          activeTabId: null,
+          activeTabType: null,
+          tabs: []
+        }
+      }
+    }
+    return {
+      ok: true,
+      result: { tab: { id: 'host-tab-1::leaf-1', leafId: 'leaf-1' } }
+    }
+  })
+}
+
 /** Activates and asserts a focusable tab appeared with no queued startup, returning its id. */
 function activateAndExpectNoRelaunch(
   worktreeId: string,
@@ -536,16 +566,7 @@ describe('activateAndRevealWorktree', () => {
 
   it('respawns a host terminal when waking a slept web workspace with dead local PTYs', async () => {
     const worktree = makeWebRuntimeWorktree()
-    const callRuntimeEnvironment = vi
-      .fn()
-      .mockResolvedValueOnce({
-        ok: true,
-        result: { repoId: worktree.repoId, worktreeId: worktree.id, activated: true }
-      })
-      .mockResolvedValueOnce({
-        ok: true,
-        result: { tabId: 'host-tab-1', terminal: 'term_host' }
-      })
+    const callRuntimeEnvironment = makeWakeTerminalRuntimeCall(worktree.id)
     ;(globalThis as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__ = true
     vi.stubGlobal('window', {
       api: {
@@ -612,9 +633,19 @@ describe('activateAndRevealWorktree', () => {
     })
 
     ensureWebRuntimeWorktreeTerminalAfterWake(worktree.id)
-    await new Promise((resolve) => setTimeout(resolve, 0))
+    await vi.waitFor(() => {
+      expect(callRuntimeEnvironment).toHaveBeenCalledTimes(3)
+    })
 
-    expect(callRuntimeEnvironment).toHaveBeenCalledWith(
+    expect(callRuntimeEnvironment).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        selector: 'web-runtime-1',
+        method: 'status.get'
+      })
+    )
+    expect(callRuntimeEnvironment).toHaveBeenNthCalledWith(
+      2,
       expect.objectContaining({
         selector: 'web-runtime-1',
         method: 'session.tabs.createTerminal'
@@ -624,10 +655,7 @@ describe('activateAndRevealWorktree', () => {
 
   it('respawns wake terminals on the explicit owner runtime when focus changed', async () => {
     const worktree = makeWorktree()
-    const callRuntimeEnvironment = vi.fn().mockResolvedValue({
-      ok: true,
-      result: { tabId: 'host-tab-1', terminal: 'term_host' }
-    })
+    const callRuntimeEnvironment = makeWakeTerminalRuntimeCall(worktree.id)
     ;(globalThis as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__ = true
     vi.stubGlobal('window', {
       api: {
@@ -676,9 +704,19 @@ describe('activateAndRevealWorktree', () => {
     })
 
     ensureWebRuntimeWorktreeTerminalAfterWake(worktree.id)
-    await new Promise((resolve) => setTimeout(resolve, 0))
+    await vi.waitFor(() => {
+      expect(callRuntimeEnvironment).toHaveBeenCalledTimes(3)
+    })
 
-    expect(callRuntimeEnvironment).toHaveBeenCalledWith(
+    expect(callRuntimeEnvironment).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        selector: 'owner-runtime',
+        method: 'status.get'
+      })
+    )
+    expect(callRuntimeEnvironment).toHaveBeenNthCalledWith(
+      2,
       expect.objectContaining({
         selector: 'owner-runtime',
         method: 'session.tabs.createTerminal'
diff --git a/src/renderer/src/lib/worktree-activation-empty-remote.test.ts b/src/renderer/src/lib/worktree-activation-empty-remote.test.ts
index 49f38e7aa7c..c4e2edc4907 100644
--- a/src/renderer/src/lib/worktree-activation-empty-remote.test.ts
+++ b/src/renderer/src/lib/worktree-activation-empty-remote.test.ts
@@ -1,6 +1,7 @@
 import path from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { getDefaultSettings } from '../../../shared/constants'
+import { TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
 import type { Worktree } from '../../../shared/types'
 import { resetWebRuntimeWakeTerminalRespawnForTests } from '@/runtime/web-runtime-wake-terminal-respawn'
 import { resetWebSessionTabsSnapshotFreshnessForTests } from '@/runtime/web-session-tabs-sync'
@@ -48,21 +49,43 @@ function makeWorktree(): Worktree {
 describe('empty remote worktree activation', () => {
   it('creates a host terminal when waking an empty remote workspace', async () => {
     const worktree = makeWorktree()
-    const callRuntimeEnvironment = vi.fn().mockResolvedValueOnce({
-      ok: true,
-      result: {
-        tab: {
-          type: 'terminal',
-          id: 'host-tab-1::leaf-1',
-          parentTabId: 'host-tab-1',
-          leafId: 'leaf-1',
-          title: 'Terminal 1',
-          terminal: 'term_host',
-          status: 'ready',
-          isActive: true
-        },
-        publicationEpoch: 'epoch-1',
-        snapshotVersion: 1
+    const callRuntimeEnvironment = vi.fn(async (args: { method?: string }) => {
+      if (args.method === 'status.get') {
+        return {
+          ok: true,
+          result: { capabilities: [TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY] }
+        }
+      }
+      if (args.method === 'session.tabs.list') {
+        return {
+          ok: true,
+          result: {
+            worktree: worktree.id,
+            publicationEpoch: 'epoch-1',
+            snapshotVersion: 1,
+            activeGroupId: null,
+            activeTabId: null,
+            activeTabType: null,
+            tabs: []
+          }
+        }
+      }
+      return {
+        ok: true,
+        result: {
+          tab: {
+            type: 'terminal',
+            id: 'host-tab-1::leaf-1',
+            parentTabId: 'host-tab-1',
+            leafId: 'leaf-1',
+            title: 'Terminal 1',
+            terminal: 'term_host',
+            status: 'ready',
+            isActive: true
+          },
+          publicationEpoch: 'epoch-1',
+          snapshotVersion: 1
+        }
       }
     })
     ;(globalThis as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__ = true
@@ -100,10 +123,18 @@ describe('empty remote worktree activation', () => {
 
     ensureWebRuntimeWorktreeTerminalAfterWake(worktree.id)
     await vi.waitFor(() => {
-      expect(callRuntimeEnvironment).toHaveBeenCalled()
+      expect(callRuntimeEnvironment).toHaveBeenCalledTimes(3)
     })
 
-    expect(callRuntimeEnvironment).toHaveBeenCalledWith(
+    expect(callRuntimeEnvironment).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        selector: 'web-runtime-1',
+        method: 'status.get'
+      })
+    )
+    expect(callRuntimeEnvironment).toHaveBeenNthCalledWith(
+      2,
       expect.objectContaining({
         selector: 'web-runtime-1',
         method: 'session.tabs.createTerminal',
diff --git a/src/renderer/src/lib/worktree-palette-search.test.ts b/src/renderer/src/lib/worktree-palette-search.test.ts
index 81d549a346c..6e0fa1848f9 100644
--- a/src/renderer/src/lib/worktree-palette-search.test.ts
+++ b/src/renderer/src/lib/worktree-palette-search.test.ts
@@ -540,6 +540,75 @@ describe('worktree-palette-search', () => {
     })
   })
 
+  it('matches a pasted GitHub issue URL to the linked worktree instead of the URL text', () => {
+    const results = searchWorktrees(
+      [
+        makeWorktree({ id: 'wt-issue', linkedIssue: 14198 }),
+        makeWorktree({ id: 'wt-other', linkedIssue: 7, displayName: 'github.com' })
+      ],
+      'https://github.com/stablyai/orca/issues/14198',
+      repoMap,
+      null,
+      null
+    )
+
+    expect(results).toEqual([
+      expect.objectContaining({
+        worktreeId: 'wt-issue',
+        matchedField: 'issue',
+        supportingText: {
+          labelKind: 'issue',
+          text: 'Issue #14198',
+          matchRange: { start: 0, end: 'Issue #14198'.length }
+        }
+      })
+    ])
+  })
+
+  it('matches a pasted GitHub pull URL to the linked worktree', () => {
+    const results = searchWorktrees(
+      [
+        makeWorktree({
+          id: 'wt-pr',
+          linkedPR: 12789,
+          linkedWorkItem: {
+            provider: 'github',
+            type: 'pr',
+            number: 12789,
+            title: 'Perf',
+            url: 'https://github.com/stablyai/orca/pull/12789'
+          }
+        }),
+        makeWorktree({ id: 'wt-issue', linkedIssue: 12789 })
+      ],
+      'https://github.com/stablyai/orca/pull/12789',
+      repoMap,
+      null,
+      null
+    )
+
+    expect(results.map((result) => result.worktreeId)).toEqual(['wt-pr'])
+  })
+
+  it('matches a pasted Linear issue URL to the linked worktree', () => {
+    const results = searchWorktrees(
+      [
+        makeWorktree({
+          id: 'wt-linear',
+          linkedLinearIssue: 'STA-4052',
+          linkedLinearIssueOrganizationUrlKey: 'stably'
+        }),
+        makeWorktree({ id: 'wt-name', displayName: 'linear.app' })
+      ],
+      'https://linear.app/stably/issue/STA-4052/agent-terminals-disappearing-randomly',
+      repoMap,
+      null,
+      null
+    )
+
+    expect(results.map((result) => result.worktreeId)).toEqual(['wt-linear'])
+  })
+
   it('matches workspace ports by port number before issue and PR numbers', () => {
     const results = searchWorktrees(
       [makeWorktree({ id: 'wt-port', linkedIssue: 3000 })],
diff --git a/src/renderer/src/lib/worktree-palette-search.ts b/src/renderer/src/lib/worktree-palette-search.ts
index 074587e8aec..a2fa082456f 100644
--- a/src/renderer/src/lib/worktree-palette-search.ts
+++ b/src/renderer/src/lib/worktree-palette-search.ts
@@ -8,6 +8,10 @@ import type { Repo, Worktree } from '../../../shared/types'
 import { extractWorktreePaletteCommentSnippet } from './worktree-palette-comment-snippet'
 import { isWorktreePaletteQueryTooLarge } from './worktree-palette-query-bounds'
 import { matchWorktreePaletteReview } from './worktree-palette-review-match'
+import {
+  matchWorktreePaletteTaskUrl,
+  parseCmdJTaskSourceUrl
+} from './worktree-palette-task-url-match'
 
 export type MatchRange = { start: number; end: number }
 
@@ -88,6 +92,21 @@ export function searchWorktrees(
   const q = trimmedQuery.toLowerCase()
   const numericQuery = q.startsWith('#') ? q.slice(1) : q
   const results: PaletteSearchResult[] = []
+  const taskSourceUrl = parseCmdJTaskSourceUrl(trimmedQuery)
+  if (taskSourceUrl) {
+    for (const worktree of worktrees) {
+      const match = matchWorktreePaletteTaskUrl({
+        worktree,
+        intent: taskSourceUrl,
+        repo: repoMap.get(worktree.repoId),
+        review: checksReviewByWorktree?.get(worktree)
+      })
+      if (match) {
+        results.push(match)
+      }
+    }
+    return results
+  }
 
   // Support "repo/worktree" composite queries (e.g. "orca/main") so users can
   // narrow by repo and worktree in a single token. Worktrees are identified by
diff --git a/src/renderer/src/lib/worktree-palette-task-url-match.test.ts b/src/renderer/src/lib/worktree-palette-task-url-match.test.ts
new file mode 100644
index 00000000000..db626e590d6
--- /dev/null
+++ b/src/renderer/src/lib/worktree-palette-task-url-match.test.ts
@@ -0,0 +1,236 @@
+import { describe, expect, it } from 'vitest'
+import type { Repo, Worktree } from '../../../shared/types'
+import {
+  getCmdJTaskUrlCreatePreview,
+  matchWorktreePaletteTaskUrl,
+  parseCmdJTaskSourceUrl,
+  withResolvedCmdJGitHubPreview
+} from './worktree-palette-task-url-match'
+
+function makeWorktree(overrides: Partial<Worktree> = {}): Worktree {
+  return {
+    id: 'wt-1',
+    repoId: 'repo-1',
+    path: '/tmp/wt-1',
+    head: 'abc123',
+    branch: 'refs/heads/feature/url-match',
+    isBare: false,
+    isMainWorktree: false,
+    displayName: 'URL match',
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    ...overrides
+  }
+}
+
+const orcaRepo: Repo = {
+  id: 'repo-1',
+  path: '/repo/orca',
+  displayName: 'stablyai/orca',
+  badgeColor: '#22c55e',
+  addedAt: 0
+}
+
+describe('parseCmdJTaskSourceUrl', () => {
+  it('parses GitHub issue and pull URLs', () => {
+    expect(parseCmdJTaskSourceUrl('https://github.com/stablyai/orca/issues/14198')).toEqual({
+      provider: 'github',
+      link: {
+        slug: { owner: 'stablyai', repo: 'orca', host: 'github.com' },
+        type: 'issue',
+        number: 14198
+      }
+    })
+    expect(parseCmdJTaskSourceUrl('https://github.com/stablyai/orca/pull/12789')).toEqual({
+      provider: 'github',
+      link: {
+        slug: { owner: 'stablyai', repo: 'orca', host: 'github.com' },
+        type: 'pr',
+        number: 12789
+      }
+    })
+  })
+
+  it('parses Linear, GitLab, and Jira URLs', () => {
+    expect(
+      parseCmdJTaskSourceUrl(
+        'https://linear.app/stably/issue/STA-4052/agent-terminals-disappearing-randomly'
+      )
+    ).toEqual({
+      provider: 'linear',
+      intent: { identifier: 'STA-4052', organizationUrlKey: 'stably' }
+    })
+    expect(
+      parseCmdJTaskSourceUrl('https://gitlab.com/acme/orca/-/merge_requests/17')
+    ).toMatchObject({
+      provider: 'gitlab',
+      link: { type: 'mr', number: 17 }
+    })
+    expect(parseCmdJTaskSourceUrl('https://company.atlassian.net/browse/ORCA-123')).toEqual({
+      provider: 'jira',
+      parsed: {
+        issueKey: 'ORCA-123',
+        origin: 'https://company.atlassian.net',
+        sitePath: ''
+      }
+    })
+  })
+
+  it('does not treat names or repo homepages as task URLs', () => {
+    expect(parseCmdJTaskSourceUrl('sta-4052-agent-terminals')).toBeNull()
+    expect(parseCmdJTaskSourceUrl('https://github.com/stablyai/orca')).toBeNull()
+    expect(parseCmdJTaskSourceUrl('#14198')).toBeNull()
+  })
+})
+
+describe('matchWorktreePaletteTaskUrl', () => {
+  it('matches a GitHub issue URL to the linked worktree in the same repo', () => {
+    const intent = parseCmdJTaskSourceUrl('https://github.com/stablyai/orca/issues/14198')
+    expect(intent).not.toBeNull()
+
+    expect(
+      matchWorktreePaletteTaskUrl({
+        worktree: makeWorktree({ linkedIssue: 14198 }),
+        intent: intent!,
+        repo: orcaRepo
+      })
+    ).toMatchObject({
+      worktreeId: 'wt-1',
+      matchedField: 'issue',
+      supportingText: { labelKind: 'issue', text: 'Issue #14198' }
+    })
+    expect(
+      matchWorktreePaletteTaskUrl({
+        worktree: makeWorktree({ linkedIssue: 14198 }),
+        intent: intent!,
+        repo: { ...orcaRepo, displayName: 'other/repo' }
+      })
+    ).toBeNull()
+  })
+
+  it('matches a GitHub work-item number when the stored URL is missing', () => {
+    const intent = parseCmdJTaskSourceUrl('https://github.com/stablyai/orca/pull/12789')
+    expect(
+      matchWorktreePaletteTaskUrl({
+        worktree: makeWorktree({
+          linkedWorkItem: {
+            provider: 'github',
+            type: 'pr',
+            number: 12789,
+            title: 'Perf',
+            url: ''
+          }
+        }),
+        intent: intent!,
+        repo: orcaRepo
+      })
+    ).toMatchObject({ matchedField: 'pr' })
+  })
+
+  it('matches a GitHub pull URL via the stored work-item URL', () => {
+    const intent = parseCmdJTaskSourceUrl('https://github.com/stablyai/orca/pull/12789')
+    expect(
+      matchWorktreePaletteTaskUrl({
+        worktree: makeWorktree({
+          linkedWorkItem: {
+            provider: 'github',
+            type: 'pr',
+            number: 12789,
+            title: 'Perf',
+            url: 'https://github.com/stablyai/orca/pull/12789'
+          }
+        }),
+        intent: intent!,
+        repo: { ...orcaRepo, displayName: 'Repo 1' }
+      })
+    ).toMatchObject({ matchedField: 'pr', supportingText: { text: 'PR #12789' } })
+  })
+
+  it('matches a Linear issue URL and rejects a different organization', () => {
+    const intent = parseCmdJTaskSourceUrl(
+      'https://linear.app/stably/issue/STA-4052/agent-terminals-disappearing-randomly'
+    )
+
+    expect(
+      matchWorktreePaletteTaskUrl({
+        worktree: makeWorktree({
+          linkedLinearIssue: 'STA-4052',
+          linkedLinearIssueOrganizationUrlKey: 'stably'
+        }),
+        intent: intent!
+      })
+    ).toMatchObject({ supportingText: { text: 'STA-4052' } })
+    expect(
+      matchWorktreePaletteTaskUrl({
+        worktree: makeWorktree({
+          linkedLinearIssue: 'STA-4052',
+          linkedLinearIssueOrganizationUrlKey: 'other'
+        }),
+        intent: intent!
+      })
+    ).toBeNull()
+  })
+})
+
+describe('getCmdJTaskUrlCreatePreview', () => {
+  it('describes GitHub issue and pull URLs without fetching', () => {
+    expect(
+      getCmdJTaskUrlCreatePreview(
+        parseCmdJTaskSourceUrl('https://github.com/stablyai/orca/issues/14198')!
+      )
+    ).toEqual({
+      provider: 'github',
+      identifier: '#14198',
+      subtitle: 'stablyai/orca',
+      kindLabel: 'GitHub issue',
+      createLabel: 'Create worktree from GitHub issue stablyai/orca#14198'
+    })
+    expect(
+      getCmdJTaskUrlCreatePreview(
+        parseCmdJTaskSourceUrl('https://github.com/stablyai/orca/pull/12789')!
+      )?.kindLabel
+    ).toBe('GitHub pull request')
+    expect(
+      getCmdJTaskUrlCreatePreview(
+        parseCmdJTaskSourceUrl('https://gitlab.com/acme/orca/-/merge_requests/17')!
+      )
+    ).toMatchObject({
+      provider: 'gitlab',
+      identifier: '!17',
+      kindLabel: 'GitLab merge request'
+    })
+    expect(
+      getCmdJTaskUrlCreatePreview(
+        parseCmdJTaskSourceUrl('https://company.atlassian.net/browse/ORCA-123')!
+      )
+    ).toMatchObject({
+      provider: 'jira',
+      identifier: 'ORCA-123',
+      kindLabel: 'Jira issue'
+    })
+  })
+
+  it('replaces the GitHub subtitle with the resolved issue title', () => {
+    const preview = getCmdJTaskUrlCreatePreview(
+      parseCmdJTaskSourceUrl('https://github.com/stablyai/orca/issues/14198')!
+    )!
+    expect(
+      withResolvedCmdJGitHubPreview(preview, 'Agent terminals disappearing randomly', false)
+    ).toEqual(
+      expect.objectContaining({
+        subtitle: 'Agent terminals disappearing randomly',
+        createLabel:
+          'Create worktree from GitHub issue stablyai/orca#14198: Agent terminals disappearing randomly',
+        loading: false
+      })
+    )
+    expect(withResolvedCmdJGitHubPreview(preview, null, true).loading).toBe(true)
+  })
+})
diff --git a/src/renderer/src/lib/worktree-palette-task-url-match.ts b/src/renderer/src/lib/worktree-palette-task-url-match.ts
new file mode 100644
index 00000000000..4b4cbce5166
--- /dev/null
+++ b/src/renderer/src/lib/worktree-palette-task-url-match.ts
@@ -0,0 +1,319 @@
+import type { HostedReviewInfo } from '../../../shared/hosted-review'
+import {
+  parseGitHubIssueOrPRLink,
+  type GitHubIssueOrPRLink,
+  type RepoSlug
+} from '../../../shared/github-links'
+import { githubRepoIdentityKey } from '../../../shared/github-repository-identity-key'
+import { parseGitLabIssueOrMRLink } from '../../../shared/new-workspace/gitlab-links'
+import { parseJiraIssueUrl, type ParsedJiraIssueUrl } from '../../../shared/jira-issue-url'
+import { parseLinearIssueUrlIntent, type LinearIssueUrlIntent } from '../../../shared/linear-links'
+import type { Repo, Worktree } from '../../../shared/types'
+import { normalizeLinearIdentifier } from './linear-issue-workspace-attachment'
+import { isWorktreePaletteQueryTooLarge } from './worktree-palette-query-bounds'
+import type { PaletteSearchResult, PaletteSupportingText } from './worktree-palette-search'
+
+export type CmdJTaskSourceUrl =
+  | { provider: 'github'; link: GitHubIssueOrPRLink }
+  | { provider: 'linear'; intent: LinearIssueUrlIntent }
+  | {
+      provider: 'gitlab'
+      link: NonNullable<ReturnType<typeof parseGitLabIssueOrMRLink>>
+    }
+  | { provider: 'jira'; parsed: ParsedJiraIssueUrl }
+
+export type CmdJTaskUrlCreatePreview = {
+  provider: 'github' | 'gitlab' | 'jira'
+  identifier: string
+  subtitle: string
+  createLabel: string
+  kindLabel: string
+  loading?: boolean
+}
+
+export function withResolvedCmdJGitHubPreview(
+  preview: CmdJTaskUrlCreatePreview,
+  resolvedTitle: string | null,
+  loading: boolean
+): CmdJTaskUrlCreatePreview {
+  if (preview.provider !== 'github') {
+    return preview
+  }
+  if (resolvedTitle) {
+    return {
+      ...preview,
+      subtitle: resolvedTitle,
+      createLabel: `${preview.createLabel}: ${resolvedTitle}`,
+      loading: false
+    }
+  }
+  return loading ? { ...preview, loading: true } : preview
+}
+
+function githubIdentityKey(slug: RepoSlug): string {
+  return githubRepoIdentityKey({
+    owner: slug.owner,
+    repo: slug.repo,
+    host: slug.host?.replace(/^www\./i, '')
+  })
+}
+
+function githubLinksEqual(left: GitHubIssueOrPRLink, right: GitHubIssueOrPRLink): boolean {
+  return (
+    left.type === right.type &&
+    left.number === right.number &&
+    githubIdentityKey(left.slug) === githubIdentityKey(right.slug)
+  )
+}
+
+function parseOwnerRepoDisplayName(value: string | null | undefined): RepoSlug | null {
+  const match = /^([^/]+)\/([^/]+)$/.exec(value?.trim() ?? '')
+  if (!match) {
+    return null
+  }
+  return { owner: match[1], repo: match[2] }
+}
+
+function repoMatchesGitHubSlug(repo: Repo | undefined, slug: RepoSlug): boolean | 'unknown' {
+  if (!repo) {
+    return 'unknown'
+  }
+  const fromName = parseOwnerRepoDisplayName(repo.displayName)
+  if (fromName) {
+    return githubIdentityKey({ ...fromName, host: slug.host }) === githubIdentityKey(slug)
+  }
+  if (repo.upstream?.owner && repo.upstream.repo) {
+    return githubIdentityKey(repo.upstream) === githubIdentityKey(slug)
+  }
+  return 'unknown'
+}
+
+export function parseCmdJTaskSourceUrl(query: string): CmdJTaskSourceUrl | null {
+  const trimmed = query.trim()
+  if (!trimmed || isWorktreePaletteQueryTooLarge(trimmed)) {
+    return null
+  }
+
+  const linear = parseLinearIssueUrlIntent(trimmed)
+  if (linear) {
+    return { provider: 'linear', intent: linear }
+  }
+
+  const github = parseGitHubIssueOrPRLink(trimmed)
+  if (github) {
+    return { provider: 'github', link: github }
+  }
+
+  const gitlab = parseGitLabIssueOrMRLink(trimmed)
+  if (gitlab) {
+    return { provider: 'gitlab', link: gitlab }
+  }
+
+  const jira = parseJiraIssueUrl(trimmed)
+  if (jira) {
+    return { provider: 'jira', parsed: jira }
+  }
+
+  return null
+}
+
+export function getCmdJTaskUrlCreatePreview(
+  intent: CmdJTaskSourceUrl
+): CmdJTaskUrlCreatePreview | null {
+  if (intent.provider === 'linear') {
+    return null
+  }
+  if (intent.provider === 'github') {
+    const { slug, number, type } = intent.link
+    const repo = `${slug.owner}/${slug.repo}`
+    const kindLabel = type === 'pr' ? 'GitHub pull request' : 'GitHub issue'
+    return {
+      provider: 'github',
+      identifier: `#${number}`,
+      subtitle: repo,
+      kindLabel,
+      createLabel: `Create worktree from ${kindLabel} ${repo}#${number}`
+    }
+  }
+  if (intent.provider === 'gitlab') {
+    const { slug, number, type } = intent.link
+    const project = `${slug.host}/${slug.path}`
+    const kindLabel = type === 'mr' ? 'GitLab merge request' : 'GitLab issue'
+    const identifier = type === 'mr' ? `!${number}` : `#${number}`
+    return {
+      provider: 'gitlab',
+      identifier,
+      subtitle: project,
+      kindLabel,
+      createLabel: `Create worktree from ${kindLabel} ${project}${identifier}`
+    }
+  }
+  return {
+    provider: 'jira',
+    identifier: intent.parsed.issueKey,
+    subtitle: intent.parsed.origin.replace(/^https?:\/\//, ''),
+    kindLabel: 'Jira issue',
+    createLabel: `Create worktree from Jira issue ${intent.parsed.issueKey}`
+  }
+}
+
+function supportingText(
+  labelKind: PaletteSupportingText['labelKind'],
+  text: string
+): PaletteSupportingText {
+  return { labelKind, text, matchRange: { start: 0, end: text.length } }
+}
+
+function result(
+  worktreeId: string,
+  matchedField: PaletteSearchResult['matchedField'],
+  text: PaletteSupportingText
+): PaletteSearchResult {
+  return {
+    worktreeId,
+    matchedField,
+    displayNameRange: null,
+    branchRange: null,
+    repoRange: null,
+    supportingText: text
+  }
+}
+
+function worktreeMatchesGitHubUrl(
+  worktree: Worktree,
+  link: GitHubIssueOrPRLink,
+  repo: Repo | undefined,
+  review: HostedReviewInfo | null | undefined
+): boolean {
+  const linkedUrl = worktree.linkedWorkItem?.url
+    ? parseGitHubIssueOrPRLink(worktree.linkedWorkItem.url)
+    : null
+  if (linkedUrl && githubLinksEqual(linkedUrl, link)) {
+    return true
+  }
+
+  const reviewUrl = review?.url ? parseGitHubIssueOrPRLink(review.url) : null
+  if (reviewUrl && githubLinksEqual(reviewUrl, link)) {
+    return true
+  }
+
+  const linkedItem = worktree.linkedWorkItem
+  const linkedItemMatches =
+    linkedItem?.provider === 'github' &&
+    linkedItem.type === link.type &&
+    linkedItem.number === link.number
+  const numberMatches =
+    linkedItemMatches ||
+    (link.type === 'pr' ? worktree.linkedPR === link.number : worktree.linkedIssue === link.number)
+  if (!numberMatches) {
+    return false
+  }
+
+  return repoMatchesGitHubSlug(repo, link.slug) !== false
+}
+
+function worktreeMatchesLinearUrl(worktree: Worktree, intent: LinearIssueUrlIntent): boolean {
+  const identifier = normalizeLinearIdentifier(intent.identifier)
+  const linkedIdentifier =
+    normalizeLinearIdentifier(worktree.linkedLinearIssue) ??
+    normalizeLinearIdentifier(worktree.linkedWorkItem?.linearIdentifier)
+  if (!identifier || linkedIdentifier !== identifier) {
+    const linkedUrl = worktree.linkedWorkItem?.url
+      ? parseLinearIssueUrlIntent(worktree.linkedWorkItem.url)
+      : null
+    if (
+      !linkedUrl ||
+      linkedUrl.identifier !== intent.identifier ||
+      linkedUrl.organizationUrlKey.toLowerCase() !== intent.organizationUrlKey.toLowerCase()
+    ) {
+      return false
+    }
+  }
+
+  const worktreeOrg = worktree.linkedLinearIssueOrganizationUrlKey?.trim().toLowerCase()
+  if (worktreeOrg && worktreeOrg !== intent.organizationUrlKey.toLowerCase()) {
+    return false
+  }
+  return true
+}
+
+function worktreeMatchesGitLabUrl(
+  worktree: Worktree,
+  link: NonNullable<ReturnType<typeof parseGitLabIssueOrMRLink>>
+): boolean {
+  const linkedUrl = worktree.linkedWorkItem?.url
+    ? parseGitLabIssueOrMRLink(worktree.linkedWorkItem.url)
+    : null
+  if (
+    linkedUrl &&
+    linkedUrl.number === link.number &&
+    linkedUrl.type === link.type &&
+    linkedUrl.slug.host.toLowerCase() === link.slug.host.toLowerCase() &&
+    linkedUrl.slug.path.toLowerCase() === link.slug.path.toLowerCase()
+  ) {
+    return true
+  }
+  return link.type === 'mr'
+    ? worktree.linkedGitLabMR === link.number
+    : worktree.linkedGitLabIssue === link.number
+}
+
+function worktreeMatchesJiraUrl(worktree: Worktree, parsed: ParsedJiraIssueUrl): boolean {
+  if (worktree.linkedWorkItem?.jiraIdentifier?.toUpperCase() === parsed.issueKey) {
+    return true
+  }
+  const linkedUrl = worktree.linkedWorkItem?.url
+    ? parseJiraIssueUrl(worktree.linkedWorkItem.url)
+    : null
+  return (
+    linkedUrl !== null &&
+    linkedUrl.issueKey === parsed.issueKey &&
+    linkedUrl.origin === parsed.origin &&
+    linkedUrl.sitePath === parsed.sitePath
+  )
+}
+
+export function matchWorktreePaletteTaskUrl(args: {
+  worktree: Worktree
+  intent: CmdJTaskSourceUrl
+  repo?: Repo
+  review?: HostedReviewInfo | null
+}): PaletteSearchResult | null {
+  const { worktree, intent, repo, review } = args
+  if (intent.provider === 'github') {
+    if (!worktreeMatchesGitHubUrl(worktree, intent.link, repo, review)) {
+      return null
+    }
+    return result(
+      worktree.id,
+      intent.link.type === 'pr' ? 'pr' : 'issue',
+      supportingText(
+        intent.link.type === 'pr' ? 'pr' : 'issue',
+        `${intent.link.type === 'pr' ? 'PR' : 'Issue'} #${intent.link.number}`
+      )
+    )
+  }
+  if (intent.provider === 'linear') {
+    if (!worktreeMatchesLinearUrl(worktree, intent.intent)) {
+      return null
+    }
+    return result(worktree.id, 'issue', supportingText('issue', intent.intent.identifier))
+  }
+  if (intent.provider === 'gitlab') {
+    if (!worktreeMatchesGitLabUrl(worktree, intent.link)) {
+      return null
+    }
+    return result(
+      worktree.id,
+      intent.link.type === 'mr' ? 'pr' : 'issue',
+      supportingText(
+        intent.link.type === 'mr' ? 'mr' : 'issue',
+        `${intent.link.type === 'mr' ? 'MR' : 'Issue'} #${intent.link.number}`
+      )
+    )
+  }
+  if (!worktreeMatchesJiraUrl(worktree, intent.parsed)) {
+    return null
+  }
+  return result(worktree.id, 'issue', supportingText('issue', intent.parsed.issueKey))
+}
diff --git a/src/renderer/src/lib/worktree-runtime-owner-index.ts b/src/renderer/src/lib/worktree-runtime-owner-index.ts
index 8fc642cfddb..6a66d7e33f4 100644
--- a/src/renderer/src/lib/worktree-runtime-owner-index.ts
+++ b/src/renderer/src/lib/worktree-runtime-owner-index.ts
@@ -12,7 +12,7 @@ type DetectedWorktreeListing = { worktrees: readonly WorktreeOwnerRecord[] }
 type RepoOwnerRecord = Pick<Repo, 'id' | 'connectionId' | 'executionHostId'>
 type FolderWorkspaceOwnerRecord = Pick<
   FolderWorkspace,
-  'id' | 'projectGroupId' | 'connectionId' | 'executionHostId'
+  'id' | 'projectGroupId' | 'connectionId' | 'executionHostId' | 'diffComments'
 >
 type ProjectGroupOwnerRecord = Pick<ProjectGroup, 'id' | 'connectionId' | 'executionHostId'>
 
diff --git a/src/renderer/src/lib/worktree-status.ts b/src/renderer/src/lib/worktree-status.ts
index e12d197dda9..6f39d8c1e0b 100644
--- a/src/renderer/src/lib/worktree-status.ts
+++ b/src/renderer/src/lib/worktree-status.ts
@@ -2,7 +2,7 @@ import { resolveAgentTypeFromTerminalTitle } from '@/components/sidebar/worktree
 import { classifyTitleActivity } from '@/lib/pane-agent-evidence'
 import { tabHasLivePty } from '@/lib/tab-has-live-pty'
 import { resolveRuntimePaneTitleLeafIdFromRoot } from '@/lib/runtime-pane-title-leaf-id'
-import { containsBrailleSpinner } from '../../../shared/agent-title-core'
+import { containsAgentSpinnerGlyph } from '../../../shared/agent-title-core'
 import type {
   TerminalLayoutSnapshot,
   TerminalPaneLayoutNode,
@@ -106,7 +106,7 @@ function titleStatusIsAgentAttributable(title: string, launchAgent?: TuiAgent |
   // Why: a spinner proves activity but not identity (Claude's thinking title has no provider
   // token, #9040); the tab's launch identity supplies it, mirroring the row builder's spinner
   // fallback (#9647) so the dot and the sidebar row agree.
-  return containsBrailleSpinner(title) && Boolean(launchAgent)
+  return containsAgentSpinnerGlyph(title) && Boolean(launchAgent)
 }
 
 export function getWorktreeStatusLabel(status: WorktreeStatus): string {
diff --git a/src/renderer/src/runtime/abortable-runtime-environment-call.ts b/src/renderer/src/runtime/abortable-runtime-environment-call.ts
index 619dfc517ce..357bf1b2d08 100644
--- a/src/renderer/src/runtime/abortable-runtime-environment-call.ts
+++ b/src/renderer/src/runtime/abortable-runtime-environment-call.ts
@@ -12,7 +12,8 @@ export async function callAbortableRuntimeEnvironment(
   params: unknown,
   timeoutMs: number | undefined,
   signal: AbortSignal,
-  expectedEnvironmentPairingRevision?: number
+  expectedEnvironmentPairingRevision?: number,
+  expectedRuntimeId?: string
 ): Promise<RuntimeRpcResponse<unknown>> {
   if (signal.aborted) {
     throw createRuntimeRpcAbortError()
@@ -47,7 +48,14 @@ export async function callAbortableRuntimeEnvironment(
     signal.addEventListener('abort', onAbort, { once: true })
     void window.api.runtimeEnvironments
       .subscribe(
-        { selector: environmentId, method, params, timeoutMs, expectedEnvironmentPairingRevision },
+        {
+          selector: environmentId,
+          method,
+          params,
+          timeoutMs,
+          expectedEnvironmentPairingRevision,
+          expectedRuntimeId
+        },
         {
           onResponse: (response) => finish(() => resolve(response)),
           onError: (error) => finish(() => reject(new Error(error.message))),
diff --git a/src/renderer/src/runtime/remote-agent-session-launch.test.ts b/src/renderer/src/runtime/remote-agent-session-launch.test.ts
index 0fb6399d688..aea62019626 100644
--- a/src/renderer/src/runtime/remote-agent-session-launch.test.ts
+++ b/src/renderer/src/runtime/remote-agent-session-launch.test.ts
@@ -1,8 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const mocks = vi.hoisted(() => ({
-  supportsCapability: vi.fn()
-}))
+const mocks = vi.hoisted(() => ({ probe: vi.fn() }))
 
 vi.mock('./runtime-rpc-client', () => ({
   RuntimeRpcCallError: class RuntimeRpcCallError extends Error {
@@ -12,75 +10,110 @@ vi.mock('./runtime-rpc-client', () => ({
       this.code = response.error.code
     }
   },
-  runtimeEnvironmentSupportsCapability: mocks.supportsCapability
+  probeLiveRuntimeEnvironmentCapabilities: mocks.probe
 }))
 
 import { RuntimeRpcCallError } from './runtime-rpc-client'
 import { runRemoteAgentSessionLaunch } from './remote-agent-session-launch'
 
+const authority = {
+  runtimeId: 'runtime-1',
+  expectedEnvironmentPairingRevision: 7,
+  capabilities: [
+    'terminal.attribution-removed.v1',
+    'agent-session.host-authority.v1',
+    'agent-session.omp-resume-path.v1'
+  ]
+} as const
+
 describe('remote agent-session launch routing', () => {
   beforeEach(() => {
-    mocks.supportsCapability.mockReset()
+    mocks.probe.mockReset()
+    mocks.probe.mockResolvedValue({ supported: true, authority })
   })
 
-  it('uses host authority only when the host advertises it', async () => {
+  it('uses one live all-capability probe before host authority', async () => {
+    const hostAuthority = vi.fn().mockResolvedValue('structured')
+    const legacy = vi.fn().mockResolvedValue('legacy')
+
+    await expect(
+      runRemoteAgentSessionLaunch({
+        environmentId: 'env-1',
+        expectedEnvironmentPairingRevision: 7,
+        hostAuthority,
+        requiredHostAuthorityCapabilities: ['agent-session.omp-resume-path.v1'],
+        legacy
+      })
+    ).resolves.toBe('structured')
+
+    expect(mocks.probe).toHaveBeenCalledWith({
+      environmentId: 'env-1',
+      requiredCapabilities: [
+        'terminal.attribution-removed.v1',
+        'agent-session.host-authority.v1',
+        'agent-session.omp-resume-path.v1'
+      ],
+      timeoutMs: 15_000,
+      expectedEnvironmentPairingRevision: 7
+    })
+    expect(hostAuthority).toHaveBeenCalledWith(authority)
+    expect(legacy).not.toHaveBeenCalled()
+  })
+
+  it('uses fenced legacy when a structured-only capability is absent', async () => {
+    mocks.probe.mockResolvedValue({ supported: false, authority })
     const hostAuthority = vi.fn().mockResolvedValue('structured')
     const legacy = vi.fn().mockResolvedValue('legacy')
-    mocks.supportsCapability.mockResolvedValue(true)
 
     await expect(
       runRemoteAgentSessionLaunch({
         environmentId: 'env-1',
         hostAuthority,
-        hostAuthorityCapability: 'agent-session.omp-resume-path.v1',
+        requiredHostAuthorityCapabilities: ['agent-session.omp-resume-path.v1'],
         legacy
       })
-    ).resolves.toBe('structured')
-    expect(mocks.supportsCapability).toHaveBeenCalledWith(
-      'env-1',
-      'agent-session.omp-resume-path.v1'
-    )
-    expect(hostAuthority).toHaveBeenCalledOnce()
+    ).resolves.toBe('legacy')
+
+    expect(hostAuthority).not.toHaveBeenCalled()
+    expect(legacy).toHaveBeenCalledWith({ skipCompatibilityCheck: true, authority })
+  })
+
+  it('fails closed without attribution-removal capability evidence', async () => {
+    mocks.probe.mockResolvedValue({
+      supported: false,
+      authority: { ...authority, capabilities: ['agent-session.host-authority.v1'] }
+    })
+    const legacy = vi.fn().mockResolvedValue('legacy')
+
+    await expect(
+      runRemoteAgentSessionLaunch({ environmentId: 'env-1', hostAuthority: vi.fn(), legacy })
+    ).rejects.toThrow('Update the host and try again')
     expect(legacy).not.toHaveBeenCalled()
   })
 
-  it('preserves the exact legacy path when the capability is absent', async () => {
-    const hostAuthority = vi.fn().mockResolvedValue('structured')
+  it('fails closed when the live capability probe fails', async () => {
+    mocks.probe.mockRejectedValue(
+      Object.assign(new Error('status temporarily unavailable'), { code: 'runtime_timeout' })
+    )
     const legacy = vi.fn().mockResolvedValue('legacy')
-    mocks.supportsCapability.mockResolvedValue(false)
 
-    await expect(
-      runRemoteAgentSessionLaunch({ environmentId: 'env-1', hostAuthority, legacy })
-    ).resolves.toBe('legacy')
-    expect(legacy).toHaveBeenCalledOnce()
-    expect(hostAuthority).not.toHaveBeenCalled()
+    const result = expect(
+      runRemoteAgentSessionLaunch({ environmentId: 'env-1', hostAuthority: vi.fn(), legacy })
+    ).rejects
+    await result.toThrow('Update the host and try again')
+    await result.toMatchObject({ code: 'runtime_timeout' })
+    expect(legacy).not.toHaveBeenCalled()
   })
 
-  it('keeps legacy behavior when a read-only capability probe fails', async () => {
-    const hostAuthority = vi.fn().mockResolvedValue('structured')
-    const legacy = vi.fn().mockResolvedValue('legacy')
-    mocks.supportsCapability.mockRejectedValue(new Error('status temporarily unavailable'))
-
-    await expect(
-      runRemoteAgentSessionLaunch({ environmentId: 'env-1', hostAuthority, legacy })
-    ).resolves.toBe('legacy')
-    expect(legacy).toHaveBeenCalledOnce()
-    expect(hostAuthority).not.toHaveBeenCalled()
-  })
-
-  it('does not bypass an incompatible runtime protocol', async () => {
+  it('preserves an incompatible runtime protocol error', async () => {
     const compatibilityError = Object.assign(new Error('runtime incompatible'), {
       code: 'runtime_compat_block'
     })
+    mocks.probe.mockRejectedValue(compatibilityError)
     const legacy = vi.fn().mockResolvedValue('legacy')
-    mocks.supportsCapability.mockRejectedValue(compatibilityError)
 
     await expect(
-      runRemoteAgentSessionLaunch({
-        environmentId: 'env-1',
-        hostAuthority: vi.fn(),
-        legacy
-      })
+      runRemoteAgentSessionLaunch({ environmentId: 'env-1', hostAuthority: vi.fn(), legacy })
     ).rejects.toBe(compatibilityError)
     expect(legacy).not.toHaveBeenCalled()
   })
@@ -88,7 +121,6 @@ describe('remote agent-session launch routing', () => {
   it('never downgrades after structured dispatch has started', async () => {
     const structuredError = new Error('structured response was lost')
     const legacy = vi.fn().mockResolvedValue('legacy')
-    mocks.supportsCapability.mockResolvedValue(true)
 
     await expect(
       runRemoteAgentSessionLaunch({
@@ -100,14 +132,13 @@ describe('remote agent-session launch routing', () => {
     expect(legacy).not.toHaveBeenCalled()
   })
 
-  it('uses legacy only for the host pre-side-effect lower-owner response', async () => {
-    const legacy = vi.fn().mockResolvedValue('legacy')
-    mocks.supportsCapability.mockResolvedValue(true)
+  it('uses fenced legacy for the pre-side-effect lower-owner response', async () => {
     const legacyRequired = new RuntimeRpcCallError({
       id: 'request-1',
       ok: false,
       error: { code: 'agent_session_legacy_required', message: 'legacy required' }
     })
+    const legacy = vi.fn().mockResolvedValue('legacy')
 
     await expect(
       runRemoteAgentSessionLaunch({
@@ -116,17 +147,16 @@ describe('remote agent-session launch routing', () => {
         legacy
       })
     ).resolves.toBe('legacy')
-    expect(legacy).toHaveBeenCalledOnce()
+    expect(legacy).toHaveBeenCalledWith({ skipCompatibilityCheck: true, authority })
   })
 
-  it('uses legacy when a replaced old host does not recognize the structured method', async () => {
-    const legacy = vi.fn().mockResolvedValue('legacy')
-    mocks.supportsCapability.mockResolvedValue(true)
+  it('does not downgrade when a replacement host rejects the structured method', async () => {
     const methodNotFound = new RuntimeRpcCallError({
       id: 'request-1',
       ok: false,
       error: { code: 'method_not_found', message: 'Unknown method' }
     })
+    const legacy = vi.fn().mockResolvedValue('legacy')
 
     await expect(
       runRemoteAgentSessionLaunch({
@@ -134,16 +164,16 @@ describe('remote agent-session launch routing', () => {
         hostAuthority: vi.fn().mockRejectedValue(methodNotFound),
         legacy
       })
-    ).resolves.toBe('legacy')
-    expect(legacy).toHaveBeenCalledOnce()
+    ).rejects.toBe(methodNotFound)
+    expect(legacy).not.toHaveBeenCalled()
   })
 
-  it('uses legacy directly when no structured form exists', async () => {
+  it('probes and fences legacy when no structured form exists', async () => {
     const legacy = vi.fn().mockResolvedValue('legacy')
 
     await expect(runRemoteAgentSessionLaunch({ environmentId: 'env-1', legacy })).resolves.toBe(
       'legacy'
     )
-    expect(mocks.supportsCapability).not.toHaveBeenCalled()
+    expect(legacy).toHaveBeenCalledWith({ skipCompatibilityCheck: true, authority })
   })
 })
diff --git a/src/renderer/src/runtime/remote-agent-session-launch.ts b/src/renderer/src/runtime/remote-agent-session-launch.ts
index b00c6cbbdab..82c61d89ab1 100644
--- a/src/renderer/src/runtime/remote-agent-session-launch.ts
+++ b/src/renderer/src/runtime/remote-agent-session-launch.ts
@@ -1,46 +1,61 @@
 import { AGENT_SESSION_HOST_AUTHORITY_CAPABILITY } from '../../../shared/agent-session-host-authority'
-import type { RuntimeCapability } from '../../../shared/protocol-version'
-import { RuntimeRpcCallError, runtimeEnvironmentSupportsCapability } from './runtime-rpc-client'
+import {
+  TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY,
+  type RuntimeCapability
+} from '../../../shared/protocol-version'
+import { TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE } from '../../../shared/legacy-terminal-attribution-env'
+import {
+  probeLiveRuntimeEnvironmentCapabilities,
+  RuntimeRpcCallError,
+  type LiveRuntimeEnvironmentAuthority
+} from './runtime-rpc-client'
 import { isRuntimeCompatBlockError } from './runtime-protocol-compat'
 
 export async function runRemoteAgentSessionLaunch<TResult>(args: {
   environmentId: string
-  hostAuthority?: () => Promise<TResult>
-  hostAuthorityCapability?: RuntimeCapability
-  legacy: (options: { skipCompatibilityCheck: boolean }) => Promise<TResult>
+  expectedEnvironmentPairingRevision?: number
+  hostAuthority?: (authority: LiveRuntimeEnvironmentAuthority) => Promise<TResult>
+  requiredHostAuthorityCapabilities?: readonly RuntimeCapability[]
+  legacy: (options: {
+    skipCompatibilityCheck: boolean
+    authority: LiveRuntimeEnvironmentAuthority
+  }) => Promise<TResult>
 }): Promise<TResult> {
-  if (!args.hostAuthority) {
-    return await args.legacy({ skipCompatibilityCheck: false })
-  }
-  let supported: boolean
+  const requiredCapabilities = [
+    TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY,
+    ...(args.hostAuthority ? [AGENT_SESSION_HOST_AUTHORITY_CAPABILITY] : []),
+    ...(args.requiredHostAuthorityCapabilities ?? [])
+  ]
+  let probe: Awaited<ReturnType<typeof probeLiveRuntimeEnvironmentCapabilities>>
   try {
-    supported = await runtimeEnvironmentSupportsCapability(
-      args.environmentId,
-      args.hostAuthorityCapability ?? AGENT_SESSION_HOST_AUTHORITY_CAPABILITY
-    )
+    probe = await probeLiveRuntimeEnvironmentCapabilities({
+      environmentId: args.environmentId,
+      requiredCapabilities,
+      timeoutMs: 15_000,
+      expectedEnvironmentPairingRevision: args.expectedEnvironmentPairingRevision
+    })
   } catch (error) {
     if (isRuntimeCompatBlockError(error)) {
       throw error
     }
-    // Why: a failed read-only probe has not launched anything, so preserving
-    // the legacy path cannot duplicate an agent and keeps transient upgrades neutral.
-    return await args.legacy({ skipCompatibilityCheck: true })
+    const code = error && typeof error === 'object' ? Reflect.get(error, 'code') : undefined
+    // Why: unknown-outcome recovery still needs to classify a transient failed probe.
+    throw Object.assign(
+      new Error(TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE, { cause: error }),
+      typeof code === 'string' ? { code } : {}
+    )
   }
-  // Why: choose before invoking either path; an ambiguous structured outcome
-  // must never trigger a legacy retry that could spawn a duplicate.
-  if (!supported) {
-    return await args.legacy({ skipCompatibilityCheck: true })
+  if (!probe.authority.capabilities.includes(TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY)) {
+    throw new Error(TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE)
+  }
+  if (!args.hostAuthority || !probe.supported) {
+    return await args.legacy({ skipCompatibilityCheck: true, authority: probe.authority })
   }
   try {
-    return await args.hostAuthority()
+    return await args.hostAuthority(probe.authority)
   } catch (error) {
-    if (
-      error instanceof RuntimeRpcCallError &&
-      (error.code === 'agent_session_legacy_required' || error.code === 'method_not_found')
-    ) {
-      // Why: both responses prove no structured side effect began: the new host rejected an old
-      // lower owner before dispatch, or an old host never recognized the method.
-      return await args.legacy({ skipCompatibilityCheck: true })
+    if (error instanceof RuntimeRpcCallError && error.code === 'agent_session_legacy_required') {
+      return await args.legacy({ skipCompatibilityCheck: true, authority: probe.authority })
     }
     throw error
   }
diff --git a/src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts b/src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts
index e153c1c75cb..183838fdc2f 100644
--- a/src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts
+++ b/src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts
@@ -14,6 +14,7 @@ import {
   parseTerminalSnapshotUnavailableReason,
   type TerminalSnapshotUnavailableReason
 } from '../../../shared/terminal-snapshot-unavailability'
+import { parseTerminalKittyKeyboardFlags } from '../../../shared/terminal-kitty-keyboard-flags'
 import { e2eConfig, e2eDisableRemoteTerminalStallRecovery } from '@/lib/e2e-config'
 import { recordRendererCrashBreadcrumb } from '@/lib/crash-breadcrumb-recorder'
 import { deliverTerminalDataWithDeferredCredit } from '@/lib/pane-manager/terminal-delivery-credit'
@@ -60,7 +61,14 @@ type TerminalMultiplexEvent =
 
 export type RemoteRuntimeMultiplexedTerminalCallbacks = {
   onData: (data: string, meta?: { seq?: number; rawLength?: number; transformed?: boolean }) => void
-  onSnapshot: (data: string, meta?: { pendingEscapeTailAnsi?: string }) => void
+  onSnapshot: (
+    data: string,
+    meta?: {
+      pendingEscapeTailAnsi?: string
+      seq?: number
+      kittyKeyboardFlags?: number
+    }
+  ) => void
   onSubscribed?: () => void
   onOutputPauseCapability?: () => void
   onEnd?: () => void
@@ -84,6 +92,10 @@ export type RemoteRuntimeSnapshotImage = {
   seq?: number
   source?: 'headless' | 'renderer'
   pendingEscapeTailAnsi?: string
+  /** Effective kitty flags the HOST proved at this image's own `seq`. Absent
+   *  from any host that predates the field — the pane tracker then stays
+   *  unproven and commits raw text instead of guessing zero. */
+  kittyKeyboardFlags?: number
 }
 
 /** Transient causes the host itself reported: a request reached it and it declined to serialize now. */
@@ -197,6 +209,7 @@ type RemoteRuntimeSnapshotInfo = {
   rows?: number
   seq?: number
   source?: 'headless' | 'renderer'
+  kittyKeyboardFlags?: number
   requestId?: number
   truncated?: boolean
   unavailable?: TerminalSnapshotUnavailableReason
@@ -879,13 +892,16 @@ class RemoteRuntimeTerminalMultiplexer {
               rows: info?.rows ?? 24,
               seq: info?.seq,
               source: info?.source,
+              kittyKeyboardFlags: info?.kittyKeyboardFlags,
               pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi
             }
           })
           clearPendingSnapshotRequest(stream)
         } else if (target === 'initial') {
           stream.callbacks.onSnapshot(data ?? '', {
-            pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi
+            pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi,
+            seq: info?.seq,
+            kittyKeyboardFlags: info?.kittyKeyboardFlags
           })
         } else if (target === 'recovery') {
           // Why: a server-pushed recovery snapshot replaces terminal state
@@ -893,7 +909,9 @@ class RemoteRuntimeTerminalMultiplexer {
           // An empty snapshot is still applied so stale dropped output does
           // not linger on a terminal the model says is blank.
           stream.callbacks.onSnapshot(`\x1b[2J\x1b[3J\x1b[H${data ?? ''}`, {
-            pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi
+            pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi,
+            seq: info?.seq,
+            kittyKeyboardFlags: info?.kittyKeyboardFlags
           })
         }
       } else if (matchesPendingRequest) {
@@ -1529,6 +1547,7 @@ function decodeSnapshotInfo(
     truncated?: unknown
     unavailable?: unknown
     pendingEscapeTailAnsi?: unknown
+    kittyKeyboardFlags?: unknown
   }>(payload)
   if (!raw) {
     return null
@@ -1538,6 +1557,8 @@ function decodeSnapshotInfo(
     rows: typeof raw.rows === 'number' ? raw.rows : undefined,
     seq: typeof raw.seq === 'number' ? raw.seq : undefined,
     source: raw.source === 'headless' || raw.source === 'renderer' ? raw.source : undefined,
+    // Negative, fractional, and unsafe values are treated as absent, never clamped.
+    kittyKeyboardFlags: parseTerminalKittyKeyboardFlags(raw.kittyKeyboardFlags),
     requestId: typeof raw.requestId === 'number' ? raw.requestId : undefined,
     truncated: raw.truncated === true,
     unavailable: parseTerminalSnapshotUnavailableReason(raw.unavailable),
diff --git a/src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts b/src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts
new file mode 100644
index 00000000000..08213580ea8
--- /dev/null
+++ b/src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts
@@ -0,0 +1,184 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  TerminalStreamOpcode,
+  decodeTerminalStreamFrame,
+  decodeTerminalStreamJson,
+  encodeTerminalStreamFrame,
+  encodeTerminalStreamJson,
+  encodeTerminalStreamText
+} from '../../../shared/terminal-stream-protocol'
+import {
+  getRemoteRuntimeTerminalMultiplexer,
+  resetRemoteRuntimeTerminalMultiplexersForTests,
+  type RemoteRuntimeMultiplexedTerminal
+} from './remote-runtime-terminal-multiplexer'
+import { replaceRuntimeEnvironmentRevisions } from './runtime-environment-revision'
+
+// `kittyKeyboardFlags` is an additive optional field on the existing
+// SnapshotStart frame (Rule 1 of docs/reference/remote-wire-compatibility.md).
+// An old host omits it, and absence must stay unknown rather than be laundered
+// into "the host proved kitty is inactive".
+
+type SubscribeCallbacks = {
+  onResponse: (response: unknown) => void
+  onBinary?: (bytes: Uint8Array<ArrayBufferLike>) => void
+}
+
+type SnapshotStartMeta = { requestId?: number; kittyKeyboardFlags?: unknown }
+
+class KittyFlagsServer {
+  private streamId = 0
+  /** Meta the host attaches to its next SnapshotStart, initial and requested alike. */
+  nextMeta: SnapshotStartMeta = {}
+
+  constructor(private readonly toClient: (bytes: Uint8Array<ArrayBufferLike>) => void) {}
+
+  receive(bytes: Uint8Array<ArrayBufferLike>): void {
+    const frame = decodeTerminalStreamFrame(bytes)
+    if (!frame) {
+      return
+    }
+    if (frame.opcode === TerminalStreamOpcode.Subscribe) {
+      this.streamId = decodeTerminalStreamJson<{ streamId: number }>(frame.payload)?.streamId ?? 0
+      this.sendSnapshot('INITIAL', {})
+      return
+    }
+    if (frame.opcode !== TerminalStreamOpcode.SnapshotRequest) {
+      return
+    }
+    const requestId = decodeTerminalStreamJson<{ requestId?: number }>(frame.payload)?.requestId
+    this.sendSnapshot('REQUESTED', { ...this.nextMeta, requestId })
+  }
+
+  /** A host-pushed recovery snapshot, which arrives with no requestId. */
+  pushRecovery(meta: SnapshotStartMeta): void {
+    this.sendSnapshot('RECOVERED', meta)
+  }
+
+  private sendSnapshot(data: string, meta: SnapshotStartMeta): void {
+    this.send(
+      TerminalStreamOpcode.SnapshotStart,
+      encodeTerminalStreamJson({
+        cols: 80,
+        rows: 24,
+        seq: 7,
+        ...meta
+      })
+    )
+    this.send(TerminalStreamOpcode.SnapshotChunk, encodeTerminalStreamText(data))
+    this.send(TerminalStreamOpcode.SnapshotEnd, new Uint8Array())
+  }
+
+  private send(opcode: TerminalStreamOpcode, payload: Uint8Array): void {
+    this.toClient(
+      encodeTerminalStreamFrame({
+        opcode,
+        streamId: this.streamId,
+        seq: 0,
+        payload
+      })
+    )
+  }
+}
+
+describe('SnapshotStart kitty keyboard flags', () => {
+  let server: KittyFlagsServer
+  const snapshots: {
+    data: string
+    meta?: { seq?: number; kittyKeyboardFlags?: number }
+  }[] = []
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    snapshots.length = 0
+    resetRemoteRuntimeTerminalMultiplexersForTests()
+    replaceRuntimeEnvironmentRevisions([])
+    vi.stubGlobal('window', {
+      api: {
+        runtimeEnvironments: {
+          subscribe: vi.fn(async (_args: unknown, callbacks: SubscribeCallbacks) => {
+            server = new KittyFlagsServer((bytes) => callbacks.onBinary?.(bytes))
+            queueMicrotask(() => callbacks.onResponse({ ok: true, result: { type: 'ready' } }))
+            return {
+              unsubscribe: vi.fn(),
+              sendBinary: (bytes: Uint8Array<ArrayBufferLike>) => server.receive(bytes)
+            }
+          })
+        }
+      }
+    })
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  async function subscribeClient(): Promise<RemoteRuntimeMultiplexedTerminal> {
+    const stream = await getRemoteRuntimeTerminalMultiplexer('env-1').subscribeTerminal({
+      terminal: 'terminal-1',
+      client: { id: 'desktop-1', type: 'desktop' },
+      callbacks: {
+        onData: () => {},
+        onSnapshot: (data, meta) => {
+          snapshots.push({ data, meta })
+        }
+      }
+    })
+    await Promise.resolve()
+    await Promise.resolve()
+    return stream
+  }
+
+  it.each([
+    ['a proven inactive protocol', 0],
+    ['proven bit-3 flags', 8]
+  ])('decodes %s into the requested snapshot result', async (_name, flags) => {
+    const stream = await subscribeClient()
+    server.nextMeta = { kittyKeyboardFlags: flags }
+
+    const outcome = await stream.serializeBufferOutcome({
+      scrollbackRows: 100
+    })
+    expect(outcome.snapshot).toMatchObject({
+      seq: 7,
+      kittyKeyboardFlags: flags
+    })
+  })
+
+  it('carries the flags and their sequence onto a host-pushed recovery snapshot', async () => {
+    await subscribeClient()
+    expect(snapshots).toHaveLength(1)
+
+    server.pushRecovery({ kittyKeyboardFlags: 8 })
+    expect(snapshots[1]?.meta).toMatchObject({ seq: 7, kittyKeyboardFlags: 8 })
+  })
+
+  it.each([
+    ['negative', -1],
+    ['fractional', 1.5],
+    ['beyond safe integers', Number.MAX_SAFE_INTEGER + 2],
+    ['a string', '8'],
+    ['null', null]
+  ])('treats %s as absent rather than clamping it', async (_name, value) => {
+    const stream = await subscribeClient()
+    server.nextMeta = { kittyKeyboardFlags: value }
+
+    const outcome = await stream.serializeBufferOutcome({
+      scrollbackRows: 100
+    })
+    expect(outcome.snapshot?.kittyKeyboardFlags).toBeUndefined()
+  })
+
+  it('accepts an old host that omits the field without coercing it to zero', async () => {
+    const stream = await subscribeClient()
+    server.nextMeta = {}
+
+    const outcome = await stream.serializeBufferOutcome({
+      scrollbackRows: 100
+    })
+    expect(outcome.availability).toEqual({ kind: 'snapshot' })
+    expect(outcome.snapshot?.data).toBe('REQUESTED')
+    expect(outcome.snapshot?.kittyKeyboardFlags).toBeUndefined()
+    expect(snapshots[0]?.meta?.kittyKeyboardFlags).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/runtime/remote-server-parity.test.ts b/src/renderer/src/runtime/remote-server-parity.test.ts
index 8e9be06da0c..41318a7248e 100644
--- a/src/renderer/src/runtime/remote-server-parity.test.ts
+++ b/src/renderer/src/runtime/remote-server-parity.test.ts
@@ -304,7 +304,13 @@ describe('parity §11: remote browser create focuses the new browser tab', () =>
   it('honors focus intent for a newly created browser session tab', () => {
     const pageId = 'browser-page-1'
     const prior = stateWithLocalTerminals([localTerminal('host-tab-1', 0, true)])
-    recordWebSessionFocusIntent({ environmentId: ENV }, WT, pageId)
+    recordWebSessionFocusIntent(
+      { environmentId: ENV },
+      WT,
+      pageId,
+      undefined,
+      toWebTerminalSurfaceTabId('host-tab-1')
+    )
     const patch = applyWebSessionTabsSnapshot(
       prior,
       makeSnapshot([{ parentTab: 'host-tab-1', leaf: LEAF_A, active: false }], {
diff --git a/src/renderer/src/runtime/runtime-environment-authority.ts b/src/renderer/src/runtime/runtime-environment-authority.ts
new file mode 100644
index 00000000000..f773941bdf3
--- /dev/null
+++ b/src/renderer/src/runtime/runtime-environment-authority.ts
@@ -0,0 +1,46 @@
+import type { RuntimeRpcResponse } from '../../../shared/runtime-rpc-envelope'
+import type { RuntimeStatus } from '../../../shared/runtime-types'
+import type { RuntimeCapability } from '../../../shared/protocol-version'
+import { callRuntimeEnvironmentWithRevision } from './runtime-rpc-environment-call'
+import { captureRuntimeEnvironmentRequestRevision } from './runtime-environment-revision'
+import { assertRuntimeStatusCompatible } from './runtime-protocol-compat'
+import { unwrapRuntimeRpcResult } from './runtime-rpc-result'
+
+export type LiveRuntimeEnvironmentAuthority = Readonly<{
+  runtimeId: string
+  expectedEnvironmentPairingRevision: number | undefined
+  capabilities: readonly RuntimeCapability[]
+}>
+
+export async function probeLiveRuntimeEnvironmentCapabilities(args: {
+  environmentId: string
+  requiredCapabilities: readonly RuntimeCapability[]
+  timeoutMs?: number
+  expectedEnvironmentPairingRevision?: number
+}): Promise<{ supported: boolean; authority: LiveRuntimeEnvironmentAuthority }> {
+  const environmentId = args.environmentId.trim()
+  const expectedEnvironmentPairingRevision = captureRuntimeEnvironmentRequestRevision(
+    environmentId,
+    args.expectedEnvironmentPairingRevision
+  )
+  const response = await callRuntimeEnvironmentWithRevision({
+    environmentId,
+    method: 'status.get',
+    params: undefined,
+    timeoutMs: args.timeoutMs,
+    expectedEnvironmentPairingRevision
+  })
+  const status = unwrapRuntimeRpcResult<RuntimeStatus>(
+    response as RuntimeRpcResponse<RuntimeStatus>
+  )
+  assertRuntimeStatusCompatible(status)
+  const capabilities = status.capabilities ?? []
+  return {
+    supported: args.requiredCapabilities.every((capability) => capabilities.includes(capability)),
+    authority: Object.freeze({
+      runtimeId: status.runtimeId,
+      expectedEnvironmentPairingRevision,
+      capabilities: Object.freeze([...capabilities])
+    })
+  }
+}
diff --git a/src/renderer/src/runtime/runtime-git-client.test.ts b/src/renderer/src/runtime/runtime-git-client.test.ts
index 36bd5d1aeb6..61d058d8f45 100644
--- a/src/renderer/src/runtime/runtime-git-client.test.ts
+++ b/src/renderer/src/runtime/runtime-git-client.test.ts
@@ -641,8 +641,7 @@ describe('runtime git client', () => {
       settings: {
         activeRuntimeEnvironmentId: 'env-1',
         commitMessageAi,
-        agentCmdOverrides,
-        enableGitHubAttribution: true
+        agentCmdOverrides
       },
       worktreeId: 'wt-1',
       worktreePath: '/repo'
@@ -655,7 +654,6 @@ describe('runtime git client', () => {
         worktree: 'id:wt-1',
         commitMessageAi,
         agentCmdOverrides,
-        enableGitHubAttribution: true,
         commitMessageDiscoveryHostKey: 'runtime:env-1'
       },
       timeoutMs: 75_000
diff --git a/src/renderer/src/runtime/runtime-git-client.ts b/src/renderer/src/runtime/runtime-git-client.ts
index f4b5931d696..48e608daf4a 100644
--- a/src/renderer/src/runtime/runtime-git-client.ts
+++ b/src/renderer/src/runtime/runtime-git-client.ts
@@ -49,12 +49,7 @@ export type RuntimePullRequestGenerationInput = {
 }
 
 type RuntimeGitSettings = Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> &
-  Partial<
-    Pick<
-      GlobalSettings,
-      'commitMessageAi' | 'sourceControlAi' | 'agentCmdOverrides' | 'enableGitHubAttribution'
-    >
-  >
+  Partial<Pick<GlobalSettings, 'commitMessageAi' | 'sourceControlAi' | 'agentCmdOverrides'>>
 
 type RuntimeDiscoverCommitMessageModelsResult =
   | {
@@ -96,12 +91,7 @@ export type RuntimeGeneratePullRequestFieldsOverrides = RuntimeGenerateCommitMes
 function getRuntimeCommitMessageSettings(
   settings: RuntimeGitSettings | null | undefined,
   connectionId?: string
-): Partial<
-  Pick<
-    GlobalSettings,
-    'commitMessageAi' | 'sourceControlAi' | 'agentCmdOverrides' | 'enableGitHubAttribution'
-  >
-> & {
+): Partial<Pick<GlobalSettings, 'commitMessageAi' | 'sourceControlAi' | 'agentCmdOverrides'>> & {
   commitMessageDiscoveryHostKey?: string
 } {
   if (!settings) {
@@ -118,9 +108,6 @@ function getRuntimeCommitMessageSettings(
     ...(settings.agentCmdOverrides !== undefined
       ? { agentCmdOverrides: settings.agentCmdOverrides }
       : {}),
-    ...(settings.enableGitHubAttribution !== undefined
-      ? { enableGitHubAttribution: settings.enableGitHubAttribution }
-      : {}),
     commitMessageDiscoveryHostKey: getCommitMessageModelDiscoveryHostKeyForScope(scope)
   }
 }
diff --git a/src/renderer/src/runtime/runtime-rpc-client-pairing-revision.test.ts b/src/renderer/src/runtime/runtime-rpc-client-pairing-revision.test.ts
index b3e4c103f4f..00995d0db6d 100644
--- a/src/renderer/src/runtime/runtime-rpc-client-pairing-revision.test.ts
+++ b/src/renderer/src/runtime/runtime-rpc-client-pairing-revision.test.ts
@@ -3,7 +3,11 @@ import {
   MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
   RUNTIME_PROTOCOL_VERSION
 } from '../../../shared/protocol-version'
-import { callRuntimeRpc, clearRuntimeCompatibilityCacheForTests } from './runtime-rpc-client'
+import {
+  callRuntimeRpc,
+  clearRuntimeCompatibilityCacheForTests,
+  probeLiveRuntimeEnvironmentCapabilities
+} from './runtime-rpc-client'
 import { replaceRuntimeEnvironmentRevisions } from './runtime-environment-revision'
 
 const runtimeEnvironmentCall = vi.fn()
@@ -62,3 +66,57 @@ it('captures the pairing revision before awaiting the compatibility probe', asyn
     expectedEnvironmentPairingRevision: 10
   })
 })
+
+it('live capability probes ignore a warm cache and pin the captured pairing revision', async () => {
+  replaceRuntimeEnvironmentRevisions([{ id: 'env-live', createdAt: 1, pairingRevision: 20 }])
+  runtimeEnvironmentCall
+    .mockResolvedValueOnce({
+      id: 'warm-status',
+      ok: true,
+      result: {
+        runtimeId: 'runtime-a',
+        graphStatus: 'ready',
+        runtimeProtocolVersion: RUNTIME_PROTOCOL_VERSION,
+        minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
+        capabilities: ['terminal.attribution-removed.v1']
+      }
+    })
+    .mockResolvedValueOnce({ id: 'repo', ok: true, result: { repos: [] } })
+    .mockImplementationOnce(async () => {
+      replaceRuntimeEnvironmentRevisions([{ id: 'env-live', createdAt: 1, pairingRevision: 21 }])
+      return {
+        id: 'live-status',
+        ok: true,
+        result: {
+          runtimeId: 'runtime-b',
+          graphStatus: 'ready',
+          runtimeProtocolVersion: RUNTIME_PROTOCOL_VERSION,
+          minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
+          capabilities: []
+        }
+      }
+    })
+
+  await callRuntimeRpc({ kind: 'environment', environmentId: 'env-live' }, 'repo.list')
+  await expect(
+    probeLiveRuntimeEnvironmentCapabilities({
+      environmentId: 'env-live',
+      requiredCapabilities: ['terminal.attribution-removed.v1']
+    })
+  ).resolves.toEqual({
+    supported: false,
+    authority: {
+      runtimeId: 'runtime-b',
+      expectedEnvironmentPairingRevision: 20,
+      capabilities: []
+    }
+  })
+
+  expect(runtimeEnvironmentCall).toHaveBeenLastCalledWith({
+    selector: 'env-live',
+    method: 'status.get',
+    params: undefined,
+    timeoutMs: undefined,
+    expectedEnvironmentPairingRevision: 20
+  })
+})
diff --git a/src/renderer/src/runtime/runtime-rpc-client.ts b/src/renderer/src/runtime/runtime-rpc-client.ts
index 57ba17b75a0..ad79ba94f13 100644
--- a/src/renderer/src/runtime/runtime-rpc-client.ts
+++ b/src/renderer/src/runtime/runtime-rpc-client.ts
@@ -19,6 +19,8 @@ export {
   RuntimeRpcCallError,
   unwrapRuntimeRpcResult
 } from './runtime-rpc-result'
+export { probeLiveRuntimeEnvironmentCapabilities } from './runtime-environment-authority'
+export type { LiveRuntimeEnvironmentAuthority } from './runtime-environment-authority'
 
 const RUNTIME_COMPATIBILITY_CACHE_MAX = 32
 const RECENT_RUNTIME_COMPATIBILITY_FAILURE_TTL_MS = 60_000
@@ -54,6 +56,7 @@ export async function callRuntimeRpc<TResult>(
     skipCompatibilityCheck?: boolean
     signal?: AbortSignal
     expectedEnvironmentPairingRevision?: number
+    expectedRuntimeId?: string
   } = {}
 ): Promise<TResult> {
   const expectedEnvironmentPairingRevision =
@@ -88,7 +91,8 @@ export async function callRuntimeRpc<TResult>(
           params: nextParams,
           timeoutMs: options.timeoutMs,
           signal: options.signal,
-          expectedEnvironmentPairingRevision
+          expectedEnvironmentPairingRevision,
+          expectedRuntimeId: options.expectedRuntimeId
         })
   return unwrapRuntimeRpcResult<TResult>(response as RuntimeRpcResponse<TResult>)
 }
@@ -325,8 +329,7 @@ export async function assertRuntimeEnvironmentCapability(
   message: string,
   timeoutMs?: number
 ): Promise<void> {
-  const status = await getRuntimeEnvironmentStatus(environmentId, timeoutMs)
-  if (!status.capabilities?.includes(capability)) {
+  if (!(await runtimeEnvironmentSupportsCapability(environmentId, capability, timeoutMs))) {
     throw new Error(message)
   }
 }
diff --git a/src/renderer/src/runtime/runtime-rpc-environment-call.test.ts b/src/renderer/src/runtime/runtime-rpc-environment-call.test.ts
new file mode 100644
index 00000000000..3f8b8c53c5c
--- /dev/null
+++ b/src/renderer/src/runtime/runtime-rpc-environment-call.test.ts
@@ -0,0 +1,28 @@
+import { expect, it, vi } from 'vitest'
+import { callRuntimeEnvironmentWithRevision } from './runtime-rpc-environment-call'
+
+it('preserves abort semantics for runtime-fenced requests', async () => {
+  const controller = new AbortController()
+  const unsubscribe = vi.fn()
+  const call = vi.fn()
+  const subscribe = vi.fn().mockResolvedValue({ unsubscribe, sendBinary: vi.fn() })
+  vi.stubGlobal('window', { api: { runtimeEnvironments: { call, subscribe } } })
+
+  const request = callRuntimeEnvironmentWithRevision({
+    environmentId: 'env-1',
+    method: 'status.get',
+    params: undefined,
+    signal: controller.signal,
+    expectedRuntimeId: 'runtime-1'
+  })
+  await vi.waitFor(() => expect(subscribe).toHaveBeenCalled())
+  expect(subscribe).toHaveBeenCalledWith(
+    expect.objectContaining({ expectedRuntimeId: 'runtime-1' }),
+    expect.any(Object)
+  )
+  controller.abort()
+
+  await expect(request).rejects.toMatchObject({ name: 'AbortError' })
+  await vi.waitFor(() => expect(unsubscribe).toHaveBeenCalledOnce())
+  expect(call).not.toHaveBeenCalled()
+})
diff --git a/src/renderer/src/runtime/runtime-rpc-environment-call.ts b/src/renderer/src/runtime/runtime-rpc-environment-call.ts
index 5acc0fa0a85..dc5f85f8a62 100644
--- a/src/renderer/src/runtime/runtime-rpc-environment-call.ts
+++ b/src/renderer/src/runtime/runtime-rpc-environment-call.ts
@@ -7,6 +7,7 @@ export async function callRuntimeEnvironmentWithRevision(args: {
   timeoutMs?: number
   signal?: AbortSignal
   expectedEnvironmentPairingRevision?: number
+  expectedRuntimeId?: string
 }): Promise<unknown> {
   if (args.signal) {
     return callAbortableRuntimeEnvironment(
@@ -15,7 +16,8 @@ export async function callRuntimeEnvironmentWithRevision(args: {
       args.params,
       args.timeoutMs,
       args.signal,
-      args.expectedEnvironmentPairingRevision
+      args.expectedEnvironmentPairingRevision,
+      args.expectedRuntimeId
     )
   }
   return window.api.runtimeEnvironments.call({
@@ -23,6 +25,7 @@ export async function callRuntimeEnvironmentWithRevision(args: {
     method: args.method,
     params: args.params,
     timeoutMs: args.timeoutMs,
-    expectedEnvironmentPairingRevision: args.expectedEnvironmentPairingRevision
+    expectedEnvironmentPairingRevision: args.expectedEnvironmentPairingRevision,
+    expectedRuntimeId: args.expectedRuntimeId
   })
 }
diff --git a/src/renderer/src/runtime/runtime-skills-client.test.ts b/src/renderer/src/runtime/runtime-skills-client.test.ts
index 197db33cddf..e4535e3eff6 100644
--- a/src/renderer/src/runtime/runtime-skills-client.test.ts
+++ b/src/renderer/src/runtime/runtime-skills-client.test.ts
@@ -99,4 +99,24 @@ describe('discoverSkillsForRuntimeTarget', () => {
       expect.objectContaining({ method: 'skills.discover', params: {} })
     )
   })
+
+  // Why: refresh describes the request, not the client's host. Dropping it would
+  // leave an explicit re-check reading the remote host's shared scan instead of
+  // its disk, which is exactly what an install-completed refresh must not do.
+  it('forwards an explicit refresh to a remote runtime', async () => {
+    runtimeEnvironmentCall.mockResolvedValueOnce({
+      id: 'skills',
+      ok: true,
+      result: discoveryResult('orchestration')
+    })
+
+    await discoverSkillsForRuntimeTarget(
+      { kind: 'environment', environmentId: 'env-1' },
+      { runtime: 'wsl', wslDistro: 'Ubuntu', refresh: true }
+    )
+
+    expect(runtimeEnvironmentCall).toHaveBeenCalledWith(
+      expect.objectContaining({ method: 'skills.discover', params: { refresh: true } })
+    )
+  })
 })
diff --git a/src/renderer/src/runtime/runtime-skills-client.ts b/src/renderer/src/runtime/runtime-skills-client.ts
index 700e90a66fd..40101379a81 100644
--- a/src/renderer/src/runtime/runtime-skills-client.ts
+++ b/src/renderer/src/runtime/runtime-skills-client.ts
@@ -9,13 +9,17 @@ const SKILL_DISCOVERY_TIMEOUT_MS = 15_000
  * when one is active. This keeps install badges in sync with where the skill
  * files land instead of always reading the client's disk (#6789).
  *
- * The target is dropped entirely for a remote call. Every target any caller can
+ * The target is otherwise dropped for a remote call. Every target any caller can
  * currently produce describes the *client's* host — a WSL distro or a local
  * project-runtime resolution — and forwarding those would ask a Linux server to
  * resolve a WSL distro it does not have. The server does honour `cwd` and
  * `worktreeId` (see `main/runtime/rpc/methods/skills.ts`), so if a caller ever
  * supplies workspace identity, forward those two fields rather than widening
  * this to the whole target.
+ *
+ * `refresh` is the exception and must be forwarded: it describes the *request*,
+ * not the client's host, and it is the only way an explicit re-check reaches
+ * past the remote host's shared scans to its disk.
  */
 export async function discoverSkillsForRuntimeTarget(
   runtimeTarget: RuntimeClientTarget,
@@ -27,7 +31,7 @@ export async function discoverSkillsForRuntimeTarget(
   return callRuntimeRpc<SkillDiscoveryResult>(
     runtimeTarget,
     'skills.discover',
-    {},
+    target?.refresh ? { refresh: true } : {},
     { timeoutMs: SKILL_DISCOVERY_TIMEOUT_MS }
   )
 }
diff --git a/src/renderer/src/runtime/use-runtime-session-mirror-environment-key.test.ts b/src/renderer/src/runtime/use-runtime-session-mirror-environment-key.test.ts
index c08643c7606..fc28095e136 100644
--- a/src/renderer/src/runtime/use-runtime-session-mirror-environment-key.test.ts
+++ b/src/renderer/src/runtime/use-runtime-session-mirror-environment-key.test.ts
@@ -17,6 +17,7 @@ vi.mock('@/lib/runtime-session-mirror-targets', async (importOriginal) => {
 })
 
 import { useAppStore } from '@/store'
+import type { PublicKnownRuntimeEnvironment } from '../../../shared/runtime-environments'
 import type { AppState } from '@/store/types'
 import {
   selectRuntimeSessionMirrorTargetInputs,
@@ -71,7 +72,7 @@ function seedMirrorState(): void {
       runtimeEnvironments: [
         { id: 'env-a', createdAt: 100, pairingRevision: 101 },
         { id: 'env-b', createdAt: 200, pairingRevision: 201 }
-      ] as AppState['runtimeEnvironments'],
+      ] as PublicKnownRuntimeEnvironment[],
       runtimeStatusByEnvironmentId: new Map([
         [
           'env-a',
@@ -260,7 +261,7 @@ describe('useRuntimeSessionMirrorEnvironmentKey', () => {
       useAppStore.setState({
         runtimeEnvironments: [
           { id: 'env-a', createdAt: 100, pairingRevision: 102 }
-        ] as AppState['runtimeEnvironments']
+        ] as PublicKnownRuntimeEnvironment[]
       })
     })
     expect(hook.result.current).toBe('env-a\u0001runtime-a\u00012\u0001102')
diff --git a/src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts b/src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts
new file mode 100644
index 00000000000..135fdad5925
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts
@@ -0,0 +1,82 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createWebRuntimeSessionBrowserTab } from './web-runtime-session'
+
+const ENVIRONMENT_ID = 'runtime-1'
+const WORKTREE_ID = 'repo::/worktree'
+
+const mocks = vi.hoisted(() => ({
+  closeEmptyGroup: vi.fn(),
+  getState: vi.fn(),
+  runtimeCall: vi.fn(),
+  setState: vi.fn(),
+  subscribe: vi.fn()
+}))
+
+vi.mock('../store', () => ({
+  useAppStore: {
+    getState: mocks.getState,
+    setState: mocks.setState,
+    subscribe: mocks.subscribe
+  }
+}))
+
+vi.mock('./web-session-tabs-sync', () => ({
+  acceptReplayedWebSessionTabsSnapshot: vi.fn(),
+  applyFreshWebSessionTabsSnapshot: vi.fn(),
+  applyWebSessionTabsStorePatch: vi.fn(),
+  resolveHostSessionTabIdForWebSessionTab: vi.fn()
+}))
+
+vi.mock('@/lib/feature-education-telemetry', () => ({
+  trackTerminalPaneSplit: vi.fn()
+}))
+
+vi.mock('@/lib/worktree-runtime-owner', () => ({
+  getRuntimeEnvironmentIdForWorktree: vi.fn()
+}))
+
+vi.mock('@/lib/agent-launch-prompt-delivery', () => ({
+  deliverLaunchPromptToAgentTab: vi.fn(),
+  seedNativeChatLaunchDraftForAgentTab: vi.fn()
+}))
+
+describe('paired browser capability cleanup', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    vi.stubGlobal('window', {
+      api: { runtimeEnvironments: { call: mocks.runtimeCall } }
+    })
+  })
+
+  it.each([
+    ['absent status', new Map()],
+    [
+      'unknown capabilities',
+      new Map([[ENVIRONMENT_ID, { status: { capabilities: undefined }, checkedAt: 1 }]])
+    ],
+    [
+      'mixed-version host',
+      new Map([[ENVIRONMENT_ID, { status: { capabilities: [] }, checkedAt: 1 }]])
+    ]
+  ])('rejects %s and removes the caller-created split', async (_label, runtimeStatuses) => {
+    mocks.getState.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: ENVIRONMENT_ID },
+      runtimeStatusByEnvironmentId: runtimeStatuses,
+      closeEmptyGroup: mocks.closeEmptyGroup
+    })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        clientTargetGroupId: 'preview-group',
+        clientTargetGroupCreated: true
+      })
+    ).rejects.toThrow('does not support browser streaming')
+
+    expect(mocks.closeEmptyGroup).toHaveBeenCalledOnce()
+    expect(mocks.closeEmptyGroup).toHaveBeenCalledWith(WORKTREE_ID, 'preview-group')
+    expect(mocks.runtimeCall).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation-e2e-fault.ts b/src/renderer/src/runtime/web-runtime-browser-creation-e2e-fault.ts
new file mode 100644
index 00000000000..51c02be9842
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-browser-creation-e2e-fault.ts
@@ -0,0 +1,122 @@
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import { e2eConfig } from '@/lib/e2e-config'
+
+type BrowserCreationFaultSnapshot = {
+  armed: boolean
+  capabilityRejectionArmed: boolean
+  createdPageId: string | null
+  suppressedPageIds: string[]
+}
+
+type BrowserCreationFaultApi = {
+  arm: () => void
+  armCapabilityRejection: () => void
+  release: () => boolean
+  reset: () => void
+  snapshot: () => BrowserCreationFaultSnapshot
+}
+
+type BrowserCreationFaultWindow = Window & {
+  __webRuntimeBrowserCreationFault?: BrowserCreationFaultApi
+}
+
+let armed = false
+let capabilityRejectionArmed = false
+let createdPageId: string | null = null
+let failNextReconciliation = false
+let releaseCreatedPage: (() => void) | null = null
+let createdPageBarrier: Promise<void> | null = null
+const suppressedPageIds = new Set<string>()
+const MAX_SUPPRESSED_PAGE_IDS = 128
+
+function resetFault(): void {
+  releaseCreatedPage?.()
+  armed = false
+  capabilityRejectionArmed = false
+  createdPageId = null
+  failNextReconciliation = false
+  releaseCreatedPage = null
+  createdPageBarrier = null
+  suppressedPageIds.clear()
+}
+
+function exposeFaultApi(): void {
+  if (!e2eConfig.exposeStore || typeof window === 'undefined') {
+    return
+  }
+  const target = window as BrowserCreationFaultWindow
+  target.__webRuntimeBrowserCreationFault ??= {
+    arm: () => {
+      resetFault()
+      armed = true
+      createdPageBarrier = new Promise<void>((resolve) => {
+        releaseCreatedPage = resolve
+      })
+    },
+    armCapabilityRejection: () => {
+      resetFault()
+      capabilityRejectionArmed = true
+    },
+    release: () => {
+      if (!armed || !createdPageId || !releaseCreatedPage) {
+        return false
+      }
+      failNextReconciliation = true
+      const release = releaseCreatedPage
+      releaseCreatedPage = null
+      release()
+      return true
+    },
+    reset: resetFault,
+    snapshot: () => ({
+      armed,
+      capabilityRejectionArmed,
+      createdPageId,
+      suppressedPageIds: [...suppressedPageIds]
+    })
+  }
+}
+
+exposeFaultApi()
+
+export function throwIfE2eWebRuntimeBrowserCapabilityUnavailable(): void {
+  if (!e2eConfig.exposeStore || !capabilityRejectionArmed) {
+    return
+  }
+  capabilityRejectionArmed = false
+  throw new Error('E2E forced browser capability rejection')
+}
+
+export async function pauseAfterE2eWebRuntimeBrowserCreate(remotePageId: string): Promise<void> {
+  if (!e2eConfig.exposeStore || !armed || !createdPageBarrier) {
+    return
+  }
+  createdPageId = remotePageId
+  await createdPageBarrier
+}
+
+export function throwIfE2eWebRuntimeBrowserReconciliationFails(): void {
+  if (!e2eConfig.exposeStore || !failNextReconciliation) {
+    return
+  }
+  failNextReconciliation = false
+  throw new Error('E2E forced session-tabs reconciliation timeout')
+}
+
+export function suppressE2eWebRuntimeBrowserSnapshot(
+  snapshot: RuntimeMobileSessionTabsResult
+): boolean {
+  if (!e2eConfig.exposeStore || !armed) {
+    return false
+  }
+  const pageIds = snapshot.tabs.flatMap((tab) =>
+    tab.type === 'browser' && tab.browserPageId ? [tab.browserPageId] : []
+  )
+  for (const pageId of pageIds) {
+    if (suppressedPageIds.size >= MAX_SUPPRESSED_PAGE_IDS) {
+      break
+    }
+    suppressedPageIds.add(pageId)
+  }
+  return pageIds.length > 0
+}
diff --git a/src/renderer/src/runtime/web-runtime-browser-materialization.test.ts b/src/renderer/src/runtime/web-runtime-browser-materialization.test.ts
new file mode 100644
index 00000000000..1bdda2a132b
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-browser-materialization.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import type { AppState } from '@/store/types'
+import { hasMaterializedWebRuntimeBrowserPage } from './web-runtime-browser-materialization'
+
+function state(overrides: Partial<AppState> = {}): AppState {
+  return {
+    browserTabsByWorktree: {
+      'wt-1': [{ id: 'workspace-1', worktreeId: 'wt-1', pageIds: ['page-1'] }]
+    },
+    browserPagesByWorkspace: {
+      'workspace-1': [{ id: 'page-1', workspaceId: 'workspace-1', worktreeId: 'wt-1' }]
+    },
+    remoteBrowserPageHandlesByPageId: {
+      'page-1': { environmentId: 'env-1', remotePageId: 'remote-page-1' }
+    },
+    unifiedTabsByWorktree: {
+      'wt-1': [
+        {
+          id: 'tab-1',
+          entityId: 'workspace-1',
+          contentType: 'browser',
+          groupId: 'group-1'
+        }
+      ]
+    },
+    ...overrides
+  } as AppState
+}
+
+describe('hasMaterializedWebRuntimeBrowserPage', () => {
+  it('requires the exact remote owner, client workspace, unified tab, and requested group', () => {
+    const materialized = state()
+
+    expect(
+      hasMaterializedWebRuntimeBrowserPage(
+        materialized,
+        'env-1',
+        'wt-1',
+        'remote-page-1',
+        'group-1'
+      )
+    ).toBe(true)
+    expect(
+      hasMaterializedWebRuntimeBrowserPage(
+        materialized,
+        'env-1',
+        'wt-1',
+        'remote-page-1',
+        'other-group'
+      )
+    ).toBe(false)
+    expect(
+      hasMaterializedWebRuntimeBrowserPage(
+        state({ unifiedTabsByWorktree: { 'wt-1': [] } }),
+        'env-1',
+        'wt-1',
+        'remote-page-1'
+      )
+    ).toBe(false)
+    expect(
+      hasMaterializedWebRuntimeBrowserPage(materialized, 'env-2', 'wt-1', 'remote-page-1')
+    ).toBe(false)
+  })
+})
diff --git a/src/renderer/src/runtime/web-runtime-browser-materialization.ts b/src/renderer/src/runtime/web-runtime-browser-materialization.ts
new file mode 100644
index 00000000000..434f9a579af
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-browser-materialization.ts
@@ -0,0 +1,33 @@
+import type { AppState } from '@/store/types'
+
+type BrowserMaterializationState = Pick<
+  AppState,
+  | 'browserPagesByWorkspace'
+  | 'browserTabsByWorktree'
+  | 'remoteBrowserPageHandlesByPageId'
+  | 'unifiedTabsByWorktree'
+>
+
+export function hasMaterializedWebRuntimeBrowserPage(
+  state: BrowserMaterializationState,
+  environmentId: string,
+  worktreeId: string,
+  remotePageId: string,
+  expectedGroupId?: string
+): boolean {
+  return (state.browserTabsByWorktree[worktreeId] ?? []).some((workspace) => {
+    const hasRemotePage = (state.browserPagesByWorkspace[workspace.id] ?? []).some((page) => {
+      const handle = state.remoteBrowserPageHandlesByPageId[page.id]
+      return handle?.environmentId === environmentId && handle.remotePageId === remotePageId
+    })
+    if (!hasRemotePage) {
+      return false
+    }
+    return (state.unifiedTabsByWorktree[worktreeId] ?? []).some(
+      (tab) =>
+        tab.contentType === 'browser' &&
+        tab.entityId === workspace.id &&
+        (!expectedGroupId || tab.groupId === expectedGroupId)
+    )
+  })
+}
diff --git a/src/renderer/src/runtime/web-runtime-session.test.ts b/src/renderer/src/runtime/web-runtime-session.test.ts
index 71ecd304f96..3e64191dcab 100644
--- a/src/renderer/src/runtime/web-runtime-session.test.ts
+++ b/src/renderer/src/runtime/web-runtime-session.test.ts
@@ -34,12 +34,19 @@ import {
   resetWebAgentSessionHandoffsForTests
 } from './web-agent-session-handoff'
 import { toRuntimeExecutionHostId } from '../../../shared/execution-host'
+import {
+  isWebSessionBrowserPlacementGroupReserved,
+  resetWebSessionBrowserPlacementsForTests
+} from './web-session-browser-placement'
 
 const mocks = vi.hoisted(() => ({
   getState: vi.fn(),
   setState: vi.fn(),
+  subscribe: vi.fn(),
   setActiveWorktree: vi.fn(),
   createBrowserTab: vi.fn(),
+  closeEmptyGroup: vi.fn(),
+  moveUnifiedTabToGroup: vi.fn(),
   setRemoteBrowserPageHandle: vi.fn(),
   focusBrowserTabInWorktree: vi.fn(),
   applyFreshWebSessionTabsSnapshot: vi.fn(),
@@ -48,13 +55,18 @@ const mocks = vi.hoisted(() => ({
   trackTerminalPaneSplit: vi.fn(),
   deliverLaunchPromptToAgentTab: vi.fn(),
   seedNativeChatLaunchDraftForAgentTab: vi.fn(),
-  getRuntimeEnvironmentIdForWorktree: vi.fn()
+  getRuntimeEnvironmentIdForWorktree: vi.fn(),
+  hasMaterializedWebRuntimeBrowserPage: vi.fn(),
+  toastError: vi.fn()
 }))
 
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError } }))
+
 vi.mock('../store', () => ({
   useAppStore: {
     getState: mocks.getState,
-    setState: mocks.setState
+    setState: mocks.setState,
+    subscribe: mocks.subscribe
   }
 }))
 
@@ -79,7 +91,12 @@ vi.mock('@/lib/agent-launch-prompt-delivery', () => ({
   seedNativeChatLaunchDraftForAgentTab: mocks.seedNativeChatLaunchDraftForAgentTab
 }))
 
+vi.mock('./web-runtime-browser-materialization', () => ({
+  hasMaterializedWebRuntimeBrowserPage: mocks.hasMaterializedWebRuntimeBrowserPage
+}))
+
 const ENVIRONMENT_ID = 'web-env-1'
+const SECOND_ENVIRONMENT_ID = 'web-env-2'
 const RUNTIME_EXECUTION_HOST_ID = toRuntimeExecutionHostId(ENVIRONMENT_ID)
 const WORKTREE_ID = 'repo::/worktree'
 const FOCUS_LEAF_ID = '11111111-1111-4111-8111-111111111111'
@@ -98,6 +115,21 @@ function makeSnapshot(): RuntimeMobileSessionTabsResult {
   }
 }
 
+function makeAttributionSafeStatus(capabilities: string[] = ['terminal.attribution-removed.v1']) {
+  return {
+    id: 'status',
+    ok: true,
+    result: {
+      runtimeId: 'runtime-1',
+      graphStatus: 'ready',
+      runtimeProtocolVersion: 3,
+      minCompatibleRuntimeClientVersion: 2,
+      appVersion: '1.4.181',
+      capabilities
+    }
+  }
+}
+
 describe('refreshWebRuntimeSessionTabsSnapshot', () => {
   afterEach(() => {
     resetWebAgentSessionHandoffsForTests()
@@ -249,10 +281,28 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       settings: {
         activeRuntimeEnvironmentId: ENVIRONMENT_ID
       },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+      ]),
       activeWorktreeId: WORKTREE_ID,
+      activeWorkspaceExecutionHostId: RUNTIME_EXECUTION_HOST_ID,
+      activeTabType: 'editor',
+      activeTabTypeByWorktree: { [WORKTREE_ID]: 'editor' },
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/index.html' },
       browserPagesByWorkspace: {},
       remoteBrowserPageHandlesByPageId: {},
+      unifiedTabsByWorktree: {
+        [WORKTREE_ID]: [
+          {
+            id: 'local-editor-tab',
+            entityId: '/worktree/index.html',
+            contentType: 'editor'
+          }
+        ]
+      },
       createBrowserTab: mocks.createBrowserTab,
+      closeEmptyGroup: mocks.closeEmptyGroup,
+      moveUnifiedTabToGroup: mocks.moveUnifiedTabToGroup,
       setRemoteBrowserPageHandle: mocks.setRemoteBrowserPageHandle,
       focusBrowserTabInWorktree: mocks.focusBrowserTabInWorktree,
       setActiveWorktree: mocks.setActiveWorktree
@@ -263,24 +313,54 @@ describe('createWebRuntimeSessionBrowserTab', () => {
         activeWorktreeId: WORKTREE_ID
       })
     })
+    mocks.subscribe.mockReturnValue(vi.fn())
     mocks.createBrowserTab.mockReturnValue({
       id: 'local-browser-workspace-1',
       activePageId: 'local-page-1',
       pageIds: ['local-page-1']
     })
+    mocks.moveUnifiedTabToGroup.mockReturnValue(true)
     mocks.applyFreshWebSessionTabsSnapshot.mockReturnValue({ state: 'after' })
     mocks.resolveHostSessionTabIdForWebSessionTab.mockReturnValue(null)
     mocks.deliverLaunchPromptToAgentTab.mockResolvedValue(true)
+    mocks.hasMaterializedWebRuntimeBrowserPage.mockReturnValue(true)
   })
 
   afterEach(() => {
     vi.unstubAllGlobals()
     clearRuntimeCompatibilityCacheForTests()
+    resetWebSessionBrowserPlacementsForTests()
+    resetWebSessionFocusIntentForTests()
     vi.clearAllMocks()
   })
 
-  it('eagerly applies the host session snapshot after creating a remote browser tab', async () => {
+  it('rejects before RPC when the selected runtime does not advertise screencast', async () => {
+    mocks.getState.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: ENVIRONMENT_ID },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: [] }, checkedAt: 1 }]
+      ])
+    })
+    const runtimeCall = vi.fn()
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID
+      })
+    ).rejects.toThrow('does not support browser streaming')
+
+    expect(runtimeCall).not.toHaveBeenCalled()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('applies an empty host snapshot without retaining delayed browser focus', async () => {
     const snapshot = makeSnapshot()
+    let resolveList!: (response: unknown) => void
+    const listResponse = new Promise((resolve) => {
+      resolveList = resolve
+    })
     const runtimeCall = vi
       .fn()
       .mockResolvedValueOnce({
@@ -288,11 +368,7 @@ describe('createWebRuntimeSessionBrowserTab', () => {
         ok: true,
         result: { browserPageId: 'remote-browser-page-1' }
       })
-      .mockResolvedValueOnce({
-        id: 'list',
-        ok: true,
-        result: snapshot
-      })
+      .mockReturnValueOnce(listResponse)
 
     vi.stubGlobal('window', {
       api: {
@@ -302,14 +378,19 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       }
     })
 
-    await expect(
-      createWebRuntimeSessionBrowserTab({
-        worktreeId: WORKTREE_ID,
-        url: 'https://example.com/'
-      })
-    ).resolves.toBe(true)
+    const pendingCreate = createWebRuntimeSessionBrowserTab({
+      worktreeId: WORKTREE_ID,
+      url: 'https://example.com/'
+    })
 
     await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
+    expect(mocks.subscribe).toHaveBeenCalledOnce()
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toEqual({
+      hostTabId: 'remote-browser-page-1',
+      expectedCurrentLocalTabId: 'local-editor-tab'
+    })
+    resolveList({ id: 'list', ok: true, result: snapshot })
+    await expect(pendingCreate).resolves.toBe(true)
     await vi.waitFor(() => expect(mocks.applyFreshWebSessionTabsSnapshot).toHaveBeenCalledTimes(1))
 
     expect(runtimeCall).toHaveBeenNthCalledWith(1, {
@@ -339,20 +420,724 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       snapshot,
       ENVIRONMENT_ID
     )
-    expect(mocks.createBrowserTab).toHaveBeenCalledWith(WORKTREE_ID, 'https://example.com/', {
-      title: 'https://example.com/',
-      focusAddressBar: true,
-      browserRuntimeEnvironmentId: ENVIRONMENT_ID
+    expect(mocks.acceptReplayedWebSessionTabsSnapshot).toHaveBeenCalledWith(
+      ENVIRONMENT_ID,
+      WORKTREE_ID
+    )
+    expect(mocks.acceptReplayedWebSessionTabsSnapshot.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.applyFreshWebSessionTabsSnapshot.mock.invocationCallOrder[0]!
+    )
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('does not let a slow browser create replace a newer browser selection', async () => {
+    let resolveCreate!: (response: unknown) => void
+    const createResponse = new Promise((resolve) => {
+      resolveCreate = resolve
     })
-    expect(mocks.setRemoteBrowserPageHandle).toHaveBeenCalledWith('local-page-1', {
+    mocks.resolveHostSessionTabIdForWebSessionTab.mockReturnValue('newer-host-browser')
+    const runtimeCall = vi.fn(async (request: { method: string }) => {
+      if (request.method === 'browser.tabCreate') {
+        return createResponse
+      }
+      if (request.method === 'session.tabs.activate') {
+        return { id: 'activate', ok: true, result: {} }
+      }
+      return { id: 'list', ok: true, result: makeSnapshot() }
+    })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const pendingCreate = createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })
+    await vi.waitFor(() =>
+      expect(
+        runtimeCall.mock.calls.some(([request]) => request.method === 'browser.tabCreate')
+      ).toBe(true)
+    )
+    await activateWebRuntimeSessionTab({
+      worktreeId: WORKTREE_ID,
+      tabId: 'newer-local-browser'
+    })
+    resolveCreate({
+      id: 'create',
+      ok: true,
+      result: { browserPageId: 'created-host-browser' }
+    })
+    await expect(pendingCreate).resolves.toBe(true)
+
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toEqual({
+      hostTabId: 'newer-host-browser'
+    })
+  })
+
+  it('does not focus a slow browser create after an editor A-B-A selection', async () => {
+    let resolveCreate!: (response: unknown) => void
+    const createResponse = new Promise((resolve) => {
+      resolveCreate = resolve
+    })
+    let state = mocks.getState()
+    let listener: ((next: typeof state, previous: typeof state) => void) | null = null
+    mocks.getState.mockImplementation(() => state)
+    mocks.subscribe.mockImplementation((nextListener) => {
+      listener = nextListener
+      return vi.fn()
+    })
+    const runtimeCall = vi.fn(async (request: { method: string }) => {
+      if (request.method === 'browser.tabCreate') {
+        return createResponse
+      }
+      return { id: 'list', ok: true, result: makeSnapshot() }
+    })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const pendingCreate = createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })
+    await vi.waitFor(() => expect(listener).not.toBeNull())
+    const editorBState = {
+      ...state,
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/other.html' },
+      unifiedTabsByWorktree: {
+        [WORKTREE_ID]: [
+          ...state.unifiedTabsByWorktree[WORKTREE_ID],
+          {
+            id: 'other-editor-tab',
+            entityId: '/worktree/other.html',
+            contentType: 'editor'
+          }
+        ]
+      }
+    }
+    listener!(editorBState, state)
+    const editorAState = {
+      ...editorBState,
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/index.html' }
+    }
+    listener!(editorAState, editorBState)
+    state = editorAState
+    resolveCreate({
+      id: 'create',
+      ok: true,
+      result: { browserPageId: 'created-host-browser' }
+    })
+    await expect(pendingCreate).resolves.toBe(true)
+
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+  })
+
+  it('does not focus a browser after an editor A-B-A selection during reconciliation', async () => {
+    let resolveList!: (response: unknown) => void
+    const listResponse = new Promise((resolve) => {
+      resolveList = resolve
+    })
+    let state = mocks.getState()
+    let listener: ((next: typeof state, previous: typeof state) => void) | null = null
+    mocks.getState.mockImplementation(() => state)
+    mocks.subscribe.mockImplementation((nextListener) => {
+      listener = nextListener
+      return vi.fn()
+    })
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'created-host-browser' }
+      })
+      .mockReturnValueOnce(listResponse)
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const pendingCreate = createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })
+    await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
+    const editorBState = {
+      ...state,
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/other.html' },
+      unifiedTabsByWorktree: {
+        [WORKTREE_ID]: [
+          ...state.unifiedTabsByWorktree[WORKTREE_ID],
+          {
+            id: 'other-editor-tab',
+            entityId: '/worktree/other.html',
+            contentType: 'editor'
+          }
+        ]
+      }
+    }
+    listener!(editorBState, state)
+    const editorAState = {
+      ...editorBState,
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/index.html' }
+    }
+    listener!(editorAState, editorBState)
+    state = editorAState
+    resolveList({ id: 'list', ok: true, result: makeSnapshot() })
+    await expect(pendingCreate).resolves.toBe(true)
+
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+  })
+
+  it.each([
+    {
+      label: 'worktree',
+      leave: (state: Record<string, unknown>) => ({
+        ...state,
+        activeWorktreeId: 'repo::/other-worktree'
+      }),
+      returnToStart: (state: Record<string, unknown>) => ({
+        ...state,
+        activeWorktreeId: WORKTREE_ID
+      })
+    },
+    {
+      label: 'runtime owner',
+      leave: (state: Record<string, unknown>) => ({
+        ...state,
+        activeWorkspaceExecutionHostId: 'local'
+      }),
+      returnToStart: (state: Record<string, unknown>) => ({
+        ...state,
+        activeWorkspaceExecutionHostId: RUNTIME_EXECUTION_HOST_ID
+      })
+    }
+  ])(
+    'does not focus after leaving and returning to the $label during reconciliation',
+    async ({ leave, returnToStart }) => {
+      let resolveList!: (response: unknown) => void
+      const listResponse = new Promise((resolve) => {
+        resolveList = resolve
+      })
+      let state = mocks.getState()
+      let listener: ((next: typeof state, previous: typeof state) => void) | null = null
+      mocks.getState.mockImplementation(() => state)
+      mocks.subscribe.mockImplementation((nextListener) => {
+        listener = nextListener
+        return vi.fn()
+      })
+      const runtimeCall = vi
+        .fn()
+        .mockResolvedValueOnce({
+          id: 'create',
+          ok: true,
+          result: { browserPageId: 'created-host-browser' }
+        })
+        .mockReturnValueOnce(listResponse)
+      vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+      const pendingCreate = createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })
+      await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
+      const awayState = leave(state)
+      listener!(awayState, state)
+      const returnedState = returnToStart(awayState)
+      listener!(returnedState, awayState)
+      state = returnedState
+      resolveList({ id: 'list', ok: true, result: makeSnapshot() })
+      await expect(pendingCreate).resolves.toBe(true)
+
+      expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+    }
+  )
+
+  it.each([
+    'remote_runtime_unavailable',
+    'runtime_timeout',
+    'invalid_runtime_response',
+    'runtime_error'
+  ])('reports a browser-create %s as ambiguous without retrying', async (code) => {
+    const runtimeCall = vi.fn().mockResolvedValue({
+      id: 'create-lost',
+      ok: false,
+      error: { code, message: 'response lost' }
+    })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID, url: 'https://example.com/' })
+    ).rejects.toThrow('did not confirm whether the browser tab was created')
+
+    expect(runtimeCall).toHaveBeenCalledOnce()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it.each(['browser_error', 'invalid_argument', 'method_not_found'])(
+    'reports a definitive browser-create %s as a soft failure',
+    async (code) => {
+      const runtimeCall = vi.fn().mockResolvedValue({
+        id: 'create-rejected',
+        ok: false,
+        error: { code, message: 'host rejected before creation' }
+      })
+      vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+      await expect(
+        createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID, url: 'https://example.com/' })
+      ).resolves.toBe(false)
+
+      expect(runtimeCall).toHaveBeenCalledOnce()
+      expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+    }
+  )
+
+  it('creates an unfocused browser while preserving its requested split', async () => {
+    mocks.getState.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: ENVIRONMENT_ID },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+      ]),
+      activeWorktreeId: WORKTREE_ID,
+      browserPagesByWorkspace: {
+        'host-browser-workspace': [
+          { id: 'host-browser-page', workspaceId: 'host-browser-workspace' }
+        ]
+      },
+      remoteBrowserPageHandlesByPageId: {
+        'host-browser-page': {
+          environmentId: ENVIRONMENT_ID,
+          remotePageId: 'remote-browser-page-1'
+        }
+      },
+      unifiedTabsByWorktree: { [WORKTREE_ID]: [] },
+      createBrowserTab: mocks.createBrowserTab,
+      closeEmptyGroup: mocks.closeEmptyGroup,
+      moveUnifiedTabToGroup: mocks.moveUnifiedTabToGroup,
+      setRemoteBrowserPageHandle: mocks.setRemoteBrowserPageHandle,
+      focusBrowserTabInWorktree: mocks.focusBrowserTabInWorktree,
+      setActiveWorktree: mocks.setActiveWorktree
+    })
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({ id: 'list', ok: true, result: makeSnapshot() })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        clientTargetGroupId: 'client-preview-group',
+        focusOnCreate: false
+      })
+    ).resolves.toBe(true)
+
+    expect(runtimeCall).toHaveBeenNthCalledWith(1, {
+      selector: ENVIRONMENT_ID,
+      method: 'browser.tabCreate',
+      params: {
+        worktree: `id:${WORKTREE_ID}`,
+        url: undefined,
+        profileId: undefined,
+        activate: false,
+        waitForRegistration: false
+      },
+      timeoutMs: 15_000
+    })
+    expect(mocks.subscribe).not.toHaveBeenCalled()
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+    expect(mocks.acceptReplayedWebSessionTabsSnapshot).toHaveBeenCalledWith(
+      ENVIRONMENT_ID,
+      WORKTREE_ID
+    )
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        worktreeId: WORKTREE_ID,
+        groupId: 'client-preview-group'
+      })
+    ).toBe(false)
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+  })
+
+  it('releases and removes a newly-created split when host creation is ambiguous', async () => {
+    vi.stubGlobal('window', {
+      api: {
+        runtimeEnvironments: {
+          call: vi.fn().mockRejectedValue(new Error('offline'))
+        }
+      }
+    })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        clientTargetGroupId: 'client-preview-group',
+        clientTargetGroupCreated: true
+      })
+    ).rejects.toThrow('did not confirm whether the browser tab was created')
+
+    expect(mocks.closeEmptyGroup).toHaveBeenCalledWith(WORKTREE_ID, 'client-preview-group')
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        worktreeId: WORKTREE_ID,
+        groupId: 'client-preview-group'
+      })
+    ).toBe(false)
+  })
+
+  it('cleans up and reports failure when the created browser cannot reconcile', async () => {
+    mocks.hasMaterializedWebRuntimeBrowserPage.mockReturnValue(false)
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({
+        id: 'list',
+        ok: false,
+        error: { code: 'remote_runtime_timeout', message: 'session tabs timed out' }
+      })
+      .mockResolvedValueOnce({ id: 'close', ok: true, result: { closed: true } })
+      .mockResolvedValueOnce({ id: 'list-after-close', ok: true, result: makeSnapshot() })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        clientTargetGroupId: 'client-preview-group',
+        clientTargetGroupCreated: true,
+        focusOnCreate: false
+      })
+    ).resolves.toBe(false)
+
+    expect(runtimeCall).toHaveBeenNthCalledWith(3, {
+      selector: ENVIRONMENT_ID,
+      method: 'browser.tabClose',
+      params: {
+        worktree: `id:${WORKTREE_ID}`,
+        page: 'remote-browser-page-1'
+      },
+      timeoutMs: 15_000
+    })
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+    expect(mocks.closeEmptyGroup).toHaveBeenCalledWith(WORKTREE_ID, 'client-preview-group')
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        worktreeId: WORKTREE_ID,
+        groupId: 'client-preview-group'
+      })
+    ).toBe(false)
+  })
+
+  it('keeps a split reserved after ownership moves to an overlapping browser creation', async () => {
+    mocks.getState.mockReturnValue({
+      ...mocks.getState(),
+      runtimeStatusByEnvironmentId: new Map(
+        [ENVIRONMENT_ID, SECOND_ENVIRONMENT_ID].map((environmentId) => [
+          environmentId,
+          { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }
+        ])
+      )
+    })
+    let resolveFirstList!: (response: unknown) => void
+    let resolveSecondList!: (response: unknown) => void
+    const firstList = new Promise((resolve) => {
+      resolveFirstList = resolve
+    })
+    const secondList = new Promise((resolve) => {
+      resolveSecondList = resolve
+    })
+    let createCount = 0
+    let listCount = 0
+    const runtimeCall = vi.fn((request: { method: string }) => {
+      if (request.method === 'browser.tabCreate') {
+        createCount += 1
+        return Promise.resolve({
+          id: `create-${createCount}`,
+          ok: true,
+          result: { browserPageId: `remote-browser-page-${createCount}` }
+        })
+      }
+      if (request.method === 'session.tabs.list') {
+        listCount += 1
+        if (listCount === 1) {
+          return firstList
+        }
+        if (listCount === 2) {
+          return secondList
+        }
+        return Promise.resolve({ id: 'list-after-close', ok: true, result: makeSnapshot() })
+      }
+      return Promise.resolve({ id: 'close', ok: true, result: { closed: true } })
+    })
+    mocks.hasMaterializedWebRuntimeBrowserPage.mockImplementation(
+      (_state, _environmentId, _worktreeId, remotePageId) =>
+        remotePageId === 'remote-browser-page-2'
+    )
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const first = createWebRuntimeSessionBrowserTab({
+      worktreeId: WORKTREE_ID,
       environmentId: ENVIRONMENT_ID,
-      remotePageId: 'remote-browser-page-1'
+      clientTargetGroupId: 'client-preview-group',
+      clientTargetGroupCreated: true,
+      focusOnCreate: false
     })
+    await vi.waitFor(() => expect(listCount).toBe(1))
+    const second = createWebRuntimeSessionBrowserTab({
+      worktreeId: WORKTREE_ID,
+      environmentId: SECOND_ENVIRONMENT_ID,
+      clientTargetGroupId: 'client-preview-group',
+      clientTargetGroupCreated: false,
+      focusOnCreate: false
+    })
+    await vi.waitFor(() => expect(createCount).toBe(2))
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        worktreeId: WORKTREE_ID,
+        groupId: 'client-preview-group'
+      })
+    ).toBe(true)
+
+    resolveFirstList({
+      id: 'first-list',
+      ok: false,
+      error: { code: 'remote_runtime_timeout', message: 'first preview timed out' }
+    })
+    await vi.waitFor(() => expect(listCount).toBeGreaterThanOrEqual(2))
+    resolveSecondList({ id: 'second-list', ok: true, result: makeSnapshot() })
+    await expect(second).resolves.toBe(true)
+    await expect(first).resolves.toBe(false)
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+    expect(mocks.hasMaterializedWebRuntimeBrowserPage).toHaveBeenCalledWith(
+      expect.anything(),
+      SECOND_ENVIRONMENT_ID,
+      WORKTREE_ID,
+      'remote-browser-page-2',
+      'client-preview-group'
+    )
+  })
+
+  it('transfers empty-split cleanup when both overlapping creations fail', async () => {
+    mocks.getState.mockReturnValue({
+      ...mocks.getState(),
+      runtimeStatusByEnvironmentId: new Map(
+        [ENVIRONMENT_ID, SECOND_ENVIRONMENT_ID].map((environmentId) => [
+          environmentId,
+          { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }
+        ])
+      )
+    })
+    let rejectFirst!: (error: Error) => void
+    let rejectSecond!: (error: Error) => void
+    const runtimeCall = vi
+      .fn()
+      .mockReturnValueOnce(
+        new Promise((_resolve, reject) => {
+          rejectFirst = reject
+        })
+      )
+      .mockReturnValueOnce(
+        new Promise((_resolve, reject) => {
+          rejectSecond = reject
+        })
+      )
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const first = createWebRuntimeSessionBrowserTab({
+      worktreeId: WORKTREE_ID,
+      environmentId: ENVIRONMENT_ID,
+      clientTargetGroupId: 'client-preview-group',
+      clientTargetGroupCreated: true,
+      focusOnCreate: false
+    })
+    const second = createWebRuntimeSessionBrowserTab({
+      worktreeId: WORKTREE_ID,
+      environmentId: SECOND_ENVIRONMENT_ID,
+      clientTargetGroupId: 'client-preview-group',
+      clientTargetGroupCreated: false,
+      focusOnCreate: false
+    })
+    rejectFirst(new Error('first host offline'))
+    await expect(first).rejects.toThrow('did not confirm whether the browser tab was created')
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+
+    rejectSecond(new Error('second host offline'))
+    await expect(second).rejects.toThrow('did not confirm whether the browser tab was created')
+    expect(mocks.closeEmptyGroup).toHaveBeenCalledOnce()
+    expect(mocks.closeEmptyGroup).toHaveBeenCalledWith(WORKTREE_ID, 'client-preview-group')
+  })
+
+  it('rechecks split reservations after delayed host rollback', async () => {
+    mocks.getState.mockReturnValue({
+      ...mocks.getState(),
+      runtimeStatusByEnvironmentId: new Map(
+        [ENVIRONMENT_ID, SECOND_ENVIRONMENT_ID].map((environmentId) => [
+          environmentId,
+          { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }
+        ])
+      )
+    })
+    let resolveClose!: (response: unknown) => void
+    const closeResponse = new Promise((resolve) => {
+      resolveClose = resolve
+    })
+    let createCount = 0
+    let listCount = 0
+    const runtimeCall = vi.fn((request: { method: string }) => {
+      if (request.method === 'browser.tabCreate') {
+        createCount += 1
+        return Promise.resolve({
+          id: `create-${createCount}`,
+          ok: true,
+          result: { browserPageId: `remote-browser-page-${createCount}` }
+        })
+      }
+      if (request.method === 'browser.tabClose') {
+        return closeResponse
+      }
+      listCount += 1
+      return Promise.resolve(
+        listCount === 1
+          ? {
+              id: 'first-list',
+              ok: false,
+              error: { code: 'remote_runtime_timeout', message: 'first preview timed out' }
+            }
+          : { id: `list-${listCount}`, ok: true, result: makeSnapshot() }
+      )
+    })
+    mocks.hasMaterializedWebRuntimeBrowserPage.mockImplementation(
+      (_state, _environmentId, _worktreeId, remotePageId) =>
+        remotePageId === 'remote-browser-page-2'
+    )
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const first = createWebRuntimeSessionBrowserTab({
+      worktreeId: WORKTREE_ID,
+      environmentId: ENVIRONMENT_ID,
+      clientTargetGroupId: 'client-preview-group',
+      clientTargetGroupCreated: true,
+      focusOnCreate: false
+    })
+    await vi.waitFor(() =>
+      expect(
+        runtimeCall.mock.calls.some(([request]) => request.method === 'browser.tabClose')
+      ).toBe(true)
+    )
+    const second = createWebRuntimeSessionBrowserTab({
+      worktreeId: WORKTREE_ID,
+      environmentId: SECOND_ENVIRONMENT_ID,
+      clientTargetGroupId: 'client-preview-group',
+      clientTargetGroupCreated: false,
+      focusOnCreate: false
+    })
+    await vi.waitFor(() => expect(createCount).toBe(2))
+
+    resolveClose({ id: 'close', ok: true, result: { closed: true } })
+    await expect(second).resolves.toBe(true)
+    await expect(first).resolves.toBe(false)
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+  })
+
+  it('accepts subscription materialization when the eager reconciliation fails', async () => {
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({
+        id: 'list',
+        ok: false,
+        error: { code: 'remote_runtime_timeout', message: 'session tabs timed out' }
+      })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })).resolves.toBe(true)
+
+    expect(mocks.hasMaterializedWebRuntimeBrowserPage).toHaveBeenCalledWith(
+      expect.anything(),
+      ENVIRONMENT_ID,
+      WORKTREE_ID,
+      'remote-browser-page-1',
+      undefined
+    )
+    expect(runtimeCall).toHaveBeenCalledTimes(2)
+  })
+
+  it('reports ambiguous failure when exact host cleanup is not confirmed', async () => {
+    mocks.hasMaterializedWebRuntimeBrowserPage.mockReturnValue(false)
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({
+        id: 'list',
+        ok: false,
+        error: { code: 'remote_runtime_timeout', message: 'session tabs timed out' }
+      })
+      .mockResolvedValueOnce({
+        id: 'close',
+        ok: false,
+        error: { code: 'remote_runtime_timeout', message: 'close timed out' }
+      })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        clientTargetGroupId: 'client-preview-group',
+        clientTargetGroupCreated: true
+      })
+    ).rejects.toThrow('could not recover the failed browser creation')
+
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+    expect(mocks.closeEmptyGroup).toHaveBeenCalledWith(WORKTREE_ID, 'client-preview-group')
+  })
+
+  it('cleans up when applying the host snapshot fails before materialization', async () => {
+    mocks.hasMaterializedWebRuntimeBrowserPage.mockReturnValue(false)
+    mocks.applyFreshWebSessionTabsSnapshot.mockImplementationOnce(() => {
+      throw new Error('store reconcile failed')
+    })
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({ id: 'list', ok: true, result: makeSnapshot() })
+      .mockResolvedValueOnce({ id: 'close', ok: true, result: { closed: true } })
+      .mockResolvedValueOnce({ id: 'list-after-close', ok: true, result: makeSnapshot() })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })).resolves.toBe(
+      false
+    )
+
+    expect(runtimeCall.mock.calls.map(([request]) => request.method)).toEqual([
+      'browser.tabCreate',
+      'session.tabs.list',
+      'browser.tabClose',
+      'session.tabs.list'
+    ])
   })
 
   it('keeps the requested worktree selected while the browser snapshot catches up', async () => {
     const snapshot = makeSnapshot()
     const setStateResults: unknown[] = []
+    let focusState = {
+      ...mocks.getState(),
+      activeWorktreeId: 'landing',
+      activeWorkspaceExecutionHostId: 'local'
+    }
+    mocks.getState.mockImplementation(() => focusState)
+    mocks.setActiveWorktree.mockImplementation((worktreeId, executionHostId) => {
+      focusState = {
+        ...focusState,
+        activeWorktreeId: worktreeId,
+        activeWorkspaceExecutionHostId: executionHostId
+      }
+    })
     let mockState: Record<string, unknown> = { state: 'before-stage', activeWorktreeId: 'landing' }
     mocks.setState.mockImplementation((updater: (state: unknown) => unknown) => {
       const result = updater(mockState)
@@ -403,6 +1188,45 @@ describe('createWebRuntimeSessionBrowserTab', () => {
     expect(setStateResults.at(-1)).toEqual({ state: 'after' })
   })
 
+  it('does not reselect an already active browser worktree on the same runtime', async () => {
+    mocks.getState.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: ENVIRONMENT_ID },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+      ]),
+      activeWorktreeId: WORKTREE_ID,
+      activeWorkspaceExecutionHostId: RUNTIME_EXECUTION_HOST_ID,
+      browserPagesByWorkspace: {},
+      remoteBrowserPageHandlesByPageId: {},
+      unifiedTabsByWorktree: {},
+      createBrowserTab: mocks.createBrowserTab,
+      closeEmptyGroup: mocks.closeEmptyGroup,
+      moveUnifiedTabToGroup: mocks.moveUnifiedTabToGroup,
+      setRemoteBrowserPageHandle: mocks.setRemoteBrowserPageHandle,
+      focusBrowserTabInWorktree: mocks.focusBrowserTabInWorktree,
+      setActiveWorktree: mocks.setActiveWorktree
+    })
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({ id: 'list', ok: true, result: makeSnapshot() })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        url: 'https://example.com/'
+      })
+    ).resolves.toBe(true)
+
+    expect(mocks.setActiveWorktree).not.toHaveBeenCalled()
+  })
+
   it('can create a browser tab without selecting the target worktree', async () => {
     const setStateResults: unknown[] = []
     mocks.setState.mockImplementation((updater: (state: unknown) => unknown) => {
@@ -451,6 +1275,9 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       settings: {
         activeRuntimeEnvironmentId: ENVIRONMENT_ID
       },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+      ]),
       activeWorktreeId,
       browserPagesByWorkspace: {},
       remoteBrowserPageHandlesByPageId: {},
@@ -531,7 +1358,7 @@ describe('createWebRuntimeSessionBrowserTab', () => {
     expect(mocks.setRemoteBrowserPageHandle).not.toHaveBeenCalled()
   })
 
-  it('uses renderer-local staged presentation without changing the RPC shape', async () => {
+  it('keeps client presentation fields out of the RPC shape', async () => {
     const runtimeCall = vi
       .fn()
       .mockResolvedValueOnce({
@@ -553,15 +1380,7 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       })
     ).resolves.toBe(true)
 
-    expect(mocks.createBrowserTab).toHaveBeenCalledWith(
-      WORKTREE_ID,
-      'https://example.com/?q=private',
-      {
-        title: 'Search Google',
-        focusAddressBar: false,
-        browserRuntimeEnvironmentId: ENVIRONMENT_ID
-      }
-    )
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
     expect(runtimeCall.mock.calls[0][0].params).not.toHaveProperty('stagedTitle')
   })
 
@@ -582,7 +1401,7 @@ describe('createWebRuntimeSessionBrowserTab', () => {
         url: 'https://example.com/?q=private',
         failureLogMode: 'operation-only'
       })
-    ).resolves.toBe(false)
+    ).rejects.toThrow('did not confirm whether the browser tab was created')
 
     expect(consoleWarn).toHaveBeenCalledWith('[web-runtime-session] failed to create browser tab')
     expect(JSON.stringify(consoleWarn.mock.calls)).not.toContain('private')
@@ -629,6 +1448,7 @@ describe('createWebRuntimeSessionTerminal', () => {
     })
     const runtimeCall = vi
       .fn()
+      .mockResolvedValueOnce(makeAttributionSafeStatus())
       .mockResolvedValueOnce({
         id: 'create',
         ok: true,
@@ -649,6 +1469,43 @@ describe('createWebRuntimeSessionTerminal', () => {
     expect(selectedHosts).toEqual([RUNTIME_EXECUTION_HOST_ID])
   })
 
+  it('refuses session-tab creation when an older host drops terminal environment fields', async () => {
+    const runtimeCall = vi.fn().mockResolvedValue({
+      id: 'status',
+      ok: true,
+      result: { capabilities: ['mobile.tasks.v1'] }
+    })
+    vi.stubGlobal('window', {
+      api: { runtimeEnvironments: { call: runtimeCall } }
+    })
+
+    await expect(createWebRuntimeSessionTerminal({ worktreeId: WORKTREE_ID })).resolves.toEqual({
+      status: 'failed',
+      message:
+        'Creating terminals requires a newer workspace host that can verify safe terminal environment forwarding. Update the host and try again.'
+    })
+
+    expect(runtimeCall.mock.calls.map(([request]) => request.method)).toEqual(['status.get'])
+  })
+
+  it('returns a failed outcome when attribution cleanup exceeds the deletion limit', async () => {
+    const runtimeCall = vi.fn()
+    vi.stubGlobal('window', {
+      api: { runtimeEnvironments: { call: runtimeCall } }
+    })
+
+    await expect(
+      createWebRuntimeSessionTerminal({
+        worktreeId: WORKTREE_ID,
+        envToDelete: Array.from({ length: 32 }, (_, index) => `KEY_${index}`)
+      })
+    ).resolves.toEqual({
+      status: 'failed',
+      message: 'Terminal environment deletion limit leaves no room for attribution cleanup'
+    })
+    expect(runtimeCall).not.toHaveBeenCalled()
+  })
+
   it.each([
     { sessionKind: 'fresh' as const, activate: true },
     { sessionKind: 'fresh' as const, activate: false },
@@ -668,7 +1525,7 @@ describe('createWebRuntimeSessionTerminal', () => {
               graphStatus: 'ready',
               runtimeProtocolVersion: 3,
               minCompatibleRuntimeClientVersion: 2,
-              capabilities: ['agent-session.host-authority.v1']
+              capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
             }
           }
         }
@@ -757,7 +1614,7 @@ describe('createWebRuntimeSessionTerminal', () => {
           graphStatus: 'ready',
           runtimeProtocolVersion: 3,
           minCompatibleRuntimeClientVersion: 2,
-          capabilities: ['agent-session.host-authority.v1']
+          capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
         }
       })
       .mockResolvedValueOnce({
@@ -821,6 +1678,7 @@ describe('createWebRuntimeSessionTerminal', () => {
     expect(runtimeCall).toHaveBeenNthCalledWith(2, {
       selector: ENVIRONMENT_ID,
       expectedEnvironmentPairingRevision: undefined,
+      expectedRuntimeId: 'runtime-1',
       method: 'terminal.createAgentSession',
       params: {
         clientOperationId: expect.stringMatching(/^\d{13}-[0-9a-f]{32}$/),
@@ -865,6 +1723,7 @@ describe('createWebRuntimeSessionTerminal', () => {
   it('keeps exact legacy ordering when structured creation cannot express afterTabId', async () => {
     const runtimeCall = vi
       .fn()
+      .mockResolvedValueOnce(makeAttributionSafeStatus())
       .mockResolvedValueOnce({
         id: 'legacy-create',
         ok: true,
@@ -890,8 +1749,10 @@ describe('createWebRuntimeSessionTerminal', () => {
       })
     ).resolves.toEqual({ status: 'created' })
 
-    expect(runtimeCall).toHaveBeenNthCalledWith(1, {
+    expect(runtimeCall).toHaveBeenNthCalledWith(2, {
       selector: ENVIRONMENT_ID,
+      expectedEnvironmentPairingRevision: undefined,
+      expectedRuntimeId: 'runtime-1',
       method: 'session.tabs.createTerminal',
       params: {
         worktree: `id:${WORKTREE_ID}`,
@@ -899,6 +1760,8 @@ describe('createWebRuntimeSessionTerminal', () => {
         targetGroupId: 'group-left',
         command: undefined,
         cwd: undefined,
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
         startupCommandDelivery: undefined,
         agent: 'codex',
         activate: false,
@@ -908,6 +1771,7 @@ describe('createWebRuntimeSessionTerminal', () => {
       timeoutMs: 15_000
     })
     expect(runtimeCall.mock.calls.map(([request]) => request.method)).toEqual([
+      'status.get',
       'session.tabs.createTerminal',
       'session.tabs.list'
     ])
@@ -924,6 +1788,7 @@ describe('createWebRuntimeSessionTerminal', () => {
     })
     const runtimeCall = vi
       .fn()
+      .mockResolvedValueOnce(makeAttributionSafeStatus())
       .mockResolvedValueOnce({
         id: 'create-terminal',
         ok: true,
@@ -980,7 +1845,7 @@ describe('createWebRuntimeSessionTerminal', () => {
               graphStatus: 'ready',
               runtimeProtocolVersion: 3,
               minCompatibleRuntimeClientVersion: 2,
-              capabilities: ['agent-session.host-authority.v1']
+              capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
             }
           }
         }
@@ -1041,7 +1906,7 @@ describe('createWebRuntimeSessionTerminal', () => {
             graphStatus: 'ready',
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: ['agent-session.host-authority.v1']
+            capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
           }
         }
       }
@@ -1094,7 +1959,7 @@ describe('createWebRuntimeSessionTerminal', () => {
             graphStatus: 'ready',
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: []
+            capabilities: ['terminal.attribution-removed.v1']
           }
         }
       }
@@ -1125,6 +1990,8 @@ describe('createWebRuntimeSessionTerminal', () => {
 
     expect(runtimeCall).toHaveBeenNthCalledWith(2, {
       selector: ENVIRONMENT_ID,
+      expectedEnvironmentPairingRevision: undefined,
+      expectedRuntimeId: 'old-runtime',
       method: 'session.tabs.createTerminal',
       params: {
         worktree: `id:${WORKTREE_ID}`,
@@ -1132,6 +1999,8 @@ describe('createWebRuntimeSessionTerminal', () => {
         targetGroupId: 'group-left',
         command: undefined,
         cwd: undefined,
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
         startupCommandDelivery: undefined,
         launchAgent: 'codex',
         activate: false,
@@ -1158,7 +2027,7 @@ describe('createWebRuntimeSessionTerminal', () => {
             graphStatus: 'ready',
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: []
+            capabilities: ['terminal.attribution-removed.v1']
           }
         }
       }
@@ -1193,6 +2062,8 @@ describe('createWebRuntimeSessionTerminal', () => {
 
     expect(runtimeCall).toHaveBeenNthCalledWith(2, {
       selector: ENVIRONMENT_ID,
+      expectedEnvironmentPairingRevision: undefined,
+      expectedRuntimeId: 'old-runtime',
       method: 'session.tabs.createTerminal',
       params: {
         worktree: `id:${WORKTREE_ID}`,
@@ -1200,7 +2071,8 @@ describe('createWebRuntimeSessionTerminal', () => {
         targetGroupId: undefined,
         command: "codex resume 'session-1'",
         cwd: undefined,
-        env: { CODEX_PROFILE: 'captured' },
+        env: { CODEX_PROFILE: 'captured', ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
         startupCommandDelivery: undefined,
         launchConfig: {
           agentCommand: 'codex',
@@ -1229,7 +2101,7 @@ describe('createWebRuntimeSessionTerminal', () => {
             graphStatus: 'ready',
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: ['agent-session.host-authority.v1']
+            capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
           }
         }
       }
@@ -1270,9 +2142,14 @@ describe('createWebRuntimeSessionTerminal', () => {
 
     expect(methods).toEqual(['status.get', 'session.tabs.createTerminal', 'session.tabs.list'])
     expect(runtimeCall.mock.calls[1]?.[0]).toMatchObject({
+      expectedRuntimeId: 'new-runtime',
       params: {
         command: "omp --resume '/custom/omp/project/session.jsonl'",
-        env: { PI_CODING_AGENT_DIR: '/custom/omp' },
+        env: {
+          PI_CODING_AGENT_DIR: '/custom/omp',
+          ORCA_ATTRIBUTION_BYPASS: '1'
+        },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
         launchAgent: 'omp'
       }
     })
@@ -1289,7 +2166,7 @@ describe('createWebRuntimeSessionTerminal', () => {
             graphStatus: 'ready',
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: ['agent-session.host-authority.v1']
+            capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
           }
         }
       }
@@ -1351,7 +2228,7 @@ describe('createWebRuntimeSessionTerminal', () => {
             graphStatus: 'ready',
             runtimeProtocolVersion: 3,
             minCompatibleRuntimeClientVersion: 2,
-            capabilities: ['agent-session.host-authority.v1']
+            capabilities: ['agent-session.host-authority.v1', 'terminal.attribution-removed.v1']
           }
         }
       }
@@ -1410,6 +2287,7 @@ describe('moveWebRuntimeSessionTab', () => {
   })
 
   afterEach(() => {
+    resetWebSessionFocusIntentForTests()
     vi.unstubAllGlobals()
     vi.clearAllMocks()
   })
@@ -1613,6 +2491,7 @@ describe('web runtime session tab actions', () => {
   })
 
   afterEach(() => {
+    resetWebSessionFocusIntentForTests()
     vi.unstubAllGlobals()
     vi.clearAllMocks()
   })
@@ -1691,6 +2570,25 @@ describe('web runtime session tab actions', () => {
     expect(mocks.applyFreshWebSessionTabsSnapshot).toHaveBeenCalled()
   })
 
+  it('supersedes browser focus intent when a terminal is activated next', async () => {
+    mocks.resolveHostSessionTabIdForWebSessionTab.mockImplementation(
+      (_state, args: { tabId: string }) =>
+        args.tabId === 'local-browser-unified' ? 'host-browser-unified' : 'host-terminal'
+    )
+    const runtimeCall = vi.fn().mockResolvedValue({ id: 'activate', ok: true, result: {} })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await activateWebRuntimeSessionTab({
+      worktreeId: WORKTREE_ID,
+      tabId: 'local-browser-unified'
+    })
+    await activateWebRuntimeSessionTab({ worktreeId: WORKTREE_ID, tabId: 'local-terminal' })
+
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toEqual({
+      hostTabId: 'host-terminal'
+    })
+  })
+
   it('sends lifecycle and explicit user close reasons on the wire', async () => {
     const runtimeCall = vi
       .fn()
@@ -1960,17 +2858,25 @@ describe('splitWebRuntimeTerminal', () => {
   })
 
   it('passes telemetry source to the host split while allowing the mirrored split event to be suppressed', async () => {
-    const runtimeCall = vi.fn().mockResolvedValue({
-      id: 'split',
-      ok: true,
-      result: {
-        split: {
-          handle: 'terminal-2',
-          tabId: 'tab-1',
-          paneRuntimeId: -1
-        }
-      }
-    })
+    const runtimeCall = vi.fn(async (request: { method: string }) =>
+      request.method === 'status.get'
+        ? {
+            id: 'status',
+            ok: true,
+            result: { capabilities: ['terminal.attribution-removed.v1'] }
+          }
+        : {
+            id: 'split',
+            ok: true,
+            result: {
+              split: {
+                handle: 'terminal-2',
+                tabId: 'tab-1',
+                paneRuntimeId: -1
+              }
+            }
+          }
+    )
     vi.stubGlobal('window', {
       api: {
         runtimeEnvironments: {
@@ -1989,13 +2895,22 @@ describe('splitWebRuntimeTerminal', () => {
       consumePendingWebRuntimeSplitMirrorTelemetry('remote:web-env-1@@terminal-1', 'horizontal')
     ).toBe(true)
 
-    await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(1))
-    expect(runtimeCall).toHaveBeenCalledWith({
+    await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
+    expect(runtimeCall).toHaveBeenNthCalledWith(1, {
       selector: 'web-env-1',
+      expectedEnvironmentPairingRevision: undefined,
+      method: 'status.get',
+      timeoutMs: 15_000
+    })
+    expect(runtimeCall).toHaveBeenNthCalledWith(2, {
+      selector: 'web-env-1',
+      expectedEnvironmentPairingRevision: undefined,
       method: 'terminal.split',
       params: {
         terminal: 'terminal-1',
         direction: 'horizontal',
+        env: { ORCA_ATTRIBUTION_BYPASS: '1' },
+        envToDelete: ['ORCA_ENABLE_GIT_ATTRIBUTION'],
         telemetrySource: 'keyboard'
       },
       timeoutMs: 15_000
@@ -2004,11 +2919,19 @@ describe('splitWebRuntimeTerminal', () => {
 
   it('does not track rejected host split RPCs', async () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const runtimeCall = vi.fn().mockResolvedValue({
-      id: 'split',
-      ok: false,
-      error: { code: 'terminal_exited', message: 'Terminal exited' }
-    })
+    const runtimeCall = vi.fn(async (request: { method: string }) =>
+      request.method === 'status.get'
+        ? {
+            id: 'status',
+            ok: true,
+            result: { capabilities: ['terminal.attribution-removed.v1'] }
+          }
+        : {
+            id: 'split',
+            ok: false,
+            error: { code: 'terminal_exited', message: 'Terminal exited' }
+          }
+    )
     vi.stubGlobal('window', {
       api: {
         runtimeEnvironments: {
@@ -2021,23 +2944,53 @@ describe('splitWebRuntimeTerminal', () => {
       splitWebRuntimeTerminal('remote:web-env-1@@terminal-1', 'vertical', 'context_menu')
     ).toBe(true)
 
-    await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(1))
+    await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
     await vi.waitFor(() => expect(warnSpy).toHaveBeenCalledTimes(1))
+    expect(mocks.toastError).toHaveBeenCalledWith('Terminal exited')
     expect(mocks.trackTerminalPaneSplit).not.toHaveBeenCalled()
   })
 
-  it('ignores local panes but delegates remote runtime panes from desktop or web clients', async () => {
+  it('refuses legacy hosts because renderer-owned splits discard environment fields', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const runtimeCall = vi.fn().mockResolvedValue({
-      id: 'split',
+      id: 'status',
       ok: true,
-      result: {
-        split: {
-          handle: 'terminal-2',
-          tabId: 'tab-1',
-          ptyId: 'pty-2'
-        }
-      }
+      result: { appVersion: '1.4.181', capabilities: ['mobile.tasks.v1'] }
     })
+    vi.stubGlobal('window', {
+      api: { runtimeEnvironments: { call: runtimeCall } }
+    })
+
+    expect(splitWebRuntimeTerminal('remote:web-env-1@@terminal-1', 'vertical', 'keyboard')).toBe(
+      true
+    )
+
+    await vi.waitFor(() => expect(warnSpy).toHaveBeenCalledTimes(1))
+    expect(runtimeCall).toHaveBeenCalledTimes(1)
+    expect(runtimeCall).not.toHaveBeenCalledWith(
+      expect.objectContaining({ method: 'terminal.split' })
+    )
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      expect.stringContaining('Update the host and try again')
+    )
+  })
+
+  it('ignores local panes but delegates remote runtime panes from desktop or web clients', async () => {
+    const runtimeCall = vi.fn(async (request: { method: string }) =>
+      request.method === 'status.get'
+        ? { id: 'status', ok: true, result: { capabilities: ['terminal.attribution-removed.v1'] } }
+        : {
+            id: 'split',
+            ok: true,
+            result: {
+              split: {
+                handle: 'terminal-2',
+                tabId: 'tab-1',
+                ptyId: 'pty-2'
+              }
+            }
+          }
+    )
     vi.stubGlobal('window', {
       api: {
         runtimeEnvironments: {
@@ -2052,7 +3005,7 @@ describe('splitWebRuntimeTerminal', () => {
       true
     )
 
-    await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(1))
+    await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
   })
 })
 
diff --git a/src/renderer/src/runtime/web-runtime-session.ts b/src/renderer/src/runtime/web-runtime-session.ts
index afe64a8097e..089ceafd53c 100644
--- a/src/renderer/src/runtime/web-runtime-session.ts
+++ b/src/renderer/src/runtime/web-runtime-session.ts
@@ -8,6 +8,7 @@ import type {
   RuntimeMobileSessionTabMoveResult,
   RuntimeMobileSessionTabsResult,
   RuntimeSessionTabCloseReason,
+  RuntimeStatus,
   RuntimeTerminalCreate,
   RuntimeTerminalClose,
   RuntimeTerminalSplit
@@ -18,7 +19,10 @@ import type {
   SleepingAgentLaunchConfig,
   AgentProviderSessionMetadata
 } from '../../../shared/agent-session-resume'
-import { AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import {
+  AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
+  TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY
+} from '../../../shared/protocol-version'
 import type {
   AgentLaunchPreferences,
   AgentPromptDelivery,
@@ -26,17 +30,22 @@ import type {
   RuntimeEnsureAgentSessionResult
 } from '../../../shared/agent-session-host-authority'
 import type { TerminalPaneLayoutNode, TuiAgent } from '../../../shared/types'
-import type { AppState } from '../store/types'
+import { createBrowserUuid } from '../lib/browser-uuid'
 import { getRuntimeEnvironmentIdForWorktree } from '../lib/worktree-runtime-owner'
 import { useAppStore } from '../store'
-import { unwrapRuntimeRpcResult } from './runtime-rpc-client'
+import { hasRuntimeRpcErrorCode, unwrapRuntimeRpcResult } from './runtime-rpc-client'
 import {
   createAgentSessionCreateOperation,
   withAgentSessionCreateOperationId
 } from './agent-session-create-operation'
 import { parseRemoteRuntimePtyId } from './runtime-terminal-stream'
 import { toRuntimeWorktreeSelector } from './runtime-worktree-selector'
-import { recordWebSessionFocusIntent } from './web-session-focus-intent'
+import {
+  clearWebSessionFocusIntentIfMatches,
+  peekWebSessionFocusIntent,
+  recordWebSessionFocusIntent,
+  resolveWebSessionVisibleTabId
+} from './web-session-focus-intent'
 import { clearWebSessionCloseIntent, recordWebSessionCloseIntent } from './web-session-close-intent'
 import {
   clearWebSessionReorderIntent,
@@ -61,6 +70,30 @@ import { translate } from '../i18n/i18n'
 import { getRuntimeEnvironmentRevision } from './runtime-environment-revision'
 import { parsePaneKey } from '../../../shared/stable-pane-id'
 import { toRuntimeExecutionHostId } from '../../../shared/execution-host'
+import {
+  claimWebSessionBrowserPlacementGroupCleanup,
+  forgetWebSessionBrowserPlacement,
+  markWebSessionBrowserPlacementGroupMaterialized,
+  moveWebSessionBrowserPlacement,
+  recordWebSessionBrowserPlacement,
+  releaseWebSessionBrowserPlacementGroup
+} from './web-session-browser-placement'
+import { assertRuntimeManagedBrowserCreationAvailable } from '../lib/client-creation-action-policy'
+import { hasMaterializedWebRuntimeBrowserPage } from './web-runtime-browser-materialization'
+import {
+  pauseAfterE2eWebRuntimeBrowserCreate,
+  throwIfE2eWebRuntimeBrowserCapabilityUnavailable,
+  throwIfE2eWebRuntimeBrowserReconciliationFails
+} from './web-runtime-browser-creation-e2e-fault'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  hostSupportsSessionTabTerminalCreateAttributionDisable,
+  hostSupportsTerminalSplitAttributionDisable,
+  SESSION_TAB_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE,
+  TERMINAL_SPLIT_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE,
+  withLegacyTerminalAttributionDisabledEnv
+} from '../../../shared/legacy-terminal-attribution-env'
+import { toast } from 'sonner'
 
 export {
   HOST_TERMINAL_SURFACE_SEPARATOR,
@@ -81,6 +114,22 @@ export type WebRuntimeTerminalCreateOutcome =
   | { status: 'created' }
   | { status: 'failed'; message: string }
 
+const DEFINITIVE_BROWSER_CREATE_FAILURE_CODES = [
+  'browser_error',
+  'capability_unsupported',
+  'invalid_argument',
+  'invalid_params',
+  'method_not_found',
+  'runtime_rpc_queue_overloaded',
+  'selector_ambiguous',
+  'selector_not_found',
+  'unauthorized'
+] as const
+
+function isDefinitiveBrowserCreateFailure(error: unknown): boolean {
+  return DEFINITIVE_BROWSER_CREATE_FAILURE_CODES.some((code) => hasRuntimeRpcErrorCode(error, code))
+}
+
 const pendingWebRuntimeSplitMirrorTelemetry = new Map<string, Set<string>>()
 const WEB_RUNTIME_SPLIT_MIRROR_SUPPRESSION_TTL_MS = 30_000
 let pendingWebRuntimeSplitMirrorTelemetryId = 0
@@ -94,6 +143,7 @@ function captureRuntimeEnvironmentCall(
   method: string
   params?: unknown
   timeoutMs?: number
+  expectedRuntimeId?: string
 }) => Promise<RuntimeRpcResponse<unknown>> {
   return (args) =>
     window.api.runtimeEnvironments.call({
@@ -228,6 +278,14 @@ async function createWebRuntimeSessionTerminalResult(
   }
   const intentOwner = captureWebSessionIntentOwner(environmentId)
   const callEnvironment = captureRuntimeEnvironmentCall(environmentId, intentOwner.pairingRevision)
+  const assertSessionTabCreateAttributionDisableSupported = async (): Promise<RuntimeStatus> => {
+    const response = await callEnvironment({ method: 'status.get', timeoutMs: 15_000 })
+    const status = unwrapRuntimeRpcResult(response as RuntimeRpcResponse<RuntimeStatus>)
+    if (!hostSupportsSessionTabTerminalCreateAttributionDisable(status)) {
+      throw new Error(SESSION_TAB_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE)
+    }
+    return status
+  }
 
   if (args.selectWorktree !== false) {
     selectWebRuntimeSessionWorktree(args.worktreeId, environmentId)
@@ -236,6 +294,8 @@ async function createWebRuntimeSessionTerminalResult(
   let createdTabId: string | undefined
   let createdLeafId: string | undefined
   try {
+    const env = withLegacyTerminalAttributionDisabledEnv(args.env)
+    const envToDelete = addLegacyTerminalAttributionDisableRequest(args.envToDelete)
     const agent = args.launchAgent ?? args.agent
     const agentArgsOverride =
       args.agentArgs !== undefined ? args.agentArgs : args.launchConfig?.agentArgs
@@ -247,7 +307,7 @@ async function createWebRuntimeSessionTerminalResult(
         ? undefined
         : args.agentSessionKind === 'resume'
           ? args.providerSession
-            ? async () =>
+            ? async (authority: { runtimeId: string }) =>
                 unwrapRuntimeRpcResult(
                   (await callEnvironment({
                     method: 'terminal.ensureAgentSession',
@@ -265,11 +325,12 @@ async function createWebRuntimeSessionTerminalResult(
                         : {}),
                       presentation: 'background'
                     },
-                    timeoutMs: 15_000
+                    timeoutMs: 15_000,
+                    expectedRuntimeId: authority.runtimeId
                   })) as RuntimeRpcResponse<RuntimeEnsureAgentSessionResult>
                 )
             : undefined
-          : async () =>
+          : async (authority: { runtimeId: string }) =>
               await createAgentSessionCreateOperation().run(async (clientOperationId) =>
                 unwrapRuntimeRpcResult(
                   (await callEnvironment({
@@ -292,7 +353,8 @@ async function createWebRuntimeSessionTerminalResult(
                       },
                       clientOperationId
                     ),
-                    timeoutMs: 15_000
+                    timeoutMs: 15_000,
+                    expectedRuntimeId: authority.runtimeId
                   })) as RuntimeRpcResponse<RuntimeCreateAgentSessionResult>
                 )
               )
@@ -300,11 +362,15 @@ async function createWebRuntimeSessionTerminalResult(
         terminal: CreatedAgentTerminalIdentity
       }>({
         environmentId,
+        expectedEnvironmentPairingRevision: intentOwner.pairingRevision,
         ...(hostAuthority ? { hostAuthority } : {}),
-        ...(args.agentSessionKind === 'resume' && agent === 'omp'
-          ? { hostAuthorityCapability: AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY }
-          : {}),
-        legacy: async () => {
+        requiredHostAuthorityCapabilities: [
+          TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY,
+          ...(args.agentSessionKind === 'resume' && agent === 'omp'
+            ? [AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY]
+            : [])
+        ],
+        legacy: async ({ authority }) => {
           const response = await callEnvironment({
             method: 'session.tabs.createTerminal',
             params: {
@@ -313,8 +379,8 @@ async function createWebRuntimeSessionTerminalResult(
               targetGroupId: args.targetGroupId,
               command: args.command,
               cwd: args.cwd,
-              ...(args.env ? { env: args.env } : {}),
-              ...(args.envToDelete ? { envToDelete: args.envToDelete } : {}),
+              env,
+              ...(envToDelete ? { envToDelete } : {}),
               startupCommandDelivery: args.startupCommandDelivery,
               ...(args.launchConfig ? { launchConfig: args.launchConfig } : {}),
               ...(args.launchToken ? { launchToken: args.launchToken } : {}),
@@ -326,7 +392,8 @@ async function createWebRuntimeSessionTerminalResult(
               select: args.activate !== false,
               navigation: 'caller'
             },
-            timeoutMs: 15_000
+            timeoutMs: 15_000,
+            expectedRuntimeId: authority.runtimeId
           })
           const legacyCreated = unwrapRuntimeRpcResult(
             response as RuntimeRpcResponse<RuntimeMobileSessionCreateTerminalResult>
@@ -358,6 +425,7 @@ async function createWebRuntimeSessionTerminalResult(
         })
       }
     } else {
+      const status = await assertSessionTabCreateAttributionDisableSupported()
       const response = await callEnvironment({
         method: 'session.tabs.createTerminal',
         params: {
@@ -366,8 +434,8 @@ async function createWebRuntimeSessionTerminalResult(
           targetGroupId: args.targetGroupId,
           command: args.command,
           cwd: args.cwd,
-          ...(args.env ? { env: args.env } : {}),
-          ...(args.envToDelete ? { envToDelete: args.envToDelete } : {}),
+          env,
+          ...(envToDelete ? { envToDelete } : {}),
           startupCommandDelivery: args.startupCommandDelivery,
           ...(args.launchConfig ? { launchConfig: args.launchConfig } : {}),
           ...(args.launchToken ? { launchToken: args.launchToken } : {}),
@@ -377,7 +445,8 @@ async function createWebRuntimeSessionTerminalResult(
           select: args.activate !== false,
           navigation: 'caller'
         },
-        timeoutMs: 15_000
+        timeoutMs: 15_000,
+        expectedRuntimeId: status.runtimeId
       })
       const created = unwrapRuntimeRpcResult(
         response as RuntimeRpcResponse<RuntimeMobileSessionCreateTerminalResult>
@@ -423,6 +492,9 @@ export async function createWebRuntimeSessionBrowserTab(args: {
   url?: string
   profileId?: string | null
   targetGroupId?: string
+  clientTargetGroupId?: string
+  clientTargetGroupCreated?: boolean
+  focusOnCreate?: boolean
   selectWorktree?: boolean
   stagedTitle?: string
   stagedFocusAddressBar?: boolean
@@ -437,51 +509,230 @@ export async function createWebRuntimeSessionBrowserTab(args: {
   }
   const intentOwner = captureWebSessionIntentOwner(environmentId)
   const callEnvironment = captureRuntimeEnvironmentCall(environmentId, intentOwner.pairingRevision)
-
+  const shouldFocusOnCreate = args.focusOnCreate !== false
   const shouldSelectWorktree = args.selectWorktree !== false
-  const stagedFromWorktreeId = useAppStore.getState().activeWorktreeId
-  if (shouldSelectWorktree) {
-    selectWebRuntimeSessionWorktree(args.worktreeId, environmentId)
-  }
+  const provisionalPageId = createBrowserUuid()
+  let unsubscribeFocusGuard = (): void => {}
+  let guardedPageId = provisionalPageId
+  let createdPageId: string | null = null
+  let createAttempted = false
   try {
-    const response = await callEnvironment({
-      method: 'browser.tabCreate',
-      params: {
-        worktree: toRuntimeWorktreeSelector(args.worktreeId),
-        url: args.url,
-        profileId: args.profileId ?? undefined,
-        // Why: user clicked "New Browser Tab", so mark it active in the snapshot, else the reconcile snaps back to a terminal.
-        activate: true,
-        // Why: place the new browser in the clicked split group so the host snapshot is authoritative for it (no left-snap).
-        ...(args.targetGroupId ? { targetGroupId: args.targetGroupId } : {}),
-        // Why: web clients need the local tab now; waiting for host webview registration makes the workspace appear to close.
-        waitForRegistration: false
-      },
-      timeoutMs: 15_000
-    })
-    const created = unwrapRuntimeRpcResult(response as RuntimeRpcResponse<BrowserTabCreateResult>)
-    // Why: record focus intent (tab id === browserPageId on a headless host) so the reconcile follows to the new browser tab.
-    if (matchesWebSessionIntentOwner(intentOwner)) {
-      recordWebSessionFocusIntent(intentOwner, args.worktreeId, created.browserPageId)
+    throwIfE2eWebRuntimeBrowserCapabilityUnavailable()
+    assertRuntimeManagedBrowserCreationAvailable(useAppStore.getState(), environmentId)
+    if (args.clientTargetGroupId) {
+      recordWebSessionBrowserPlacement({
+        environmentId,
+        worktreeId: args.worktreeId,
+        remotePageId: provisionalPageId,
+        groupId: args.clientTargetGroupId,
+        callerCreatedGroup: args.clientTargetGroupCreated
+      })
     }
-    stageWebRuntimeBrowserTab({
+    if (shouldSelectWorktree) {
+      selectWebRuntimeSessionBrowserWorktree(args.worktreeId, environmentId)
+    }
+    const initialFocusState = shouldFocusOnCreate ? useAppStore.getState() : null
+    const expectedActiveWorktreeId = initialFocusState?.activeWorktreeId
+    const expectedActiveWorkspaceExecutionHostId = initialFocusState?.activeWorkspaceExecutionHostId
+    const expectedCurrentLocalTabId = initialFocusState
+      ? resolveWebSessionVisibleTabId(initialFocusState, args.worktreeId)
+      : null
+    if (shouldFocusOnCreate && matchesWebSessionIntentOwner(intentOwner)) {
+      recordWebSessionFocusIntent(
+        intentOwner,
+        args.worktreeId,
+        provisionalPageId,
+        undefined,
+        expectedCurrentLocalTabId
+      )
+      unsubscribeFocusGuard = useAppStore.subscribe((state, previousState) => {
+        if (
+          state.activeBrowserTabIdByWorktree === previousState.activeBrowserTabIdByWorktree &&
+          state.activeFileIdByWorktree === previousState.activeFileIdByWorktree &&
+          state.activeTabIdByWorktree === previousState.activeTabIdByWorktree &&
+          state.activeTabType === previousState.activeTabType &&
+          state.activeTabTypeByWorktree === previousState.activeTabTypeByWorktree &&
+          state.activeWorktreeId === previousState.activeWorktreeId &&
+          state.activeWorkspaceExecutionHostId === previousState.activeWorkspaceExecutionHostId &&
+          state.unifiedTabsByWorktree === previousState.unifiedTabsByWorktree
+        ) {
+          return
+        }
+        if (
+          state.activeWorktreeId === expectedActiveWorktreeId &&
+          state.activeWorkspaceExecutionHostId === expectedActiveWorkspaceExecutionHostId &&
+          resolveWebSessionVisibleTabId(state, args.worktreeId) === expectedCurrentLocalTabId
+        ) {
+          return
+        }
+        clearWebSessionFocusIntentIfMatches(intentOwner, args.worktreeId, guardedPageId)
+        unsubscribeFocusGuard()
+      })
+    }
+    createAttempted = true
+    const created = unwrapRuntimeRpcResult(
+      (await callEnvironment({
+        method: 'browser.tabCreate',
+        params: {
+          worktree: toRuntimeWorktreeSelector(args.worktreeId),
+          url: args.url,
+          profileId: args.profileId ?? undefined,
+          activate: shouldFocusOnCreate,
+          // Why: place the new browser in the clicked split group so the host snapshot is authoritative for it (no left-snap).
+          ...(args.targetGroupId ? { targetGroupId: args.targetGroupId } : {}),
+          // Why: web clients need the local tab now; waiting for host webview registration makes the workspace appear to close.
+          waitForRegistration: false
+        },
+        timeoutMs: 15_000
+      })) as RuntimeRpcResponse<BrowserTabCreateResult>
+    )
+    createdPageId = created.browserPageId
+    await pauseAfterE2eWebRuntimeBrowserCreate(created.browserPageId)
+    if (created.browserPageId !== provisionalPageId) {
+      moveWebSessionBrowserPlacement({
+        environmentId,
+        worktreeId: args.worktreeId,
+        fromRemotePageId: provisionalPageId,
+        toRemotePageId: created.browserPageId
+      })
+      const focusIntent = shouldFocusOnCreate
+        ? peekWebSessionFocusIntent(intentOwner, args.worktreeId)
+        : null
+      if (focusIntent?.hostTabId === provisionalPageId) {
+        recordWebSessionFocusIntent(
+          intentOwner,
+          args.worktreeId,
+          created.browserPageId,
+          undefined,
+          focusIntent.expectedCurrentLocalTabId
+        )
+      }
+      guardedPageId = created.browserPageId
+    }
+    try {
+      await refreshWebRuntimeSessionTabsSnapshot(environmentId, args.worktreeId, {
+        expectedEnvironmentPairingRevision: intentOwner.pairingRevision,
+        acceptCurrentSnapshot: true,
+        afterCurrentInFlight: true,
+        errorMode: 'throw'
+      })
+    } catch (error) {
+      if (
+        !hasMaterializedWebRuntimeBrowserPage(
+          useAppStore.getState(),
+          environmentId,
+          args.worktreeId,
+          created.browserPageId,
+          args.clientTargetGroupId ?? args.targetGroupId
+        )
+      ) {
+        throw error
+      }
+    }
+    if (
+      !hasMaterializedWebRuntimeBrowserPage(
+        useAppStore.getState(),
+        environmentId,
+        args.worktreeId,
+        created.browserPageId,
+        args.clientTargetGroupId ?? args.targetGroupId
+      )
+    ) {
+      throw new Error('The created browser tab did not materialize in the client.')
+    }
+    const remainingFocusIntent = shouldFocusOnCreate
+      ? peekWebSessionFocusIntent(intentOwner, args.worktreeId)
+      : null
+    if (
+      remainingFocusIntent?.hostTabId === guardedPageId &&
+      remainingFocusIntent.expectedCurrentLocalTabId === expectedCurrentLocalTabId
+    ) {
+      clearWebSessionFocusIntentIfMatches(intentOwner, args.worktreeId, guardedPageId)
+    }
+    unsubscribeFocusGuard()
+    if (args.clientTargetGroupId) {
+      markWebSessionBrowserPlacementGroupMaterialized({
+        worktreeId: args.worktreeId,
+        groupId: args.clientTargetGroupId
+      })
+    }
+    forgetWebSessionBrowserPlacement({
       environmentId,
       worktreeId: args.worktreeId,
-      remotePageId: created.browserPageId,
-      url: args.url,
-      targetGroupId: args.targetGroupId,
-      title: args.stagedTitle,
-      focusAddressBar: args.stagedFocusAddressBar,
-      restoreFocus:
-        shouldSelectWorktree &&
-        (stagedFromWorktreeId === args.worktreeId ||
-          useAppStore.getState().activeWorktreeId === args.worktreeId)
-    })
-    void refreshWebRuntimeSessionTabsSnapshot(environmentId, args.worktreeId, {
-      expectedEnvironmentPairingRevision: intentOwner.pairingRevision
+      remotePageId: guardedPageId
     })
     return true
   } catch (error) {
+    unsubscribeFocusGuard()
+    let recoveryError: unknown = null
+    const createOutcomeUnknown = !createdPageId && !isDefinitiveBrowserCreateFailure(error)
+    const ownsClientGroupCleanup = args.clientTargetGroupId
+      ? releaseWebSessionBrowserPlacementGroup({
+          environmentId,
+          worktreeId: args.worktreeId,
+          remotePageId: guardedPageId,
+          groupId: args.clientTargetGroupId,
+          callerCreatedGroup: args.clientTargetGroupCreated === true
+        })
+      : false
+    if (!args.clientTargetGroupId) {
+      forgetWebSessionBrowserPlacement({
+        environmentId,
+        worktreeId: args.worktreeId,
+        remotePageId: guardedPageId
+      })
+    }
+    if (createdPageId) {
+      try {
+        const closeResult = unwrapRuntimeRpcResult(
+          (await callEnvironment({
+            method: 'browser.tabClose',
+            params: {
+              worktree: toRuntimeWorktreeSelector(args.worktreeId),
+              page: createdPageId
+            },
+            timeoutMs: 15_000
+          })) as RuntimeRpcResponse<{ closed: boolean }>
+        )
+        if (!closeResult.closed) {
+          throw new Error('The paired runtime did not close the unreconciled browser tab.')
+        }
+        await refreshWebRuntimeSessionTabsSnapshot(environmentId, args.worktreeId, {
+          expectedEnvironmentPairingRevision: intentOwner.pairingRevision,
+          afterCurrentInFlight: true,
+          errorMode: 'throw'
+        })
+        if (
+          hasMaterializedWebRuntimeBrowserPage(
+            useAppStore.getState(),
+            environmentId,
+            args.worktreeId,
+            createdPageId
+          )
+        ) {
+          throw new Error('The closed browser tab remained materialized in the client.')
+        }
+      } catch (cleanupError) {
+        recoveryError = cleanupError
+        console.warn(
+          '[web-runtime-session] failed to clean up unreconciled browser tab:',
+          cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+        )
+      }
+    }
+    if (shouldFocusOnCreate) {
+      clearWebSessionFocusIntentIfMatches(intentOwner, args.worktreeId, guardedPageId)
+    }
+    if (
+      args.clientTargetGroupId &&
+      claimWebSessionBrowserPlacementGroupCleanup({
+        worktreeId: args.worktreeId,
+        groupId: args.clientTargetGroupId,
+        ownsGroupCleanup: ownsClientGroupCleanup
+      })
+    ) {
+      useAppStore.getState().closeEmptyGroup(args.worktreeId, args.clientTargetGroupId)
+    }
     if (args.failureLogMode === 'operation-only') {
       console.warn('[web-runtime-session] failed to create browser tab')
     } else {
@@ -490,79 +741,35 @@ export async function createWebRuntimeSessionBrowserTab(args: {
         error instanceof Error ? error.message : String(error)
       )
     }
+    if (recoveryError) {
+      throw new Error('The paired runtime could not recover the failed browser creation.', {
+        cause: recoveryError
+      })
+    }
+    if (!createAttempted) {
+      throw error
+    }
+    if (createOutcomeUnknown) {
+      throw new Error('The paired runtime did not confirm whether the browser tab was created.', {
+        cause: error
+      })
+    }
     return false
   }
 }
 
-function stageWebRuntimeBrowserTab(args: {
-  environmentId: string
-  worktreeId: string
-  remotePageId: string
-  url?: string
-  targetGroupId?: string
-  title?: string
-  focusAddressBar?: boolean
-  restoreFocus?: boolean
-}): void {
-  const remotePageId = args.remotePageId.trim()
-  if (!remotePageId) {
-    return
-  }
-
-  const existing = findLocalBrowserPageForRemotePage(
-    useAppStore.getState(),
-    args.environmentId,
-    remotePageId
-  )
-  if (args.restoreFocus !== false) {
-    selectWebRuntimeSessionWorktree(args.worktreeId, args.environmentId)
-  }
-
-  if (existing) {
-    if (args.restoreFocus !== false) {
-      useAppStore
-        .getState()
-        .focusBrowserTabInWorktree(args.worktreeId, existing.pageId, { surfacePane: true })
-    }
-    return
-  }
-
-  const url = args.url?.trim() || 'about:blank'
-  // Why: the snapshot can arrive after React renders a fallback; stage the handle now so the worktree stays selected.
-  const browserTab = useAppStore.getState().createBrowserTab(args.worktreeId, url, {
-    title: args.title ?? (url === 'about:blank' ? 'New Browser Tab' : url),
-    focusAddressBar: args.focusAddressBar ?? true,
-    browserRuntimeEnvironmentId: args.environmentId,
-    targetGroupId: args.targetGroupId
-  })
-  const pageId = browserTab.activePageId ?? browserTab.pageIds?.[0] ?? null
-  if (!pageId) {
-    return
-  }
-  useAppStore.getState().setRemoteBrowserPageHandle(pageId, {
-    environmentId: args.environmentId,
-    remotePageId
-  })
-}
-
 function selectWebRuntimeSessionWorktree(worktreeId: string, environmentId: string): void {
   useAppStore.getState().setActiveWorktree(worktreeId, toRuntimeExecutionHostId(environmentId))
 }
 
-function findLocalBrowserPageForRemotePage(
-  state: AppState,
-  environmentId: string,
-  remotePageId: string
-): { pageId: string } | null {
-  for (const pages of Object.values(state.browserPagesByWorkspace)) {
-    for (const page of pages) {
-      const handle = state.remoteBrowserPageHandlesByPageId[page.id]
-      if (handle?.environmentId === environmentId && handle.remotePageId === remotePageId) {
-        return { pageId: page.id }
-      }
-    }
+function selectWebRuntimeSessionBrowserWorktree(worktreeId: string, environmentId: string): void {
+  const state = useAppStore.getState()
+  if (
+    state.activeWorktreeId !== worktreeId ||
+    state.activeWorkspaceExecutionHostId !== toRuntimeExecutionHostId(environmentId)
+  ) {
+    state.setActiveWorktree(worktreeId, toRuntimeExecutionHostId(environmentId))
   }
-  return null
 }
 
 export async function refreshWebRuntimeSessionTabsSnapshot(
@@ -576,6 +783,8 @@ export async function refreshWebRuntimeSessionTabsSnapshot(
       hostTabId: string
       hostTerminalHandle: string
     }
+    afterCurrentInFlight?: boolean
+    errorMode?: 'warn' | 'throw'
   } = {}
 ): Promise<void> {
   const expectedEnvironmentPairingRevision =
@@ -591,9 +800,13 @@ export async function refreshWebRuntimeSessionTabsSnapshot(
       // re-accept its current version after the exact provisional handoff is known.
       acceptReplayedWebSessionTabsSnapshot(environmentId, worktreeId)
     }
-    const listSessionTabs = options.confirmAgentSessionHandoff
-      ? listRemoteRuntimeSessionTabsAfterCurrentInFlight
-      : listRemoteRuntimeSessionTabsDeduped
+    const listSessionTabs =
+      options.confirmAgentSessionHandoff || options.afterCurrentInFlight
+        ? listRemoteRuntimeSessionTabsAfterCurrentInFlight
+        : listRemoteRuntimeSessionTabsDeduped
+    if (options.afterCurrentInFlight) {
+      throwIfE2eWebRuntimeBrowserReconciliationFails()
+    }
     const snapshot = await listSessionTabs({
       environmentId,
       worktreeId,
@@ -631,6 +844,9 @@ export async function refreshWebRuntimeSessionTabsSnapshot(
       return patch === state ? state : patch
     })
   } catch (error) {
+    if (options.errorMode === 'throw') {
+      throw error
+    }
     // Why: host creation already succeeded; the long-lived session.tabs subscription catches up if this eager refresh fails.
     console.warn(
       '[web-runtime-session] failed to refresh session-tabs snapshot:',
@@ -873,6 +1089,7 @@ async function callWebRuntimeSessionTabMethod(
   const intentOwner = captureWebSessionIntentOwner(environmentId)
   const callEnvironment = captureRuntimeEnvironmentCall(environmentId, intentOwner.pairingRevision)
   const closeIntentTabIds = new Set<string>()
+  let activationHostTabId: string | null = null
 
   const isClose = method === 'session.tabs.close'
   const isLifecycleClose = isClose && args.reason !== 'user'
@@ -908,6 +1125,9 @@ async function callWebRuntimeSessionTabMethod(
       // Why: suppress until the host confirms removal, else an in-flight pre-close snapshot flashes the tab back.
       closeIntentTabIds.add(hostTabId)
       recordWebSessionCloseIntent(intentOwner, args.worktreeId, hostTabId, Date.now())
+    } else {
+      activationHostTabId = hostTabId
+      recordWebSessionFocusIntent(intentOwner, args.worktreeId, hostTabId)
     }
     const response = await callEnvironment({
       // Why: old hosts cannot route this additive method, so a generation
@@ -956,6 +1176,9 @@ async function callWebRuntimeSessionTabMethod(
     }
     return true
   } catch (error) {
+    if (activationHostTabId) {
+      clearWebSessionFocusIntentIfMatches(intentOwner, args.worktreeId, activationHostTabId)
+    }
     for (const hostTabId of closeIntentTabIds) {
       clearWebSessionCloseIntent(intentOwner, args.worktreeId, hostTabId)
     }
@@ -995,26 +1218,37 @@ export function splitWebRuntimeTerminal(
     direction,
     pendingMirrorSuppressionId
   )
-  void window.api.runtimeEnvironments
-    .call({
-      selector: environmentId,
-      method: 'terminal.split',
-      params: {
-        terminal: remote.handle,
-        direction,
-        telemetrySource
-      },
-      timeoutMs: 15_000
+  const callEnvironment = captureRuntimeEnvironmentCall(environmentId)
+  void callEnvironment({
+    method: 'status.get',
+    timeoutMs: 15_000
+  })
+    .then((response) => {
+      const status = unwrapRuntimeRpcResult(response as RuntimeRpcResponse<RuntimeStatus>)
+      if (!hostSupportsTerminalSplitAttributionDisable(status)) {
+        throw new Error(TERMINAL_SPLIT_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE)
+      }
+      return callEnvironment({
+        method: 'terminal.split',
+        params: {
+          terminal: remote.handle,
+          direction,
+          env: withLegacyTerminalAttributionDisabledEnv(undefined),
+          envToDelete: addLegacyTerminalAttributionDisableRequest(undefined),
+          telemetrySource
+        },
+        timeoutMs: 15_000,
+        expectedRuntimeId: status.runtimeId
+      })
     })
     .then((response) => {
       unwrapRuntimeRpcResult(response as RuntimeRpcResponse<{ split: RuntimeTerminalSplit }>)
     })
     .catch((error) => {
       releasePendingMirrorSuppression()
-      console.warn(
-        '[web-runtime-session] failed to split terminal:',
-        error instanceof Error ? error.message : String(error)
-      )
+      const message = error instanceof Error ? error.message : String(error)
+      toast.error(message)
+      console.warn('[web-runtime-session] failed to split terminal:', message)
     })
   return true
 }
diff --git a/src/renderer/src/runtime/web-session-browser-placement.test.ts b/src/renderer/src/runtime/web-session-browser-placement.test.ts
new file mode 100644
index 00000000000..ea5719b92c6
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-browser-placement.test.ts
@@ -0,0 +1,370 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  claimWebSessionBrowserPlacementGroupCleanup,
+  clearWebSessionBrowserPlacementsForEnvironment,
+  clearWebSessionBrowserPlacementsForWorktree,
+  forgetWebSessionBrowserPlacement,
+  isWebSessionBrowserPlacementGroupReserved,
+  peekWebSessionBrowserPlacementGroup,
+  recordWebSessionBrowserPlacement,
+  releaseWebSessionBrowserPlacementGroup,
+  resetWebSessionBrowserPlacementsForTests,
+  takeWebSessionBrowserPlacementGroup
+} from './web-session-browser-placement'
+
+const ENVIRONMENT_ID = 'environment-1'
+const WORKTREE_ID = 'worktree-1'
+
+afterEach(resetWebSessionBrowserPlacementsForTests)
+
+describe('web session browser placement', () => {
+  it('keeps a shared target group reserved until every pending page settles', () => {
+    for (const remotePageId of ['page-1', 'page-2']) {
+      recordWebSessionBrowserPlacement({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId,
+        groupId: 'preview-group'
+      })
+    }
+
+    forgetWebSessionBrowserPlacement({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-1'
+    })
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group'
+      })
+    ).toBe(true)
+
+    forgetWebSessionBrowserPlacement({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-2'
+    })
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group'
+      })
+    ).toBe(false)
+  })
+
+  it('transfers caller-created group cleanup to the last failed reservation', () => {
+    recordWebSessionBrowserPlacement({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-1',
+      groupId: 'preview-group',
+      callerCreatedGroup: true
+    })
+    recordWebSessionBrowserPlacement({
+      environmentId: 'environment-2',
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-2',
+      groupId: 'preview-group'
+    })
+
+    const creatorOwnsCleanup = releaseWebSessionBrowserPlacementGroup({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-1',
+      groupId: 'preview-group',
+      callerCreatedGroup: true
+    })
+    expect(
+      claimWebSessionBrowserPlacementGroupCleanup({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group',
+        ownsGroupCleanup: creatorOwnsCleanup
+      })
+    ).toBe(false)
+    const followerOwnsCleanup = releaseWebSessionBrowserPlacementGroup({
+      environmentId: 'environment-2',
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-2',
+      groupId: 'preview-group',
+      callerCreatedGroup: false
+    })
+    expect(
+      claimWebSessionBrowserPlacementGroupCleanup({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group',
+        ownsGroupCleanup: followerOwnsCleanup
+      })
+    ).toBe(true)
+  })
+
+  it('retains transferred cleanup when one overlapping environment clears', () => {
+    for (const [environmentId, remotePageId, callerCreatedGroup] of [
+      [ENVIRONMENT_ID, 'page-1', true],
+      ['environment-2', 'page-2', false],
+      ['environment-3', 'page-3', false]
+    ] as const) {
+      recordWebSessionBrowserPlacement({
+        environmentId,
+        worktreeId: WORKTREE_ID,
+        remotePageId,
+        groupId: 'preview-group',
+        callerCreatedGroup
+      })
+    }
+    const ownsCleanup = releaseWebSessionBrowserPlacementGroup({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-1',
+      groupId: 'preview-group',
+      callerCreatedGroup: true
+    })
+    expect(
+      claimWebSessionBrowserPlacementGroupCleanup({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group',
+        ownsGroupCleanup: ownsCleanup
+      })
+    ).toBe(false)
+
+    clearWebSessionBrowserPlacementsForEnvironment('environment-2')
+    const remainingOwnsCleanup = releaseWebSessionBrowserPlacementGroup({
+      environmentId: 'environment-3',
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-3',
+      groupId: 'preview-group',
+      callerCreatedGroup: false
+    })
+    expect(remainingOwnsCleanup).toBe(true)
+    expect(
+      claimWebSessionBrowserPlacementGroupCleanup({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group',
+        ownsGroupCleanup: remainingOwnsCleanup
+      })
+    ).toBe(false)
+    const clearedEnvironmentOwnsCleanup = releaseWebSessionBrowserPlacementGroup({
+      environmentId: 'environment-2',
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-2',
+      groupId: 'preview-group',
+      callerCreatedGroup: false
+    })
+    expect(
+      claimWebSessionBrowserPlacementGroupCleanup({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group',
+        ownsGroupCleanup: clearedEnvironmentOwnsCleanup
+      })
+    ).toBe(true)
+  })
+
+  it('retains transferred cleanup through snapshot placement lookup', () => {
+    recordWebSessionBrowserPlacement({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-1',
+      groupId: 'preview-group',
+      callerCreatedGroup: true
+    })
+    recordWebSessionBrowserPlacement({
+      environmentId: 'environment-2',
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-2',
+      groupId: 'preview-group'
+    })
+    const ownsCleanup = releaseWebSessionBrowserPlacementGroup({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-1',
+      groupId: 'preview-group',
+      callerCreatedGroup: true
+    })
+    expect(
+      claimWebSessionBrowserPlacementGroupCleanup({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group',
+        ownsGroupCleanup: ownsCleanup
+      })
+    ).toBe(false)
+
+    expect(
+      peekWebSessionBrowserPlacementGroup({
+        environmentId: 'environment-2',
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-2'
+      })
+    ).toBe('preview-group')
+    expect(
+      releaseWebSessionBrowserPlacementGroup({
+        environmentId: 'environment-2',
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-2',
+        groupId: 'preview-group',
+        callerCreatedGroup: false
+      })
+    ).toBe(true)
+  })
+
+  it.each(['environment', 'worktree'] as const)(
+    'retains transferred cleanup through %s teardown',
+    (scope) => {
+      recordWebSessionBrowserPlacement({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-1',
+        groupId: 'preview-group',
+        callerCreatedGroup: true
+      })
+      recordWebSessionBrowserPlacement({
+        environmentId: 'environment-2',
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-2',
+        groupId: 'preview-group'
+      })
+      const ownsCleanup = releaseWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-1',
+        groupId: 'preview-group',
+        callerCreatedGroup: true
+      })
+      claimWebSessionBrowserPlacementGroupCleanup({
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group',
+        ownsGroupCleanup: ownsCleanup
+      })
+
+      if (scope === 'environment') {
+        clearWebSessionBrowserPlacementsForEnvironment('environment-2')
+      } else {
+        clearWebSessionBrowserPlacementsForWorktree('environment-2', WORKTREE_ID)
+      }
+
+      expect(
+        releaseWebSessionBrowserPlacementGroup({
+          environmentId: 'environment-2',
+          worktreeId: WORKTREE_ID,
+          remotePageId: 'page-2',
+          groupId: 'preview-group',
+          callerCreatedGroup: false
+        })
+      ).toBe(true)
+    }
+  )
+
+  it('bounds pending page placements', () => {
+    for (let index = 0; index < 128; index += 1) {
+      recordWebSessionBrowserPlacement({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: `page-${index}`,
+        groupId: `group-${index}`
+      })
+    }
+
+    expect(() =>
+      recordWebSessionBrowserPlacement({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-128',
+        groupId: 'group-128'
+      })
+    ).toThrow('Too many paired browser placements are pending')
+
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-0'
+      })
+    ).toBe('group-0')
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        worktreeId: WORKTREE_ID,
+        groupId: 'group-0'
+      })
+    ).toBe(false)
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-128'
+      })
+    ).toBeUndefined()
+  })
+
+  it('refreshes existing entries at capacity without evicting another placement', () => {
+    for (let index = 0; index < 128; index += 1) {
+      recordWebSessionBrowserPlacement({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: `page-${index}`,
+        groupId: `group-${index}`
+      })
+    }
+
+    recordWebSessionBrowserPlacement({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-127',
+      groupId: 'group-127'
+    })
+
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        worktreeId: WORKTREE_ID,
+        groupId: 'group-0'
+      })
+    ).toBe(true)
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-0'
+      })
+    ).toBe('group-0')
+  })
+
+  it('clears only the requested worktree or environment', () => {
+    for (const [environmentId, worktreeId, suffix] of [
+      [ENVIRONMENT_ID, WORKTREE_ID, 'target'],
+      [ENVIRONMENT_ID, 'worktree-2', 'sibling'],
+      ['environment-2', WORKTREE_ID, 'other-environment']
+    ] as const) {
+      recordWebSessionBrowserPlacement({
+        environmentId,
+        worktreeId,
+        remotePageId: `page-${suffix}`,
+        groupId: `group-${suffix}`
+      })
+    }
+
+    clearWebSessionBrowserPlacementsForWorktree(ENVIRONMENT_ID, WORKTREE_ID)
+
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-target'
+      })
+    ).toBeUndefined()
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: 'worktree-2',
+        remotePageId: 'page-sibling'
+      })
+    ).toBe('group-sibling')
+
+    clearWebSessionBrowserPlacementsForEnvironment('environment-2')
+
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: 'environment-2',
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-other-environment'
+      })
+    ).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-browser-placement.ts b/src/renderer/src/runtime/web-session-browser-placement.ts
new file mode 100644
index 00000000000..4e027a5b205
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-browser-placement.ts
@@ -0,0 +1,213 @@
+type PendingBrowserPlacement = {
+  groupId: string
+  ownsGroupCleanup: boolean
+}
+
+const placementByPendingPage = new Map<string, PendingBrowserPlacement>()
+const materializedGroupKeys = new Set<string>()
+const pendingCleanupClaimsByGroup = new Map<string, number>()
+const MAX_PENDING_PLACEMENTS = 128
+
+function pageKey(environmentId: string, worktreeId: string, remotePageId: string): string {
+  return `${environmentId}\0${worktreeId}\0${remotePageId}`
+}
+
+function worktreePrefix(environmentId: string, worktreeId: string): string {
+  return `${environmentId}\0${worktreeId}\0`
+}
+
+function worktreeGroupKey(worktreeId: string, groupId: string): string {
+  return `${worktreeId}\0${groupId}`
+}
+
+function hasPlacementForGroup(worktreeId: string, groupId: string): boolean {
+  const worktreeMarker = `\0${worktreeId}\0`
+  for (const [key, placement] of placementByPendingPage) {
+    if (key.includes(worktreeMarker) && placement.groupId === groupId) {
+      return true
+    }
+  }
+  return false
+}
+
+function forgetSettledMaterializedGroup(worktreeId: string, groupId: string): void {
+  const key = worktreeGroupKey(worktreeId, groupId)
+  if (!hasPlacementForGroup(worktreeId, groupId) && !pendingCleanupClaimsByGroup.has(key)) {
+    materializedGroupKeys.delete(key)
+  }
+}
+
+export function recordWebSessionBrowserPlacement(args: {
+  environmentId: string
+  worktreeId: string
+  remotePageId: string
+  groupId: string
+  callerCreatedGroup?: boolean
+}): void {
+  const key = pageKey(args.environmentId, args.worktreeId, args.remotePageId)
+  const existing = placementByPendingPage.get(key)
+  if (!existing && placementByPendingPage.size >= MAX_PENDING_PLACEMENTS) {
+    throw new Error('Too many paired browser placements are pending.')
+  }
+  placementByPendingPage.set(key, {
+    groupId: args.groupId,
+    ownsGroupCleanup: args.callerCreatedGroup === true || existing?.ownsGroupCleanup === true
+  })
+}
+
+export function moveWebSessionBrowserPlacement(args: {
+  environmentId: string
+  worktreeId: string
+  fromRemotePageId: string
+  toRemotePageId: string
+}): void {
+  const fromKey = pageKey(args.environmentId, args.worktreeId, args.fromRemotePageId)
+  const placement = placementByPendingPage.get(fromKey)
+  placementByPendingPage.delete(fromKey)
+  if (placement) {
+    recordWebSessionBrowserPlacement({
+      environmentId: args.environmentId,
+      worktreeId: args.worktreeId,
+      remotePageId: args.toRemotePageId,
+      groupId: placement.groupId,
+      callerCreatedGroup: placement.ownsGroupCleanup
+    })
+  }
+}
+
+export function forgetWebSessionBrowserPlacement(args: {
+  environmentId: string
+  worktreeId: string
+  remotePageId: string
+}): void {
+  const key = pageKey(args.environmentId, args.worktreeId, args.remotePageId)
+  const placement = placementByPendingPage.get(key)
+  placementByPendingPage.delete(key)
+  if (placement) {
+    forgetSettledMaterializedGroup(args.worktreeId, placement.groupId)
+  }
+}
+
+export function takeWebSessionBrowserPlacementGroup(args: {
+  environmentId: string
+  worktreeId: string
+  remotePageId: string
+}): string | undefined {
+  const key = pageKey(args.environmentId, args.worktreeId, args.remotePageId)
+  const placement = placementByPendingPage.get(key)
+  placementByPendingPage.delete(key)
+  if (placement) {
+    forgetSettledMaterializedGroup(args.worktreeId, placement.groupId)
+  }
+  return placement?.groupId
+}
+
+export function peekWebSessionBrowserPlacementGroup(args: {
+  environmentId: string
+  worktreeId: string
+  remotePageId: string
+}): string | undefined {
+  return placementByPendingPage.get(pageKey(args.environmentId, args.worktreeId, args.remotePageId))
+    ?.groupId
+}
+
+export function isWebSessionBrowserPlacementGroupReserved(args: {
+  worktreeId: string
+  groupId: string
+}): boolean {
+  const worktreeMarker = `\0${args.worktreeId}\0`
+  for (const [key, placement] of placementByPendingPage) {
+    if (key.includes(worktreeMarker) && placement.groupId === args.groupId) {
+      return true
+    }
+  }
+  return false
+}
+
+export function releaseWebSessionBrowserPlacementGroup(args: {
+  environmentId: string
+  worktreeId: string
+  remotePageId: string
+  groupId: string
+  callerCreatedGroup: boolean
+}): boolean {
+  const key = pageKey(args.environmentId, args.worktreeId, args.remotePageId)
+  const placement = placementByPendingPage.get(key)
+  const groupId = placement?.groupId ?? args.groupId
+  const groupKey = worktreeGroupKey(args.worktreeId, groupId)
+  const materialized = materializedGroupKeys.has(groupKey)
+  placementByPendingPage.delete(key)
+  const ownsCleanup =
+    !materialized && (args.callerCreatedGroup || placement?.ownsGroupCleanup === true)
+  if (ownsCleanup) {
+    pendingCleanupClaimsByGroup.set(groupKey, (pendingCleanupClaimsByGroup.get(groupKey) ?? 0) + 1)
+  }
+  forgetSettledMaterializedGroup(args.worktreeId, groupId)
+  return ownsCleanup
+}
+
+export function markWebSessionBrowserPlacementGroupMaterialized(args: {
+  worktreeId: string
+  groupId: string
+}): void {
+  if (hasPlacementForGroup(args.worktreeId, args.groupId)) {
+    materializedGroupKeys.add(worktreeGroupKey(args.worktreeId, args.groupId))
+  }
+}
+
+export function claimWebSessionBrowserPlacementGroupCleanup(args: {
+  worktreeId: string
+  groupId: string
+  ownsGroupCleanup: boolean
+}): boolean {
+  if (!args.ownsGroupCleanup) {
+    return false
+  }
+  const groupKey = worktreeGroupKey(args.worktreeId, args.groupId)
+  const pendingClaims = pendingCleanupClaimsByGroup.get(groupKey) ?? 0
+  if (pendingClaims <= 1) {
+    pendingCleanupClaimsByGroup.delete(groupKey)
+  } else {
+    pendingCleanupClaimsByGroup.set(groupKey, pendingClaims - 1)
+  }
+  if (materializedGroupKeys.has(groupKey)) {
+    forgetSettledMaterializedGroup(args.worktreeId, args.groupId)
+    return false
+  }
+  const worktreeMarker = `\0${args.worktreeId}\0`
+  let transferred = false
+  for (const [key, placement] of placementByPendingPage) {
+    if (key.includes(worktreeMarker) && placement.groupId === args.groupId) {
+      placementByPendingPage.set(key, { ...placement, ownsGroupCleanup: true })
+      transferred = true
+    }
+  }
+  return !transferred
+}
+
+export function clearWebSessionBrowserPlacementsForWorktree(
+  environmentId: string,
+  worktreeId: string
+): void {
+  const prefix = worktreePrefix(environmentId, worktreeId)
+  for (const key of placementByPendingPage.keys()) {
+    if (key.startsWith(prefix) && !placementByPendingPage.get(key)?.ownsGroupCleanup) {
+      placementByPendingPage.delete(key)
+    }
+  }
+}
+
+export function clearWebSessionBrowserPlacementsForEnvironment(environmentId: string): void {
+  const prefix = `${environmentId}\0`
+  for (const key of placementByPendingPage.keys()) {
+    if (key.startsWith(prefix) && !placementByPendingPage.get(key)?.ownsGroupCleanup) {
+      placementByPendingPage.delete(key)
+    }
+  }
+}
+
+export function resetWebSessionBrowserPlacementsForTests(): void {
+  placementByPendingPage.clear()
+  materializedGroupKeys.clear()
+  pendingCleanupClaimsByGroup.clear()
+}
diff --git a/src/renderer/src/runtime/web-session-focus-intent.ts b/src/renderer/src/runtime/web-session-focus-intent.ts
index 8ed33b8d15e..e185250372f 100644
--- a/src/renderer/src/runtime/web-session-focus-intent.ts
+++ b/src/renderer/src/runtime/web-session-focus-intent.ts
@@ -10,14 +10,50 @@
 // snapshots, unlike a transient per-snapshot flag).
 
 import { webSessionIntentOwnerKey, type WebSessionIntentOwner } from './web-session-intent-owner'
+import type { AppState } from '../store/types'
 
 export type WebSessionFocusIntent = {
   hostTabId: string
   leafId?: string
+  expectedCurrentLocalTabId?: string | null
 }
 
 const pendingFocusByOwnerAndWorktree = new Map<string, WebSessionFocusIntent>()
 
+type WebSessionVisibleTabState = Pick<
+  AppState,
+  | 'activeBrowserTabIdByWorktree'
+  | 'activeFileIdByWorktree'
+  | 'activeTabIdByWorktree'
+  | 'activeTabType'
+  | 'activeTabTypeByWorktree'
+  | 'activeWorktreeId'
+  | 'unifiedTabsByWorktree'
+>
+
+export function resolveWebSessionVisibleTabId(
+  state: WebSessionVisibleTabState,
+  worktreeId: string,
+  tabs = state.unifiedTabsByWorktree?.[worktreeId] ?? []
+): string | null {
+  const currentType =
+    state.activeTabTypeByWorktree?.[worktreeId] ??
+    (state.activeWorktreeId === worktreeId ? state.activeTabType : null)
+  if (currentType === 'terminal') {
+    const tabId = state.activeTabIdByWorktree?.[worktreeId]
+    return tabId && tabs.some((tab) => tab.id === tabId) ? tabId : null
+  }
+  const entityId =
+    currentType === 'browser'
+      ? state.activeBrowserTabIdByWorktree?.[worktreeId]
+      : currentType === 'editor'
+        ? state.activeFileIdByWorktree?.[worktreeId]
+        : null
+  return (
+    tabs.find((tab) => tab.contentType === currentType && tab.entityId === entityId)?.id ?? null
+  )
+}
+
 function focusIntentPartitionKey(owner: WebSessionIntentOwner, worktreeId: string): string {
   return `${webSessionIntentOwnerKey(owner)}\0${worktreeId}`
 }
@@ -26,7 +62,8 @@ export function recordWebSessionFocusIntent(
   owner: WebSessionIntentOwner,
   worktreeId: string,
   hostTabId: string,
-  leafId?: string
+  leafId?: string,
+  expectedCurrentLocalTabId?: string | null
 ): void {
   const trimmed = hostTabId.trim()
   if (!worktreeId || !trimmed) {
@@ -35,7 +72,8 @@ export function recordWebSessionFocusIntent(
   const trimmedLeafId = leafId?.trim()
   pendingFocusByOwnerAndWorktree.set(focusIntentPartitionKey(owner, worktreeId), {
     hostTabId: trimmed,
-    ...(trimmedLeafId ? { leafId: trimmedLeafId } : {})
+    ...(trimmedLeafId ? { leafId: trimmedLeafId } : {}),
+    ...(expectedCurrentLocalTabId !== undefined ? { expectedCurrentLocalTabId } : {})
   })
 }
 
@@ -50,6 +88,17 @@ export function clearWebSessionFocusIntent(owner: WebSessionIntentOwner, worktre
   pendingFocusByOwnerAndWorktree.delete(focusIntentPartitionKey(owner, worktreeId))
 }
 
+export function clearWebSessionFocusIntentIfMatches(
+  owner: WebSessionIntentOwner,
+  worktreeId: string,
+  hostTabId: string
+): void {
+  const key = focusIntentPartitionKey(owner, worktreeId)
+  if (pendingFocusByOwnerAndWorktree.get(key)?.hostTabId === hostTabId) {
+    pendingFocusByOwnerAndWorktree.delete(key)
+  }
+}
+
 export function clearWebSessionFocusIntentsForOwner(owner: WebSessionIntentOwner): void {
   const prefix = `${webSessionIntentOwnerKey(owner)}\0`
   for (const key of pendingFocusByOwnerAndWorktree.keys()) {
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx b/src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx
index 5b05ba2536d..693dcbb823b 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx
+++ b/src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx
@@ -38,6 +38,7 @@ vi.mock('./web-runtime-session', async (importOriginal) => {
 })
 
 import { useAppStore } from '@/store'
+import type { PublicKnownRuntimeEnvironment } from '../../../shared/runtime-environments'
 import type { AppState } from '@/store/types'
 import { replaceRuntimeEnvironmentRevisions } from './runtime-environment-revision'
 import { toRemoteRuntimePtyId } from './runtime-terminal-stream'
@@ -221,7 +222,7 @@ function seedRemoteMirrorState(): void {
   const runtimeEnvironments = [
     { id: ENV_A, createdAt: 100, pairingRevision: REVISION_A },
     { id: ENV_B, createdAt: 200, pairingRevision: REVISION_B }
-  ] as AppState['runtimeEnvironments']
+  ] as PublicKnownRuntimeEnvironment[]
   replaceRuntimeEnvironmentRevisions(runtimeEnvironments)
   useAppStore.setState(
     {
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx b/src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx
index 5885e536bcc..19be26009de 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx
+++ b/src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx
@@ -37,6 +37,7 @@ vi.mock('./web-runtime-session', async (importOriginal) => {
 })
 
 import { useAppStore } from '@/store'
+import type { PublicKnownRuntimeEnvironment } from '../../../shared/runtime-environments'
 import type { AppState } from '@/store/types'
 import { replaceRuntimeEnvironmentRevisions } from './runtime-environment-revision'
 import {
@@ -179,7 +180,7 @@ function seedRemoteMirrorState(): void {
   const runtimeEnvironments = [
     { id: ENV_A, createdAt: 100, pairingRevision: REVISION_A },
     { id: ENV_B, createdAt: 200, pairingRevision: REVISION_B }
-  ] as AppState['runtimeEnvironments']
+  ] as PublicKnownRuntimeEnvironment[]
   replaceRuntimeEnvironmentRevisions(runtimeEnvironments)
   useAppStore.setState(
     {
diff --git a/src/renderer/src/runtime/web-session-tabs-sync.test.ts b/src/renderer/src/runtime/web-session-tabs-sync.test.ts
index 4d94c99e728..e830e027208 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync.test.ts
@@ -20,13 +20,24 @@ import {
   recordWebSessionReorderIntent,
   resetWebSessionReorderIntentForTests
 } from './web-session-reorder-intent'
-import type { BrowserPage, BrowserWorkspace, Tab, TerminalTab } from '../../../shared/types'
+import type {
+  BrowserPage,
+  BrowserWorkspace,
+  Tab,
+  TabGroupLayoutNode,
+  TerminalTab
+} from '../../../shared/types'
 import type { OpenFile } from '../store/slices/editor'
 import {
   confirmWebAgentSessionHandoffAfterCreate,
   recordWebAgentSessionHandoff,
   resetWebAgentSessionHandoffsForTests
 } from './web-agent-session-handoff'
+import {
+  moveWebSessionBrowserPlacement,
+  recordWebSessionBrowserPlacement,
+  takeWebSessionBrowserPlacementGroup
+} from './web-session-browser-placement'
 import {
   _getWebSessionTabsTrackingCountsForTest,
   acceptReplayedWebSessionTabsSnapshot,
@@ -58,6 +69,16 @@ const SECOND_LEAF_ID = '22222222-2222-4222-8222-222222222222'
 const THIRD_LEAF_ID = '33333333-3333-4333-8333-333333333333'
 const HOST_SURFACE_ID = `host-tab-1::${LEAF_ID}`
 
+function layoutHasGroup(layout: TabGroupLayoutNode | undefined, groupId: string): boolean {
+  if (!layout) {
+    return false
+  }
+  if (layout.type === 'leaf') {
+    return layout.groupId === groupId
+  }
+  return layoutHasGroup(layout.first, groupId) || layoutHasGroup(layout.second, groupId)
+}
+
 function makeState(overrides: Partial<WebSessionTabsSyncState> = {}): WebSessionTabsSyncState {
   return {
     activeBrowserTabId: null,
@@ -2300,6 +2321,64 @@ describe('applyWebSessionTabsSnapshot', () => {
     expect(patch.sortEpoch).toBe((initialState.sortEpoch ?? 0) + 1)
   })
 
+  it('bumps sort epoch when a mirrored same-state done update becomes a completion', () => {
+    const hostPaneKey = makePaneKey('host-tab-1', LEAF_ID)
+    const initialSnapshot = makeSnapshot([
+      {
+        type: 'terminal',
+        id: HOST_SURFACE_ID,
+        title: 'Codex',
+        parentTabId: 'host-tab-1',
+        leafId: LEAF_ID,
+        isActive: true,
+        status: 'ready',
+        terminal: 'terminal-1',
+        agentStatus: {
+          state: 'done',
+          prompt: 'same prompt',
+          updatedAt: NOW - 1_000,
+          stateStartedAt: NOW - 2_000,
+          agentType: 'codex',
+          paneKey: hostPaneKey,
+          stateHistory: [],
+          interrupted: true
+        }
+      }
+    ])
+    const initialPatch = applyWebSessionTabsSnapshot(
+      makeState(),
+      initialSnapshot,
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+    const initialState = { ...makeState(), ...initialPatch }
+
+    const patch = applyWebSessionTabsSnapshot(
+      initialState,
+      {
+        ...initialSnapshot,
+        snapshotVersion: 2,
+        tabs: initialSnapshot.tabs.map((tab) =>
+          tab.type === 'terminal' && tab.agentStatus
+            ? {
+                ...tab,
+                agentStatus: {
+                  ...tab.agentStatus,
+                  updatedAt: NOW,
+                  interrupted: undefined
+                }
+              }
+            : tab
+        )
+      },
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(patch.agentStatusEpoch).toBe((initialState.agentStatusEpoch ?? 0) + 1)
+    expect(patch.sortEpoch).toBe((initialState.sortEpoch ?? 0) + 1)
+  })
+
   it('hydrates multiple initial host snapshots in one merged patch', () => {
     const secondWorktree = 'repo::/other-worktree'
     const patch = applyWebSessionTabsSnapshots(
@@ -2954,7 +3033,7 @@ describe('applyWebSessionTabsSnapshot', () => {
       NOW
     ) as Partial<WebSessionTabsSyncState>
 
-    expect(Object.prototype.hasOwnProperty.call(patch, 'openFiles')).toBe(false)
+    expect(Object.hasOwn(patch, 'openFiles')).toBe(false)
     expect(state.openFiles).toEqual([unchanged])
   })
 
@@ -3286,6 +3365,191 @@ describe('applyWebSessionTabsSnapshot', () => {
     expect(followed.groupsByWorktree?.[WT]?.[0]?.activeTabId).toBe(agentTabId)
   })
 
+  it('does not let stale browser intent override a newer terminal selection', () => {
+    const terminalId = toWebTerminalSurfaceTabId('host-terminal')
+    const terminalTab: Tab = {
+      id: terminalId,
+      entityId: terminalId,
+      groupId: 'host-group-1',
+      worktreeId: WT,
+      contentType: 'terminal',
+      label: 'shell',
+      customLabel: null,
+      color: null,
+      sortOrder: 0,
+      createdAt: NOW,
+      isPreview: false,
+      isPinned: false
+    }
+    recordWebSessionFocusIntent(
+      { environmentId: ENV },
+      WT,
+      'host-browser',
+      undefined,
+      'previous-local-tab'
+    )
+
+    const patch = applyWebSessionTabsSnapshot(
+      makeState({
+        activeTabId: terminalId,
+        activeTabIdByWorktree: { [WT]: terminalId },
+        activeTabType: 'terminal',
+        activeTabTypeByWorktree: { [WT]: 'terminal' },
+        tabsByWorktree: {
+          [WT]: [
+            {
+              id: terminalId,
+              ptyId: 'remote:web-env-1@@terminal-1',
+              worktreeId: WT,
+              title: 'shell',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: NOW
+            }
+          ]
+        },
+        unifiedTabsByWorktree: { [WT]: [terminalTab] },
+        groupsByWorktree: {
+          [WT]: [
+            {
+              id: 'host-group-1',
+              worktreeId: WT,
+              activeTabId: terminalId,
+              tabOrder: [terminalId],
+              recentTabIds: [terminalId]
+            }
+          ]
+        }
+      }),
+      makeSnapshot(
+        [
+          {
+            type: 'terminal',
+            id: `host-terminal::${LEAF_ID}`,
+            title: 'shell',
+            parentTabId: 'host-terminal',
+            leafId: LEAF_ID,
+            isActive: false,
+            status: 'ready',
+            terminal: 'terminal-1'
+          },
+          {
+            type: 'browser',
+            id: 'host-browser',
+            title: 'Preview',
+            browserWorkspaceId: 'host-browser-workspace',
+            browserPageId: 'host-browser-page',
+            url: 'file:///repo/index.html',
+            loading: false,
+            canGoBack: false,
+            canGoForward: false,
+            isActive: true
+          }
+        ],
+        { activeTabId: 'host-browser', activeTabType: 'browser' }
+      ),
+      ENV,
+      NOW + 1
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(patch.activeTabType).toBeUndefined()
+    expect(patch.activeTabIdByWorktree?.[WT]).toBeUndefined()
+    expect(patch.groupsByWorktree?.[WT]?.[0]?.activeTabId).toBe(terminalId)
+  })
+
+  it('does not let stale browser intent override a newer editor selection', () => {
+    const fileId = '/repo/index.html'
+    const editorTab: Tab = {
+      id: 'local-editor',
+      entityId: fileId,
+      groupId: 'host-group-1',
+      worktreeId: WT,
+      contentType: 'editor',
+      label: 'index.html',
+      customLabel: null,
+      color: null,
+      sortOrder: 0,
+      createdAt: NOW,
+      isPreview: false,
+      isPinned: false
+    }
+    recordWebSessionFocusIntent(
+      { environmentId: ENV },
+      WT,
+      'host-browser',
+      undefined,
+      'previous-local-tab'
+    )
+
+    const patch = applyWebSessionTabsSnapshot(
+      makeState({
+        activeFileId: fileId,
+        activeFileIdByWorktree: { [WT]: fileId },
+        activeTabType: 'editor',
+        activeTabTypeByWorktree: { [WT]: 'editor' },
+        openFiles: [
+          {
+            id: fileId,
+            filePath: fileId,
+            relativePath: 'index.html',
+            worktreeId: WT,
+            language: 'html',
+            isDirty: false,
+            runtimeEnvironmentId: ENV,
+            mode: 'edit',
+            mirroredFromRuntimeSession: true
+          } as OpenFile
+        ],
+        unifiedTabsByWorktree: { [WT]: [editorTab] },
+        groupsByWorktree: {
+          [WT]: [
+            {
+              id: 'host-group-1',
+              worktreeId: WT,
+              activeTabId: editorTab.id,
+              tabOrder: [editorTab.id],
+              recentTabIds: [editorTab.id]
+            }
+          ]
+        }
+      }),
+      makeSnapshot(
+        [
+          {
+            type: 'file',
+            id: 'host-editor',
+            title: 'index.html',
+            filePath: fileId,
+            relativePath: 'index.html',
+            language: 'html',
+            isDirty: false,
+            isActive: false
+          },
+          {
+            type: 'browser',
+            id: 'host-browser',
+            title: 'Preview',
+            browserWorkspaceId: 'host-browser-workspace',
+            browserPageId: 'host-browser-page',
+            url: 'file:///repo/index.html',
+            loading: false,
+            canGoBack: false,
+            canGoForward: false,
+            isActive: true
+          }
+        ],
+        { activeTabId: 'host-browser', activeTabType: 'browser' }
+      ),
+      ENV,
+      NOW + 1
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(patch.activeTabType).toBeUndefined()
+    expect(patch.activeFileIdByWorktree?.[WT]).toBeUndefined()
+    expect(patch.groupsByWorktree?.[WT]?.[0]?.activeTabId).toBe('host-editor')
+  })
+
   it('focuses a caller-created terminal even when an older host leaves it inactive', () => {
     const existingTabId = toWebTerminalSurfaceTabId('host-tab-1')
     const newTabId = toWebTerminalSurfaceTabId('host-tab-2')
@@ -3853,6 +4117,316 @@ describe('applyWebSessionTabsSnapshot', () => {
     expect(patch.layoutByWorktree).toBeUndefined()
   })
 
+  it('keeps one remote browser in its client-owned side-preview group', () => {
+    const editorGroupId = 'client-editor-group'
+    const previewGroupId = 'client-preview-group'
+    recordWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'host-browser-page',
+      groupId: previewGroupId
+    })
+
+    const patch = applyWebSessionTabsSnapshot(
+      makeState({
+        groupsByWorktree: {
+          [WT]: [
+            {
+              id: editorGroupId,
+              worktreeId: WT,
+              activeTabId: 'local-editor',
+              tabOrder: ['local-editor']
+            },
+            {
+              id: previewGroupId,
+              worktreeId: WT,
+              activeTabId: null,
+              tabOrder: []
+            }
+          ]
+        },
+        layoutByWorktree: {
+          [WT]: {
+            type: 'split',
+            direction: 'horizontal',
+            first: { type: 'leaf', groupId: editorGroupId },
+            second: { type: 'leaf', groupId: previewGroupId },
+            ratio: 0.5
+          }
+        },
+        unifiedTabsByWorktree: {
+          [WT]: [
+            {
+              id: 'local-editor',
+              worktreeId: WT,
+              groupId: editorGroupId,
+              contentType: 'editor',
+              entityId: 'local-file',
+              label: 'example.html',
+              sortOrder: 0,
+              createdAt: NOW,
+              isPreview: false,
+              isPinned: false,
+              customLabel: null,
+              color: null
+            }
+          ]
+        }
+      }),
+      makeSnapshot(
+        [
+          {
+            type: 'browser',
+            id: 'host-browser-tab',
+            title: 'example.html',
+            browserWorkspaceId: 'host-browser-workspace',
+            browserPageId: 'host-browser-page',
+            url: 'file:///srv/repo/example.html',
+            loading: false,
+            canGoBack: false,
+            canGoForward: false,
+            isActive: true
+          }
+        ],
+        { activeTabId: 'host-browser-tab', activeTabType: 'browser' }
+      ),
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+
+    const browserTab = patch.unifiedTabsByWorktree?.[WT]?.find(
+      (tab) => tab.contentType === 'browser'
+    )
+    expect(browserTab).toMatchObject({ id: 'host-browser-tab', groupId: previewGroupId })
+    expect(
+      patch.groupsByWorktree?.[WT]?.find((group) => group.id === previewGroupId)
+    ).toMatchObject({ activeTabId: 'host-browser-tab', tabOrder: ['host-browser-tab'] })
+    expect(patch.groupsByWorktree?.[WT]?.find((group) => group.id === editorGroupId)).toMatchObject(
+      { activeTabId: 'local-editor', tabOrder: ['local-editor'] }
+    )
+    expect(patch.browserTabsByWorktree?.[WT]).toHaveLength(1)
+  })
+
+  it('replays a pre-response browser snapshot after canonical placement and focus are known', () => {
+    const editorGroupId = 'client-editor-group'
+    const previewGroupId = 'client-preview-group'
+    const editorFileId = '/srv/repo/example.html'
+    const editorTab: Tab = {
+      id: 'host-editor',
+      worktreeId: WT,
+      groupId: editorGroupId,
+      contentType: 'editor',
+      entityId: editorFileId,
+      label: 'example.html',
+      sortOrder: 0,
+      createdAt: NOW,
+      isPreview: false,
+      isPinned: false,
+      customLabel: null,
+      color: null
+    }
+    const state = makeState({
+      activeFileId: editorFileId,
+      activeFileIdByWorktree: { [WT]: editorFileId },
+      activeTabType: 'editor',
+      activeTabTypeByWorktree: { [WT]: 'editor' },
+      activeGroupIdByWorktree: { [WT]: editorGroupId },
+      groupsByWorktree: {
+        [WT]: [
+          {
+            id: editorGroupId,
+            worktreeId: WT,
+            activeTabId: editorTab.id,
+            tabOrder: [editorTab.id]
+          },
+          {
+            id: previewGroupId,
+            worktreeId: WT,
+            activeTabId: null,
+            tabOrder: []
+          }
+        ]
+      },
+      layoutByWorktree: {
+        [WT]: {
+          type: 'split',
+          direction: 'horizontal',
+          first: { type: 'leaf', groupId: editorGroupId },
+          second: { type: 'leaf', groupId: previewGroupId },
+          ratio: 0.5
+        }
+      },
+      unifiedTabsByWorktree: { [WT]: [editorTab] }
+    })
+    const snapshot = makeSnapshot(
+      [
+        {
+          type: 'file',
+          id: 'host-editor',
+          title: 'example.html',
+          filePath: editorFileId,
+          relativePath: 'example.html',
+          language: 'html',
+          isDirty: false,
+          isActive: false
+        },
+        {
+          type: 'browser',
+          id: 'host-browser-tab',
+          title: 'example.html',
+          browserWorkspaceId: 'host-browser-workspace',
+          browserPageId: 'host-browser-page',
+          url: 'file:///srv/repo/example.html',
+          loading: false,
+          canGoBack: false,
+          canGoForward: false,
+          isActive: true
+        }
+      ],
+      { activeTabId: 'host-browser-tab', activeTabType: 'browser' }
+    )
+    recordWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'provisional-browser-page',
+      groupId: previewGroupId
+    })
+
+    const subscriptionPatch = applyFreshWebSessionTabsSnapshot(state, snapshot, ENV, NOW)
+    const afterSubscription = {
+      ...state,
+      ...(subscriptionPatch as Partial<WebSessionTabsSyncState>)
+    }
+    expect(afterSubscription.activeTabType).toBe('editor')
+    expect(
+      afterSubscription.unifiedTabsByWorktree[WT]?.find((tab) => tab.contentType === 'browser')
+        ?.groupId
+    ).not.toBe(previewGroupId)
+
+    moveWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      fromRemotePageId: 'provisional-browser-page',
+      toRemotePageId: 'host-browser-page'
+    })
+    recordWebSessionFocusIntent(
+      { environmentId: ENV },
+      WT,
+      'host-browser-page',
+      undefined,
+      editorTab.id
+    )
+    acceptReplayedWebSessionTabsSnapshot(ENV, WT)
+    const replayPatch = applyFreshWebSessionTabsSnapshot(
+      afterSubscription,
+      snapshot,
+      ENV,
+      NOW + 1
+    ) as Partial<WebSessionTabsSyncState>
+    const afterReplay = { ...afterSubscription, ...replayPatch }
+
+    expect(
+      afterReplay.unifiedTabsByWorktree[WT]?.find((tab) => tab.contentType === 'browser')
+    ).toMatchObject({ id: 'host-browser-tab', groupId: previewGroupId })
+    expect(
+      afterReplay.groupsByWorktree[WT]?.find((group) => group.id === previewGroupId)
+    ).toMatchObject({ activeTabId: 'host-browser-tab', tabOrder: ['host-browser-tab'] })
+    expect(afterReplay.activeBrowserTabIdByWorktree[WT]).toBe('host-browser-workspace')
+    expect(afterReplay.activeTabTypeByWorktree[WT]).toBe('browser')
+  })
+
+  it('keeps a reserved side-preview split across a pre-publication snapshot', () => {
+    const editorGroupId = 'client-editor-group'
+    const previewGroupId = 'client-preview-group'
+    const initialLayout: TabGroupLayoutNode = {
+      type: 'split',
+      direction: 'horizontal',
+      first: { type: 'leaf', groupId: editorGroupId },
+      second: { type: 'leaf', groupId: previewGroupId },
+      ratio: 0.5
+    }
+    recordWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'pending-browser-page',
+      groupId: previewGroupId
+    })
+
+    const patch = applyWebSessionTabsSnapshot(
+      makeState({
+        groupsByWorktree: {
+          [WT]: [
+            {
+              id: editorGroupId,
+              worktreeId: WT,
+              activeTabId: 'local-editor',
+              tabOrder: ['local-editor']
+            },
+            {
+              id: previewGroupId,
+              worktreeId: WT,
+              activeTabId: null,
+              tabOrder: []
+            }
+          ]
+        },
+        layoutByWorktree: { [WT]: initialLayout },
+        unifiedTabsByWorktree: {
+          [WT]: [
+            {
+              id: 'local-editor',
+              worktreeId: WT,
+              groupId: editorGroupId,
+              contentType: 'editor',
+              entityId: 'local-file',
+              label: 'example.html',
+              sortOrder: 0,
+              createdAt: NOW,
+              isPreview: false,
+              isPinned: false,
+              customLabel: null,
+              color: null
+            }
+          ]
+        }
+      }),
+      makeSnapshot([], {
+        activeTabType: null,
+        tabGroups: [{ id: editorGroupId, activeTabId: null, tabOrder: [], recentTabIds: [] }],
+        tabGroupLayout: { type: 'leaf', groupId: editorGroupId }
+      }),
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(patch.groupsByWorktree?.[WT]?.map((group) => group.id)).toContain(previewGroupId)
+    expect(layoutHasGroup(patch.layoutByWorktree?.[WT] ?? initialLayout, previewGroupId)).toBe(true)
+  })
+
+  it('forgets client browser placement after the host removes the page', () => {
+    recordWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'host-browser-page',
+      groupId: 'client-preview-group'
+    })
+    takeWebSessionBrowserPlacementGroup({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'host-browser-page'
+    })
+
+    applyWebSessionTabsSnapshot(makeState(), makeSnapshot([]), ENV, NOW)
+
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENV,
+        worktreeId: WT,
+        remotePageId: 'host-browser-page'
+      })
+    ).toBeUndefined()
+  })
+
   it('creates a rendered web layout group when stale group records do not include it', () => {
     const visibleGroupId = 'visible-web-group'
     const hostOnlyGroupId = 'host-group-1'
@@ -3938,7 +4512,7 @@ describe('applyWebSessionTabsSnapshot', () => {
     const unifiedTab: Tab = {
       id: 'local-browser-unified',
       entityId: workspace.id,
-      groupId: 'host-group-1',
+      groupId: 'client-moved-group',
       worktreeId: WT,
       contentType: 'browser',
       label: 'New Tab',
@@ -3961,7 +4535,7 @@ describe('applyWebSessionTabsSnapshot', () => {
         groupsByWorktree: {
           [WT]: [
             {
-              id: 'host-group-1',
+              id: 'client-moved-group',
               worktreeId: WT,
               activeTabId: unifiedTab.id,
               tabOrder: [unifiedTab.id],
@@ -4006,6 +4580,7 @@ describe('applyWebSessionTabsSnapshot', () => {
         title: 'Example Domain'
       }
     ])
+    expect(patch.unifiedTabsByWorktree?.[WT]?.[0]?.groupId).toBe('client-moved-group')
     // Absent key, not a missing handle: the seeded { ENV, 'host-browser-page' } handle matched.
     expect(patch.remoteBrowserPageHandlesByPageId).toBeUndefined()
     expect(patch.unifiedTabsByWorktree?.[WT]?.map((tab) => tab.id)).toEqual([
diff --git a/src/renderer/src/runtime/web-session-tabs-sync.ts b/src/renderer/src/runtime/web-session-tabs-sync.ts
index 174a239ac5a..8de495919d7 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync.ts
@@ -8,6 +8,7 @@ import {
   AGENT_STATUS_STALE_AFTER_MS,
   type AgentStatusEntry
 } from '../../../shared/agent-status-types'
+import { agentEntryCompletionAt } from '../../../shared/agent-completion-time'
 import { agentProviderSessionsEqual } from '../../../shared/agent-session-resume'
 import type {
   RuntimeMobileSessionTabsResult,
@@ -53,7 +54,8 @@ import { toRuntimeWorktreeSelector } from './runtime-worktree-selector'
 import {
   clearWebSessionFocusIntent,
   clearWebSessionFocusIntentsForOwner,
-  peekWebSessionFocusIntent
+  peekWebSessionFocusIntent,
+  resolveWebSessionVisibleTabId
 } from './web-session-focus-intent'
 import {
   clearWebSessionCloseIntentsForOwner,
@@ -89,6 +91,14 @@ import {
   installWindowVisibilitySubscriptionParking,
   type WindowVisibilitySubscriptionSpec
 } from './window-visibility-subscription-parking'
+import {
+  clearWebSessionBrowserPlacementsForEnvironment,
+  clearWebSessionBrowserPlacementsForWorktree,
+  isWebSessionBrowserPlacementGroupReserved,
+  peekWebSessionBrowserPlacementGroup,
+  resetWebSessionBrowserPlacementsForTests
+} from './web-session-browser-placement'
+import { suppressE2eWebRuntimeBrowserSnapshot } from './web-runtime-browser-creation-e2e-fault'
 
 const WEB_SESSION_GROUP_PREFIX = 'web-session-tabs:'
 export const WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS = 100
@@ -169,6 +179,7 @@ type MirroredBrowserTab = {
   remotePageId: string
   unifiedTab: Tab
   hostTabId: string
+  clientGroupId?: string
 }
 
 type MirroredEditorTab = {
@@ -632,6 +643,7 @@ export function resetWebSessionTabsSnapshotFreshnessForTests(): void {
   lastHostTerminalTabCountByWorktree.clear()
   hostSessionTabIdByLocalKey.clear()
   hostSessionTabMappingKeysByEnvironmentAndWorktree.clear()
+  resetWebSessionBrowserPlacementsForTests()
 }
 
 export function _getWebSessionTabsTrackingCountsForTest(): {
@@ -674,6 +686,7 @@ function clearWebSessionTabsTrackingForWorktree(environmentId: string, worktreeI
   clearWebSessionCloseIntentsForWorktree({ environmentId }, worktreeId)
   clearWebAgentSessionHandoffsForWorktree(environmentId, worktreeId)
   clearHostSessionTabIdMappings(environmentId, worktreeId)
+  clearWebSessionBrowserPlacementsForWorktree(environmentId, worktreeId)
 }
 
 export function clearWebSessionTabsTrackingForEnvironment(environmentId: string): void {
@@ -727,6 +740,7 @@ export function clearWebSessionTabsTrackingForEnvironment(environmentId: string)
     hostSessionTabMappingKeysByEnvironmentAndWorktree.delete(trimmedEnvironmentId)
   }
   clearWebAgentSessionHandoffsForEnvironment(trimmedEnvironmentId)
+  clearWebSessionBrowserPlacementsForEnvironment(trimmedEnvironmentId)
   clearAllWebRuntimeWakeTerminalRespawn()
 }
 
@@ -1278,12 +1292,17 @@ function buildMirroredAgentStatusPatch(
       existing?.worktreeId !== entry.worktreeId || existing?.tabId !== entry.tabId
     const entryFreshnessChanged =
       !!existing && isAgentStatusFresh(existing, now) !== isAgentStatusFresh(entry, now)
+    const doneAttentionChanged =
+      existing?.state === 'done' &&
+      entry.state === 'done' &&
+      agentEntryCompletionAt(existing) !== agentEntryCompletionAt(entry)
     const entrySortRelevantChange =
       !existing ||
       existing.state !== entry.state ||
       !isAgentStatusFresh(existing, now) ||
       entryFreshnessChanged ||
       entryAttributionChanged ||
+      doneAttentionChanged ||
       isMirroredCommandCodeTurnBump(existing, entry)
     aggregateRelevantChange = aggregateRelevantChange || entrySortRelevantChange
     sortRelevantChange = sortRelevantChange || entrySortRelevantChange
@@ -1488,6 +1507,10 @@ function buildMirroredBrowserTabs(
   sortOffset: number,
   now: number
 ): MirroredBrowserTab[] {
+  const renderedGroupIds = collectLayoutGroupIds(state.layoutByWorktree[snapshot.worktree])
+  const clientGroupIds = new Set(
+    (state.groupsByWorktree[snapshot.worktree] ?? []).map((group) => group.id)
+  )
   return snapshot.tabs.filter(isReadyBrowserTab).map((tab, index) => {
     const existing = findBrowserWorkspaceForRemotePage(
       state,
@@ -1498,7 +1521,22 @@ function buildMirroredBrowserTabs(
     const workspaceId = existing?.workspace.id ?? tab.browserWorkspaceId
     const pageId = existing?.page.id ?? tab.browserPageId
     const createdAt = existing?.page.createdAt ?? now + sortOffset + index
-    const groupId = hostGroupIdByTabId.get(tab.id) ?? fallbackGroupId
+    const recordedClientGroupId = peekWebSessionBrowserPlacementGroup({
+      environmentId,
+      worktreeId: snapshot.worktree,
+      remotePageId: tab.browserPageId
+    })
+    const hostGroupId = hostGroupIdByTabId.get(tab.id) ?? fallbackGroupId
+    const existingClientGroupId =
+      existing?.unifiedTab?.groupId !== hostGroupId ? existing?.unifiedTab?.groupId : undefined
+    const preferredClientGroupId = recordedClientGroupId ?? existingClientGroupId
+    const clientGroupId =
+      preferredClientGroupId &&
+      clientGroupIds.has(preferredClientGroupId) &&
+      (renderedGroupIds.size === 0 || renderedGroupIds.has(preferredClientGroupId))
+        ? preferredClientGroupId
+        : undefined
+    const groupId = clientGroupId ?? hostGroupId
     const title = tab.title.trim() || 'Browser'
     const nextPage: BrowserPage = {
       id: pageId,
@@ -1540,7 +1578,8 @@ function buildMirroredBrowserTabs(
       certificateFailure: tab.certificateFailure ?? null,
       remotePageId: tab.browserPageId,
       unifiedTab: buildBrowserUnifiedTab(workspace, tab, existing?.unifiedTab ?? null, groupId),
-      hostTabId: tab.id
+      hostTabId: tab.id,
+      ...(clientGroupId ? { clientGroupId } : {})
     }
   })
 }
@@ -1730,6 +1769,46 @@ function updateHostSessionTabIdMappings(args: {
   }
 }
 
+function retainClientPlacedMirroredTabs(args: {
+  groups: readonly TabGroup[]
+  mirroredUnifiedIds: ReadonlySet<string>
+  validUnifiedTabIds: ReadonlySet<string>
+  clientGroupIdByLocalTabId: ReadonlyMap<string, string>
+  nextActiveUnifiedTabId: string | null
+}): TabGroup[] {
+  return args.groups.map((group) => {
+    const retainedTabOrder = group.tabOrder.filter(
+      (tabId) =>
+        args.validUnifiedTabIds.has(tabId) &&
+        (!args.mirroredUnifiedIds.has(tabId) ||
+          args.clientGroupIdByLocalTabId.get(tabId) === group.id)
+    )
+    const placedTabIds = [...args.clientGroupIdByLocalTabId]
+      .filter(
+        ([tabId, groupId]) =>
+          groupId === group.id &&
+          args.validUnifiedTabIds.has(tabId) &&
+          !retainedTabOrder.includes(tabId)
+      )
+      .map(([tabId]) => tabId)
+    const tabOrder = [...retainedTabOrder, ...placedTabIds]
+    const activeTabId =
+      args.nextActiveUnifiedTabId && tabOrder.includes(args.nextActiveUnifiedTabId)
+        ? args.nextActiveUnifiedTabId
+        : group.activeTabId && tabOrder.includes(group.activeTabId)
+          ? group.activeTabId
+          : (tabOrder[0] ?? null)
+    return {
+      ...group,
+      tabOrder,
+      activeTabId,
+      recentTabIds: activeTabId
+        ? pushRecentTabId(sanitizeRecentTabIds(group.recentTabIds, tabOrder), activeTabId)
+        : []
+    }
+  })
+}
+
 function buildMirroredHostGroups({
   currentGroups,
   hostGroups,
@@ -1739,7 +1818,8 @@ function buildMirroredHostGroups({
   now,
   validUnifiedTabIds,
   environmentId,
-  worktreeId
+  worktreeId,
+  clientGroupIdByLocalTabId
 }: {
   currentGroups: readonly TabGroup[]
   hostGroups: readonly RuntimeMobileSessionTabGroup[]
@@ -1750,16 +1830,14 @@ function buildMirroredHostGroups({
   validUnifiedTabIds: ReadonlySet<string>
   environmentId: string
   worktreeId: string
+  clientGroupIdByLocalTabId: ReadonlyMap<string, string>
 }): TabGroup[] | null {
-  const strippedGroups = currentGroups.map((group) => {
-    const tabOrder = group.tabOrder.filter(
-      (tabId) => validUnifiedTabIds.has(tabId) && !mirroredUnifiedIds.has(tabId)
-    )
-    return {
-      ...group,
-      tabOrder,
-      recentTabIds: sanitizeRecentTabIds(group.recentTabIds, tabOrder)
-    }
+  const strippedGroups = retainClientPlacedMirroredTabs({
+    groups: currentGroups,
+    mirroredUnifiedIds,
+    validUnifiedTabIds,
+    clientGroupIdByLocalTabId,
+    nextActiveUnifiedTabId
   })
   const groupsById = new Map(strippedGroups.map((group) => [group.id, group]))
   const orderedGroups: TabGroup[] = []
@@ -1769,7 +1847,12 @@ function buildMirroredHostGroups({
     const existing = groupsById.get(hostGroup.id)
     const localHostOrder = hostGroup.tabOrder
       .map((tabId) => hostToLocalTabId.get(tabId))
-      .filter((tabId): tabId is string => tabId !== undefined && validUnifiedTabIds.has(tabId))
+      .filter(
+        (tabId): tabId is string =>
+          tabId !== undefined &&
+          validUnifiedTabIds.has(tabId) &&
+          !clientGroupIdByLocalTabId.has(tabId)
+      )
     const hostTabOrder = [
       ...(existing?.tabOrder.filter((tabId) => !localHostOrder.includes(tabId)) ?? []),
       ...localHostOrder
@@ -1811,7 +1894,11 @@ function buildMirroredHostGroups({
   }
 
   for (const group of strippedGroups) {
-    if (!seen.has(group.id) && group.tabOrder.length > 0) {
+    if (
+      !seen.has(group.id) &&
+      (group.tabOrder.length > 0 ||
+        isWebSessionBrowserPlacementGroupReserved({ worktreeId, groupId: group.id }))
+    ) {
       orderedGroups.push(group)
     }
   }
@@ -2225,42 +2312,6 @@ function toVisibleTabType(tab: Tab): WebSessionTabsSyncState['activeTabType'] {
   return 'editor'
 }
 
-function findCurrentVisibleUnifiedTabId(args: {
-  state: WebSessionTabsSyncState
-  worktreeId: string
-  nextUnifiedTabs: readonly Tab[] | null
-}): string | null {
-  const { state, worktreeId, nextUnifiedTabs } = args
-  if (!nextUnifiedTabs) {
-    return null
-  }
-  const currentVisibleType =
-    state.activeTabTypeByWorktree[worktreeId] ??
-    (state.activeWorktreeId === worktreeId ? state.activeTabType : null)
-  if (currentVisibleType === 'terminal') {
-    const terminalTabId = state.activeTabIdByWorktree[worktreeId]
-    return terminalTabId && nextUnifiedTabs.some((tab) => tab.id === terminalTabId)
-      ? terminalTabId
-      : null
-  }
-  if (currentVisibleType === 'browser') {
-    const browserWorkspaceId = state.activeBrowserTabIdByWorktree[worktreeId]
-    return (
-      nextUnifiedTabs.find(
-        (tab) => tab.contentType === 'browser' && tab.entityId === browserWorkspaceId
-      )?.id ?? null
-    )
-  }
-  if (currentVisibleType === 'editor') {
-    const fileId = state.activeFileIdByWorktree[worktreeId]
-    return (
-      nextUnifiedTabs.find((tab) => tab.contentType === 'editor' && tab.entityId === fileId)?.id ??
-      null
-    )
-  }
-  return null
-}
-
 function applyWebSessionTabsSnapshotWithContext(
   state: WebSessionTabsSyncState,
   rawSnapshot: RuntimeMobileSessionTabsResult,
@@ -2268,6 +2319,9 @@ function applyWebSessionTabsSnapshotWithContext(
   now = Date.now(),
   batchContext?: WebSessionTabsBatchContext
 ): WebSessionTabsSyncState | Partial<WebSessionTabsSyncState> {
+  if (suppressE2eWebRuntimeBrowserSnapshot(rawSnapshot)) {
+    return state
+  }
   const worktreeId = rawSnapshot.worktree
   if (worktreeId === FLOATING_TERMINAL_WORKTREE_ID) {
     return state
@@ -2300,7 +2354,7 @@ function applyWebSessionTabsSnapshotWithContext(
   // Why: only a caller-recorded create intent may focus its arriving tab; unsolicited server-active must not steal focus (#5435).
   const focusIntent = peekWebSessionFocusIntent({ environmentId }, worktreeId)
   const focusIntentHostTabId = focusIntent?.hostTabId ?? null
-  const callerFocusIntentTab =
+  const matchingFocusIntentTab =
     focusIntentHostTabId === null
       ? null
       : focusIntent?.leafId
@@ -2316,13 +2370,21 @@ function applyWebSessionTabsSnapshotWithContext(
               (tab.type === 'terminal' && tab.parentTabId === focusIntentHostTabId) ||
               (tab.type === 'browser' && tab.browserPageId === focusIntentHostTabId)
           ) ?? null)
+  const expectedCurrentLocalTabId = focusIntent?.expectedCurrentLocalTabId
+  const currentVisibleLocalTabId = resolveWebSessionVisibleTabId(state, worktreeId)
+  const callerFocusIntentTab =
+    matchingFocusIntentTab &&
+    (expectedCurrentLocalTabId === undefined ||
+      expectedCurrentLocalTabId === currentVisibleLocalTabId)
+      ? matchingFocusIntentTab
+      : null
   const followIntentTab =
     snapshot.navigationIntent === 'follow'
       ? (snapshot.tabs.find((tab) => tab.id === snapshot.activeTabId) ?? null)
       : null
   const navigationIntentTab = callerFocusIntentTab ?? followIntentTab
   const honorSnapshotActiveFocus = navigationIntentTab !== null
-  if (callerFocusIntentTab) {
+  if (matchingFocusIntentTab) {
     clearWebSessionFocusIntent({ environmentId }, worktreeId)
   }
   const currentTerminalTabs = state.tabsByWorktree[worktreeId] ?? []
@@ -2640,11 +2702,11 @@ function applyWebSessionTabsSnapshotWithContext(
       ? (activeMirroredEditorFileId ?? mirroredEditorTabs[0]?.file.id)
       : mirroredEditorTabs[0]?.file.id) ??
     null
-  const currentVisibleUnifiedTabId = findCurrentVisibleUnifiedTabId({
+  const currentVisibleUnifiedTabId = resolveWebSessionVisibleTabId(
     state,
     worktreeId,
-    nextUnifiedTabs
-  })
+    nextUnifiedTabs ?? []
+  )
   // Why: a client-initiated activation also drives the visible unified tab, overriding the sticky current-visible tab.
   const intentUnifiedTabId = honorSnapshotActiveFocus
     ? navigationIntentTab?.type === 'browser'
@@ -2686,6 +2748,11 @@ function applyWebSessionTabsSnapshotWithContext(
   })
 
   const currentGroups = state.groupsByWorktree[worktreeId] ?? []
+  const clientGroupIdByLocalTabId = new Map(
+    mirroredBrowserTabs.flatMap((entry) =>
+      entry.clientGroupId ? [[entry.unifiedTab.id, entry.clientGroupId]] : []
+    )
+  )
   const nextGroups = (() => {
     if (!nextUnifiedTabs || nextUnifiedTabs.length === 0) {
       return null
@@ -2700,21 +2767,17 @@ function applyWebSessionTabsSnapshotWithContext(
         now,
         validUnifiedTabIds,
         environmentId,
-        worktreeId
+        worktreeId,
+        clientGroupIdByLocalTabId
       })
     }
-    const strippedGroups = currentGroups.map((group) => ({
-      ...group,
-      tabOrder: group.tabOrder.filter(
-        (tabId) => validUnifiedTabIds.has(tabId) && !mirroredUnifiedIds.has(tabId)
-      ),
-      recentTabIds: sanitizeRecentTabIds(
-        group.recentTabIds,
-        group.tabOrder.filter(
-          (tabId) => validUnifiedTabIds.has(tabId) && !mirroredUnifiedIds.has(tabId)
-        )
-      )
-    }))
+    const strippedGroups = retainClientPlacedMirroredTabs({
+      groups: currentGroups,
+      mirroredUnifiedIds,
+      validUnifiedTabIds,
+      clientGroupIdByLocalTabId,
+      nextActiveUnifiedTabId
+    })
     const target = strippedGroups.find((group) => group.id === targetGroupId) ?? {
       id: targetGroupId,
       worktreeId,
@@ -2724,7 +2787,9 @@ function applyWebSessionTabsSnapshotWithContext(
     }
     const targetOrder = [
       ...target.tabOrder.filter((tabId) => validUnifiedTabIds.has(tabId)),
-      ...mirroredUnifiedTabs.map((tab) => tab.id)
+      ...mirroredUnifiedTabs
+        .filter((tab) => !clientGroupIdByLocalTabId.has(tab.id))
+        .map((tab) => tab.id)
     ]
     const targetActiveTabId =
       nextActiveUnifiedTabId && targetOrder.includes(nextActiveUnifiedTabId)
@@ -2744,7 +2809,15 @@ function applyWebSessionTabsSnapshotWithContext(
     const merged = strippedGroups.some((group) => group.id === targetGroupId)
       ? strippedGroups.map((group) => (group.id === targetGroupId ? updatedTarget : group))
       : [...strippedGroups, updatedTarget]
-    return merged.filter((group) => group.id === targetGroupId || group.tabOrder.length > 0)
+    return merged.filter(
+      (group) =>
+        group.id === targetGroupId ||
+        group.tabOrder.length > 0 ||
+        isWebSessionBrowserPlacementGroupReserved({
+          worktreeId,
+          groupId: group.id
+        })
+    )
   })()
 
   const nextTabBarOrder = (() => {
@@ -3350,8 +3423,7 @@ export function applyWebSessionTabsStorePatch(
   let mirroredAgentStatusChanged = false
   useAppStore.setState((state) => {
     const patch = buildPatch(state)
-    mirroredAgentStatusChanged =
-      patch !== state && Object.prototype.hasOwnProperty.call(patch, 'agentStatusByPaneKey')
+    mirroredAgentStatusChanged = patch !== state && Object.hasOwn(patch, 'agentStatusByPaneKey')
     return patch
   })
   // Why: paired-web snapshots bypass setAgentStatus, so arm the stale-boundary timer explicitly like local hook events do.
diff --git a/src/renderer/src/store/index.ts b/src/renderer/src/store/index.ts
index e0e2a5e88a6..ebc4691da30 100644
--- a/src/renderer/src/store/index.ts
+++ b/src/renderer/src/store/index.ts
@@ -46,7 +46,10 @@ import { createRemoteServerUpdatesSlice } from './slices/remote-server-updates'
 import { createTerminalQuickCommandHostsSlice } from './slices/terminal-quick-command-hosts'
 import { e2eConfig } from '@/lib/e2e-config'
 import type { createWebRuntimeSessionTerminal } from '@/runtime/web-runtime-session'
-import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing'
+import {
+  registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener
+} from '@/lib/http-link-routing'
 import { installStoreListenerCensus } from './store-listener-census'
 import {
   registerRendererMemoryProfileContributor,
@@ -104,6 +107,10 @@ export const useAppStore = create<AppState>()((...a) => {
 })
 
 registerHttpLinkStoreAccessor(() => useAppStore.getState())
+registerRuntimeHttpLinkBrowserOpener(async (request) => {
+  const { openWorkspaceBrowserTab } = await import('@/lib/workspace-browser-tab-open')
+  await openWorkspaceBrowserTab(request)
+})
 
 // Why: names the fattest store slices in renderer_memory_highwater breadcrumbs
 // so OOM crash reports identify what grew without a local repro.
diff --git a/src/renderer/src/store/running-terminal-close-confirm.ts b/src/renderer/src/store/running-terminal-close-confirm.ts
index 618d30c98c5..88db03a5d38 100644
--- a/src/renderer/src/store/running-terminal-close-confirm.ts
+++ b/src/renderer/src/store/running-terminal-close-confirm.ts
@@ -83,7 +83,7 @@ export const useRunningTerminalCloseConfirmStore = create<RunningTerminalCloseCo
       const queuedIndex = queuedRequests.findIndex(
         (queued) => queued.terminalTabId === request.terminalTabId
       )
-      if (queuedIndex >= 0) {
+      if (queuedIndex !== -1) {
         queuedRequests[queuedIndex] = mergeRequests(queuedRequests[queuedIndex]!, request)
         return
       }
diff --git a/src/renderer/src/store/slices/agent-status-batch.test.ts b/src/renderer/src/store/slices/agent-status-batch.test.ts
new file mode 100644
index 00000000000..5504f4d463e
--- /dev/null
+++ b/src/renderer/src/store/slices/agent-status-batch.test.ts
@@ -0,0 +1,506 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_STATUS_STALE_AFTER_MS,
+  type AgentStatusEntry
+} from '../../../../shared/agent-status-types'
+import type { AppState } from '../types'
+import {
+  MAX_LIVE_AGENT_STATUSES,
+  type AgentStatusBatchUpdate,
+  type RetainedAgentEntry
+} from './agent-status'
+import type { GeneratedTabTitleUpdate } from './terminal-tab-title-batch'
+import { createTestStore, makeTab } from './store-test-helpers'
+
+const BASE_TIME = 2_000_000
+const FIRST_PANE = 'tab-1:11111111-1111-4111-8111-111111111111'
+const SECOND_PANE = 'tab-1:22222222-2222-4222-8222-222222222222'
+const PROVIDER_SESSION = {
+  key: 'session_id' as const,
+  id: 'pi-session-1',
+  transcriptPath: '/tmp/pi-session-1.jsonl'
+}
+
+function flushMicrotasks(): Promise<void> {
+  return new Promise((resolve) => queueMicrotask(resolve))
+}
+
+function seedBatchStore() {
+  const store = createTestStore()
+  const tab = makeTab({ id: 'tab-1', worktreeId: 'wt-1', title: 'pi' })
+  const retainedEntry: AgentStatusEntry = {
+    paneKey: FIRST_PANE,
+    state: 'done',
+    prompt: 'old turn',
+    agentType: 'pi',
+    updatedAt: BASE_TIME - 100,
+    stateStartedAt: BASE_TIME - 200,
+    stateHistory: []
+  }
+  const retained: RetainedAgentEntry = {
+    entry: retainedEntry,
+    worktreeId: 'wt-1',
+    tab,
+    agentType: 'pi',
+    startedAt: BASE_TIME - 200
+  }
+  store.setState({
+    tabsByWorktree: { 'wt-1': [tab] },
+    retainedAgentsByPaneKey: { [FIRST_PANE]: retained },
+    retentionSuppressedPaneKeys: { [FIRST_PANE]: true },
+    refreshGitHubForWorktreeIfStale: vi.fn().mockResolvedValue(undefined)
+  } as Partial<AppState>)
+  return store
+}
+
+function makeUpdates(): AgentStatusBatchUpdate[] {
+  return [
+    {
+      paneKey: FIRST_PANE,
+      payload: { state: 'working', prompt: 'first turn', agentType: 'pi' },
+      terminalTitle: 'Pi',
+      timing: { updatedAt: BASE_TIME, stateStartedAt: BASE_TIME },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1', terminalHandle: 'pty-1' },
+      metadata: { providerSession: PROVIDER_SESSION }
+    },
+    {
+      paneKey: FIRST_PANE,
+      payload: {
+        state: 'waiting',
+        prompt: 'first turn',
+        agentType: 'pi',
+        toolName: 'AskUserQuestion'
+      },
+      timing: { updatedAt: BASE_TIME + 1, stateStartedAt: BASE_TIME + 1 }
+    },
+    {
+      paneKey: FIRST_PANE,
+      payload: {
+        state: 'done',
+        prompt: 'first turn',
+        agentType: 'pi',
+        lastAssistantMessage: 'Finished.'
+      },
+      timing: { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 }
+    },
+    {
+      paneKey: FIRST_PANE,
+      payload: { state: 'working', prompt: 'second turn', agentType: 'pi' },
+      timing: { updatedAt: BASE_TIME + 3, stateStartedAt: BASE_TIME + 3 }
+    },
+    {
+      paneKey: FIRST_PANE,
+      payload: { state: 'done', prompt: 'late first turn', agentType: 'pi' },
+      timing: { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 }
+    },
+    {
+      kind: 'providerSession',
+      paneKey: SECOND_PANE,
+      agent: 'pi',
+      providerSession: PROVIDER_SESSION,
+      timing: { updatedAt: BASE_TIME + 4 },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1' }
+    },
+    {
+      paneKey: SECOND_PANE,
+      payload: { state: 'working', prompt: 'provider turn', agentType: 'pi' },
+      timing: { updatedAt: BASE_TIME + 5, stateStartedAt: BASE_TIME + 5 },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1' },
+      metadata: { providerSession: PROVIDER_SESSION }
+    }
+  ]
+}
+
+function selectBatchState(state: AppState) {
+  return {
+    agentStatusByPaneKey: state.agentStatusByPaneKey,
+    retainedAgentsByPaneKey: state.retainedAgentsByPaneKey,
+    sleepingAgentSessionsByPaneKey: state.sleepingAgentSessionsByPaneKey,
+    agentLaunchConfigByPaneKey: state.agentLaunchConfigByPaneKey,
+    migrationUnsupportedByPtyId: state.migrationUnsupportedByPtyId,
+    retentionSuppressedPaneKeys: state.retentionSuppressedPaneKeys,
+    agentStatusEpoch: state.agentStatusEpoch,
+    sortEpoch: state.sortEpoch
+  }
+}
+
+describe('setAgentStatuses', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+    vi.useRealTimers()
+  })
+
+  it('matches sequential updates across repeated panes and provider-session records', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const sequentialStore = seedBatchStore()
+    const batchStore = seedBatchStore()
+    const sequentialTitleGeneration = vi.fn()
+    const batchTitleGeneration = vi.fn()
+    const batchTitleGenerationBulk = vi.fn((updates: readonly GeneratedTabTitleUpdate[]) => {
+      for (const update of updates) {
+        if (update.options) {
+          batchTitleGeneration(update.paneKey, update.prompt, update.options)
+        } else {
+          batchTitleGeneration(update.paneKey, update.prompt)
+        }
+      }
+    })
+    sequentialStore.setState({
+      setGeneratedTabTitleFromAgentPrompt: sequentialTitleGeneration
+    } as Partial<AppState>)
+    batchStore.setState({
+      setGeneratedTabTitlesFromAgentPrompts: batchTitleGenerationBulk
+    } as Partial<AppState>)
+    const updates = makeUpdates()
+
+    for (const update of updates) {
+      if (update.kind === 'providerSession') {
+        sequentialStore
+          .getState()
+          .recordAgentProviderSession(
+            update.paneKey,
+            update.agent,
+            update.providerSession,
+            update.timing,
+            update.routing,
+            update.metadata
+          )
+      } else {
+        sequentialStore
+          .getState()
+          .setAgentStatus(
+            update.paneKey,
+            update.payload,
+            update.terminalTitle,
+            update.timing,
+            update.routing,
+            update.metadata
+          )
+      }
+    }
+    const outcomes = batchStore.getState().setAgentStatuses(updates)
+
+    expect(outcomes).toEqual([true, true, true, true, false, true, true])
+    expect(selectBatchState(batchStore.getState())).toEqual(
+      selectBatchState(sequentialStore.getState())
+    )
+    expect(
+      batchStore.getState().agentStatusByPaneKey[FIRST_PANE].stateHistory.at(-1)
+    ).toMatchObject({ state: 'done' })
+    // The swallowed `done`'s output survives on the entry, not on the history row.
+    expect(
+      batchStore.getState().agentStatusByPaneKey[FIRST_PANE].lastCompletedAssistantMessage
+    ).toBe('Finished.')
+    expect(batchTitleGeneration.mock.calls).toEqual(sequentialTitleGeneration.mock.calls)
+    expect(batchTitleGeneration).toHaveBeenCalledTimes(5)
+    expect(batchTitleGenerationBulk).toHaveBeenCalledOnce()
+    await flushMicrotasks()
+    expect(batchStore.getState().refreshGitHubForWorktreeIfStale).toHaveBeenCalledTimes(1)
+    expect(sequentialStore.getState().refreshGitHubForWorktreeIfStale).toHaveBeenCalledTimes(1)
+
+    vi.advanceTimersByTime(AGENT_STATUS_STALE_AFTER_MS + 1)
+    expect(selectBatchState(batchStore.getState())).toEqual(
+      selectBatchState(sequentialStore.getState())
+    )
+  })
+
+  it('publishes once and reports skipped ordered updates', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const store = seedBatchStore()
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    const outcomes = store.getState().setAgentStatuses(makeUpdates())
+
+    expect(outcomes).toEqual([true, true, true, true, false, true, true])
+    expect(publications).toBe(1)
+    expect(store.getState().setAgentStatuses([])).toEqual([])
+    expect(publications).toBe(1)
+    unsubscribe()
+  })
+
+  it('coalesces 100 generated tab titles into one post-status publication', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const store = createTestStore()
+    const paneCount = 100
+    const tabsByWorktree = Object.fromEntries(
+      Array.from({ length: paneCount }, (_, index) => {
+        const worktreeId = `wt-${index}`
+        return [worktreeId, [makeTab({ id: `tab-${index}`, worktreeId })]]
+      })
+    )
+    store.setState({
+      settings: { ...store.getState().settings, tabAutoGenerateTitle: true },
+      tabsByWorktree
+    } as Partial<AppState>)
+    const updates: AgentStatusBatchUpdate[] = Array.from({ length: paneCount }, (_, index) => ({
+      paneKey: `tab-${index}:11111111-1111-4111-8111-111111111111`,
+      payload: {
+        state: 'working',
+        prompt: `Refactor remote startup module ${index}`,
+        agentType: 'pi'
+      },
+      timing: { updatedAt: BASE_TIME + index, stateStartedAt: BASE_TIME + index },
+      routing: { tabId: `tab-${index}`, worktreeId: `wt-${index}` }
+    }))
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    const outcomes = store.getState().setAgentStatuses(updates)
+
+    unsubscribe()
+    expect(outcomes).toEqual(Array(paneCount).fill(true))
+    expect(publications).toBe(2)
+    expect(store.getState().tabsByWorktree['wt-99']?.[0]?.generatedTitle).toBe(
+      'Refactor remote startup module 99'
+    )
+  })
+
+  it('coalesces batch freshness requests while preserving standalone scheduling', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const store = seedBatchStore()
+    const queueMicrotaskSpy = vi.spyOn(globalThis, 'queueMicrotask')
+    const workingUpdate = (updatedAt: number, prompt: string): AgentStatusBatchUpdate => ({
+      paneKey: FIRST_PANE,
+      payload: { state: 'working', prompt, agentType: 'pi' },
+      timing: { updatedAt, stateStartedAt: updatedAt },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1' }
+    })
+
+    const outcomes = store
+      .getState()
+      .setAgentStatuses([
+        workingUpdate(BASE_TIME, 'first'),
+        workingUpdate(BASE_TIME + 1, 'second'),
+        workingUpdate(BASE_TIME + 2, 'third'),
+        workingUpdate(BASE_TIME + 1, 'stale')
+      ])
+
+    expect(outcomes).toEqual([true, true, true, false])
+    expect(queueMicrotaskSpy).toHaveBeenCalledTimes(1)
+
+    queueMicrotaskSpy.mockClear()
+    store
+      .getState()
+      .setAgentStatus(
+        FIRST_PANE,
+        { state: 'working', prompt: 'standalone', agentType: 'pi' },
+        undefined,
+        { updatedAt: BASE_TIME + 3, stateStartedAt: BASE_TIME + 3 },
+        { tabId: 'tab-1', worktreeId: 'wt-1' }
+      )
+    store
+      .getState()
+      .setAgentStatus(
+        FIRST_PANE,
+        { state: 'working', prompt: 'standalone stale', agentType: 'pi' },
+        undefined,
+        { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 },
+        { tabId: 'tab-1', worktreeId: 'wt-1' }
+      )
+
+    expect(queueMicrotaskSpy).toHaveBeenCalledTimes(2)
+    await flushMicrotasks()
+  })
+
+  it('shares freshness across nested folds but isolates synchronous reentrant transactions', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const store = seedBatchStore()
+    const queueMicrotaskSpy = vi.spyOn(globalThis, 'queueMicrotask')
+    const update = (paneKey: string, updatedAt: number): AgentStatusBatchUpdate => ({
+      paneKey,
+      payload: { state: 'working', prompt: paneKey, agentType: 'pi' },
+      timing: { updatedAt, stateStartedAt: updatedAt },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1' }
+    })
+    let publications = 0
+    const unsubscribeNested = store.subscribe(() => {
+      publications += 1
+    })
+
+    const nestedOutcomes = store
+      .getState()
+      .transactAgentStatuses((transaction) => [
+        transaction.apply(update(FIRST_PANE, BASE_TIME)),
+        store
+          .getState()
+          .transactAgentStatuses((nestedTransaction) =>
+            nestedTransaction.apply(update(SECOND_PANE, BASE_TIME + 1))
+          )
+      ])
+
+    expect(nestedOutcomes).toEqual([true, true])
+    expect(publications).toBe(1)
+    expect(queueMicrotaskSpy).toHaveBeenCalledTimes(1)
+    unsubscribeNested()
+
+    queueMicrotaskSpy.mockClear()
+    let reentered = false
+    const unsubscribeReentrant = store.subscribe(() => {
+      publications += 1
+      if (!reentered) {
+        reentered = true
+        store.getState().setAgentStatuses([update(SECOND_PANE, BASE_TIME + 3)])
+      }
+    })
+
+    store.getState().setAgentStatuses([update(FIRST_PANE, BASE_TIME + 2)])
+
+    expect(publications).toBe(3)
+    expect(queueMicrotaskSpy).toHaveBeenCalledTimes(2)
+    expect(store.getState().agentStatusByPaneKey[FIRST_PANE]?.updatedAt).toBe(BASE_TIME + 2)
+    expect(store.getState().agentStatusByPaneKey[SECOND_PANE]?.updatedAt).toBe(BASE_TIME + 3)
+    unsubscribeReentrant()
+    await flushMicrotasks()
+  })
+
+  it('exposes cap evictions to later updates in the same transaction', () => {
+    const store = seedBatchStore()
+    const firstPane = 'orphan-tab:orphan-0'
+    const entries = Object.fromEntries(
+      Array.from({ length: MAX_LIVE_AGENT_STATUSES }, (_, index) => {
+        const paneKey = `orphan-tab:orphan-${index}`
+        return [
+          paneKey,
+          {
+            paneKey,
+            state: 'working',
+            prompt: 'old turn',
+            agentType: 'pi',
+            updatedAt: BASE_TIME,
+            stateStartedAt: BASE_TIME,
+            stateHistory: []
+          } satisfies AgentStatusEntry
+        ]
+      })
+    )
+    store.setState({ agentStatusByPaneKey: entries } as Partial<AppState>)
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    const outcomes = store.getState().transactAgentStatuses((transaction) => {
+      const added = transaction.apply({
+        paneKey: 'orphan-tab:new-pane',
+        payload: { state: 'working', prompt: 'new turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + 1, stateStartedAt: BASE_TIME + 1 }
+      })
+      expect(transaction.getState().agentStatusByPaneKey[firstPane]).toBeUndefined()
+      const completed = transaction.apply({
+        paneKey: firstPane,
+        payload: { state: 'done', prompt: 'different agent', agentType: 'claude' },
+        timing: { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 }
+      })
+      return [added, completed]
+    })
+
+    expect(outcomes).toEqual([true, true])
+    expect(store.getState().agentStatusByPaneKey[firstPane]).toMatchObject({
+      agentType: 'claude',
+      state: 'done'
+    })
+    expect(publications).toBe(1)
+    unsubscribe()
+  })
+
+  it('preserves a store write that bypassed the transaction instead of reverting it', () => {
+    const store = seedBatchStore()
+
+    const outcome = store.getState().transactAgentStatuses((transaction) => {
+      const applied = transaction.apply({
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: 'first turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME, stateStartedAt: BASE_TIME }
+      })
+      // Any slice action reached through get() writes straight to the real store — a
+      // REPLACE commit of the fold's snapshot would silently revert it.
+      store.setState({ worktreesByRepo: { 'repo-late': [] } } as Partial<AppState>)
+      return applied
+    })
+
+    expect(outcome).toBe(true)
+    expect(store.getState().worktreesByRepo).toEqual({ 'repo-late': [] })
+    expect(store.getState().agentStatusByPaneKey[FIRST_PANE]).toMatchObject({ state: 'working' })
+  })
+
+  it('keeps one completed-turn message per entry instead of one per history row', () => {
+    const store = seedBatchStore()
+    const turns: AgentStatusBatchUpdate[] = []
+    for (let turn = 0; turn < 5; turn += 1) {
+      turns.push({
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: `turn ${turn}`, agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + turn * 2, stateStartedAt: BASE_TIME + turn * 2 }
+      })
+      turns.push({
+        paneKey: FIRST_PANE,
+        payload: {
+          state: 'done',
+          prompt: `turn ${turn}`,
+          agentType: 'pi',
+          lastAssistantMessage: `output ${turn}`
+        },
+        timing: { updatedAt: BASE_TIME + turn * 2 + 1, stateStartedAt: BASE_TIME + turn * 2 + 1 }
+      })
+    }
+    store.getState().setAgentStatuses(turns)
+
+    const entry = store.getState().agentStatusByPaneKey[FIRST_PANE]
+    expect(entry.stateHistory.length).toBeGreaterThan(1)
+    expect(entry.stateHistory.some((row) => 'lastAssistantMessage' in row)).toBe(false)
+    // Only the newest done that rolled into history is retained, so memory is O(1) per pane.
+    expect(entry.lastCompletedAssistantMessage).toBe('output 3')
+    expect(entry.lastAssistantMessage).toBe('output 4')
+  })
+
+  it('clears the completed-turn message when a done carried no assistant output', () => {
+    const store = seedBatchStore()
+    store.getState().setAgentStatuses([
+      {
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: 'first turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME, stateStartedAt: BASE_TIME }
+      },
+      {
+        paneKey: FIRST_PANE,
+        payload: {
+          state: 'done',
+          prompt: 'first turn',
+          agentType: 'pi',
+          lastAssistantMessage: 'Finished.'
+        },
+        timing: { updatedAt: BASE_TIME + 1, stateStartedAt: BASE_TIME + 1 }
+      },
+      {
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: 'second turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 }
+      },
+      {
+        paneKey: FIRST_PANE,
+        payload: { state: 'done', prompt: 'second turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + 3, stateStartedAt: BASE_TIME + 3 }
+      },
+      {
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: 'third turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + 4, stateStartedAt: BASE_TIME + 4 }
+      }
+    ])
+
+    // The second turn finished silently; leaking turn one's output would misreport the run.
+    expect(
+      store.getState().agentStatusByPaneKey[FIRST_PANE].lastCompletedAssistantMessage
+    ).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts b/src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts
new file mode 100644
index 00000000000..93d49d79404
--- /dev/null
+++ b/src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts
@@ -0,0 +1,139 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_STATUS_STALE_AFTER_MS,
+  type AgentStatusEntry
+} from '../../../../shared/agent-status-types'
+import { createFreshnessScheduler } from './agent-status-freshness-scheduler'
+
+const NOW = new Date('2026-04-09T12:00:00.000Z').getTime()
+
+function doneEntry(overrides: Partial<AgentStatusEntry> = {}): AgentStatusEntry {
+  return {
+    paneKey: 'tab-1:11111111-1111-4111-8111-111111111111',
+    state: 'done',
+    prompt: '',
+    updatedAt: NOW,
+    stateStartedAt: NOW,
+    stateHistory: [],
+    agentType: 'claude',
+    ...overrides
+  }
+}
+
+function setup(entries: AgentStatusEntry[]) {
+  const bumpEpochs = vi.fn()
+  const scheduler = createFreshnessScheduler({ getEntries: () => entries, bumpEpochs })
+  return { bumpEpochs, scheduler }
+}
+
+describe('freshness scheduler completion deadlines', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('wakes at the completion deadline even while the hook row stays fresh', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    // Completion is 25m old; same-state `done` writes have kept updatedAt at now.
+    const completedAt = NOW - 25 * 60_000
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({ stateStartedAt: completedAt, updatedAt: NOW })
+    ])
+
+    scheduler.schedule()
+    vi.advanceTimersByTime(completedAt + AGENT_STATUS_STALE_AFTER_MS - NOW)
+    expect(bumpEpochs).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(1)
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+
+    scheduler.dispose()
+  })
+
+  it('keeps the strict-expiry wake armed when rescheduled exactly at the boundary', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({
+        stateStartedAt: NOW - AGENT_STATUS_STALE_AFTER_MS,
+        updatedAt: NOW
+      })
+    ])
+
+    scheduler.schedule()
+    vi.advanceTimersByTime(1)
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+
+    scheduler.dispose()
+  })
+
+  it('does not lose a completion deadline when an overdue timer is rescheduled after sleep', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const completedAt = NOW - 25 * 60_000
+    const entries = [doneEntry({ stateStartedAt: completedAt, updatedAt: NOW })]
+    const { bumpEpochs, scheduler } = setup(entries)
+
+    scheduler.schedule()
+    vi.setSystemTime(completedAt + AGENT_STATUS_STALE_AFTER_MS + 1)
+    entries[0] = doneEntry({ stateStartedAt: completedAt, updatedAt: Date.now() })
+    scheduler.schedule()
+
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+    scheduler.schedule()
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+    scheduler.dispose()
+  })
+
+  it('does not rearm an expired completion deadline in a zero-delay loop', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const completedAt = NOW - 25 * 60_000
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({ stateStartedAt: completedAt, updatedAt: NOW })
+    ])
+
+    scheduler.schedule()
+    // Past both the completion deadline and the hook-freshness deadline.
+    vi.advanceTimersByTime(AGENT_STATUS_STALE_AFTER_MS + 60_000)
+
+    // One bump for the completion boundary, one for hook freshness — never a spin.
+    expect(bumpEpochs).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(0)
+
+    scheduler.dispose()
+  })
+
+  it('ignores completions that cannot demand attention', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const completedAt = NOW - 25 * 60_000
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({ stateStartedAt: completedAt, updatedAt: NOW, interrupted: true })
+    ])
+
+    scheduler.schedule()
+    vi.advanceTimersByTime(completedAt + AGENT_STATUS_STALE_AFTER_MS - NOW + 1)
+    expect(bumpEpochs).not.toHaveBeenCalled()
+
+    // Only the hook-freshness deadline remains.
+    vi.advanceTimersByTime(AGENT_STATUS_STALE_AFTER_MS)
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+
+    scheduler.dispose()
+  })
+
+  it('still arms hook freshness for a working entry', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({ state: 'working', stateStartedAt: NOW, updatedAt: NOW })
+    ])
+
+    scheduler.schedule()
+    vi.advanceTimersByTime(AGENT_STATUS_STALE_AFTER_MS + 1)
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+
+    scheduler.dispose()
+  })
+})
diff --git a/src/renderer/src/store/slices/agent-status-freshness-scheduler.ts b/src/renderer/src/store/slices/agent-status-freshness-scheduler.ts
index 628529dd007..93c3e54fee1 100644
--- a/src/renderer/src/store/slices/agent-status-freshness-scheduler.ts
+++ b/src/renderer/src/store/slices/agent-status-freshness-scheduler.ts
@@ -1,3 +1,4 @@
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
 import { AGENT_STATUS_STALE_AFTER_MS } from '../../../../shared/agent-status-types'
 
@@ -21,6 +22,7 @@ export function createFreshnessScheduler(deps: FreshnessSchedulerDeps): Freshnes
   // `dispose()` in teardown — otherwise a real 30-minute setTimeout leaks
   // into the test process.
   let timer: ReturnType<typeof setTimeout> | null = null
+  let lastCheckedAt: number | null = null
 
   const clear = (): void => {
     if (timer !== null) {
@@ -33,10 +35,12 @@ export function createFreshnessScheduler(deps: FreshnessSchedulerDeps): Freshnes
     clear()
     const entries = deps.getEntries()
     if (entries.length === 0) {
+      lastCheckedAt = null
       return
     }
     const now = Date.now()
     let nextExpiryAt = Number.POSITIVE_INFINITY
+    let crossedCompletionDeadline = false
     // Why: skip entries already past the stale boundary — they each contribute
     // exactly one epoch bump at crossing, and rescheduling on them would spin
     // the timer forever because the bump doesn't clear them from the map
@@ -47,9 +51,29 @@ export function createFreshnessScheduler(deps: FreshnessSchedulerDeps): Freshnes
     // freshness-aware selectors can decay them immediately on that render.
     for (const entry of entries) {
       const expiryAt = entry.updatedAt + AGENT_STATUS_STALE_AFTER_MS
-      if (expiryAt > now) {
+      if (expiryAt >= now) {
         nextExpiryAt = Math.min(nextExpiryAt, expiryAt)
       }
+      // Completion and hook freshness have independent expiry times.
+      const completedAt = agentEntryCompletionAt(entry)
+      if (completedAt !== null) {
+        const completionExpiryAt = completedAt + AGENT_STATUS_STALE_AFTER_MS
+        // Detect a missed completion expiry before a same-state update extends hook freshness.
+        if (
+          lastCheckedAt !== null &&
+          completionExpiryAt >= lastCheckedAt &&
+          completionExpiryAt < now
+        ) {
+          crossedCompletionDeadline = true
+        }
+        if (completionExpiryAt >= now) {
+          nextExpiryAt = Math.min(nextExpiryAt, completionExpiryAt)
+        }
+      }
+    }
+    lastCheckedAt = now
+    if (crossedCompletionDeadline) {
+      deps.bumpEpochs()
     }
     if (!Number.isFinite(nextExpiryAt)) {
       return
@@ -62,6 +86,7 @@ export function createFreshnessScheduler(deps: FreshnessSchedulerDeps): Freshnes
     timer = setTimeout(() => {
       timer = null
       deps.bumpEpochs()
+      lastCheckedAt = Date.now()
       schedule()
     }, delayMs)
   }
diff --git a/src/renderer/src/store/slices/agent-status.test.ts b/src/renderer/src/store/slices/agent-status.test.ts
index 6965ca8bbb2..d937c3af53b 100644
--- a/src/renderer/src/store/slices/agent-status.test.ts
+++ b/src/renderer/src/store/slices/agent-status.test.ts
@@ -805,6 +805,29 @@ describe('agent status tool + assistant fields', () => {
     expect(store.getState().sortEpoch).toBe(firstSortEpoch)
   })
 
+  it('bumps sort epoch when a same-state done update changes completion eligibility', () => {
+    vi.useFakeTimers()
+    const store = createTestStore()
+    store
+      .getState()
+      .setAgentStatus(
+        'tab-1:1',
+        { state: 'done', prompt: 'p1', agentType: 'claude', interrupted: true },
+        'claude',
+        { updatedAt: 1_000, stateStartedAt: 1_000 }
+      )
+    const firstSortEpoch = store.getState().sortEpoch
+
+    store
+      .getState()
+      .setAgentStatus('tab-1:1', { state: 'done', prompt: 'p1', agentType: 'claude' }, 'claude', {
+        updatedAt: 2_000,
+        stateStartedAt: 1_000
+      })
+
+    expect(store.getState().sortEpoch).toBe(firstSortEpoch + 1)
+  })
+
   it('bumps global epochs when a stale same-state entry refreshes', () => {
     vi.useFakeTimers()
     const store = createTestStore()
diff --git a/src/renderer/src/store/slices/agent-status.ts b/src/renderer/src/store/slices/agent-status.ts
index 271ab70829a..0f1ebf66e08 100644
--- a/src/renderer/src/store/slices/agent-status.ts
+++ b/src/renderer/src/store/slices/agent-status.ts
@@ -26,6 +26,7 @@ import {
   shouldSuppressInheritedTerminalStatus
 } from '../../../../shared/agent-status-identity'
 import { isCommandCodeNewTurnWhileWorking } from '../../../../shared/command-code-turn-boundary'
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import type { TerminalPaneLayoutNode, TerminalTab } from '../../../../shared/types'
 import {
   getRepoExecutionHostId,
@@ -46,6 +47,7 @@ import {
   transferAgentPaneAuthorityAlias
 } from './agent-pane-authority'
 import { createFreshnessScheduler } from './agent-status-freshness-scheduler'
+import type { GeneratedTabTitleUpdate } from './terminal-tab-title-batch'
 
 /** Snapshot of a finished/vanished agent status entry, kept so the dashboard and sidebar hover
  *  keep showing the completion until the user clicks the worktree. `worktreeId` is stamped at
@@ -106,6 +108,65 @@ type AgentLaunchConfigRegistryEntry = {
   identity: AgentLaunchConfigRegistrationMetadata
 }
 
+export type AgentStatusPayload = ParsedAgentStatusPayload & {
+  orchestration?: AgentStatusOrchestrationContext
+  promptInteractionKey?: string
+  restoredUnconfirmed?: boolean
+}
+
+export type AgentStatusTiming = { updatedAt?: number; stateStartedAt?: number }
+
+export type AgentStatusRouting = {
+  tabId?: string
+  worktreeId?: string
+  terminalHandle?: string
+  connectionId?: string | null
+}
+
+export type AgentStatusMetadata = {
+  providerSession?: AgentProviderSessionMetadata
+  launchConfig?: SleepingAgentLaunchConfig
+  launchToken?: string
+}
+
+export type AgentStatusUpdate = {
+  kind?: 'status'
+  paneKey: string
+  payload: AgentStatusPayload
+  terminalTitle?: string
+  timing?: AgentStatusTiming
+  routing?: AgentStatusRouting
+  metadata?: AgentStatusMetadata
+}
+
+export type AgentProviderSessionTiming = { updatedAt?: number }
+
+export type AgentProviderSessionRouting = {
+  tabId?: string
+  worktreeId?: string
+  connectionId?: string | null
+}
+
+export type AgentProviderSessionRecordMetadata = { launchToken?: string }
+
+export type AgentProviderSessionUpdate = {
+  kind: 'providerSession'
+  paneKey: string
+  agent: ResumableTuiAgent
+  providerSession: AgentProviderSessionMetadata
+  timing?: AgentProviderSessionTiming
+  routing?: AgentProviderSessionRouting
+  metadata?: AgentProviderSessionRecordMetadata
+}
+
+export type AgentStatusBatchUpdate = AgentStatusUpdate | AgentProviderSessionUpdate
+
+export type AgentStatusBatchTransaction = {
+  getState: () => AppState
+  apply: (update: AgentStatusBatchUpdate) => boolean
+  afterCommit: (effect: () => void) => void
+}
+
 export type AgentStatusSlice = {
   /** Explicit agent status entries keyed by `${tabId}:${leafId}`; real-time only, not persisted. */
   agentStatusByPaneKey: Record<string, AgentStatusEntry>
@@ -152,34 +213,30 @@ export type AgentStatusSlice = {
   /** Update or insert an agent status entry from a status payload. */
   setAgentStatus: (
     paneKey: string,
-    payload: ParsedAgentStatusPayload & {
-      orchestration?: AgentStatusOrchestrationContext
-      promptInteractionKey?: string
-      restoredUnconfirmed?: boolean
-    },
+    payload: AgentStatusPayload,
     terminalTitle?: string,
-    timing?: { updatedAt?: number; stateStartedAt?: number },
-    routing?: {
-      tabId?: string
-      worktreeId?: string
-      terminalHandle?: string
-      connectionId?: string | null
-    },
-    metadata?: {
-      providerSession?: AgentProviderSessionMetadata
-      launchConfig?: SleepingAgentLaunchConfig
-      launchToken?: string
-    }
+    timing?: AgentStatusTiming,
+    routing?: AgentStatusRouting,
+    metadata?: AgentStatusMetadata
   ) => void
 
+  /** Apply ordered status updates as one status publication (generated titles and tab
+   *  titles still publish after it — three total, not 2N). */
+  setAgentStatuses: (updates: readonly AgentStatusBatchUpdate[]) => boolean[]
+
+  /** Fold caller-derived updates against exact staged state, committing one status publication. */
+  transactAgentStatuses: <Result>(
+    operation: (transaction: AgentStatusBatchTransaction) => Result
+  ) => Result
+
   /** Record resume identity without creating a visible turn-status row. */
   recordAgentProviderSession: (
     paneKey: string,
     agent: ResumableTuiAgent,
     providerSession: AgentProviderSessionMetadata,
-    timing?: { updatedAt?: number },
-    routing?: { tabId?: string; worktreeId?: string; connectionId?: string | null },
-    metadata?: { launchToken?: string }
+    timing?: AgentProviderSessionTiming,
+    routing?: AgentProviderSessionRouting,
+    metadata?: AgentProviderSessionRecordMetadata
   ) => void
 
   registerAgentLaunchConfig: (
@@ -1211,10 +1268,143 @@ function collectWorktreeIdsForConnection(state: AppState, connectionId: string):
   return onConnection
 }
 
+/** Slices that only the fold touched, so the batch commits as a MERGE.
+ *  Why: the fold runs against a snapshot taken at transaction start. Committing that
+ *  snapshot wholesale (zustand REPLACE) would silently revert any write that landed on
+ *  the real store meanwhile — and it can, because a batched action reaching another
+ *  slice's setter through `get()` bypasses the shadowed `set` entirely
+ *  (setRuntimeAgentOrchestrationByPaneKey → setGeneratedTabTitleFromAgentPrompt does this).
+ *  A merge keeps the single publication while confining conflicts to keys this fold wrote. */
+function buildAgentStatusBatchPatch(
+  initialState: AppState,
+  nextState: AppState
+): Partial<AppState> {
+  const patch: Record<string, unknown> = {}
+  for (const key of Object.keys(nextState) as (keyof AppState)[]) {
+    if (!Object.is(nextState[key], initialState[key])) {
+      patch[key as string] = nextState[key]
+    }
+  }
+  return patch as Partial<AppState>
+}
+
 export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusSlice> = (
-  set,
-  get
+  storeSet,
+  storeGet
 ) => {
+  type AgentStatusStateUpdate =
+    | AppState
+    | Partial<AppState>
+    | ((state: AppState) => AppState | Partial<AppState>)
+
+  let batchedAgentStatusState: AppState | null = null
+  let batchedAgentStatusEffects: (() => void)[] | null = null
+  let batchedGeneratedTabTitleUpdates: GeneratedTabTitleUpdate[] | null = null
+  let batchedAgentStatusFreshnessRequested = false
+  const get = (): AppState => batchedAgentStatusState ?? storeGet()
+  // Deliberately narrower than zustand's `set`: no `replace` parameter, so no call site in
+  // this slice can compile into a REPLACE the batch commit is unable to express.
+  const set = (update: AgentStatusStateUpdate): void => {
+    if (batchedAgentStatusState === null) {
+      storeSet(update, false)
+      return
+    }
+    const nextState = typeof update === 'function' ? update(batchedAgentStatusState) : update
+    if (Object.is(nextState, batchedAgentStatusState)) {
+      return
+    }
+    batchedAgentStatusState = Object.assign({}, batchedAgentStatusState, nextState)
+  }
+  const runAfterAgentStatusCommit = (effect: () => void): void => {
+    if (batchedAgentStatusEffects) {
+      batchedAgentStatusEffects.push(effect)
+      return
+    }
+    effect()
+  }
+  const applyGeneratedTabTitleUpdate = (update: GeneratedTabTitleUpdate): void => {
+    if (batchedGeneratedTabTitleUpdates) {
+      batchedGeneratedTabTitleUpdates.push(update)
+      return
+    }
+    if (update.options) {
+      get().setGeneratedTabTitleFromAgentPrompt(update.paneKey, update.prompt, update.options)
+    } else {
+      get().setGeneratedTabTitleFromAgentPrompt(update.paneKey, update.prompt)
+    }
+  }
+  const applyBatchedAgentStatusUpdate = (update: AgentStatusBatchUpdate): boolean => {
+    const stateBeforeUpdate = batchedAgentStatusState
+    if (!stateBeforeUpdate) {
+      return false
+    }
+    if (update.kind === 'providerSession') {
+      get().recordAgentProviderSession(
+        update.paneKey,
+        update.agent,
+        update.providerSession,
+        update.timing,
+        update.routing,
+        update.metadata
+      )
+    } else {
+      get().setAgentStatus(
+        update.paneKey,
+        update.payload,
+        update.terminalTitle,
+        update.timing,
+        update.routing,
+        update.metadata
+      )
+    }
+    return batchedAgentStatusState !== stateBeforeUpdate
+  }
+  const batchTransaction: AgentStatusBatchTransaction = {
+    getState: get,
+    apply: applyBatchedAgentStatusUpdate,
+    afterCommit: runAfterAgentStatusCommit
+  }
+  const transactAgentStatuses = <Result>(
+    operation: (transaction: AgentStatusBatchTransaction) => Result
+  ): Result => {
+    if (batchedAgentStatusState) {
+      return operation(batchTransaction)
+    }
+    const initialState = storeGet()
+    batchedAgentStatusState = initialState
+    batchedAgentStatusEffects = []
+    batchedGeneratedTabTitleUpdates = []
+    try {
+      const result = operation(batchTransaction)
+      const nextState = batchedAgentStatusState
+      const effects = batchedAgentStatusEffects
+      const generatedTabTitleUpdates = batchedGeneratedTabTitleUpdates
+      const freshnessRequested = batchedAgentStatusFreshnessRequested
+      batchedAgentStatusState = null
+      batchedAgentStatusEffects = null
+      batchedGeneratedTabTitleUpdates = null
+      batchedAgentStatusFreshnessRequested = false
+      if (nextState !== initialState) {
+        storeSet(buildAgentStatusBatchPatch(initialState, nextState), false)
+      }
+      if (generatedTabTitleUpdates.length > 0) {
+        storeGet().setGeneratedTabTitlesFromAgentPrompts(generatedTabTitleUpdates)
+      }
+      if (freshnessRequested) {
+        queueMicrotask(() => freshness.schedule())
+      }
+      for (const effect of effects) {
+        effect()
+      }
+      return result
+    } finally {
+      batchedAgentStatusState = null
+      batchedAgentStatusEffects = null
+      batchedGeneratedTabTitleUpdates = null
+      batchedAgentStatusFreshnessRequested = false
+    }
+  }
+
   // Why: scheduler is process-lifetime-scoped (no dispose) because the store is a
   // module-level singleton with no teardown lifecycle anywhere in the codebase.
   const freshness = createFreshnessScheduler({
@@ -1228,6 +1418,13 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
       }))
     }
   })
+  const requestAgentStatusFreshness = (acceptedInBatch: boolean): void => {
+    if (batchedAgentStatusState !== null) {
+      batchedAgentStatusFreshnessRequested ||= acceptedInBatch
+      return
+    }
+    queueMicrotask(() => freshness.schedule())
+  }
 
   const clearSleepingAgentSessionsByPaneKey = (paneKeys: readonly string[]): void => {
     if (paneKeys.length === 0) {
@@ -1706,7 +1903,7 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
         }
       })
       if (removedLiveStatus) {
-        queueMicrotask(() => freshness.schedule())
+        requestAgentStatusFreshness(true)
       }
     },
 
@@ -1745,6 +1942,10 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
         // must push that completion into history, or the finished timestamp and unread badge
         // lose the turn the moment the flag overwrites the live entry.
         let history: AgentStateHistoryEntry[] = existing?.stateHistory ?? []
+        // Why: a batched burst can fold a whole done→working turn into one publication, so a
+        // completion-reactive subscriber never sees `lastAssistantMessage` while state is `done`.
+        // One slot per entry, not one per history row — 20 transcripts per live status OOMs (#9872).
+        let lastCompletedAssistantMessage = existing?.lastCompletedAssistantMessage
         const boundaryLandsOnRealDone =
           existing?.state === 'done' &&
           existing.sessionBoundary !== true &&
@@ -1769,6 +1970,11 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
           if (history.length > AGENT_STATE_HISTORY_MAX) {
             history = history.slice(history.length - AGENT_STATE_HISTORY_MAX)
           }
+          if (existing.state === 'done') {
+            // The push above just moved this completion out of the live entry; a done that
+            // carried no message must clear the slot, or a stale prior turn leaks forward.
+            lastCompletedAssistantMessage = existing.lastAssistantMessage
+          }
         }
 
         const identity = resolveAgentStatusIdentity({
@@ -1933,6 +2139,7 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
           // card; parseAgentStatusPayload clears it on tool/state change.
           interactivePrompt: payload.interactivePrompt,
           lastAssistantMessage: payload.lastAssistantMessage,
+          ...(lastCompletedAssistantMessage ? { lastCompletedAssistantMessage } : {}),
           // Why: reused panes can start non-orchestrated work; only final done rows keep the
           // previous lineage fallback so completed children stay grouped.
           orchestration,
@@ -1982,13 +2189,18 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
           !!existing &&
           existing.state === payload.state &&
           entry.stateStartedAt !== existing.stateStartedAt
+        const sameStateDoneAttentionChanged =
+          existing?.state === 'done' &&
+          entry.state === 'done' &&
+          agentEntryCompletionAt(existing) !== agentEntryCompletionAt(entry)
         const sortRelevantChange =
           !existing ||
           existing.state !== payload.state ||
           !wasFresh ||
           attributionChanged ||
           commandCodeNewTurn ||
-          sameStateStateStartedAtChanged
+          sameStateStateStartedAtChanged ||
+          sameStateDoneAttentionChanged
         const doneRetentionFieldsChanged =
           existing?.state === 'done' &&
           entry.state === 'done' &&
@@ -2157,15 +2369,19 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
             ? getAgentRowGeneratedTitleText(entryForGeneratedTitle)
             : entryForGeneratedTitle.prompt
         if (shouldReplaceGeneratedTitle) {
-          get().setGeneratedTabTitleFromAgentPrompt(paneKey, generatedTitlePrompt, {
-            replaceExistingGeneratedTitle: true
+          applyGeneratedTabTitleUpdate({
+            paneKey,
+            prompt: generatedTitlePrompt,
+            options: {
+              replaceExistingGeneratedTitle: true
+            }
           })
         } else {
-          get().setGeneratedTabTitleFromAgentPrompt(paneKey, generatedTitlePrompt)
+          applyGeneratedTabTitleUpdate({ paneKey, prompt: generatedTitlePrompt })
         }
       }
-      // Why: schedule via queueMicrotask after set so the timer reads the updated map without re-entering the store during set.
-      queueMicrotask(() => freshness.schedule())
+      // Why: batches coalesce accepted updates; standalone calls keep their existing deferred scheduling.
+      requestAgentStatusFreshness(generatedTitleEntry.current !== null)
       if (completionRefreshWorktreeId) {
         const worktreeId = completionRefreshWorktreeId
         // Why: agents can create a PR via `gh pr create`, bypassing Orca's flow and leaving a stale "no PR" cache entry in place.
@@ -2173,6 +2389,13 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
       }
     },
 
+    setAgentStatuses: (updates) =>
+      updates.length === 0
+        ? []
+        : transactAgentStatuses((transaction) => updates.map(transaction.apply)),
+
+    transactAgentStatuses,
+
     setMigrationUnsupportedPty: (entry) => {
       set((s) => {
         const existing = s.migrationUnsupportedByPtyId[entry.ptyId]
diff --git a/src/renderer/src/store/slices/browser.test.ts b/src/renderer/src/store/slices/browser.test.ts
index c760b37a655..5239a5537ab 100644
--- a/src/renderer/src/store/slices/browser.test.ts
+++ b/src/renderer/src/store/slices/browser.test.ts
@@ -1,5 +1,5 @@
 /* eslint-disable max-lines -- Why: browser slice behavior shares one mocked store harness; splitting only the tests would duplicate more setup than it saves. */
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { create } from 'zustand'
 import { createBrowserSlice, isLocalBrowserPageOwner } from './browser'
 import type { AppState } from '../types'
@@ -10,6 +10,7 @@ import {
 import { GRAB_BUDGET, type BrowserPageAnnotation } from '../../../../shared/browser-grab-types'
 import { clearRuntimeCompatibilityCacheForTests } from '../../runtime/runtime-rpc-client'
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import { getExecutionHostLabel } from '../../../../shared/execution-host'
 
 const createWebRuntimeSessionBrowserTabMock = vi.hoisted(() => vi.fn())
 const runtimeEnvironmentCall = vi.fn()
@@ -66,6 +67,18 @@ function settingsWithRuntime(id: string): AppState['settings'] {
   return { activeRuntimeEnvironmentId: id } as AppState['settings']
 }
 
+function runtimeStatuses(capabilities: string[]): AppState['runtimeStatusByEnvironmentId'] {
+  return new Map([
+    [
+      'env-1',
+      {
+        status: { capabilities },
+        checkedAt: 1
+      }
+    ]
+  ]) as AppState['runtimeStatusByEnvironmentId']
+}
+
 function seedUnifiedBrowserTab(
   store: ReturnType<typeof createTestStore>,
   entityId: string,
@@ -164,6 +177,21 @@ describe('createBrowserSlice annotations', () => {
     expect(store.getState().recordFeatureInteraction).toHaveBeenCalledWith('browser-tab-created')
   })
 
+  it('opens a local sign-in tab with the imported browser profile', async () => {
+    const store = createTestStore()
+
+    await expect(
+      store
+        .getState()
+        .openBrowserProfileTabInActiveWorkspace('https://accounts.google.com/', 'profile-1')
+    ).resolves.toBe(true)
+
+    expect(store.getState().browserTabsByWorktree['wt-1']?.[0]).toMatchObject({
+      url: 'https://accounts.google.com/',
+      sessionProfileId: 'profile-1'
+    })
+  })
+
   it('clears page annotations when the browser page URL changes', () => {
     const store = createTestStore()
     const tab = store.getState().createBrowserTab('wt-1', 'https://example.com')
@@ -533,6 +561,35 @@ describe('createBrowserSlice runtime guard', () => {
     runtimeEnvironmentCall.mockResolvedValue({ id: 'rpc-1', ok: true, result: {} })
   })
 
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('rejects direct client-local materialization in the web client', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const store = createTestStore()
+
+    expect(() => store.getState().createBrowserTab('wt-1', 'about:blank')).toThrow(
+      'must be created by a capable paired runtime'
+    )
+    expect(store.getState().browserTabsByWorktree['wt-1']).toBeUndefined()
+    expect(store.getState().createUnifiedTab).not.toHaveBeenCalled()
+  })
+
+  it('rejects direct remote materialization without the provider capability', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const store = createTestStore()
+    store.setState({ runtimeStatusByEnvironmentId: runtimeStatuses([]) })
+
+    expect(() =>
+      store.getState().createBrowserTab('wt-1', 'about:blank', {
+        browserRuntimeEnvironmentId: 'env-1'
+      })
+    ).toThrow('paired runtime does not support browser streaming')
+    expect(store.getState().browserTabsByWorktree['wt-1']).toBeUndefined()
+    expect(store.getState().createUnifiedTab).not.toHaveBeenCalled()
+  })
+
   it('fetches browser profiles from the active runtime environment', async () => {
     const store = createTestStore()
     runtimeEnvironmentCall.mockResolvedValueOnce({
@@ -786,7 +843,10 @@ describe('createBrowserSlice runtime guard', () => {
       })
     })
     const store = createTestStore()
-    store.setState({ browserSessionHostIdOverride: 'runtime:windows-2' })
+    store.setState({
+      browserSessionHostIdOverride: 'runtime:windows-2',
+      runtimeEnvironments: [{ id: 'windows-2', name: 'Windows Server' }] as never
+    })
 
     const importing = store
       .getState()
@@ -805,7 +865,12 @@ describe('createBrowserSlice runtime guard', () => {
       _meta: { runtimeId: 'runtime-windows' }
     })
 
-    await expect(importing).resolves.toMatchObject({ ok: true, profileId: 'windows-profile' })
+    await expect(importing).resolves.toMatchObject({
+      ok: true,
+      profileId: 'windows-profile',
+      executionHostId: 'runtime:windows-2',
+      executionHostLabel: 'Windows Server'
+    })
     expect(store.getState().browserSessionHostIdOverride).toBe('runtime:linux-3')
     expect(store.getState().browserSessionImportState).toBeNull()
     expect(runtimeEnvironmentCall.mock.calls).toHaveLength(callsBeforeCompletion)
@@ -941,6 +1006,7 @@ describe('createBrowserSlice runtime guard', () => {
     store.setState({
       activeWorktreeId: 'wt-remote',
       settings: { activeRuntimeEnvironmentId: null } as AppState['settings'],
+      runtimeStatusByEnvironmentId: runtimeStatuses(['browser.screencast.v1']),
       browserDefaultUrl: 'about:blank',
       repos: [
         {
@@ -991,15 +1057,12 @@ describe('createBrowserSlice runtime guard', () => {
     expect(store.getState().recordFeatureInteraction).toHaveBeenCalledWith('browser-tab-created')
   })
 
-  it('does not create a local fallback tab when remote browser creation fails', async () => {
+  it('uses the desktop client browser when a remote npm host cannot stream', async () => {
     const store = createTestStore()
-    // Why: a remote-owned workspace must stay remote-owned. If the remote host
-    // cannot create the page, we must NOT silently open a local desktop tab —
-    // that produces confusing split ownership (issue #5321 UX requirement).
-    createWebRuntimeSessionBrowserTabMock.mockResolvedValueOnce(false)
     store.setState({
       activeWorktreeId: 'wt-remote',
-      settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      settings: settingsWithRuntime('env-1'),
+      runtimeStatusByEnvironmentId: runtimeStatuses([]),
       worktreesByRepo: {
         'repo-1': [
           {
@@ -1014,6 +1077,39 @@ describe('createBrowserSlice runtime guard', () => {
 
     await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
 
+    expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
+    const tab = store.getState().browserTabsByWorktree['wt-remote']?.[0]
+    const page = tab ? store.getState().browserPagesByWorkspace[tab.id]?.[0] : undefined
+    expect(page?.browserRuntimeEnvironmentId).toBeNull()
+    expect(store.getState().createUnifiedTab).toHaveBeenCalled()
+  })
+
+  it('does not create a local fallback tab when remote browser creation fails', async () => {
+    const store = createTestStore()
+    // Why: a remote-owned workspace must stay remote-owned. If the remote host
+    // cannot create the page, we must NOT silently open a local desktop tab —
+    // that produces confusing split ownership (issue #5321 UX requirement).
+    createWebRuntimeSessionBrowserTabMock.mockResolvedValueOnce(false)
+    store.setState({
+      activeWorktreeId: 'wt-remote',
+      settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      runtimeStatusByEnvironmentId: runtimeStatuses(['browser.screencast.v1']),
+      worktreesByRepo: {
+        'repo-1': [
+          {
+            id: 'wt-remote',
+            repoId: 'repo-1',
+            hostId: 'local',
+            runtimeOwnerEnvironmentId: 'env-1'
+          } as never
+        ]
+      }
+    })
+
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      'The paired runtime could not create a managed browser tab.'
+    )
+
     expect(createWebRuntimeSessionBrowserTabMock).toHaveBeenCalledWith({
       worktreeId: 'wt-remote',
       environmentId: 'env-1',
@@ -1028,12 +1124,12 @@ describe('createBrowserSlice runtime guard', () => {
     )
   })
 
-  it('does not create a local fallback tab when remote browser creation throws', async () => {
+  it('opens a remote sign-in tab with the imported browser profile', async () => {
     const store = createTestStore()
-    createWebRuntimeSessionBrowserTabMock.mockRejectedValueOnce(new Error('remote down'))
     store.setState({
       activeWorktreeId: 'wt-remote',
       settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      runtimeStatusByEnvironmentId: runtimeStatuses(['browser.screencast.v1']),
       worktreesByRepo: {
         'repo-1': [
           {
@@ -1046,7 +1142,103 @@ describe('createBrowserSlice runtime guard', () => {
       }
     })
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(
+      store
+        .getState()
+        .openBrowserProfileTabInActiveWorkspace('https://accounts.google.com/', 'profile-1')
+    ).resolves.toBe(true)
+
+    expect(createWebRuntimeSessionBrowserTabMock).toHaveBeenCalledWith({
+      worktreeId: 'wt-remote',
+      environmentId: 'env-1',
+      url: 'https://accounts.google.com/',
+      profileId: 'profile-1'
+    })
+    expect(store.getState().browserTabsByWorktree['wt-remote']).toBeUndefined()
+  })
+
+  it('opens a local desktop sign-in tab when the remote host cannot stream browsers', async () => {
+    const store = createTestStore()
+    store.setState({
+      activeWorktreeId: 'wt-remote',
+      settings: settingsWithRuntime('env-1'),
+      runtimeStatusByEnvironmentId: runtimeStatuses([]),
+      worktreesByRepo: {
+        'repo-1': [
+          {
+            id: 'wt-remote',
+            repoId: 'repo-1',
+            hostId: 'local',
+            runtimeOwnerEnvironmentId: 'env-1'
+          } as never
+        ]
+      }
+    })
+
+    await expect(
+      store
+        .getState()
+        .openBrowserProfileTabInActiveWorkspace('https://accounts.google.com/', 'profile-1')
+    ).resolves.toBe(true)
+
+    expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
+    expect(store.getState().browserTabsByWorktree['wt-remote']?.[0]).toMatchObject({
+      url: 'https://accounts.google.com/',
+      sessionProfileId: 'profile-1'
+    })
+  })
+
+  it('rejects a paired-web sign-in tab when the remote host cannot stream browsers', async () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const store = createTestStore()
+    store.setState({
+      activeWorktreeId: 'wt-remote',
+      settings: settingsWithRuntime('env-1'),
+      runtimeStatusByEnvironmentId: runtimeStatuses([]),
+      worktreesByRepo: {
+        'repo-1': [
+          {
+            id: 'wt-remote',
+            repoId: 'repo-1',
+            hostId: 'local',
+            runtimeOwnerEnvironmentId: 'env-1'
+          } as never
+        ]
+      }
+    })
+
+    await expect(
+      store
+        .getState()
+        .openBrowserProfileTabInActiveWorkspace('https://accounts.google.com/', 'profile-1')
+    ).resolves.toBe(false)
+
+    expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
+    expect(store.getState().browserTabsByWorktree['wt-remote']).toBeUndefined()
+  })
+
+  it('does not create a local fallback tab when remote browser creation throws', async () => {
+    const store = createTestStore()
+    createWebRuntimeSessionBrowserTabMock.mockRejectedValueOnce(new Error('remote down'))
+    store.setState({
+      activeWorktreeId: 'wt-remote',
+      settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      runtimeStatusByEnvironmentId: runtimeStatuses(['browser.screencast.v1']),
+      worktreesByRepo: {
+        'repo-1': [
+          {
+            id: 'wt-remote',
+            repoId: 'repo-1',
+            hostId: 'local',
+            runtimeOwnerEnvironmentId: 'env-1'
+          } as never
+        ]
+      }
+    })
+
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      'remote down'
+    )
 
     expect(store.getState().browserTabsByWorktree['wt-remote']).toBeUndefined()
     expect(store.getState().createUnifiedTab).not.toHaveBeenCalled()
@@ -1059,13 +1251,51 @@ describe('createBrowserSlice runtime guard', () => {
     const result = await store.getState().importCookiesToProfile('default')
 
     expect(mockApi.browser.sessionImportCookies).not.toHaveBeenCalled()
-    expect(result.ok).toBe(false)
+    expect(result).toMatchObject({
+      ok: false,
+      executionHostId: 'runtime:env-1',
+      executionHostLabel: 'env-1'
+    })
     expect(store.getState().browserSessionImportState).toMatchObject({
       profileId: 'default',
       status: 'error'
     })
   })
 
+  it('retains the host display label used by browser settings', async () => {
+    const store = createTestStore()
+    store.setState({
+      settings: {
+        ...settingsWithRuntime('env-1')!,
+        hostSettingOverrides: {
+          'runtime:env-1': { displayLabel: 'Production Browser Host' }
+        }
+      },
+      runtimeEnvironments: [{ id: 'env-1', name: 'Remote Mac' }] as never
+    })
+
+    const result = await store.getState().importCookiesToProfile('default')
+
+    expect(result.executionHostLabel).toBe('Production Browser Host')
+  })
+
+  it('retains the local execution host for a successful browser import', async () => {
+    mockApi.browser.sessionImportFromBrowser.mockResolvedValueOnce({
+      ok: true,
+      profileId: 'default',
+      summary: { totalCookies: 2, importedCookies: 2, skippedCookies: 0, domains: [] }
+    })
+    const store = createTestStore()
+
+    const result = await store.getState().importCookiesFromBrowser('default', 'chrome', 'Default')
+
+    expect(result).toMatchObject({
+      ok: true,
+      executionHostId: 'local',
+      executionHostLabel: getExecutionHostLabel('local')
+    })
+  })
+
   it('uses local browser IPC when no runtime environment is active', async () => {
     const store = createTestStore()
     mockApi.browser.sessionListProfiles.mockResolvedValueOnce([
diff --git a/src/renderer/src/store/slices/browser.ts b/src/renderer/src/store/slices/browser.ts
index 78a7a31b358..6f3c739308a 100644
--- a/src/renderer/src/store/slices/browser.ts
+++ b/src/renderer/src/store/slices/browser.ts
@@ -44,12 +44,14 @@ import type {
 import { createBrowserUuid } from '@/lib/browser-uuid'
 import { translate } from '@/i18n/i18n'
 import {
+  getExecutionHostLabel,
   getSettingsFocusedExecutionHostId,
   LOCAL_EXECUTION_HOST_ID,
   parseExecutionHostId,
   toRuntimeExecutionHostId,
   type ExecutionHostId
 } from '../../../../shared/execution-host'
+import { getHostSettingOverride } from '../../../../shared/host-setting-overrides'
 import {
   getExecutionHostIdForWorktree,
   getRuntimeEnvironmentIdForWorktree
@@ -59,6 +61,10 @@ import {
   type WorkspaceSessionHydrationOptions
 } from '@/lib/workspace-session-hydration-keys'
 import { buildValidWorktreeIdsForSessionHydration } from './degraded-repo-worktree-validity'
+import {
+  assertManagedBrowserMaterializationAllowed,
+  getClientCreationActionPolicy
+} from '@/lib/client-creation-action-policy'
 
 type CreateBrowserTabOptions = {
   activate?: boolean
@@ -117,6 +123,19 @@ export type RemoteBrowserPageHandle = {
   remotePageId: string
 }
 
+export type BrowserCookieImportExecutionResult = BrowserCookieImportResult & {
+  executionHostId: ExecutionHostId
+  executionHostLabel: string
+}
+
+function retainCookieImportExecutionHost(
+  result: BrowserCookieImportResult,
+  executionHostId: ExecutionHostId,
+  executionHostLabel: string
+): BrowserCookieImportExecutionResult {
+  return { ...result, executionHostId, executionHostLabel }
+}
+
 export type BrowserSlice = {
   browserTabsByWorktree: Record<string, BrowserWorkspace[]>
   browserPagesByWorkspace: Record<string, BrowserPage[]>
@@ -135,6 +154,7 @@ export type BrowserSlice = {
     options?: CreateBrowserTabOptions
   ) => BrowserWorkspace
   openNewBrowserTabInActiveWorkspace: (groupId: string) => Promise<void>
+  openBrowserProfileTabInActiveWorkspace: (url: string, profileId: string) => Promise<boolean>
   closeBrowserTab: (tabId: string) => void
   shutdownWorktreeBrowsers: (worktreeId: string) => Promise<void>
   reopenClosedBrowserTab: (worktreeId: string) => BrowserWorkspace | null
@@ -200,7 +220,7 @@ export type BrowserSlice = {
     options?: BrowserSessionProfileCreateOptions
   ) => Promise<BrowserSessionProfile | null>
   deleteBrowserSessionProfile: (profileId: string) => Promise<boolean>
-  importCookiesToProfile: (profileId: string) => Promise<BrowserCookieImportResult>
+  importCookiesToProfile: (profileId: string) => Promise<BrowserCookieImportExecutionResult>
   clearBrowserSessionImportState: () => void
   detectedBrowsers: {
     family: string
@@ -214,7 +234,7 @@ export type BrowserSlice = {
     profileId: string,
     browserFamily: string,
     browserProfile?: string
-  ) => Promise<BrowserCookieImportResult>
+  ) => Promise<BrowserCookieImportExecutionResult>
   clearDefaultSessionCookies: () => Promise<boolean>
   browserUrlHistory: BrowserHistoryEntry[]
   addBrowserHistoryEntry: (url: string, title: string) => void
@@ -253,6 +273,23 @@ function getBrowserSettingsHostId(
   return state.browserSessionHostIdOverride ?? getSettingsFocusedExecutionHostId(state.settings)
 }
 
+function getBrowserSettingsHostLabel(state: AppState, hostId: ExecutionHostId): string {
+  const override = getHostSettingOverride(state.settings, hostId, 'displayLabel')
+  if (override) {
+    return override
+  }
+  const parsed = parseExecutionHostId(hostId)
+  if (parsed?.kind === 'runtime') {
+    const name = state.runtimeEnvironments
+      ?.find((environment) => environment.id === parsed.environmentId)
+      ?.name.trim()
+    if (name) {
+      return name
+    }
+  }
+  return getExecutionHostLabel(hostId)
+}
+
 function getBrowserSettingsRuntimeEnvironmentId(
   state: Pick<AppState, 'browserSessionHostIdOverride' | 'settings'>
 ): string | null {
@@ -560,6 +597,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
   },
 
   createBrowserTab: (worktreeId, url, options) => {
+    assertManagedBrowserMaterializationAllowed(get(), options?.browserRuntimeEnvironmentId)
     const workspaceId = createBrowserUuid()
     const page = buildBrowserPage(
       workspaceId,
@@ -675,9 +713,16 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
     if (!worktreeId) {
       return
     }
+    const browserAvailability = getClientCreationActionPolicy(state, worktreeId)['managed-browser']
+    if (browserAvailability.state !== 'enabled') {
+      throw new Error(browserAvailability.reason)
+    }
     const defaultUrl = state.browserDefaultUrl ?? 'about:blank'
     const runtimeEnvironmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
-    if (runtimeEnvironmentId) {
+    if (browserAvailability.provider === 'paired-runtime') {
+      if (!runtimeEnvironmentId) {
+        throw new Error('The paired runtime browser provider is unavailable.')
+      }
       const { createWebRuntimeSessionBrowserTab } = await import('@/runtime/web-runtime-session')
       try {
         const created = await createWebRuntimeSessionBrowserTab({
@@ -696,16 +741,57 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           '[browser] remote browser tab creation failed:',
           error instanceof Error ? error.message : String(error)
         )
+        throw error
       }
-      return
+      throw new Error('The paired runtime could not create a managed browser tab.')
     }
     get().createBrowserTab(worktreeId, defaultUrl, {
       title: translate('auto.store.slices.browser.d175274b6d', 'New Browser Tab'),
       focusAddressBar: true,
+      ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {}),
       targetGroupId: groupId
     })
     get().recordFeatureInteraction('browser-tab-created')
   },
+
+  openBrowserProfileTabInActiveWorkspace: async (url, profileId) => {
+    const state = get()
+    const worktreeId = state.activeWorktreeId
+    if (!worktreeId) {
+      return false
+    }
+    const browserAvailability = getClientCreationActionPolicy(state, worktreeId)['managed-browser']
+    if (browserAvailability.state !== 'enabled') {
+      return false
+    }
+    const runtimeEnvironmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+    if (browserAvailability.provider === 'paired-runtime') {
+      if (!runtimeEnvironmentId) {
+        return false
+      }
+      const { createWebRuntimeSessionBrowserTab } = await import('@/runtime/web-runtime-session')
+      try {
+        return await createWebRuntimeSessionBrowserTab({
+          worktreeId,
+          environmentId: runtimeEnvironmentId,
+          url,
+          profileId
+        })
+      } catch (error) {
+        console.warn(
+          '[browser] remote profile tab creation failed:',
+          error instanceof Error ? error.message : String(error)
+        )
+        return false
+      }
+    }
+    get().createBrowserTab(worktreeId, url, {
+      activate: true,
+      sessionProfileId: profileId,
+      ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {})
+    })
+    return true
+  },
   closeBrowserTab: (tabId) => {
     let remotePagesToClose: { worktreeId: string; handle: RemoteBrowserPageHandle }[] = []
     set((s) => {
@@ -938,7 +1024,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
     if (activePageId) {
       const restoredPages = get().browserPagesByWorkspace[restored.id] ?? []
       const activePageIndex = pages.findIndex((orig) => orig.id === activePageId)
-      const targetPage = activePageIndex >= 0 ? restoredPages[activePageIndex] : null
+      const targetPage = activePageIndex !== -1 ? restoredPages[activePageIndex] : null
       if (targetPage && targetPage.id !== restoredPages[0]?.id) {
         get().setActiveBrowserPage(restored.id, targetPage.id)
       }
@@ -1955,8 +2041,10 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
   },
 
   importCookiesToProfile: async (profileId) => {
-    const hostId = getBrowserSettingsHostId(get())
-    if (getBrowserSettingsRuntimeEnvironmentId(get())) {
+    const initialState = get()
+    const hostId = getBrowserSettingsHostId(initialState)
+    const executionHostLabel = getBrowserSettingsHostLabel(initialState, hostId)
+    if (getBrowserSettingsRuntimeEnvironmentId(initialState)) {
       const reason = translate(
         'auto.store.slices.browser.remoteCookieImportUnavailable',
         'Manual cookie file import is unavailable while a remote runtime is active.'
@@ -1969,7 +2057,11 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           error: reason
         })
       )
-      return { ok: false as const, reason }
+      return retainCookieImportExecutionHost(
+        { ok: false as const, reason },
+        hostId,
+        executionHostLabel
+      )
     }
     set((state) =>
       browserImportStateForHostUpdate(state, hostId, {
@@ -2008,7 +2100,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           })
         )
       }
-      return result
+      return retainCookieImportExecutionHost(result, hostId, executionHostLabel)
     } catch (err) {
       const reason = String((err as Error)?.message ?? err)
       set((state) =>
@@ -2019,7 +2111,11 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           error: reason
         })
       )
-      return { ok: false as const, reason }
+      return retainCookieImportExecutionHost(
+        { ok: false as const, reason },
+        hostId,
+        executionHostLabel
+      )
     }
   },
 
@@ -2077,8 +2173,10 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
   },
 
   importCookiesFromBrowser: async (profileId, browserFamily, browserProfile?) => {
-    const hostId = getBrowserSettingsHostId(get())
-    const runtimeEnvironmentId = getBrowserSettingsRuntimeEnvironmentId(get())
+    const initialState = get()
+    const hostId = getBrowserSettingsHostId(initialState)
+    const executionHostLabel = getBrowserSettingsHostLabel(initialState, hostId)
+    const runtimeEnvironmentId = getBrowserSettingsRuntimeEnvironmentId(initialState)
     if (runtimeEnvironmentId) {
       set((state) =>
         browserImportStateForHostUpdate(state, hostId, {
@@ -2119,7 +2217,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
             })
           )
         }
-        return result
+        return retainCookieImportExecutionHost(result, hostId, executionHostLabel)
       } catch (err) {
         const reason = String((err as Error)?.message ?? err)
         set((state) =>
@@ -2130,7 +2228,11 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
             error: reason
           })
         )
-        return { ok: false as const, reason }
+        return retainCookieImportExecutionHost(
+          { ok: false as const, reason },
+          hostId,
+          executionHostLabel
+        )
       }
     }
     set((state) =>
@@ -2172,7 +2274,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           })
         )
       }
-      return result
+      return retainCookieImportExecutionHost(result, hostId, executionHostLabel)
     } catch (err) {
       const reason = String((err as Error)?.message ?? err)
       set((state) =>
@@ -2183,7 +2285,11 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           error: reason
         })
       )
-      return { ok: false as const, reason }
+      return retainCookieImportExecutionHost(
+        { ok: false as const, reason },
+        hostId,
+        executionHostLabel
+      )
     }
   },
 
diff --git a/src/renderer/src/store/slices/cmd-j-create-actions.test.ts b/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
index abf1904cc19..c8bf6abc690 100644
--- a/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
+++ b/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
@@ -3,6 +3,10 @@ import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import { folderWorkspaceKey } from '../../../../shared/workspace-scope'
 import type { AppState } from '../types'
 import { createTestStore, makeWorktree, seedStore, TEST_REPO } from './store-test-helpers'
+import {
+  FLOATING_BROWSER_UNAVAILABLE_MESSAGE,
+  MANAGED_BROWSER_UNAVAILABLE_MESSAGE
+} from '@/lib/client-creation-action-policy'
 
 const createWebRuntimeSessionBrowserTabMock = vi.hoisted(() => vi.fn())
 const createWebRuntimeSessionTerminalMock = vi.hoisted(() => vi.fn())
@@ -23,10 +27,19 @@ vi.mock('@/lib/web-client-location', () => ({
 
 const pairedWebFlag = globalThis as { __ORCA_WEB_CLIENT__?: boolean }
 
+function browserCapableRuntimeStatus(
+  environmentId: string
+): AppState['runtimeStatusByEnvironmentId'] {
+  return new Map([
+    [environmentId, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+  ]) as AppState['runtimeStatusByEnvironmentId']
+}
+
 function seedActiveWorkspace(store: ReturnType<typeof createTestStore>): void {
   seedStore(store, {
     activeWorktreeId: 'wt-1',
     settings: { activeRuntimeEnvironmentId: 'runtime-1' } as AppState['settings'],
+    runtimeStatusByEnvironmentId: browserCapableRuntimeStatus('runtime-1'),
     worktreesByRepo: {
       [TEST_REPO.id]: [
         makeWorktree({
@@ -55,7 +68,7 @@ describe('Cmd+J lifted creation actions', () => {
     delete pairedWebFlag.__ORCA_WEB_CLIENT__
   })
 
-  it('does not fall back to a local browser tab when paired-web creation fails', async () => {
+  it('rejects without a local browser fallback when paired-web creation fails', async () => {
     // Why: a remote-owned workspace must stay remote-owned. If the remote host
     // cannot create the page, we must NOT silently open a local desktop tab —
     // that produces confusing split ownership (issue #5321). Mirrors the
@@ -64,7 +77,9 @@ describe('Cmd+J lifted creation actions', () => {
     const store = createTestStore()
     seedActiveWorkspace(store)
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      'The paired runtime could not create a managed browser tab.'
+    )
 
     expect(createWebRuntimeSessionBrowserTabMock).toHaveBeenCalledWith({
       worktreeId: 'wt-1',
@@ -75,7 +90,7 @@ describe('Cmd+J lifted creation actions', () => {
     expect(store.getState().browserTabsByWorktree['wt-1'] ?? []).toEqual([])
   })
 
-  it('routes browser tab creation to the explicit owner runtime when another runtime is focused', async () => {
+  it('routes browser creation to the owner runtime without a local fallback', async () => {
     createWebRuntimeSessionBrowserTabMock.mockResolvedValue(false)
     const store = createTestStore()
     seedActiveWorkspace(store)
@@ -91,10 +106,13 @@ describe('Cmd+J lifted creation actions', () => {
           })
         ]
       },
-      settings: { activeRuntimeEnvironmentId: 'focused-runtime' } as AppState['settings']
+      settings: { activeRuntimeEnvironmentId: 'focused-runtime' } as AppState['settings'],
+      runtimeStatusByEnvironmentId: browserCapableRuntimeStatus('owner-runtime')
     })
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      'The paired runtime could not create a managed browser tab.'
+    )
 
     expect(createWebRuntimeSessionBrowserTabMock).toHaveBeenCalledWith({
       worktreeId: 'wt-1',
@@ -106,7 +124,7 @@ describe('Cmd+J lifted creation actions', () => {
     expect(store.getState().browserTabsByWorktree['wt-1'] ?? []).toEqual([])
   })
 
-  it('creates a local browser tab for explicitly local workspaces while a runtime is focused', async () => {
+  it('rejects local browser tabs for explicitly local paired-web workspaces', async () => {
     createWebRuntimeSessionBrowserTabMock.mockResolvedValue(false)
     const store = createTestStore()
     seedActiveWorkspace(store)
@@ -118,13 +136,15 @@ describe('Cmd+J lifted creation actions', () => {
       settings: { activeRuntimeEnvironmentId: 'focused-runtime' } as AppState['settings']
     })
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      MANAGED_BROWSER_UNAVAILABLE_MESSAGE
+    )
 
     expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
-    expect(store.getState().browserTabsByWorktree['wt-1'] ?? []).toHaveLength(1)
+    expect(store.getState().browserTabsByWorktree['wt-1'] ?? []).toEqual([])
   })
 
-  it('creates local browser and terminal tabs for the synthetic floating workspace while a runtime is focused', async () => {
+  it('rejects floating browsers while preserving floating terminal creation', async () => {
     createWebRuntimeSessionBrowserTabMock.mockResolvedValue(false)
     createWebRuntimeSessionTerminalMock.mockResolvedValue(false)
     const store = createTestStore()
@@ -144,14 +164,14 @@ describe('Cmd+J lifted creation actions', () => {
       activeGroupIdByWorktree: { [FLOATING_TERMINAL_WORKTREE_ID]: 'group-1' }
     })
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      FLOATING_BROWSER_UNAVAILABLE_MESSAGE
+    )
     await store.getState().openNewTerminalTabInActiveWorkspace('group-1')
 
     expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
     expect(createWebRuntimeSessionTerminalMock).not.toHaveBeenCalled()
-    expect(
-      store.getState().browserTabsByWorktree[FLOATING_TERMINAL_WORKTREE_ID] ?? []
-    ).toHaveLength(1)
+    expect(store.getState().browserTabsByWorktree[FLOATING_TERMINAL_WORKTREE_ID] ?? []).toEqual([])
     expect(store.getState().tabsByWorktree[FLOATING_TERMINAL_WORKTREE_ID] ?? []).toHaveLength(1)
   })
 
diff --git a/src/renderer/src/store/slices/detected-agents.test.ts b/src/renderer/src/store/slices/detected-agents.test.ts
index c4776039e13..f85b5977960 100644
--- a/src/renderer/src/store/slices/detected-agents.test.ts
+++ b/src/renderer/src/store/slices/detected-agents.test.ts
@@ -12,6 +12,7 @@ import {
   RUNTIME_PROTOCOL_VERSION
 } from '../../../../shared/protocol-version'
 import { clearRuntimeCompatibilityCacheForTests } from '@/runtime/runtime-rpc-client'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 
 const detectAgents = vi.fn()
 const refreshAgents = vi.fn()
@@ -139,6 +140,59 @@ describe('createDetectedAgentsSlice WSL context', () => {
     })
   })
 
+  it('publishes a Floating-first host probe to a later ordinary local caller', async () => {
+    let resolveDetection: (agents: string[]) => void = () => {}
+    detectAgents.mockReturnValueOnce(
+      new Promise<string[]>((resolve) => {
+        resolveDetection = resolve
+      })
+    )
+    const store = createTestStore()
+
+    const floating = store.getState().ensureDetectedAgents(FLOATING_TERMINAL_WORKTREE_ID)
+    const ordinary = store.getState().ensureDetectedAgents()
+
+    expect(detectAgents).toHaveBeenCalledTimes(1)
+    expect(store.getState().isDetectingAgents).toBe(true)
+    resolveDetection(['codex'])
+    await expect(Promise.all([floating, ordinary])).resolves.toEqual([['codex'], ['codex']])
+    expect(store.getState().detectedAgentIds).toEqual(['codex'])
+    expect(store.getState().isDetectingAgents).toBe(false)
+  })
+
+  it('restores the legacy inventory when returning to a cached local context', async () => {
+    detectAgents.mockImplementation(async (context) =>
+      context?.projectRuntime?.runtime.kind === 'wsl' ? ['claude'] : ['codex']
+    )
+    const store = createTestStore({
+      repos: [makeRepo({ id: 'repo-1', path: '\\\\wsl.localhost\\Ubuntu\\home\\alice\\repo' })],
+      activeRepoId: 'repo-1',
+      activeWorktreeId: null
+    })
+
+    await store.getState().ensureDetectedAgents()
+    store.setState({ activeRepoId: null })
+    await store.getState().ensureDetectedAgents()
+    store.setState({ activeRepoId: 'repo-1' })
+
+    await expect(store.getState().ensureDetectedAgents()).resolves.toEqual(['claude'])
+    expect(detectAgents).toHaveBeenCalledTimes(2)
+    expect(store.getState().detectedAgentIds).toEqual(['claude'])
+  })
+
+  it('retries a local context after a transient detection failure', async () => {
+    detectAgents
+      .mockRejectedValueOnce(new Error('cold-start timeout'))
+      .mockResolvedValueOnce(['codex'])
+    const store = createTestStore()
+
+    await expect(store.getState().ensureDetectedAgents()).resolves.toEqual([])
+    await expect(store.getState().ensureDetectedAgents()).resolves.toEqual(['codex'])
+
+    expect(detectAgents).toHaveBeenCalledTimes(2)
+    expect(store.getState().detectedAgentIds).toEqual(['codex'])
+  })
+
   it('refreshes local agents inside the active WSL repo distro when no worktree is selected', async () => {
     const store = createTestStore({
       repos: [makeRepo({ id: 'repo-1', path: '\\\\wsl$\\Debian\\home\\alice\\repo' })],
diff --git a/src/renderer/src/store/slices/detected-agents.ts b/src/renderer/src/store/slices/detected-agents.ts
index e3a4f4947a0..87e34b712ff 100644
--- a/src/renderer/src/store/slices/detected-agents.ts
+++ b/src/renderer/src/store/slices/detected-agents.ts
@@ -1,30 +1,10 @@
 import type { StateCreator } from 'zustand'
 import type { AppState } from '../types'
-import type { PathSource, ShellHydrationFailureReason, TuiAgent } from '../../../../shared/types'
-import {
-  getLocalAgentPreflightContext,
-  localPreflightContextKey
-} from '@/lib/local-preflight-context'
-
-export type DetectedAgentsSlice = {
-  detectedAgentIds: TuiAgent[] | null
-  isDetectingAgents: boolean
-  isRefreshingAgents: boolean
-  /** Telemetry classification of the most recent refreshAgents() run. `null`
-   *  before the first refresh resolves. Read by the wizard at agent-pick time
-   *  to attach `path_source` / `path_failure_reason` to `onboarding_agent_picked`
-   *  — see docs/agent-on-path-detection.md. */
-  pathSource: PathSource | null
-  pathFailureReason: ShellHydrationFailureReason | null
-  /** Runs `preflight.detectAgents` once per session. Subsequent callers reuse
-   *  the in-flight promise so every surface sees the same result. */
-  ensureDetectedAgents: (worktreeId?: string | null) => Promise<TuiAgent[]>
-  /** Re-runs `preflight.refreshAgents` (re-reads shell PATH). Concurrent callers
-   *  receive the same pending promise; store fields update once on resolve so
-   *  every subscribed surface re-renders in the same tick. */
-  refreshDetectedAgents: () => Promise<TuiAgent[]>
-  clearLocalDetectedAgents: () => void
+import type { TuiAgent } from '../../../../shared/types'
+import { createLocalDetectedAgentState } from './local-detected-agent-state'
+import type { LocalDetectedAgentState } from './local-detected-agent-store-state'
 
+export type DetectedAgentsSlice = LocalDetectedAgentState & {
   // Why: remote worktrees need per-connection agent detection. The local
   // detectedAgentIds field is connection-unaware, so remote state lives in a
   // separate map keyed by SSH connectionId.
@@ -41,10 +21,6 @@ export type DetectedAgentsSlice = {
 
 // Why: these are module-scoped (not in the store) so we can deduplicate
 // concurrent callers without storing a Promise in Zustand state.
-let detectPromise: { key: string; promise: Promise<TuiAgent[]> } | null = null
-let refreshPromise: { key: string; promise: Promise<TuiAgent[]> } | null = null
-let detectedContextKey: string | null = null
-let localDetectionGeneration = 0
 const remoteDetectPromises = new Map<string, Promise<TuiAgent[]>>()
 const remoteRefreshPromises = new Map<string, Promise<TuiAgent[]>>()
 
@@ -54,119 +30,10 @@ export function _getRemoteDetectPromiseCountForTest(): number {
 
 export const createDetectedAgentsSlice: StateCreator<AppState, [], [], DetectedAgentsSlice> = (
   set,
-  get
+  get,
+  store
 ) => ({
-  detectedAgentIds: null,
-  isDetectingAgents: false,
-  isRefreshingAgents: false,
-  pathSource: null,
-  pathFailureReason: null,
-
-  ensureDetectedAgents: (worktreeId) => {
-    const context = getLocalAgentPreflightContext(get(), undefined, undefined, worktreeId)
-    const contextKey = localPreflightContextKey(context)
-    const existing = get().detectedAgentIds
-    if (existing && detectedContextKey === contextKey) {
-      return Promise.resolve(existing)
-    }
-    if (detectPromise?.key === contextKey) {
-      return detectPromise.promise
-    }
-    const contextChanged = detectedContextKey !== contextKey
-    set({
-      detectedAgentIds: contextChanged ? null : get().detectedAgentIds,
-      isDetectingAgents: true
-    })
-    const requestGeneration = localDetectionGeneration
-    const pending = window.api.preflight
-      .detectAgents(context)
-      .then((ids) => {
-        const typed = ids as TuiAgent[]
-        if (requestGeneration === localDetectionGeneration) {
-          set({ detectedAgentIds: typed, isDetectingAgents: false })
-          detectedContextKey = contextKey
-        }
-        return typed
-      })
-      .catch(() => {
-        // Why: allow a retry on the next call if detection blew up (IPC timeout
-        // during cold start). Do not cache the failure or show stale context.
-        if (requestGeneration === localDetectionGeneration) {
-          detectPromise = null
-          set({
-            detectedAgentIds: contextChanged ? [] : get().detectedAgentIds,
-            isDetectingAgents: false
-          })
-        }
-        return [] as TuiAgent[]
-      })
-    detectPromise = { key: contextKey, promise: pending }
-    return pending
-  },
-
-  refreshDetectedAgents: () => {
-    const context = getLocalAgentPreflightContext(get())
-    const contextKey = localPreflightContextKey(context)
-    if (refreshPromise?.key === contextKey) {
-      return refreshPromise.promise
-    }
-    const contextChanged = detectedContextKey !== contextKey
-    set({
-      detectedAgentIds: contextChanged ? null : get().detectedAgentIds,
-      isRefreshingAgents: true
-    })
-    const requestGeneration = localDetectionGeneration
-    const pending = window.api.preflight
-      .refreshAgents(context)
-      .then((result) => {
-        const typed = result.agents as TuiAgent[]
-        if (requestGeneration === localDetectionGeneration) {
-          set({
-            detectedAgentIds: typed,
-            isRefreshingAgents: false,
-            pathSource: result.pathSource,
-            pathFailureReason: result.pathFailureReason
-          })
-          // Why: once refresh has run, treat its result as the current detection
-          // snapshot so `ensureDetectedAgents` short-circuits.
-          detectedContextKey = contextKey
-          detectPromise = { key: contextKey, promise: Promise.resolve(typed) }
-        }
-        return typed
-      })
-      .catch(() => {
-        const fallback = contextChanged ? [] : (get().detectedAgentIds ?? [])
-        if (requestGeneration === localDetectionGeneration) {
-          set({
-            detectedAgentIds: fallback,
-            isRefreshingAgents: false
-          })
-        }
-        return fallback
-      })
-      .finally(() => {
-        if (refreshPromise?.promise === pending) {
-          refreshPromise = null
-        }
-      })
-    refreshPromise = { key: contextKey, promise: pending }
-    return pending
-  },
-
-  clearLocalDetectedAgents: () => {
-    localDetectionGeneration += 1
-    detectPromise = null
-    refreshPromise = null
-    detectedContextKey = null
-    set({
-      detectedAgentIds: null,
-      isDetectingAgents: false,
-      isRefreshingAgents: false,
-      pathSource: null,
-      pathFailureReason: null
-    })
-  },
-
+  ...createLocalDetectedAgentState(set, get, store),
   remoteDetectedAgentIds: {},
   isDetectingRemoteAgents: {},
 
diff --git a/src/renderer/src/store/slices/diffComments.test.ts b/src/renderer/src/store/slices/diffComments.test.ts
index c6908d4ad6a..6f230b8665c 100644
--- a/src/renderer/src/store/slices/diffComments.test.ts
+++ b/src/renderer/src/store/slices/diffComments.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { create } from 'zustand'
 import type { AppState } from '../types'
 import type { DiffComment, Worktree } from '../../../../shared/types'
@@ -753,3 +753,83 @@ describe('bulk clear diff comments', () => {
     errSpy.mockRestore()
   })
 })
+
+describe('worktree diff comment rollback convergence', () => {
+  let errSpy: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    clearRuntimeCompatibilityCacheForTests()
+    runtimeEnvironmentTransportCall.mockReset()
+    runtimeEnvironmentTransportCall.mockImplementation((args: RuntimeEnvironmentCallRequest) => {
+      return createCompatibleRuntimeStatusResponseIfNeeded(args) ?? runtimeEnvironmentCall(args)
+    })
+    updateMeta.mockResolvedValue({})
+    runtimeEnvironmentCall.mockResolvedValue({
+      id: 'rpc-1',
+      ok: true,
+      result: { ok: true },
+      _meta: { runtimeId: 'remote-runtime' }
+    })
+    errSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    errSpy.mockRestore()
+  })
+
+  function addNote(store: ReturnType<typeof createTestStore>, body: string, lineNumber: number) {
+    return store.getState().addDiffComment({
+      worktreeId: WT,
+      filePath: 'src/foo.ts',
+      lineNumber,
+      body,
+      side: 'modified'
+    })
+  }
+
+  it('converges to the pre-burst list when two consecutive writes fail', async () => {
+    const store = createTestStore()
+    const comments = [makeComment({ id: 'c1' })]
+    seed(store, comments)
+    updateMeta.mockRejectedValue(new Error('disk full'))
+
+    await expect(Promise.all([addNote(store, 'A', 11), addNote(store, 'B', 12)])).resolves.toEqual([
+      null,
+      null
+    ])
+    expect(updateMeta).toHaveBeenCalledTimes(2)
+    expect(store.getState().getDiffComments(WT)).toBe(comments)
+  })
+
+  it('converges a mixed-mutator failing burst and still reports the delete failure', async () => {
+    const store = createTestStore()
+    const comments = [makeComment({ id: 'c1' }), makeComment({ id: 'c2' })]
+    seed(store, comments)
+    updateMeta.mockRejectedValue(new Error('disk full'))
+
+    const removed = store.getState().deleteDiffComment(WT, 'c1')
+    const marked = store.getState().markDiffCommentsSent(WT, ['c2'], 3000)
+
+    // Why: deleteDiffComment has no boolean contract, so its absent return must not hide the failure.
+    await expect(removed).resolves.toBeUndefined()
+    await expect(marked).resolves.toBe(false)
+    expect(store.getState().getDiffComments(WT)).toBe(comments)
+    expect(errSpy).toHaveBeenCalled()
+  })
+
+  it('converges on the runtime branch when two consecutive writes fail', async () => {
+    const store = createTestStore()
+    store.setState({ settings: { activeRuntimeEnvironmentId: 'env-1' } as never })
+    const comments = [makeComment({ id: 'c1' })]
+    seed(store, comments, { hostId: 'local', runtimeOwnerEnvironmentId: 'env-1' })
+    runtimeEnvironmentCall.mockRejectedValue(new Error('runtime unreachable'))
+
+    await expect(Promise.all([addNote(store, 'A', 11), addNote(store, 'B', 12)])).resolves.toEqual([
+      null,
+      null
+    ])
+    expect(updateMeta).not.toHaveBeenCalled()
+    expect(store.getState().getDiffComments(WT)).toBe(comments)
+  })
+})
diff --git a/src/renderer/src/store/slices/diffComments.ts b/src/renderer/src/store/slices/diffComments.ts
index 1154fd649b5..2bf3b18ceec 100644
--- a/src/renderer/src/store/slices/diffComments.ts
+++ b/src/renderer/src/store/slices/diffComments.ts
@@ -1,12 +1,18 @@
 /* eslint-disable max-lines -- Why: keeps note mutation, rollback, persistence ordering, and sent-state transitions under shared queue/rollback invariants. */
 import type { StateCreator } from 'zustand'
 import type { AppState } from '../types'
-import type { DiffComment, Worktree } from '../../../../shared/types'
+import type { DiffComment, FolderWorkspace, Worktree } from '../../../../shared/types'
 import { findWorktreeById, getRepoIdFromWorktreeId } from './worktree-helpers'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '../../runtime/runtime-rpc-client'
 import { toRuntimeWorktreeSelector } from '../../runtime/runtime-worktree-selector'
 import { createBrowserUuid } from '@/lib/browser-uuid'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import {
+  findFolderWorkspaceOwner,
+  getExecutionHostIdForFolderWorkspace,
+  getRuntimeEnvironmentIdForFolderWorkspace
+} from '@/lib/folder-workspace-runtime-owner'
+import { parseWorkspaceKey } from '../../../../shared/workspace-scope'
 
 export type DiffCommentsSlice = {
   getDiffComments: (worktreeId: string | null | undefined) => DiffComment[]
@@ -89,10 +95,41 @@ function deliverySnapshotMatches(
 const EMPTY_COMMENTS: readonly DiffComment[] = Object.freeze([])
 
 async function persist(
+  state: AppState,
   settings: AppState['settings'],
   worktreeId: string,
-  diffComments: DiffComment[]
+  diffComments: DiffComment[],
+  folderExecutionHostId?: ReturnType<typeof getExecutionHostIdForFolderWorkspace>
 ): Promise<void> {
+  const scope = parseWorkspaceKey(worktreeId)
+  if (scope?.type === 'folder') {
+    const executionHostId =
+      folderExecutionHostId ?? getExecutionHostIdForFolderWorkspace(state, scope.folderWorkspaceId)
+    const runtimeEnvironmentId = getRuntimeEnvironmentIdForFolderWorkspace(
+      state,
+      scope.folderWorkspaceId,
+      executionHostId
+    )
+    const target = getActiveRuntimeTarget({ activeRuntimeEnvironmentId: runtimeEnvironmentId })
+    const updated =
+      target.kind === 'local'
+        ? await window.api.folderWorkspaces.update({
+            folderWorkspaceId: scope.folderWorkspaceId,
+            updates: { diffComments }
+          })
+        : (
+            await callRuntimeRpc<{ folderWorkspace: FolderWorkspace | null }>(
+              target,
+              'folderWorkspace.update',
+              { folderWorkspaceId: scope.folderWorkspaceId, updates: { diffComments } },
+              { timeoutMs: 15_000 }
+            )
+          ).folderWorkspace
+    if (!updated?.diffComments) {
+      throw new Error('Failed to persist folder workspace review notes')
+    }
+    return
+  }
   const target = getActiveRuntimeTarget(settings)
   if (target.kind === 'local') {
     await window.api.worktrees.updateMeta({
@@ -117,42 +154,160 @@ function settingsForWorktreeOwner(state: AppState, worktreeId: string): AppState
 }
 
 // Why: IPC writes aren't ordered, so serialize per worktree to stop an older snapshot from overwriting a newer one on disk.
-const persistQueueByWorktree: Map<string, Promise<void>> = new Map()
+const persistQueueByWorktree = new Map<string, Promise<void>>()
+
+// Why: rollback must converge to what actually reached disk; in a burst of failed writes each mutation's own predecessor is stale.
+const lastPersistedByQueue = new Map<string, DiffComment[] | undefined>()
+
+// Why: the floor is only valid across an unbroken mutation chain; this is how an out-of-band replacement mid-burst is detected.
+const lastMutationNextByQueue = new Map<string, DiffComment[]>()
+
+// Why: bumped on every re-seed, so an in-flight write can tell whether the floor it captured is still the current one.
+const floorSeedEpochByQueue = new Map<string, number>()
+
+type CommentMutation = {
+  previous: DiffComment[] | undefined
+  next: DiffComment[]
+  folderExecutionHostId?: ReturnType<typeof getExecutionHostIdForFolderWorkspace>
+}
+
+// Why: one key for the queue and both bookkeeping maps, so they can never drift apart.
+function persistQueueKey(
+  worktreeId: string,
+  folderExecutionHostId?: ReturnType<typeof getExecutionHostIdForFolderWorkspace>
+): string {
+  return folderExecutionHostId ? `${folderExecutionHostId}\0${worktreeId}` : worktreeId
+}
 
 // Why: chain each write onto the prior promise so writes land in call order; both then handlers keep the chain alive past a failure.
-// Why: queued work reads the latest list at dequeue time, and the returned promise settles for THIS write so callers can roll back.
-function enqueuePersist(worktreeId: string, get: () => AppState): Promise<void> {
-  const prior = persistQueueByWorktree.get(worktreeId) ?? Promise.resolve()
+// Why: queued work reads the latest list at dequeue time, and the returned promise settles for THIS write.
+// Why: this promise rejects only after this write's rollback has been applied — callers must not roll back themselves.
+function enqueuePersist(
+  set: Parameters<StateCreator<AppState, [], [], DiffCommentsSlice>>[0],
+  worktreeId: string,
+  get: () => AppState,
+  mutation: CommentMutation
+): Promise<void> {
+  const folderExecutionHostId = mutation.folderExecutionHostId
+  const queueKey = persistQueueKey(worktreeId, folderExecutionHostId)
+  const prior = persistQueueByWorktree.get(queueKey) ?? Promise.resolve()
+  // Why: an idle queue means disk still holds the pre-mutation list, so that list is this burst's rollback floor.
+  // Why: a `previous` that isn't the last mutation's `next` means something outside the mutators replaced the list
+  //      (hydration, folderWorkspaces refresh, remote push), so the old floor predates that state and must be re-seeded.
+  // Why: seed before the queue entry below, or `has` is always true and the floor is never seeded.
+  const chainBroken = lastMutationNextByQueue.get(queueKey) !== mutation.previous
+  if (!persistQueueByWorktree.has(queueKey) || chainBroken) {
+    lastPersistedByQueue.set(queueKey, mutation.previous)
+    floorSeedEpochByQueue.set(queueKey, (floorSeedEpochByQueue.get(queueKey) ?? 0) + 1)
+  }
+  lastMutationNextByQueue.set(queueKey, mutation.next)
   const run = async (): Promise<void> => {
-    const repoId = getRepoIdFromWorktreeId(worktreeId)
-    const repoList = get().worktreesByRepo[repoId]
-    const target = repoList?.find((w) => w.id === worktreeId)
-    const latest = (target?.diffComments ?? []).map(normalizeDiffComment)
-    await persist(settingsForWorktreeOwner(get(), worktreeId), worktreeId, latest)
+    // Why: capture at dequeue time, alongside `stateList` — an epoch read at enqueue time would bar every write
+    //      that straddles a chain break from recording a floor its coalesced payload already carries.
+    const seedEpoch = floorSeedEpochByQueue.get(queueKey)
+    // Why: the state-side array, not the normalized copy sent to disk — restoring the same instance keeps
+    //      `getDiffComments` identity stable instead of churning selectors.
+    let stateList: DiffComment[] | undefined
+    try {
+      const scope = parseWorkspaceKey(worktreeId)
+      if (scope?.type === 'folder') {
+        const state = get()
+        const folderWorkspace = findFolderWorkspaceOwner(
+          state,
+          scope.folderWorkspaceId,
+          folderExecutionHostId
+        )
+        stateList = folderWorkspace?.diffComments
+        await persist(
+          state,
+          state.settings,
+          worktreeId,
+          (stateList ?? []).map(normalizeDiffComment),
+          folderExecutionHostId
+        )
+      } else {
+        const repoId = getRepoIdFromWorktreeId(worktreeId)
+        const target = get().worktreesByRepo[repoId]?.find((w) => w.id === worktreeId)
+        stateList = target?.diffComments
+        const state = get()
+        await persist(
+          state,
+          settingsForWorktreeOwner(state, worktreeId),
+          worktreeId,
+          (stateList ?? []).map(normalizeDiffComment)
+        )
+      }
+    } catch (err) {
+      // Why: converge to what actually landed; rollback's identity guard no-ops when a later mutation owns the array.
+      // Why: `has()`, not `get() ?? …` — an absent entry and a legitimately-`undefined` floor are different things.
+      const floor = lastPersistedByQueue.has(queueKey)
+        ? lastPersistedByQueue.get(queueKey)
+        : mutation.previous
+      rollback(set, worktreeId, floor, mutation.next, folderExecutionHostId)
+      throw err
+    }
+    // Why: a chain break re-seeded the floor to an out-of-band replacement while this write was awaiting, so the
+    //      list captured before the await predates it and must not be reinstated as the floor.
+    if (floorSeedEpochByQueue.get(queueKey) === seedEpoch) {
+      lastPersistedByQueue.set(queueKey, stateList)
+    }
   }
   const next = prior.then(run, run)
-  persistQueueByWorktree.set(worktreeId, next)
+  persistQueueByWorktree.set(queueKey, next)
   // Why: clear the queue entry only if still the tail, so later enqueues chain onto the real in-flight promise.
   // Why: then(cleanup, cleanup) not finally, so a rejection is consumed here rather than re-thrown as unhandledRejection.
   const cleanup = (): void => {
-    if (persistQueueByWorktree.get(worktreeId) === next) {
-      persistQueueByWorktree.delete(worktreeId)
+    if (persistQueueByWorktree.get(queueKey) === next) {
+      persistQueueByWorktree.delete(queueKey)
+      // Why: tail-guarded only; a mid-burst delete would strand the remaining writes of the burst without a floor.
+      lastPersistedByQueue.delete(queueKey)
+      lastMutationNextByQueue.delete(queueKey)
+      floorSeedEpochByQueue.delete(queueKey)
     }
   }
   next.then(cleanup, cleanup)
   return next
 }
 
+// Why: best-effort telemetry runs only after the note is on disk, so a throw here must not report a failed save.
+function recordReviewNoteInteraction(get: () => AppState): void {
+  try {
+    get().recordFeatureInteraction?.('review-notes')
+  } catch (err) {
+    console.error('Failed to record review-notes interaction:', err)
+  }
+}
+
 // Why: derive the next list inside the `set` updater so concurrent writes can't clobber each other via a stale closure.
 function mutateComments(
   set: Parameters<StateCreator<AppState, [], [], DiffCommentsSlice>>[0],
   worktreeId: string,
   mutate: (existing: DiffComment[]) => DiffComment[] | null
-): { previous: DiffComment[] | undefined; next: DiffComment[] } | null {
+): CommentMutation | null {
   const repoId = getRepoIdFromWorktreeId(worktreeId)
   let previous: DiffComment[] | undefined
   let next: DiffComment[] | null = null
+  let folderExecutionHostId: ReturnType<typeof getExecutionHostIdForFolderWorkspace> | undefined
   set((s) => {
+    const scope = parseWorkspaceKey(worktreeId)
+    if (scope?.type === 'folder') {
+      const target = findFolderWorkspaceOwner(s, scope.folderWorkspaceId)
+      if (!target) {
+        return {}
+      }
+      folderExecutionHostId = getExecutionHostIdForFolderWorkspace(s, scope.folderWorkspaceId)
+      previous = target.diffComments
+      const computed = mutate(previous ?? [])
+      if (computed === null) {
+        return {}
+      }
+      next = computed
+      return {
+        folderWorkspaces: s.folderWorkspaces.map((workspace) =>
+          workspace === target ? { ...workspace, diffComments: computed } : workspace
+        )
+      }
+    }
     const repoList = s.worktreesByRepo[repoId]
     if (!repoList) {
       return {}
@@ -175,7 +330,7 @@ function mutateComments(
   if (next === null) {
     return null
   }
-  return { previous, next }
+  return { previous, next, folderExecutionHostId }
 }
 
 // Why: on IPC-write failure, roll back optimistic state so the renderer matches disk (identity-guarded below).
@@ -183,10 +338,23 @@ function rollback(
   set: Parameters<StateCreator<AppState, [], [], DiffCommentsSlice>>[0],
   worktreeId: string,
   previous: DiffComment[] | undefined,
-  expectedCurrent: DiffComment[]
+  expectedCurrent: DiffComment[],
+  folderExecutionHostId?: ReturnType<typeof getExecutionHostIdForFolderWorkspace>
 ): void {
   const repoId = getRepoIdFromWorktreeId(worktreeId)
   set((s) => {
+    const scope = parseWorkspaceKey(worktreeId)
+    if (scope?.type === 'folder') {
+      const target = findFolderWorkspaceOwner(s, scope.folderWorkspaceId, folderExecutionHostId)
+      if (!target || target.diffComments !== expectedCurrent) {
+        return {}
+      }
+      return {
+        folderWorkspaces: s.folderWorkspaces.map((workspace) =>
+          workspace === target ? { ...workspace, diffComments: previous } : workspace
+        )
+      }
+    }
     const repoList = s.worktreesByRepo[repoId]
     if (!repoList) {
       return {}
@@ -216,7 +384,11 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
     if (!worktreeId) {
       return EMPTY_COMMENTS as DiffComment[]
     }
-    const worktree = findWorktreeById(get().worktreesByRepo, worktreeId)
+    const scope = parseWorkspaceKey(worktreeId)
+    const worktree =
+      scope?.type === 'folder'
+        ? findFolderWorkspaceOwner(get(), scope.folderWorkspaceId)
+        : findWorktreeById(get().worktreesByRepo, worktreeId)
     if (!worktree?.diffComments) {
       // Why: cast the frozen sentinel to the mutable return type; runtime freeze makes accidental mutation throw.
       return EMPTY_COMMENTS as DiffComment[]
@@ -236,15 +408,13 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
     }
     try {
       // Why: serialize through the per-worktree queue so concurrent writes can't land on disk out of call order.
-      await enqueuePersist(input.worktreeId, get)
-      get().recordFeatureInteraction?.('review-notes')
-      return comment
+      await enqueuePersist(set, input.worktreeId, get, result)
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      // Why: rollback's identity guard no-ops if a later mutation already replaced the list, so a newer write can't be lost.
-      rollback(set, input.worktreeId, result.previous, result.next)
       return null
     }
+    recordReviewNoteInteraction(get)
+    return comment
   },
 
   updateDiffComment: async (worktreeId, commentId, body) => {
@@ -255,10 +425,7 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
     }
 
     // Why: distinguish "comment missing" (false; keep draft, likely edit-while-deleted) from "body unchanged" (true; close editor) before mutating.
-    const repoId = getRepoIdFromWorktreeId(worktreeId)
-    const repoList = get().worktreesByRepo[repoId]
-    const target = repoList?.find((w) => w.id === worktreeId)
-    const existing = target?.diffComments ?? []
+    const existing = get().getDiffComments(worktreeId)
     const existingIdx = existing.findIndex((c) => c.id === commentId)
     if (existingIdx === -1) {
       return false
@@ -285,11 +452,10 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(set, worktreeId, get, result)
       return true
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
       return false
     }
   },
@@ -311,14 +477,13 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
-      get().recordFeatureInteraction?.('review-notes')
-      return true
+      await enqueuePersist(set, worktreeId, get, result)
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
       return false
     }
+    recordReviewNoteInteraction(get)
+    return true
   },
 
   markDiffCommentsSent: async (worktreeId, commentIds, sentAt = Date.now()) => {
@@ -341,14 +506,13 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
-      get().recordFeatureInteraction?.('review-notes')
-      return true
+      await enqueuePersist(set, worktreeId, get, result)
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
       return false
     }
+    recordReviewNoteInteraction(get)
+    return true
   },
 
   deleteDiffComment: async (worktreeId, commentId) => {
@@ -361,10 +525,9 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
     }
     try {
       // Why: serialize through the per-worktree queue so concurrent writes can't land out of call order.
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(set, worktreeId, get, result)
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
     }
   },
 
@@ -376,11 +539,10 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(set, worktreeId, get, result)
       return true
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
       return false
     }
   },
@@ -394,11 +556,10 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(set, worktreeId, get, result)
       return true
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
       return false
     }
   }
diff --git a/src/renderer/src/store/slices/editor.ts b/src/renderer/src/store/slices/editor.ts
index ba0685b54f8..4b2efe9516a 100644
--- a/src/renderer/src/store/slices/editor.ts
+++ b/src/renderer/src/store/slices/editor.ts
@@ -4163,7 +4163,7 @@ export const createEditorSlice: StateCreator<AppState, [], [], EditorSlice> = (s
   // Why: session-local conflict tracking (Resolved-locally) lives only in the renderer; main returns raw git status, so the renderer owns conflictStatusSource.
   setGitStatus: (worktreeId, status) =>
     set((s) => {
-      const hadStatusEntry = Object.prototype.hasOwnProperty.call(s.gitStatusByWorktree, worktreeId)
+      const hadStatusEntry = Object.hasOwn(s.gitStatusByWorktree, worktreeId)
       const prevEntries = s.gitStatusByWorktree[worktreeId] ?? []
       const prevOperation = s.gitConflictOperationByWorktree[worktreeId] ?? 'unknown'
       const currentTracked = { ...s.trackedConflictPathsByWorktree[worktreeId] }
diff --git a/src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts b/src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts
new file mode 100644
index 00000000000..b03015ec98d
--- /dev/null
+++ b/src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts
@@ -0,0 +1,634 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { create } from 'zustand'
+import type { AppState } from '../types'
+import type { DiffComment, FolderWorkspace, ProjectGroup } from '../../../../shared/types'
+import { folderWorkspaceKey } from '../../../../shared/workspace-scope'
+import {
+  createCompatibleRuntimeStatusResponseIfNeeded,
+  type RuntimeEnvironmentCallRequest
+} from '../../runtime/runtime-compatibility-test-fixture'
+import { clearRuntimeCompatibilityCacheForTests } from '../../runtime/runtime-rpc-client'
+import { createDiffCommentsSlice } from './diffComments'
+
+const runtimeEnvironmentCall = vi.fn()
+const runtimeEnvironmentTransportCall = vi.fn()
+const folderWorkspacesUpdate = vi.fn()
+
+globalThis.window = {
+  api: {
+    folderWorkspaces: { update: folderWorkspacesUpdate },
+    runtimeEnvironments: { call: runtimeEnvironmentTransportCall }
+  }
+} as never
+
+function createTestStore() {
+  return create<AppState>()((...args) => {
+    const slice = createDiffCommentsSlice(...args)
+    return {
+      ...slice,
+      settings: null,
+      activeWorktreeId: null,
+      activeWorkspaceExecutionHostId: null,
+      folderWorkspaces: [],
+      projectGroups: [],
+      runtimeEnvironments: [],
+      restoredRuntimeHostIdByWorkspaceSessionKey: {},
+      worktreesByRepo: {}
+    } as unknown as AppState
+  })
+}
+
+function makeFolderWorkspace(overrides: Partial<FolderWorkspace> = {}): FolderWorkspace {
+  return {
+    id: 'folder-1',
+    projectGroupId: 'group-1',
+    folderPath: '/workspace',
+    executionHostId: 'local',
+    diffComments: [],
+    ...overrides
+  } as FolderWorkspace
+}
+
+function seedLocalFolderWorkspace(store: ReturnType<typeof createTestStore>): FolderWorkspace {
+  const folderWorkspace = makeFolderWorkspace()
+  const projectGroup = {
+    id: folderWorkspace.projectGroupId,
+    parentPath: '/workspace',
+    executionHostId: 'local'
+  } as ProjectGroup
+  store.setState({
+    activeWorktreeId: folderWorkspaceKey(folderWorkspace.id),
+    activeWorkspaceExecutionHostId: 'local',
+    projectGroups: [projectGroup],
+    folderWorkspaces: [folderWorkspace]
+  })
+  return folderWorkspace
+}
+
+function addNote(
+  store: ReturnType<typeof createTestStore>,
+  workspaceKey: string,
+  body: string,
+  lineNumber = 1
+): Promise<DiffComment | null> {
+  return store.getState().addDiffComment({
+    worktreeId: workspaceKey,
+    filePath: 'README.md',
+    source: 'markdown',
+    lineNumber,
+    body,
+    side: 'modified'
+  })
+}
+
+function bodies(store: ReturnType<typeof createTestStore>, workspaceKey: string): string[] {
+  return store
+    .getState()
+    .getDiffComments(workspaceKey)
+    .map((comment) => comment.body)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  clearRuntimeCompatibilityCacheForTests()
+  runtimeEnvironmentTransportCall.mockImplementation((args: RuntimeEnvironmentCallRequest) => {
+    return createCompatibleRuntimeStatusResponseIfNeeded(args) ?? runtimeEnvironmentCall(args)
+  })
+})
+
+describe('folder workspace diff comments', () => {
+  it('adds and persists a review note', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => ({
+      ...folderWorkspace,
+      ...updates
+    }))
+
+    const saved = await store.getState().addDiffComment({
+      worktreeId: folderWorkspaceKey(folderWorkspace.id),
+      filePath: 'README.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'folder note',
+      side: 'modified'
+    })
+
+    expect(saved).toEqual(expect.objectContaining({ body: 'folder note' }))
+    expect(store.getState().getDiffComments(folderWorkspaceKey(folderWorkspace.id))).toEqual([
+      expect.objectContaining({ body: 'folder note' })
+    ])
+    expect(folderWorkspacesUpdate).toHaveBeenCalledWith({
+      folderWorkspaceId: folderWorkspace.id,
+      updates: { diffComments: [expect.objectContaining({ body: 'folder note' })] }
+    })
+  })
+
+  it('preserves a second note while the first write is in flight', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    let releaseFirstWrite: (() => void) | undefined
+    const firstWrite = new Promise<void>((resolve) => {
+      releaseFirstWrite = resolve
+    })
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => {
+      if (folderWorkspacesUpdate.mock.calls.length === 1) {
+        await firstWrite
+      }
+      return { ...folderWorkspace, ...updates }
+    })
+
+    const addFirst = store.getState().addDiffComment({
+      worktreeId: folderWorkspaceKey(folderWorkspace.id),
+      filePath: 'README.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'first note',
+      side: 'modified'
+    })
+    await vi.waitFor(() => expect(folderWorkspacesUpdate).toHaveBeenCalledTimes(1))
+    const addSecond = store.getState().addDiffComment({
+      worktreeId: folderWorkspaceKey(folderWorkspace.id),
+      filePath: 'README.md',
+      source: 'markdown',
+      lineNumber: 2,
+      body: 'second note',
+      side: 'modified'
+    })
+    releaseFirstWrite?.()
+
+    await Promise.all([addFirst, addSecond])
+    expect(store.getState().getDiffComments(folderWorkspaceKey(folderWorkspace.id))).toEqual([
+      expect.objectContaining({ body: 'first note' }),
+      expect.objectContaining({ body: 'second note' })
+    ])
+    expect(folderWorkspacesUpdate).toHaveBeenLastCalledWith({
+      folderWorkspaceId: folderWorkspace.id,
+      updates: {
+        diffComments: [
+          expect.objectContaining({ body: 'first note' }),
+          expect.objectContaining({ body: 'second note' })
+        ]
+      }
+    })
+  })
+
+  it('keeps same-id writes scoped to their original hosts', async () => {
+    const store = createTestStore()
+    const workspaceId = 'shared-folder-id'
+    const workspaceKey = folderWorkspaceKey(workspaceId)
+    const localWorkspace = makeFolderWorkspace({
+      id: workspaceId,
+      projectGroupId: 'local-group',
+      folderPath: '/workspace/local'
+    })
+    const runtimeWorkspace = makeFolderWorkspace({
+      id: workspaceId,
+      projectGroupId: 'runtime-group',
+      folderPath: '/workspace/runtime',
+      executionHostId: 'runtime:env-owner'
+    })
+    let resolveLocal!: () => void
+    folderWorkspacesUpdate.mockImplementation(
+      ({ updates }) =>
+        new Promise<FolderWorkspace>((resolve) => {
+          resolveLocal = () => resolve({ ...localWorkspace, ...updates })
+        })
+    )
+    runtimeEnvironmentCall.mockImplementation(async (args: RuntimeEnvironmentCallRequest) => ({
+      id: 'rpc-folder-update',
+      ok: true,
+      result: {
+        folderWorkspace: {
+          ...runtimeWorkspace,
+          ...(
+            args as RuntimeEnvironmentCallRequest & {
+              params: { updates?: Partial<FolderWorkspace> }
+            }
+          ).params.updates
+        }
+      },
+      _meta: { runtimeId: 'remote-runtime' }
+    }))
+    store.setState({
+      activeWorktreeId: workspaceKey,
+      activeWorkspaceExecutionHostId: 'local',
+      folderWorkspaces: [localWorkspace, runtimeWorkspace]
+    })
+
+    const localAdd = store.getState().addDiffComment({
+      worktreeId: workspaceKey,
+      filePath: 'LOCAL.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'local note',
+      side: 'modified'
+    })
+    await vi.waitFor(() => expect(folderWorkspacesUpdate).toHaveBeenCalledOnce())
+
+    store.setState({ activeWorkspaceExecutionHostId: 'runtime:env-owner' })
+    const runtimeAdd = store.getState().addDiffComment({
+      worktreeId: workspaceKey,
+      filePath: 'REMOTE.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'runtime note',
+      side: 'modified'
+    })
+    await vi.waitFor(() =>
+      expect(runtimeEnvironmentCall).toHaveBeenCalledWith(
+        expect.objectContaining({
+          selector: 'env-owner',
+          method: 'folderWorkspace.update',
+          params: expect.objectContaining({
+            updates: {
+              diffComments: [expect.objectContaining({ body: 'runtime note' })]
+            }
+          })
+        })
+      )
+    )
+
+    store.setState({ activeWorkspaceExecutionHostId: 'local' })
+    resolveLocal()
+    await expect(Promise.all([localAdd, runtimeAdd])).resolves.toEqual([
+      expect.objectContaining({ body: 'local note' }),
+      expect.objectContaining({ body: 'runtime note' })
+    ])
+    expect(store.getState().getDiffComments(workspaceKey)).toEqual([
+      expect.objectContaining({ body: 'local note' })
+    ])
+    store.setState({ activeWorkspaceExecutionHostId: 'runtime:env-owner' })
+    expect(store.getState().getDiffComments(workspaceKey)).toEqual([
+      expect.objectContaining({ body: 'runtime note' })
+    ])
+  })
+})
+
+describe('folder workspace diff comment rollback convergence', () => {
+  let errSpy: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    errSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    errSpy.mockRestore()
+  })
+
+  it('converges to disk when two consecutive writes fail', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    let rejectFirst!: (err: Error) => void
+    folderWorkspacesUpdate.mockImplementation(() => {
+      if (folderWorkspacesUpdate.mock.calls.length === 1) {
+        return new Promise((_resolve, reject) => {
+          rejectFirst = reject
+        })
+      }
+      return Promise.reject(new Error('disk full'))
+    })
+
+    const addA = addNote(store, key, 'note A', 1)
+    await vi.waitFor(() => expect(folderWorkspacesUpdate).toHaveBeenCalledTimes(1))
+    const addB = addNote(store, key, 'note B', 2)
+    rejectFirst(new Error('disk full'))
+
+    await expect(Promise.all([addA, addB])).resolves.toEqual([null, null])
+    expect(folderWorkspacesUpdate).toHaveBeenCalledTimes(2)
+    expect(store.getState().getDiffComments(key)).toEqual([])
+  })
+
+  it('converges across three failing writes', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    folderWorkspacesUpdate.mockImplementation(() => Promise.reject(new Error('disk full')))
+
+    const adds = [
+      addNote(store, key, 'A', 1),
+      addNote(store, key, 'B', 2),
+      addNote(store, key, 'C', 3)
+    ]
+
+    await expect(Promise.all(adds)).resolves.toEqual([null, null, null])
+    expect(store.getState().getDiffComments(key)).toEqual([])
+  })
+
+  it('keeps a durably saved note when a coalesced write succeeds before a later failure', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => {
+      if (folderWorkspacesUpdate.mock.calls.length > 1) {
+        throw new Error('disk full')
+      }
+      return { ...folderWorkspace, ...updates }
+    })
+
+    // Why: both mutations land before the first write dequeues, so write 1 coalesces and persists [A,B].
+    const addA = addNote(store, key, 'note A', 1)
+    const addB = addNote(store, key, 'note B', 2)
+
+    await Promise.all([addA, addB])
+    expect(folderWorkspacesUpdate).toHaveBeenNthCalledWith(1, {
+      folderWorkspaceId: folderWorkspace.id,
+      updates: {
+        diffComments: [
+          expect.objectContaining({ body: 'note A' }),
+          expect.objectContaining({ body: 'note B' })
+        ]
+      }
+    })
+    expect(bodies(store, key)).toEqual(['note A', 'note B'])
+  })
+
+  it('converges to the partially-written list when only the first write landed', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    let releaseFirst!: () => void
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => {
+      if (folderWorkspacesUpdate.mock.calls.length === 1) {
+        await new Promise<void>((resolve) => {
+          releaseFirst = resolve
+        })
+        return { ...folderWorkspace, ...updates }
+      }
+      throw new Error('disk full')
+    })
+
+    const addA = addNote(store, key, 'note A', 1)
+    await vi.waitFor(() => expect(folderWorkspacesUpdate).toHaveBeenCalledTimes(1))
+    const addB = addNote(store, key, 'note B', 2)
+    releaseFirst()
+
+    await Promise.all([addA, addB])
+    // Why: write 1 persisted only [A], so [A] is the floor B's failure converges to.
+    expect(bodies(store, key)).toEqual(['note A'])
+  })
+
+  it('seeds a fresh floor for the burst after a failed burst', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    folderWorkspacesUpdate.mockImplementation(() => Promise.reject(new Error('disk full')))
+    await Promise.all([addNote(store, key, 'A', 1), addNote(store, key, 'B', 2)])
+    expect(store.getState().getDiffComments(key)).toEqual([])
+
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => ({
+      ...folderWorkspace,
+      ...updates
+    }))
+    await addNote(store, key, 'C', 3)
+
+    expect(bodies(store, key)).toEqual(['C'])
+    expect(folderWorkspacesUpdate).toHaveBeenLastCalledWith({
+      folderWorkspaceId: folderWorkspace.id,
+      updates: { diffComments: [expect.objectContaining({ body: 'C' })] }
+    })
+  })
+
+  it('rolls back to the list the queue drained on, not a stale burst floor', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    folderWorkspacesUpdate.mockImplementation(() => Promise.reject(new Error('disk full')))
+    await Promise.all([addNote(store, key, 'A', 1), addNote(store, key, 'B', 2)])
+
+    // Why: the drained queue must not carry its floor into the next burst.
+    const hydrated = [
+      {
+        id: 'h1',
+        worktreeId: key,
+        filePath: 'README.md',
+        lineNumber: 9,
+        body: 'hydrated',
+        createdAt: 1,
+        side: 'modified'
+      } as DiffComment
+    ]
+    store.setState({ folderWorkspaces: [{ ...folderWorkspace, diffComments: hydrated }] })
+
+    await addNote(store, key, 'D', 4)
+
+    expect(store.getState().getDiffComments(key)).toBe(hydrated)
+  })
+
+  it('keeps an out-of-band replacement when a later mutation in the same burst fails', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    let rejectFirst!: (err: Error) => void
+    folderWorkspacesUpdate.mockImplementation(() => {
+      if (folderWorkspacesUpdate.mock.calls.length === 1) {
+        return new Promise((_resolve, reject) => {
+          rejectFirst = reject
+        })
+      }
+      return Promise.reject(new Error('disk full'))
+    })
+
+    const addA = addNote(store, key, 'note A', 1)
+    await vi.waitFor(() => expect(folderWorkspacesUpdate).toHaveBeenCalledTimes(1))
+    const hydrated = [
+      {
+        id: 'h1',
+        worktreeId: key,
+        filePath: 'README.md',
+        lineNumber: 9,
+        body: 'hydrated',
+        createdAt: 1,
+        side: 'modified'
+      } as DiffComment
+    ]
+    store.setState({ folderWorkspaces: [{ ...folderWorkspace, diffComments: hydrated }] })
+    const addE = addNote(store, key, 'note E', 2)
+    rejectFirst(new Error('disk full'))
+
+    await Promise.all([addA, addE])
+    expect(bodies(store, key)).toEqual(['hydrated'])
+  })
+
+  it('keeps an out-of-band replacement when the in-flight write succeeds', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    let releaseFirst!: () => void
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => {
+      if (folderWorkspacesUpdate.mock.calls.length === 1) {
+        await new Promise<void>((resolve) => {
+          releaseFirst = resolve
+        })
+        return { ...folderWorkspace, ...updates }
+      }
+      throw new Error('disk full')
+    })
+
+    const addA = addNote(store, key, 'note A', 1)
+    await vi.waitFor(() => expect(folderWorkspacesUpdate).toHaveBeenCalledTimes(1))
+    const hydrated = [
+      {
+        id: 'h1',
+        worktreeId: key,
+        filePath: 'README.md',
+        lineNumber: 9,
+        body: 'hydrated',
+        createdAt: 1,
+        side: 'modified'
+      } as DiffComment
+    ]
+    store.setState({ folderWorkspaces: [{ ...folderWorkspace, diffComments: hydrated }] })
+    // Why: the chain break re-seeds the floor to `hydrated`; A's success must not restore its pre-replacement capture.
+    const addE = addNote(store, key, 'note E', 2)
+    releaseFirst()
+
+    await Promise.all([addA, addE])
+    expect(bodies(store, key)).toEqual(['hydrated'])
+  })
+
+  it('keeps a successful write that straddles a chain break as the floor', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => {
+      if (folderWorkspacesUpdate.mock.calls.length > 1) {
+        throw new Error('disk full')
+      }
+      return { ...folderWorkspace, ...updates }
+    })
+
+    // Why: no await, so the replacement + E land before A dequeues — A's payload already carries `hydrated`.
+    const addA = addNote(store, key, 'note A', 1)
+    const hydrated = [
+      {
+        id: 'h1',
+        worktreeId: key,
+        filePath: 'README.md',
+        lineNumber: 9,
+        body: 'hydrated',
+        createdAt: 1,
+        side: 'modified'
+      } as DiffComment
+    ]
+    store.setState({ folderWorkspaces: [{ ...folderWorkspace, diffComments: hydrated }] })
+    const addE = addNote(store, key, 'note E', 2)
+
+    await Promise.all([addA, addE])
+    // Why: write #1 put ['hydrated', 'note E'] on disk, so E's failure must not roll back past it.
+    expect(bodies(store, key)).toEqual(['hydrated', 'note E'])
+    expect(folderWorkspacesUpdate.mock.calls[0][0].updates.diffComments).toEqual([
+      expect.objectContaining({ body: 'hydrated' }),
+      expect.objectContaining({ body: 'note E' })
+    ])
+  })
+
+  it('rolls back when the write throws before reaching persist', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    // Why: a malformed entry makes normalizeDiffComment throw inside run, before persist is ever called.
+    const malformed = [null as unknown as DiffComment]
+    store.setState({ folderWorkspaces: [{ ...folderWorkspace, diffComments: malformed }] })
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => ({
+      ...folderWorkspace,
+      ...updates
+    }))
+
+    await expect(addNote(store, key, 'note A', 1)).resolves.toBeNull()
+    expect(store.getState().getDiffComments(key)).toBe(malformed)
+    expect(folderWorkspacesUpdate).not.toHaveBeenCalled()
+    expect(errSpy).toHaveBeenCalled()
+  })
+
+  it('reports success when recordFeatureInteraction throws after a successful write', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => ({
+      ...folderWorkspace,
+      ...updates
+    }))
+    store.setState({
+      recordFeatureInteraction: () => {
+        throw new Error('telemetry down')
+      }
+    } as never)
+
+    await expect(addNote(store, key, 'note A', 1)).resolves.toEqual(
+      expect.objectContaining({ body: 'note A' })
+    )
+    expect(bodies(store, key)).toEqual(['note A'])
+  })
+
+  it('converges to the floor when persist rejects after the host may have written', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    const key = folderWorkspaceKey(folderWorkspace.id)
+    // Why: pins today's contract for the missing-diffComments throw; STA-4062 owns read-back.
+    folderWorkspacesUpdate.mockImplementation(async () => ({}))
+
+    await expect(addNote(store, key, 'note A', 1)).resolves.toBeNull()
+    expect(store.getState().getDiffComments(key)).toEqual([])
+  })
+
+  it('converges on the runtime branch when two consecutive writes fail', async () => {
+    const store = createTestStore()
+    const runtimeWorkspace = makeFolderWorkspace({ executionHostId: 'runtime:env-owner' })
+    const key = folderWorkspaceKey(runtimeWorkspace.id)
+    store.setState({
+      activeWorktreeId: key,
+      activeWorkspaceExecutionHostId: 'runtime:env-owner',
+      folderWorkspaces: [runtimeWorkspace]
+    })
+    runtimeEnvironmentCall.mockRejectedValue(new Error('runtime unreachable'))
+
+    await expect(
+      Promise.all([addNote(store, key, 'A', 1), addNote(store, key, 'B', 2)])
+    ).resolves.toEqual([null, null])
+    expect(store.getState().getDiffComments(key)).toEqual([])
+    expect(folderWorkspacesUpdate).not.toHaveBeenCalled()
+  })
+
+  it('keeps a failing burst scoped to its own execution host', async () => {
+    const store = createTestStore()
+    const workspaceId = 'shared-folder-id'
+    const key = folderWorkspaceKey(workspaceId)
+    const localWorkspace = makeFolderWorkspace({ id: workspaceId, projectGroupId: 'local-group' })
+    const runtimeWorkspace = makeFolderWorkspace({
+      id: workspaceId,
+      projectGroupId: 'runtime-group',
+      executionHostId: 'runtime:env-owner'
+    })
+    store.setState({
+      activeWorktreeId: key,
+      activeWorkspaceExecutionHostId: 'runtime:env-owner',
+      folderWorkspaces: [localWorkspace, runtimeWorkspace]
+    })
+    runtimeEnvironmentCall.mockImplementation(async (args: RuntimeEnvironmentCallRequest) => ({
+      id: 'rpc-folder-update',
+      ok: true,
+      result: {
+        folderWorkspace: {
+          ...runtimeWorkspace,
+          ...(
+            args as RuntimeEnvironmentCallRequest & {
+              params: { updates?: Partial<FolderWorkspace> }
+            }
+          ).params.updates
+        }
+      },
+      _meta: { runtimeId: 'remote-runtime' }
+    }))
+    folderWorkspacesUpdate.mockImplementation(() => Promise.reject(new Error('disk full')))
+
+    await addNote(store, key, 'runtime note', 1)
+    store.setState({ activeWorkspaceExecutionHostId: 'local' })
+    await Promise.all([addNote(store, key, 'local A', 2), addNote(store, key, 'local B', 3)])
+
+    expect(store.getState().getDiffComments(key)).toEqual([])
+    store.setState({ activeWorkspaceExecutionHostId: 'runtime:env-owner' })
+    expect(bodies(store, key)).toEqual(['runtime note'])
+  })
+})
diff --git a/src/renderer/src/store/slices/github.test.ts b/src/renderer/src/store/slices/github.test.ts
index 5e5b0d61ccb..dfcd76ec5d1 100644
--- a/src/renderer/src/store/slices/github.test.ts
+++ b/src/renderer/src/store/slices/github.test.ts
@@ -6300,6 +6300,151 @@ describe('createGitHubSlice.refreshGitHubForWorktree', () => {
   })
 })
 
+describe('createGitHubSlice.fetchWorkItems cache identity', () => {
+  const nestedSources = {
+    issues: { owner: 'acme', repo: 'widgets' },
+    prs: { owner: 'acme', repo: 'widgets' },
+    originCandidate: { owner: 'acme', repo: 'widgets' },
+    upstreamCandidate: { owner: 'acme-upstream', repo: 'widgets' }
+  }
+
+  function makeNestedWorkItem(
+    overrides: Partial<GitHubWorkItem> & Pick<GitHubWorkItem, 'id' | 'number' | 'title'>
+  ): Omit<GitHubWorkItem, 'repoId'> {
+    return {
+      type: 'pr',
+      state: 'open',
+      url: `https://github.com/acme/widgets/pull/${overrides.number}`,
+      labels: ['bug', 'needs-review'],
+      updatedAt: '2026-05-22T00:00:00Z',
+      author: 'octocat',
+      authorAvatarUrl: 'https://avatars.example/octocat.png',
+      branchName: 'feature/nested',
+      baseRefName: 'main',
+      headSha: 'abc123def456',
+      prRepo: { owner: 'acme', repo: 'widgets', host: 'github.com' },
+      additions: 12,
+      deletions: 3,
+      changedFiles: 2,
+      reviewDecision: 'REVIEW_REQUIRED',
+      reviewRequests: [
+        { login: 'reviewer', name: 'Reviewer', avatarUrl: 'https://avatars.example/reviewer.png' }
+      ],
+      latestReviews: [
+        { login: 'reviewer', state: 'COMMENTED', avatarUrl: 'https://avatars.example/reviewer.png' }
+      ],
+      assignees: [
+        { login: 'assignee', name: 'Assignee', avatarUrl: 'https://avatars.example/assignee.png' }
+      ],
+      checksSummary: {
+        state: 'pending',
+        total: 4,
+        passed: 1,
+        failed: 0,
+        pending: 3,
+        neutral: 0
+      },
+      mergeable: 'MERGEABLE',
+      ...overrides
+    }
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetRemoteRuntimeMocks()
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('reuses the cache map, entry, and nested rows on a no-op force refetch', async () => {
+    const store = createTestStore()
+    const items = [
+      makeNestedWorkItem({ id: 'pr:42', number: 42, title: 'First nested PR' }),
+      makeNestedWorkItem({ id: 'pr:43', number: 43, title: 'Second nested PR' })
+    ]
+    mockApi.gh.listWorkItems.mockImplementation(() =>
+      Promise.resolve({
+        items: structuredClone(items),
+        sources: structuredClone(nestedSources)
+      })
+    )
+
+    let now = 1_700_000_000_000
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+
+    await store.getState().fetchWorkItems('repo-id', '/repo', 24, '')
+    const cacheKey = workItemsCacheKey('repo-id', 24, '')
+    const previousCache = store.getState().workItemsCache
+    const previousEntry = previousCache[cacheKey]
+    const previousRows = previousEntry?.data
+    expect(previousRows).toHaveLength(2)
+    expect(previousRows?.[0]?.labels).toEqual(['bug', 'needs-review'])
+    expect(previousRows?.[0]?.assignees?.[0]?.login).toBe('assignee')
+    expect(previousRows?.[0]?.reviewRequests?.[0]?.login).toBe('reviewer')
+    expect(previousRows?.[0]?.prRepo).toEqual({
+      owner: 'acme',
+      repo: 'widgets',
+      host: 'github.com'
+    })
+    expect(previousRows?.[0]?.checksSummary?.state).toBe('pending')
+
+    now += 5_000
+    await store.getState().fetchWorkItems('repo-id', '/repo', 24, '', { force: true })
+
+    const nextCache = store.getState().workItemsCache
+    const nextEntry = nextCache[cacheKey]
+    expect(nextCache).toBe(previousCache)
+    expect(nextEntry).toBe(previousEntry)
+    expect(nextEntry?.data).toBe(previousRows)
+    expect(nextEntry?.data?.[0]).toBe(previousRows?.[0])
+    expect(nextEntry?.data?.[1]).toBe(previousRows?.[1])
+    expect(nextEntry?.sources).toBe(previousEntry?.sources)
+    expect(nextEntry?.fetchedAt).toBe(now)
+    expect(nextEntry?.fetchedAt).toBeGreaterThan(1_700_000_000_000)
+  })
+
+  it('writes a new entry when a nested reviewRequests login changes but reuses the sibling row', async () => {
+    const store = createTestStore()
+    const first = makeNestedWorkItem({ id: 'pr:42', number: 42, title: 'First nested PR' })
+    const second = makeNestedWorkItem({ id: 'pr:43', number: 43, title: 'Second nested PR' })
+    mockApi.gh.listWorkItems.mockResolvedValueOnce({
+      items: structuredClone([first, second]),
+      sources: structuredClone(nestedSources)
+    })
+
+    await store.getState().fetchWorkItems('repo-id', '/repo', 24, '')
+    const cacheKey = workItemsCacheKey('repo-id', 24, '')
+    const previousCache = store.getState().workItemsCache
+    const previousEntry = previousCache[cacheKey]
+    const previousRows = previousEntry?.data
+    expect(previousRows).toHaveLength(2)
+
+    const changedFirst = structuredClone(first)
+    const nextReviewer = changedFirst.reviewRequests?.[0]
+    if (nextReviewer) {
+      nextReviewer.login = 'reviewer-updated'
+    }
+    mockApi.gh.listWorkItems.mockResolvedValueOnce({
+      items: [changedFirst, structuredClone(second)],
+      sources: structuredClone(nestedSources)
+    })
+
+    await store.getState().fetchWorkItems('repo-id', '/repo', 24, '', { force: true })
+
+    const nextCache = store.getState().workItemsCache
+    const nextEntry = nextCache[cacheKey]
+    expect(nextCache).not.toBe(previousCache)
+    expect(nextEntry).not.toBe(previousEntry)
+    expect(nextEntry?.data).not.toBe(previousRows)
+    expect(nextEntry?.data?.[0]).not.toBe(previousRows?.[0])
+    expect(nextEntry?.data?.[0]?.reviewRequests?.[0]?.login).toBe('reviewer-updated')
+    expect(nextEntry?.data?.[1]).toBe(previousRows?.[1])
+    expect(nextEntry?.sources).toBe(previousEntry?.sources)
+  })
+})
+
 describe('createGitHubSlice.fetchWorkItems source/error envelope', () => {
   beforeEach(() => {
     vi.clearAllMocks()
diff --git a/src/renderer/src/store/slices/github.ts b/src/renderer/src/store/slices/github.ts
index 7ab87e09731..299e3e21bbb 100644
--- a/src/renderer/src/store/slices/github.ts
+++ b/src/renderer/src/store/slices/github.ts
@@ -78,6 +78,7 @@ import { normalizeGitHubPRForBranchOutcome } from '../../../../shared/github-pr-
 import { restoreReactionOnSubject, setReactionOnSubject } from '@/lib/pr-comment-reactions'
 import { withGitHubCheckDetailsTimeout } from '@/runtime/github-check-details-timeout'
 import { getGitHubRepoLookupIndex } from './github-repo-lookup-index'
+import { areValuesEqual, reconcileCatalogRows } from './repo-identity-reconcile'
 
 // ─── ProjectV2 cache types ────────────────────────────────────────────
 // Why: separate from CacheEntry<T> — project-view has a single GraphQL source (no issue/PR fallback) and a distinct error union.
@@ -684,7 +685,7 @@ type InflightChecks = {
 const inflightChecksRequests = new Map<string, InflightChecks>()
 const inflightCommentsRequests = new Map<string, Promise<PRComment[]>>()
 type InflightWorkItems = {
-  promise: Promise<GitHubWorkItem[]>
+  promise: Promise<readonly GitHubWorkItem[]>
   force: boolean
   noCache: boolean
   requireComplete: boolean
@@ -1852,7 +1853,7 @@ export type GitHubSlice = {
   prRefreshStates: Record<string, PRRefreshState>
   prVisibleRefreshGeneration: number
   // Why: keyed by repoId + limit + query so same-path repos on different SSH targets don't share results.
-  workItemsCache: Record<string, CacheEntry<GitHubWorkItem[]>>
+  workItemsCache: Record<string, CacheEntry<readonly GitHubWorkItem[]>>
   fetchPRForBranch: (
     repoPath: string,
     branch: string,
@@ -1950,7 +1951,7 @@ export type GitHubSlice = {
     query: string,
     repoPath?: string,
     sourceContext?: TaskSourceContext | null
-  ) => GitHubWorkItem[] | null
+  ) => readonly GitHubWorkItem[] | null
   /** Returns a thin view (sources + error, never items) so it stays a cheap selector without dragging the whole work-item array through the equality check. */
   getWorkItemsSourcesAndError: (
     repoId: string,
@@ -1973,7 +1974,7 @@ export type GitHubSlice = {
     limit: number,
     query: string,
     options?: FetchOptions
-  ) => Promise<GitHubWorkItem[]>
+  ) => Promise<readonly GitHubWorkItem[]>
   /**
    * Fan out one work-item query across repos; partial failures don't reject — a repo with no cached fallback increments `failedCount`, but one served stale cache on rejection isn't counted.
    * `githubUnavailable`: every selected GitHub source refresh failed because GitHub was unreachable (5xx/network/rate-limit), even if stale cache remains — lets the caller attribute the stale/empty list.
@@ -2657,7 +2658,13 @@ export const createGitHubSlice: StateCreator<AppState, [], [], GitHubSlice> = (s
     return null
   },
 
-  fetchWorkItems: async (repoId, repoPath, limit, query, options): Promise<GitHubWorkItem[]> => {
+  fetchWorkItems: async (
+    repoId,
+    repoPath,
+    limit,
+    query,
+    options
+  ): Promise<readonly GitHubWorkItem[]> => {
     if (isGitHubWorkItemsQueryTooLarge(query)) {
       return []
     }
@@ -2739,15 +2746,54 @@ export const createGitHubSlice: StateCreator<AppState, [], [], GitHubSlice> = (s
         if (get().workItemsInvalidationNonce !== requestInvalidationNonce) {
           return items
         }
-        set((s) => ({
-          workItemsCache: withBoundedCacheEntry(s.workItemsCache, key, {
-            data: items,
-            fetchedAt: Date.now(),
-            sources: envelope.sources,
-            ...(errorForCache ? { error: errorForCache } : {}),
-            ...(envelope.issueSourceFellBack ? { issueSourceFellBack: true } : {})
-          })
-        }))
+        // Why: TaskPage useShallow-selects cache entry refs. A new { ...entry, fetchedAt }
+        // still remaps every visible row. IPC structuredClone rebuilds nested records, so
+        // data === previous.data never holds — reconcile structurally, then either mutate
+        // fetchedAt in place or write one entry that keeps unchanged row/meta refs.
+        set((s) => {
+          const previousEntry = s.workItemsCache[key]
+          const previousData = previousEntry?.data ?? []
+          const reconciled = reconcileCatalogRows(
+            previousData,
+            items,
+            (row) => `${row.repoId}\0${row.id}`
+          )
+          const nextFellBack = envelope.issueSourceFellBack ? true : undefined
+          const sourcesUnchanged = areValuesEqual(previousEntry?.sources, envelope.sources)
+          const errorUnchanged = areValuesEqual(previousEntry?.error, errorForCache)
+          const fellBackUnchanged = previousEntry?.issueSourceFellBack === nextFellBack
+          if (
+            previousEntry &&
+            reconciled === previousData &&
+            sourcesUnchanged &&
+            errorUnchanged &&
+            fellBackUnchanged
+          ) {
+            previousEntry.fetchedAt = Date.now()
+            return {}
+          }
+          const previousSources = previousEntry?.sources
+          const previousError = previousEntry?.error
+          return {
+            workItemsCache: withBoundedCacheEntry(s.workItemsCache, key, {
+              // Why: `reconciled` already is `previousEntry.data` when nothing changed —
+              // reconcileCatalogRows returns the previous array on a structural match.
+              data: reconciled,
+              fetchedAt: Date.now(),
+              sources:
+                sourcesUnchanged && previousSources !== undefined
+                  ? previousSources
+                  : envelope.sources,
+              ...(errorForCache
+                ? {
+                    error:
+                      errorUnchanged && previousError !== undefined ? previousError : errorForCache
+                  }
+                : {}),
+              ...(nextFellBack ? { issueSourceFellBack: true } : {})
+            })
+          }
+        })
         return items
       } catch (err) {
         // Why: rethrow but keep the stale cache entry so the UI still renders while the user retries.
@@ -4706,7 +4752,7 @@ export const createGitHubSlice: StateCreator<AppState, [], [], GitHubSlice> = (s
     set((s) => {
       const prefix = `${repoId}::`
       const legacyPrefix = `${repoPath}::`
-      const next: Record<string, CacheEntry<GitHubWorkItem[]>> = {}
+      const next: Record<string, CacheEntry<readonly GitHubWorkItem[]>> = {}
       for (const [key, entry] of Object.entries(s.workItemsCache)) {
         if (!key.startsWith(prefix) && !key.startsWith(legacyPrefix)) {
           next[key] = entry
diff --git a/src/renderer/src/store/slices/local-agent-context-eviction.ts b/src/renderer/src/store/slices/local-agent-context-eviction.ts
new file mode 100644
index 00000000000..92f25c1d336
--- /dev/null
+++ b/src/renderer/src/store/slices/local-agent-context-eviction.ts
@@ -0,0 +1,118 @@
+import type { AppState } from '../types'
+
+type LocalAgentContextState = Pick<
+  AppState,
+  | 'detectedAgentIds'
+  | 'isDetectingAgents'
+  | 'isRefreshingAgents'
+  | 'localDetectedAgentIdsByContext'
+  | 'isDetectingLocalAgentsByContext'
+  | 'isRefreshingLocalAgentsByContext'
+  | 'pathSource'
+  | 'pathFailureReason'
+>
+
+export type LocalAgentContextEviction = {
+  removedContextKeys: ReadonlySet<string>
+  detectedContextKey: string | null
+  legacyDetectContextKey: string | null
+  legacyRefreshContextKey: string | null
+  statePatch: Partial<LocalAgentContextState>
+}
+
+export function removeLocalAgentContextEntries<T>(
+  entries: Record<string, T>,
+  contextKeys: ReadonlySet<string>
+): Record<string, T> {
+  let filtered = entries
+  for (const contextKey of contextKeys) {
+    if (!(contextKey in filtered)) {
+      continue
+    }
+    if (filtered === entries) {
+      filtered = { ...entries }
+    }
+    delete filtered[contextKey]
+  }
+  return filtered
+}
+
+export function removeLocalAgentContextEntry<T>(entries: Record<string, T>, contextKey: string) {
+  return removeLocalAgentContextEntries(entries, new Set([contextKey]))
+}
+
+export function getLocalAgentContextEviction(args: {
+  projectIds: readonly string[]
+  state: LocalAgentContextState
+  internalContextKeys: Iterable<string>
+  detectedContextKey: string | null
+  legacyDetectContextKey: string | null
+  legacyRefreshContextKey: string | null
+}): LocalAgentContextEviction | null {
+  const prefixes = args.projectIds
+    .map((projectId) => projectId.trim())
+    .filter(Boolean)
+    .map((projectId) => `${projectId}:`)
+  if (prefixes.length === 0) {
+    return null
+  }
+  const contextKeys = new Set([
+    ...Object.keys(args.state.localDetectedAgentIdsByContext),
+    ...Object.keys(args.state.isDetectingLocalAgentsByContext),
+    ...Object.keys(args.state.isRefreshingLocalAgentsByContext),
+    ...args.internalContextKeys
+  ])
+  const removedContextKeys = new Set(
+    [...contextKeys].filter((contextKey) =>
+      prefixes.some((prefix) => contextKey.startsWith(prefix))
+    )
+  )
+  if (removedContextKeys.size === 0) {
+    return null
+  }
+  const clearDetected = Boolean(
+    (args.detectedContextKey && removedContextKeys.has(args.detectedContextKey)) ||
+    (args.legacyDetectContextKey && removedContextKeys.has(args.legacyDetectContextKey))
+  )
+  const clearRefreshing = Boolean(
+    args.legacyRefreshContextKey && removedContextKeys.has(args.legacyRefreshContextKey)
+  )
+  return {
+    removedContextKeys,
+    detectedContextKey:
+      args.detectedContextKey && removedContextKeys.has(args.detectedContextKey)
+        ? null
+        : args.detectedContextKey,
+    legacyDetectContextKey:
+      args.legacyDetectContextKey && removedContextKeys.has(args.legacyDetectContextKey)
+        ? null
+        : args.legacyDetectContextKey,
+    legacyRefreshContextKey:
+      args.legacyRefreshContextKey && removedContextKeys.has(args.legacyRefreshContextKey)
+        ? null
+        : args.legacyRefreshContextKey,
+    statePatch: {
+      ...(clearDetected
+        ? {
+            detectedAgentIds: null,
+            isDetectingAgents: false,
+            pathSource: null,
+            pathFailureReason: null
+          }
+        : {}),
+      ...(clearRefreshing ? { isRefreshingAgents: false } : {}),
+      localDetectedAgentIdsByContext: removeLocalAgentContextEntries(
+        args.state.localDetectedAgentIdsByContext,
+        removedContextKeys
+      ),
+      isDetectingLocalAgentsByContext: removeLocalAgentContextEntries(
+        args.state.isDetectingLocalAgentsByContext,
+        removedContextKeys
+      ),
+      isRefreshingLocalAgentsByContext: removeLocalAgentContextEntries(
+        args.state.isRefreshingLocalAgentsByContext,
+        removedContextKeys
+      )
+    }
+  }
+}
diff --git a/src/renderer/src/store/slices/local-agent-legacy-loading.ts b/src/renderer/src/store/slices/local-agent-legacy-loading.ts
new file mode 100644
index 00000000000..18e99768003
--- /dev/null
+++ b/src/renderer/src/store/slices/local-agent-legacy-loading.ts
@@ -0,0 +1,43 @@
+import type { AppState } from '../types'
+import { removeLocalAgentContextEntry } from './local-agent-context-eviction'
+
+type LocalAgentLegacyLoadingState = Pick<
+  AppState,
+  'detectedAgentIds' | 'isDetectingAgents' | 'isRefreshingAgents'
+>
+
+type LocalAgentLegacyLoadingPatch = Partial<LocalAgentLegacyLoadingState>
+
+export function getLegacyLoadingPatch(
+  state: LocalAgentLegacyLoadingState,
+  contextMatches: boolean,
+  phase: 'detect' | 'refresh'
+): LocalAgentLegacyLoadingPatch | null {
+  const detectedAgentIds = contextMatches ? state.detectedAgentIds : null
+  const alreadyLoading = phase === 'detect' ? state.isDetectingAgents : state.isRefreshingAgents
+  if (state.detectedAgentIds === detectedAgentIds && alreadyLoading) {
+    return null
+  }
+  return phase === 'detect'
+    ? { detectedAgentIds, isDetectingAgents: true }
+    : { detectedAgentIds, isRefreshingAgents: true }
+}
+
+export function getSupersededDetectPatch(
+  state: LocalAgentLegacyLoadingState & Pick<AppState, 'isDetectingLocalAgentsByContext'>,
+  contextKey: string,
+  supersedesDetect: boolean,
+  clearsLegacyDetect: boolean
+): Partial<AppState> {
+  return {
+    ...(clearsLegacyDetect ? { isDetectingAgents: false } : {}),
+    ...(supersedesDetect
+      ? {
+          isDetectingLocalAgentsByContext: removeLocalAgentContextEntry(
+            state.isDetectingLocalAgentsByContext,
+            contextKey
+          )
+        }
+      : {})
+  }
+}
diff --git a/src/renderer/src/store/slices/local-detected-agent-state.test.ts b/src/renderer/src/store/slices/local-detected-agent-state.test.ts
new file mode 100644
index 00000000000..77303b8bc89
--- /dev/null
+++ b/src/renderer/src/store/slices/local-detected-agent-state.test.ts
@@ -0,0 +1,222 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { create } from 'zustand'
+import type { AppState } from '../types'
+import type { Repo } from '../../../../shared/types'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import { createDetectedAgentsSlice } from './detected-agents'
+
+const detectAgents = vi.fn()
+const refreshAgents = vi.fn()
+
+globalThis.window = {
+  api: {
+    preflight: { detectAgents, refreshAgents },
+    platform: { get: () => ({ platform: 'win32' }) }
+  } as unknown as Window['api']
+} as Window & typeof globalThis
+
+function makeRepo(id: string): Repo {
+  return {
+    id,
+    path: `C:\\${id}`,
+    displayName: id,
+    badgeColor: '#000000',
+    addedAt: 0
+  }
+}
+
+function createTestStore(repos: Repo[]) {
+  const store = create<AppState>()(
+    (...args) => createDetectedAgentsSlice(...args) as unknown as AppState
+  )
+  store.setState({
+    repos,
+    projects: [],
+    worktreesByRepo: {},
+    activeRepoId: repos[0]?.id ?? null,
+    activeWorktreeId: null
+  } as Partial<AppState>)
+  return store
+}
+
+describe('local detected agent context lifecycle', () => {
+  beforeEach(() => {
+    detectAgents.mockReset().mockResolvedValue(['claude'])
+    refreshAgents.mockReset().mockResolvedValue({
+      agents: ['codex'],
+      pathSource: 'process_env',
+      pathFailureReason: 'none'
+    })
+  })
+
+  it('deduplicates Floating-first callers without cached or settlement broadcast fanout', async () => {
+    let resolveDetection: (agents: string[]) => void = () => {}
+    detectAgents.mockReturnValueOnce(
+      new Promise<string[]>((resolve) => {
+        resolveDetection = resolve
+      })
+    )
+    const store = createTestStore([])
+    let broadcasts = 0
+    const unsubscribe = store.subscribe(() => {
+      broadcasts += 1
+    })
+
+    const floating = store.getState().ensureDetectedAgents(FLOATING_TERMINAL_WORKTREE_ID)
+    const ordinary = store.getState().ensureDetectedAgents()
+    const joinedOrdinary = store.getState().ensureDetectedAgents()
+
+    expect(detectAgents).toHaveBeenCalledTimes(1)
+    expect(ordinary).toBe(floating)
+    expect(joinedOrdinary).toBe(floating)
+    broadcasts = 0
+    resolveDetection(['codex'])
+    await Promise.all([floating, ordinary, joinedOrdinary])
+    expect(broadcasts).toBe(1)
+
+    broadcasts = 0
+    await store.getState().ensureDetectedAgents()
+    await store.getState().ensureDetectedAgents()
+    expect(broadcasts).toBe(0)
+    unsubscribe()
+  })
+
+  it('evicts removed project contexts without retaining settled loading entries', async () => {
+    const repo1 = makeRepo('repo-1')
+    const repo2 = makeRepo('repo-2')
+    const store = createTestStore([repo1, repo2])
+
+    await store.getState().ensureDetectedAgents()
+    store.setState({ activeRepoId: 'repo-2' })
+    await store.getState().ensureDetectedAgents()
+
+    expect(Object.keys(store.getState().localDetectedAgentIdsByContext)).toEqual([
+      'repo-1:windows-host',
+      'repo-2:windows-host'
+    ])
+    expect(store.getState().isDetectingLocalAgentsByContext).toEqual({})
+    expect(store.getState().isRefreshingLocalAgentsByContext).toEqual({})
+
+    store.setState({ repos: [repo2] })
+    store.getState().clearLocalDetectedAgentContextsForProjects(['repo-1'])
+
+    expect(store.getState().localDetectedAgentIdsByContext).toEqual({
+      'repo-2:windows-host': ['claude']
+    })
+
+    store.setState({ repos: [repo1, repo2], activeRepoId: 'repo-1' })
+    await expect(store.getState().ensureDetectedAgents()).resolves.toEqual(['claude'])
+    expect(detectAgents).toHaveBeenCalledTimes(3)
+  })
+
+  it('does not restore a project context cleared while detection is in flight', async () => {
+    let resolveDetection: (agents: string[]) => void = () => {}
+    detectAgents.mockReturnValueOnce(
+      new Promise<string[]>((resolve) => {
+        resolveDetection = resolve
+      })
+    )
+    const store = createTestStore([makeRepo('repo-1')])
+
+    const pending = store.getState().ensureDetectedAgents()
+    store.getState().clearLocalDetectedAgentContextsForProjects(['repo-1'])
+    resolveDetection(['claude'])
+
+    await expect(pending).resolves.toEqual(['claude'])
+    expect(store.getState().localDetectedAgentIdsByContext).toEqual({})
+    expect(store.getState().isDetectingLocalAgentsByContext).toEqual({})
+    expect(store.getState().detectedAgentIds).toBeNull()
+  })
+
+  it('does not let an older detect overwrite a successful refresh', async () => {
+    let resolveDetection: (agents: string[]) => void = () => {}
+    detectAgents.mockReturnValueOnce(
+      new Promise<string[]>((resolve) => {
+        resolveDetection = resolve
+      })
+    )
+    const store = createTestStore([])
+
+    const detect = store.getState().ensureDetectedAgents()
+    await expect(store.getState().refreshDetectedAgents()).resolves.toEqual(['codex'])
+    resolveDetection(['claude'])
+    await expect(detect).resolves.toEqual(['claude'])
+
+    expect(store.getState().detectedAgentIds).toEqual(['codex'])
+    expect(store.getState().localDetectedAgentIdsByContext.host).toEqual(['codex'])
+    expect(store.getState().isDetectingAgents).toBe(false)
+    expect(store.getState().isDetectingLocalAgentsByContext).toEqual({})
+  })
+
+  it('does not let an older failed detect erase a successful refresh', async () => {
+    let rejectDetection: (error: Error) => void = () => {}
+    detectAgents.mockReturnValueOnce(
+      new Promise<string[]>((_resolve, reject) => {
+        rejectDetection = reject
+      })
+    )
+    const store = createTestStore([])
+
+    const detect = store.getState().ensureDetectedAgents()
+    await expect(store.getState().refreshDetectedAgents()).resolves.toEqual(['codex'])
+    rejectDetection(new Error('older detect failed'))
+    await expect(detect).resolves.toEqual([])
+
+    expect(store.getState().detectedAgentIds).toEqual(['codex'])
+    expect(store.getState().localDetectedAgentIdsByContext.host).toEqual(['codex'])
+    await expect(store.getState().ensureDetectedAgents()).resolves.toEqual(['codex'])
+    expect(detectAgents).toHaveBeenCalledTimes(1)
+  })
+
+  it('joins an authoritative refresh instead of starting a later detect', async () => {
+    let resolveRefresh: (result: {
+      agents: string[]
+      pathSource: string
+      pathFailureReason: string
+    }) => void = () => {}
+    refreshAgents.mockReturnValueOnce(
+      new Promise((resolve) => {
+        resolveRefresh = resolve
+      })
+    )
+    const store = createTestStore([])
+
+    const refresh = store.getState().refreshDetectedAgents()
+    const ensure = store.getState().ensureDetectedAgents()
+    expect(ensure).toBe(refresh)
+    expect(detectAgents).not.toHaveBeenCalled()
+
+    resolveRefresh({
+      agents: ['codex'],
+      pathSource: 'process_env',
+      pathFailureReason: 'none'
+    })
+    await expect(Promise.all([refresh, ensure])).resolves.toEqual([['codex'], ['codex']])
+    expect(store.getState().detectedAgentIds).toEqual(['codex'])
+    expect(store.getState().localDetectedAgentIdsByContext.host).toEqual(['codex'])
+  })
+
+  it('retries after an authoritative refresh fails without a usable cache', async () => {
+    let resolveDetection: (agents: string[]) => void = () => {}
+    detectAgents.mockReturnValueOnce(
+      new Promise<string[]>((resolve) => {
+        resolveDetection = resolve
+      })
+    )
+    refreshAgents.mockRejectedValueOnce(new Error('transient refresh failure'))
+    const store = createTestStore([])
+
+    const supersededDetect = store.getState().ensureDetectedAgents(FLOATING_TERMINAL_WORKTREE_ID)
+    await expect(
+      store.getState().refreshDetectedAgents(FLOATING_TERMINAL_WORKTREE_ID)
+    ).resolves.toEqual([])
+    resolveDetection(['stale'])
+    await expect(supersededDetect).resolves.toEqual(['stale'])
+
+    await expect(
+      store.getState().ensureDetectedAgents(FLOATING_TERMINAL_WORKTREE_ID)
+    ).resolves.toEqual(['claude'])
+    expect(detectAgents).toHaveBeenCalledTimes(2)
+    expect(store.getState().localDetectedAgentIdsByContext.host).toEqual(['claude'])
+  })
+})
diff --git a/src/renderer/src/store/slices/local-detected-agent-state.ts b/src/renderer/src/store/slices/local-detected-agent-state.ts
new file mode 100644
index 00000000000..43b39ff5980
--- /dev/null
+++ b/src/renderer/src/store/slices/local-detected-agent-state.ts
@@ -0,0 +1,302 @@
+import type { StateCreator } from 'zustand'
+import type { AppState } from '../types'
+import type { TuiAgent } from '../../../../shared/types'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import {
+  getLocalAgentPreflightContext,
+  localPreflightContextKey
+} from '@/lib/local-preflight-context'
+import * as contextEviction from './local-agent-context-eviction'
+import { getLegacyLoadingPatch, getSupersededDetectPatch } from './local-agent-legacy-loading'
+import { createEmptyLocalDetectedAgentState } from './local-detected-agent-store-state'
+import type { LocalDetectedAgentState } from './local-detected-agent-store-state'
+
+type LocalDetectedAgentStateCreator = StateCreator<AppState, [], [], LocalDetectedAgentState>
+
+export const createLocalDetectedAgentState: LocalDetectedAgentStateCreator = (set, get) => {
+  const detectPromises = new Map<string, Promise<TuiAgent[]>>()
+  const refreshPromises = new Map<string, Promise<TuiAgent[]>>()
+  const failedDetectContextKeys = new Set<string>()
+  let detectedContextKey: string | null = null
+  let legacyDetectContextKey: string | null = null
+  let legacyRefreshContextKey: string | null = null
+  let localDetectionGeneration = 0
+
+  return {
+    ...createEmptyLocalDetectedAgentState(),
+
+    ensureDetectedAgents: (worktreeId) => {
+      const isFloating = worktreeId === FLOATING_TERMINAL_WORKTREE_ID
+      const context = getLocalAgentPreflightContext(get(), undefined, undefined, worktreeId)
+      const contextKey = localPreflightContextKey(context)
+      const existing = get().localDetectedAgentIdsByContext[contextKey]
+      const inflightRefresh = refreshPromises.get(contextKey)
+      if (inflightRefresh) {
+        if (!isFloating) {
+          legacyRefreshContextKey = contextKey
+        }
+        return inflightRefresh
+      }
+      if (existing != null && !failedDetectContextKeys.has(contextKey)) {
+        if (!isFloating) {
+          detectedContextKey = contextKey
+          const state = get()
+          if (state.detectedAgentIds !== existing || state.isDetectingAgents) {
+            set({ detectedAgentIds: existing, isDetectingAgents: false })
+          }
+        }
+        return Promise.resolve(existing)
+      }
+      const requestGeneration = localDetectionGeneration
+      const exposeInflightToLegacy = (): void => {
+        if (!isFloating) {
+          legacyDetectContextKey = contextKey
+        }
+        if (isFloating) {
+          return
+        }
+        const state = get()
+        const patch = getLegacyLoadingPatch(state, detectedContextKey === contextKey, 'detect')
+        if (patch) {
+          set(patch)
+        }
+      }
+      const inflight = detectPromises.get(contextKey)
+      if (inflight) {
+        exposeInflightToLegacy()
+        return inflight
+      }
+      if (!isFloating) {
+        legacyDetectContextKey = contextKey
+      }
+      set((state) => ({
+        ...(isFloating
+          ? {}
+          : (getLegacyLoadingPatch(state, detectedContextKey === contextKey, 'detect') ?? {})),
+        localDetectedAgentIdsByContext: {
+          ...state.localDetectedAgentIdsByContext,
+          [contextKey]: existing ?? null
+        },
+        isDetectingLocalAgentsByContext: {
+          ...state.isDetectingLocalAgentsByContext,
+          [contextKey]: true
+        }
+      }))
+      const pending = window.api.preflight
+        .detectAgents(context)
+        .then((ids) => {
+          const typed = ids as TuiAgent[]
+          if (
+            requestGeneration === localDetectionGeneration &&
+            detectPromises.get(contextKey) === pending
+          ) {
+            failedDetectContextKeys.delete(contextKey)
+            const exposeToLegacy = legacyDetectContextKey === contextKey
+            if (exposeToLegacy) {
+              legacyDetectContextKey = null
+              detectedContextKey = contextKey
+            }
+            set((state) => ({
+              ...(exposeToLegacy ? { detectedAgentIds: typed, isDetectingAgents: false } : {}),
+              localDetectedAgentIdsByContext: {
+                ...state.localDetectedAgentIdsByContext,
+                [contextKey]: typed
+              },
+              isDetectingLocalAgentsByContext: contextEviction.removeLocalAgentContextEntry(
+                state.isDetectingLocalAgentsByContext,
+                contextKey
+              )
+            }))
+          }
+          return typed
+        })
+        .catch(() => {
+          if (
+            requestGeneration === localDetectionGeneration &&
+            detectPromises.get(contextKey) === pending
+          ) {
+            failedDetectContextKeys.add(contextKey)
+            const exposeToLegacy = legacyDetectContextKey === contextKey
+            if (exposeToLegacy) {
+              legacyDetectContextKey = null
+            }
+            set((state) => ({
+              ...(exposeToLegacy ? { detectedAgentIds: [], isDetectingAgents: false } : {}),
+              localDetectedAgentIdsByContext: {
+                ...state.localDetectedAgentIdsByContext,
+                [contextKey]: []
+              },
+              isDetectingLocalAgentsByContext: contextEviction.removeLocalAgentContextEntry(
+                state.isDetectingLocalAgentsByContext,
+                contextKey
+              )
+            }))
+          }
+          return [] as TuiAgent[]
+        })
+        .finally(() => {
+          if (detectPromises.get(contextKey) === pending) {
+            detectPromises.delete(contextKey)
+          }
+        })
+      detectPromises.set(contextKey, pending)
+      return pending
+    },
+
+    refreshDetectedAgents: (worktreeId) => {
+      const isFloating = worktreeId === FLOATING_TERMINAL_WORKTREE_ID
+      const context = getLocalAgentPreflightContext(get(), undefined, undefined, worktreeId)
+      const contextKey = localPreflightContextKey(context)
+      const cached = get().localDetectedAgentIdsByContext[contextKey]
+      const hadUsableCache = cached != null && !failedDetectContextKeys.has(contextKey)
+      const requestGeneration = localDetectionGeneration
+      const exposeInflightToLegacy = (): void => {
+        if (!isFloating) {
+          legacyRefreshContextKey = contextKey
+        }
+        if (isFloating) {
+          return
+        }
+        const state = get()
+        const patch = getLegacyLoadingPatch(state, detectedContextKey === contextKey, 'refresh')
+        if (patch) {
+          set(patch)
+        }
+      }
+      const inflight = refreshPromises.get(contextKey)
+      if (inflight) {
+        exposeInflightToLegacy()
+        return inflight
+      }
+      if (!isFloating) {
+        legacyRefreshContextKey = contextKey
+      }
+      const supersedesDetect = detectPromises.delete(contextKey)
+      const clearsLegacyDetect = legacyDetectContextKey === contextKey
+      if (clearsLegacyDetect) {
+        legacyDetectContextKey = null
+      }
+      set((state) => ({
+        ...(isFloating
+          ? {}
+          : (getLegacyLoadingPatch(state, detectedContextKey === contextKey, 'refresh') ?? {})),
+        ...getSupersededDetectPatch(state, contextKey, supersedesDetect, clearsLegacyDetect),
+        isRefreshingLocalAgentsByContext: {
+          ...state.isRefreshingLocalAgentsByContext,
+          [contextKey]: true
+        }
+      }))
+      const pending = window.api.preflight
+        .refreshAgents(context)
+        .then((result) => {
+          const typed = result.agents as TuiAgent[]
+          if (
+            requestGeneration === localDetectionGeneration &&
+            refreshPromises.get(contextKey) === pending
+          ) {
+            failedDetectContextKeys.delete(contextKey)
+            const exposeToLegacy = legacyRefreshContextKey === contextKey
+            if (exposeToLegacy) {
+              legacyRefreshContextKey = null
+              detectedContextKey = contextKey
+            }
+            set((state) => ({
+              ...(exposeToLegacy
+                ? {
+                    detectedAgentIds: typed,
+                    isRefreshingAgents: false,
+                    pathSource: result.pathSource,
+                    pathFailureReason: result.pathFailureReason
+                  }
+                : {}),
+              localDetectedAgentIdsByContext: {
+                ...state.localDetectedAgentIdsByContext,
+                [contextKey]: typed
+              },
+              isRefreshingLocalAgentsByContext: contextEviction.removeLocalAgentContextEntry(
+                state.isRefreshingLocalAgentsByContext,
+                contextKey
+              )
+            }))
+          }
+          return typed
+        })
+        .catch(() => {
+          const fallback = isFloating
+            ? (get().localDetectedAgentIdsByContext[contextKey] ?? [])
+            : detectedContextKey !== contextKey
+              ? []
+              : (get().detectedAgentIds ?? [])
+          if (
+            requestGeneration === localDetectionGeneration &&
+            refreshPromises.get(contextKey) === pending
+          ) {
+            if (!hadUsableCache) {
+              failedDetectContextKeys.add(contextKey)
+            }
+            const exposeToLegacy = legacyRefreshContextKey === contextKey
+            if (exposeToLegacy) {
+              legacyRefreshContextKey = null
+            }
+            set((state) => ({
+              ...(exposeToLegacy ? { detectedAgentIds: fallback, isRefreshingAgents: false } : {}),
+              localDetectedAgentIdsByContext: {
+                ...state.localDetectedAgentIdsByContext,
+                [contextKey]: fallback
+              },
+              isRefreshingLocalAgentsByContext: contextEviction.removeLocalAgentContextEntry(
+                state.isRefreshingLocalAgentsByContext,
+                contextKey
+              )
+            }))
+          }
+          return fallback
+        })
+        .finally(() => {
+          if (refreshPromises.get(contextKey) === pending) {
+            refreshPromises.delete(contextKey)
+          }
+        })
+      refreshPromises.set(contextKey, pending)
+      return pending
+    },
+
+    clearLocalDetectedAgentContextsForProjects: (projectIds) => {
+      const eviction = contextEviction.getLocalAgentContextEviction({
+        projectIds,
+        state: get(),
+        internalContextKeys: [
+          ...detectPromises.keys(),
+          ...refreshPromises.keys(),
+          ...failedDetectContextKeys
+        ],
+        detectedContextKey,
+        legacyDetectContextKey,
+        legacyRefreshContextKey
+      })
+      if (!eviction) {
+        return
+      }
+      for (const contextKey of eviction.removedContextKeys) {
+        detectPromises.delete(contextKey)
+        refreshPromises.delete(contextKey)
+        failedDetectContextKeys.delete(contextKey)
+      }
+      detectedContextKey = eviction.detectedContextKey
+      legacyDetectContextKey = eviction.legacyDetectContextKey
+      legacyRefreshContextKey = eviction.legacyRefreshContextKey
+      set(eviction.statePatch)
+    },
+
+    clearLocalDetectedAgents: () => {
+      localDetectionGeneration += 1
+      detectPromises.clear()
+      refreshPromises.clear()
+      failedDetectContextKeys.clear()
+      detectedContextKey = null
+      legacyDetectContextKey = null
+      legacyRefreshContextKey = null
+      set(createEmptyLocalDetectedAgentState())
+    }
+  }
+}
diff --git a/src/renderer/src/store/slices/local-detected-agent-store-state.ts b/src/renderer/src/store/slices/local-detected-agent-store-state.ts
new file mode 100644
index 00000000000..c961bb5114f
--- /dev/null
+++ b/src/renderer/src/store/slices/local-detected-agent-store-state.ts
@@ -0,0 +1,40 @@
+import type { AppState } from '../types'
+import type { PathSource, ShellHydrationFailureReason, TuiAgent } from '../../../../shared/types'
+
+export type LocalDetectedAgentState = {
+  detectedAgentIds: TuiAgent[] | null
+  isDetectingAgents: boolean
+  isRefreshingAgents: boolean
+  localDetectedAgentIdsByContext: Record<string, TuiAgent[] | null>
+  isDetectingLocalAgentsByContext: Record<string, boolean>
+  isRefreshingLocalAgentsByContext: Record<string, boolean>
+  pathSource: PathSource | null
+  pathFailureReason: ShellHydrationFailureReason | null
+  ensureDetectedAgents: (worktreeId?: string | null) => Promise<TuiAgent[]>
+  refreshDetectedAgents: (worktreeId?: string | null) => Promise<TuiAgent[]>
+  clearLocalDetectedAgentContextsForProjects: (projectIds: readonly string[]) => void
+  clearLocalDetectedAgents: () => void
+}
+
+export function createEmptyLocalDetectedAgentState(): Pick<
+  AppState,
+  | 'detectedAgentIds'
+  | 'isDetectingAgents'
+  | 'isRefreshingAgents'
+  | 'localDetectedAgentIdsByContext'
+  | 'isDetectingLocalAgentsByContext'
+  | 'isRefreshingLocalAgentsByContext'
+  | 'pathSource'
+  | 'pathFailureReason'
+> {
+  return {
+    detectedAgentIds: null,
+    isDetectingAgents: false,
+    isRefreshingAgents: false,
+    localDetectedAgentIdsByContext: {},
+    isDetectingLocalAgentsByContext: {},
+    isRefreshingLocalAgentsByContext: {},
+    pathSource: null,
+    pathFailureReason: null
+  }
+}
diff --git a/src/renderer/src/store/slices/repo-filter-selection.ts b/src/renderer/src/store/slices/repo-filter-selection.ts
new file mode 100644
index 00000000000..65ae6d344a8
--- /dev/null
+++ b/src/renderer/src/store/slices/repo-filter-selection.ts
@@ -0,0 +1,10 @@
+// Why: catalog refreshes re-filter this on every fetch; six identity-sensitive subscribers
+// (App.tsx at the root among them) re-render on a new array even when nothing was pruned.
+export function retainValidFilterRepoIds(
+  filterRepoIds: readonly string[],
+  validRepoIds: ReadonlySet<string>
+): readonly string[] {
+  return filterRepoIds.every((repoId) => validRepoIds.has(repoId))
+    ? filterRepoIds
+    : filterRepoIds.filter((repoId) => validRepoIds.has(repoId))
+}
diff --git a/src/renderer/src/store/slices/repo-host-identity.ts b/src/renderer/src/store/slices/repo-host-identity.ts
index be1c2255621..f21da2b153a 100644
--- a/src/renderer/src/store/slices/repo-host-identity.ts
+++ b/src/renderer/src/store/slices/repo-host-identity.ts
@@ -29,7 +29,7 @@ export function findRepoForHost<T extends RepoIdentityParts>(
   repos: readonly T[],
   repoId: string,
   options: {
-    hostId?: ExecutionHostId | string | null
+    hostId?: ExecutionHostId | (string & {}) | null
     settings?: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null
   } = {}
 ): T | null {
diff --git a/src/renderer/src/store/slices/repo-identity-reconcile.test.ts b/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
index dda221e18b0..ecc1fa7d59e 100644
--- a/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
+++ b/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import fs from 'node:fs'
 import type { Repo } from '../../../../shared/types'
-import { reconcileFetchedRepos } from './repo-identity-reconcile'
+import { reconcileFetchedRepos, reuseEqualRecordMap } from './repo-identity-reconcile'
 
 function makeRepo(id: string, overrides: Partial<Repo> = {}): Repo {
   return { id, path: `/${id}`, displayName: id, badgeColor: '#000', addedAt: 1, ...overrides }
@@ -123,3 +123,54 @@ describe('reconcileFetchedRepos', () => {
     expect(source).not.toMatch(/previous\.find|next\.find|findIndex/)
   })
 })
+
+describe('reuseEqualRecordMap', () => {
+  const row = (value: string): { value: string; nested: { tags: string[] } } => ({
+    value,
+    nested: { tags: [value, 'shared'] }
+  })
+
+  it('returns the previous map when every key holds an equal value', () => {
+    const previous = { a: row('a'), b: row('b') }
+    expect(reuseEqualRecordMap(previous, { a: row('a'), b: row('b') })).toBe(previous)
+  })
+
+  it('reuses the previous entry for structurally equal nested values', () => {
+    const previous = { a: row('a'), b: row('b') }
+    const result = reuseEqualRecordMap(previous, { a: row('a'), b: row('changed') })
+    expect(result).not.toBe(previous)
+    expect(result.a).toBe(previous.a)
+    expect(result.b).toEqual(row('changed'))
+  })
+
+  it('returns a new map when a value changed', () => {
+    const previous = { a: row('a') }
+    const result = reuseEqualRecordMap(previous, { a: row('changed') })
+    expect(result).not.toBe(previous)
+    expect(result.a).toEqual(row('changed'))
+  })
+
+  it('returns a new map when a key is added', () => {
+    const previous = { a: row('a') }
+    const result = reuseEqualRecordMap(previous, { a: row('a'), b: row('b') })
+    expect(result).not.toBe(previous)
+    expect(result.a).toBe(previous.a)
+    expect(Object.keys(result)).toEqual(['a', 'b'])
+  })
+
+  it('returns a new map when a key is removed', () => {
+    const previous = { a: row('a'), b: row('b') }
+    const result = reuseEqualRecordMap(previous, { a: row('a') })
+    expect(result).not.toBe(previous)
+    expect(Object.keys(result)).toEqual(['a'])
+  })
+
+  it('returns a new map when a key is swapped for a same-count replacement', () => {
+    // Why: equal key counts alone must not read as unchanged — the replacement key misses the
+    // previous lookup, which is why no second pass over the previous keys is needed.
+    const previous = { a: row('a'), b: row('b') }
+    const result = reuseEqualRecordMap(previous, { a: row('a'), c: row('b') })
+    expect(result).not.toBe(previous)
+    expect(Object.keys(result)).toEqual(['a', 'c'])
+  })
+})
diff --git a/src/renderer/src/store/slices/repo-identity-reconcile.ts b/src/renderer/src/store/slices/repo-identity-reconcile.ts
index 9212313f0c7..db59e619d97 100644
--- a/src/renderer/src/store/slices/repo-identity-reconcile.ts
+++ b/src/renderer/src/store/slices/repo-identity-reconcile.ts
@@ -12,7 +12,7 @@ import { getRepoHostIdentity } from './repo-host-identity'
 // arrays). IPC structured-clone rebuilds those every fetch, and main's hydrateRepo always
 // reconstructs hookSettings — so a reference compare reports every repo as changed and no repo
 // ever reconciles. Compare nested plain values structurally; they are small sanitized records.
-function areValuesEqual(a: unknown, b: unknown): boolean {
+export function areValuesEqual(a: unknown, b: unknown): boolean {
   if (a === b) {
     return true
   }
@@ -28,9 +28,11 @@ function areValuesEqual(a: unknown, b: unknown): boolean {
     )
   }
   // Why: only plain records are safe to walk — anything exotic falls back to reference equality.
+  const aPrototype = Object.getPrototypeOf(a)
+  const bPrototype = Object.getPrototypeOf(b)
   if (
-    Object.getPrototypeOf(a) !== Object.prototype ||
-    Object.getPrototypeOf(b) !== Object.prototype
+    (aPrototype !== Object.prototype && aPrototype !== null) ||
+    (bPrototype !== Object.prototype && bPrototype !== null)
   ) {
     return false
   }
@@ -41,47 +43,64 @@ function areValuesEqual(a: unknown, b: unknown): boolean {
     return false
   }
   return keys.every(
-    (key) =>
-      Object.prototype.hasOwnProperty.call(bRecord, key) &&
-      areValuesEqual(aRecord[key], bRecord[key])
+    (key) => Object.hasOwn(bRecord, key) && areValuesEqual(aRecord[key], bRecord[key])
   )
 }
 
-function areReposEqual(a: Repo, b: Repo): boolean {
-  if (a === b) {
-    return true
-  }
-  const keys = Object.keys(a) as (keyof Repo)[]
-  if (keys.length !== Object.keys(b).length) {
-    return false
-  }
-  for (const key of keys) {
-    if (!Object.prototype.hasOwnProperty.call(b, key)) {
-      return false
-    }
-    if (!areValuesEqual(a[key], b[key])) {
-      return false
-    }
-  }
-  return true
-}
-
-export function reconcileFetchedRepos(
-  previous: readonly Repo[],
-  next: readonly Repo[]
-): readonly Repo[] {
-  const previousById = new Map(previous.map((repo) => [getRepoHostIdentity(repo), repo]))
+/**
+ * Reuses equal rows from `previous` — and the whole array when nothing moved — so a refetch that
+ * changed nothing leaves identity-keyed memos and store subscribers untouched. `getIdentity` must
+ * be the key the producing merge already dedups by, so it is unique within `next`.
+ */
+export function reconcileCatalogRows<T>(
+  previous: readonly T[],
+  next: readonly T[],
+  getIdentity: (row: T) => string
+): readonly T[] {
+  const previousByIdentity = new Map(previous.map((row) => [getIdentity(row), row]))
   let identical = next.length === previous.length
-  const reconciled = next.map((repo, index) => {
-    const existing = previousById.get(getRepoHostIdentity(repo))
-    if (existing && areReposEqual(existing, repo)) {
+  const reconciled = next.map((row, index) => {
+    const existing = previousByIdentity.get(getIdentity(row))
+    if (existing !== undefined && areValuesEqual(existing, row)) {
       if (existing !== previous[index]) {
         identical = false
       }
       return existing
     }
     identical = false
-    return repo
+    return row
   })
   return identical ? previous : reconciled
 }
+
+export function reconcileFetchedRepos(
+  previous: readonly Repo[],
+  next: readonly Repo[]
+): readonly Repo[] {
+  return reconcileCatalogRows(previous, next, getRepoHostIdentity)
+}
+
+/**
+ * Reuses equal record values from `previous` — and the whole map when nothing
+ * changed — so a cloned no-op refresh leaves Object.is subscribers untouched.
+ */
+export function reuseEqualRecordMap<T>(
+  previous: Readonly<Record<string, T>>,
+  next: Readonly<Record<string, T>>
+): Readonly<Record<string, T>> {
+  const nextKeys = Object.keys(next)
+  // Why: a matching key count plus every `next` key resolving to an equal `previous` entry below
+  // means the key sets match, so a removed key always lands as either a count or a lookup miss.
+  let identical = nextKeys.length === Object.keys(previous).length
+  const reconciled: Record<string, T> = {}
+  for (const key of nextKeys) {
+    const existing = Object.hasOwn(previous, key) ? previous[key] : undefined
+    if (existing !== undefined && areValuesEqual(existing, next[key])) {
+      reconciled[key] = existing
+      continue
+    }
+    identical = false
+    reconciled[key] = next[key]
+  }
+  return identical ? previous : reconciled
+}
diff --git a/src/renderer/src/store/slices/repos-all-hosts-generation.test.ts b/src/renderer/src/store/slices/repos-all-hosts-generation.test.ts
index 24e2c770dce..1aa9ed76072 100644
--- a/src/renderer/src/store/slices/repos-all-hosts-generation.test.ts
+++ b/src/renderer/src/store/slices/repos-all-hosts-generation.test.ts
@@ -147,6 +147,86 @@ describe('fetchReposForAllHosts generation', () => {
     expect(store.getState().repos.map((repo) => repo.id)).toEqual(['local-repo', 'remote-repo'])
   })
 
+  it('keeps an in-flight all-host remote result across a newer local refresh', async () => {
+    let resolveRemote!: (value: unknown) => void
+    let markRemoteStarted!: () => void
+    const remote = new Promise((resolve) => {
+      resolveRemote = resolve
+    })
+    const remoteStarted = new Promise<void>((resolve) => {
+      markRemoteStarted = resolve
+    })
+    runtimeEnvironmentCall.mockImplementation((args: RuntimeEnvironmentCallRequest) => {
+      if (args.method === 'repo.list') {
+        markRemoteStarted()
+        return remote
+      }
+      return {
+        id: 'rpc-other',
+        ok: true,
+        result: { projects: [], setups: [] },
+        _meta: { runtimeId: 'runtime-remote' }
+      }
+    })
+    const store = createTestStore()
+
+    const allHosts = store.getState().fetchReposForAllHosts()
+    await remoteStarted
+    await store.getState().fetchRepos({ runtimeEnvironmentId: null })
+    resolveRemote({
+      id: 'rpc-repo-list',
+      ok: true,
+      result: { repos: [remoteRepo] },
+      _meta: { runtimeId: 'runtime-remote' }
+    })
+    await allHosts
+
+    expect(store.getState().repos.map((repo) => repo.id)).toEqual(['local-repo', 'remote-repo'])
+  })
+
+  it('starts all-host remote loads after a newer local refresh replaces its local result', async () => {
+    let resolveOlderLocal!: (repos: Repo[]) => void
+    let resolveRemote!: (value: unknown) => void
+    let markRemoteStarted!: () => void
+    const olderLocal = new Promise<Repo[]>((resolve) => {
+      resolveOlderLocal = resolve
+    })
+    const remote = new Promise((resolve) => {
+      resolveRemote = resolve
+    })
+    const remoteStarted = new Promise<void>((resolve) => {
+      markRemoteStarted = resolve
+    })
+    reposList.mockReturnValueOnce(olderLocal)
+    runtimeEnvironmentCall.mockImplementation((args: RuntimeEnvironmentCallRequest) => {
+      if (args.method === 'repo.list') {
+        markRemoteStarted()
+        return remote
+      }
+      return {
+        id: 'rpc-other',
+        ok: true,
+        result: { projects: [], setups: [] },
+        _meta: { runtimeId: 'runtime-remote' }
+      }
+    })
+    const store = createTestStore()
+
+    const allHosts = store.getState().fetchReposForAllHosts()
+    await store.getState().fetchRepos({ runtimeEnvironmentId: null })
+    resolveOlderLocal([localRepo])
+    await remoteStarted
+    resolveRemote({
+      id: 'rpc-repo-list',
+      ok: true,
+      result: { repos: [remoteRepo] },
+      _meta: { runtimeId: 'runtime-remote' }
+    })
+    await allHosts
+
+    expect(store.getState().repos.map((repo) => repo.id)).toEqual(['local-repo', 'remote-repo'])
+  })
+
   it('keeps a newer Connect-flow catalog when an older all-host response resolves last', async () => {
     let resolveOlder!: (value: unknown) => void
     let markOlderStarted!: () => void
diff --git a/src/renderer/src/store/slices/repos-paired-runtime-add.test.ts b/src/renderer/src/store/slices/repos-paired-runtime-add.test.ts
new file mode 100644
index 00000000000..4e0f4cae622
--- /dev/null
+++ b/src/renderer/src/store/slices/repos-paired-runtime-add.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createTestStore } from './store-test-helpers'
+import {
+  installReposRuntimeRoutingHarness,
+  remoteRepo,
+  reposAdd,
+  reposPickFolder,
+  runtimeEnvironmentCall
+} from './repos-runtime-routing-fixture'
+
+vi.mock('sonner', () => ({
+  toast: {
+    error: vi.fn(),
+    info: vi.fn(),
+    success: vi.fn(),
+    warning: vi.fn()
+  }
+}))
+
+installReposRuntimeRoutingHarness()
+
+describe('paired runtime repo add routing', () => {
+  it('submits the selected host path to repo.add without native filesystem calls', async () => {
+    runtimeEnvironmentCall.mockResolvedValue({
+      id: 'rpc-paired-add',
+      ok: true,
+      result: { repo: remoteRepo },
+      _meta: { runtimeId: 'runtime-remote' }
+    })
+    const store = createTestStore()
+
+    await store.getState().addRepoPath('/srv/paired-project', 'folder', {
+      runtimeEnvironmentId: 'paired-host'
+    })
+
+    expect(runtimeEnvironmentCall).toHaveBeenCalledWith({
+      selector: 'paired-host',
+      method: 'repo.add',
+      params: { path: '/srv/paired-project', kind: 'folder' },
+      timeoutMs: 15_000
+    })
+    expect(reposAdd).not.toHaveBeenCalled()
+    expect(reposPickFolder).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/store/slices/repos-project-runtime.test.ts b/src/renderer/src/store/slices/repos-project-runtime.test.ts
index f007158d31b..ba61fd6a552 100644
--- a/src/renderer/src/store/slices/repos-project-runtime.test.ts
+++ b/src/renderer/src/store/slices/repos-project-runtime.test.ts
@@ -266,6 +266,35 @@ describe('repo slice project runtime updates', () => {
     expect(projectsUpdate).not.toHaveBeenCalled()
   })
 
+  // Why: a host whose repos carry no `addedAt` projects createdAt 0, which means unknown, not
+  // epoch. Merging it with the host that does know the timestamp must keep the real one.
+  it('prefers a known createdAt over an unknown 0 when merging the same project id', async () => {
+    const project: Project = {
+      id: 'github:stablyai/orca',
+      displayName: 'Orca',
+      badgeColor: '#000',
+      sourceRepoIds: ['remote-repo'],
+      createdAt: 0,
+      updatedAt: 0
+    }
+    projectsUpdate.mockResolvedValue({
+      ...project,
+      sourceRepoIds: ['local-repo'],
+      createdAt: 100,
+      updatedAt: 100,
+      localWindowsRuntimePreference: { kind: 'windows-host' }
+    })
+    const store = createTestStore()
+    store.setState({ projects: [project] })
+
+    await store.getState().updateProject(project.id, {
+      localWindowsRuntimePreference: { kind: 'windows-host' }
+    })
+
+    expect(store.getState().projects[0]?.createdAt).toBe(100)
+    expect(store.getState().projects[0]?.updatedAt).toBe(100)
+  })
+
   it('preserves shared project source repos when updating local runtime preferences', async () => {
     const project: Project = {
       id: 'github:stablyai/orca',
diff --git a/src/renderer/src/store/slices/repos-refresh-identity.test.ts b/src/renderer/src/store/slices/repos-refresh-identity.test.ts
new file mode 100644
index 00000000000..779f9e8d04e
--- /dev/null
+++ b/src/renderer/src/store/slices/repos-refresh-identity.test.ts
@@ -0,0 +1,439 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Project, Repo } from '../../../../shared/types'
+import { getSetupScriptPromptDismissalKey } from '../../lib/setup-script-prompt'
+import { getRepoHostIdentityForParts } from './repo-host-identity'
+import { createTestStore } from './store-test-helpers'
+
+// Why: every field here is load-bearing. A scalar-only repo reconciles even when the structural
+// compare is broken, which is exactly how an earlier version of this work shipped green and inert.
+// addedAt is non-zero on this fixture so the default case still exercises a real timestamp;
+// dedicated tests below cover addedAt 0 / omitted without restamping Date.now().
+const repo: Repo = {
+  id: 'repo-1',
+  path: '/repo-1',
+  displayName: 'Repo 1',
+  badgeColor: '#000000',
+  addedAt: 1_700_000_000_000,
+  executionHostId: 'local',
+  kind: 'git',
+  repoIcon: { type: 'lucide', name: 'Box' },
+  upstream: { owner: 'upstream-owner', repo: 'repo-1', host: 'github.com' },
+  gitRemoteIdentity: {
+    canonicalKey: 'github.com/octocat/repo-1',
+    remoteName: 'origin',
+    remoteUrl: 'git@github.com:octocat/repo-1.git'
+  },
+  hookSettings: { mode: 'auto', scripts: { setup: 'echo hi', archive: '' } },
+  symlinkPaths: ['.env', 'node_modules'],
+  importedExternalWorktreePaths: []
+}
+
+const secondRepo: Repo = {
+  ...repo,
+  id: 'repo-2',
+  path: '/repo-2',
+  displayName: 'Repo 2',
+  addedAt: 1_700_000_001_000,
+  upstream: { owner: 'upstream-owner', repo: 'repo-2', host: 'github.com' },
+  gitRemoteIdentity: {
+    canonicalKey: 'github.com/octocat/repo-2',
+    remoteName: 'origin',
+    remoteUrl: 'git@github.com:octocat/repo-2.git'
+  }
+}
+
+const reposList = vi.fn()
+const projectsList = vi.fn()
+const listHostSetups = vi.fn()
+
+// Why: catalogs arrive over IPC, so every fetch must hand back freshly allocated objects —
+// otherwise identity would match by accident and prove nothing.
+function clone<T>(value: T): T {
+  return structuredClone(value)
+}
+
+function mockRepos(...rows: readonly (Repo | Omit<Repo, 'addedAt'>)[]): void {
+  reposList.mockImplementation(async () => rows.map(clone))
+}
+
+function omitAddedAt(row: Repo): Omit<Repo, 'addedAt'> {
+  const { addedAt: _addedAt, ...rest } = row
+  return rest
+}
+
+beforeEach(() => {
+  reposList.mockReset()
+  projectsList.mockReset()
+  listHostSetups.mockReset()
+  mockRepos(repo)
+  projectsList.mockImplementation(async () => [])
+  listHostSetups.mockImplementation(async () => [])
+
+  vi.stubGlobal('window', {
+    api: {
+      repos: { list: reposList },
+      projects: { list: projectsList, listHostSetups }
+    },
+    dispatchEvent: vi.fn()
+  })
+})
+
+describe('repo catalog refresh identity', () => {
+  it('keeps the projects and host setups arrays and entries across a no-op refetch', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projects = store.getState().projects
+    const setups = store.getState().projectHostSetups
+    expect(projects).toHaveLength(1)
+    expect(setups).toHaveLength(1)
+
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projects).toBe(projects)
+    expect(store.getState().projects[0]).toBe(projects[0])
+    expect(store.getState().projectHostSetups).toBe(setups)
+    expect(store.getState().projectHostSetups[0]).toBe(setups[0])
+  })
+
+  it('lets a nested hookSettings change through', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const setups = store.getState().projectHostSetups
+
+    mockRepos({ ...repo, hookSettings: { mode: 'override', scripts: { setup: '', archive: '' } } })
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projectHostSetups).not.toBe(setups)
+    expect(store.getState().projectHostSetups[0]?.hookSettings?.mode).toBe('override')
+  })
+
+  it('lets a displayName change through on projects', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projects = store.getState().projects
+
+    mockRepos({ ...repo, displayName: 'Renamed' })
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projects).not.toBe(projects)
+    expect(store.getState().projects[0]?.displayName).toBe('Renamed')
+  })
+
+  it('lets an array-field change through', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const repos = store.getState().repos
+
+    mockRepos({ ...repo, symlinkPaths: ['.env'] })
+    await store.getState().fetchRepos()
+
+    expect(store.getState().repos).not.toBe(repos)
+    expect(store.getState().repos[0]?.symlinkPaths).toEqual(['.env'])
+  })
+
+  it('lets a nested gitRemoteIdentity change through', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projects = store.getState().projects
+
+    mockRepos({
+      ...repo,
+      gitRemoteIdentity: { ...repo.gitRemoteIdentity!, remoteName: 'upstream' }
+    })
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projects).not.toBe(projects)
+    expect(store.getState().projects[0]?.gitRemoteIdentity?.remoteName).toBe('upstream')
+  })
+
+  it('treats clearing localWindowsRuntimePreference as a change', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projectId = store.getState().projects[0]!.id
+    const withPreference: Project = {
+      ...store.getState().projects[0]!,
+      localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' }
+    }
+    store.setState({ projects: [withPreference] })
+
+    await store.getState().fetchRepos()
+
+    // Why: a local-host refresh is authoritative; an absent key must not read as unchanged.
+    expect(store.getState().projects[0]).not.toBe(withPreference)
+    expect(store.getState().projects[0]?.id).toBe(projectId)
+    expect(store.getState().projects[0]?.localWindowsRuntimePreference).toBeUndefined()
+  })
+
+  it('reuses an unchanged setup element while a sibling changes', async () => {
+    mockRepos(repo, secondRepo)
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const setups = store.getState().projectHostSetups
+    expect(setups).toHaveLength(2)
+
+    mockRepos(repo, { ...secondRepo, displayName: 'Repo 2 renamed' })
+    await store.getState().fetchRepos()
+
+    const next = store.getState().projectHostSetups
+    expect(next).not.toBe(setups)
+    expect(next[0]).toBe(setups[0])
+    expect(next[1]).not.toBe(setups[1])
+  })
+
+  it('does not reuse a setup that moved to a different execution host', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const setups = store.getState().projectHostSetups
+    expect(setups[0]?.hostId).toBe('local')
+
+    // Why: the repo-derived fallback sets setup.id = repo.id, so the same id on a second host is
+    // the case that would silently splice the wrong host's routing metadata into the row.
+    mockRepos({ ...repo, executionHostId: 'ssh:host-a', connectionId: 'host-a' })
+    await store.getState().fetchRepos()
+
+    const next = store.getState().projectHostSetups
+    expect(next[0]).not.toBe(setups[0])
+    expect(next[0]?.hostId).toBe('ssh:host-a')
+  })
+
+  it('reconciles both setups when one repo id exists on two hosts', async () => {
+    // Why: the repo-derived fallback sets setup.id = repo.id, so these two setups share an id and
+    // differ only by host. Keying the reconcile on setup.id instead of the owner key collapses them
+    // onto one slot and one of the two churns on every refresh.
+    const sshRepo: Repo = { ...repo, executionHostId: 'ssh:host-a', connectionId: 'host-a' }
+    mockRepos(repo, sshRepo)
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const setups = store.getState().projectHostSetups
+    expect(setups).toHaveLength(2)
+    expect(new Set(setups.map((setup) => setup.id)).size).toBe(1)
+
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projectHostSetups).toBe(setups)
+    expect(store.getState().projectHostSetups[0]).toBe(setups[0])
+    expect(store.getState().projectHostSetups[1]).toBe(setups[1])
+  })
+
+  it('drops a project and its setup when its repo disappears', async () => {
+    mockRepos(repo, secondRepo)
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projects = store.getState().projects
+
+    mockRepos(repo)
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projects).not.toBe(projects)
+    expect(store.getState().projects).toHaveLength(1)
+    expect(store.getState().projectHostSetups).toHaveLength(1)
+  })
+
+  it('adds a project and its setup when a repo appears', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projects = store.getState().projects
+
+    mockRepos(repo, secondRepo)
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projects).not.toBe(projects)
+    expect(store.getState().projects).toHaveLength(2)
+    expect(store.getState().projectHostSetups).toHaveLength(2)
+  })
+
+  it('keeps catalog identity when repo.addedAt is 0', async () => {
+    mockRepos({ ...repo, addedAt: 0 })
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projects = store.getState().projects
+    const setups = store.getState().projectHostSetups
+    expect(projects).toHaveLength(1)
+    expect(setups).toHaveLength(1)
+    expect(projects[0]?.createdAt).toBe(0)
+    expect(setups[0]?.createdAt).toBe(0)
+
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projects).toBe(projects)
+    expect(store.getState().projects[0]).toBe(projects[0])
+    expect(store.getState().projectHostSetups).toBe(setups)
+    expect(store.getState().projectHostSetups[0]).toBe(setups[0])
+  })
+
+  it('keeps catalog identity when repo.addedAt is omitted', async () => {
+    mockRepos(omitAddedAt(repo))
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projects = store.getState().projects
+    const setups = store.getState().projectHostSetups
+    expect(projects).toHaveLength(1)
+    expect(setups).toHaveLength(1)
+    expect(projects[0]?.createdAt).toBe(0)
+    expect(setups[0]?.createdAt).toBe(0)
+
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projects).toBe(projects)
+    expect(store.getState().projects[0]).toBe(projects[0])
+    expect(store.getState().projectHostSetups).toBe(setups)
+    expect(store.getState().projectHostSetups[0]).toBe(setups[0])
+  })
+
+  it('lets a nested hookSettings change through when repo.addedAt is 0', async () => {
+    mockRepos({ ...repo, addedAt: 0 })
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const setups = store.getState().projectHostSetups
+
+    mockRepos({
+      ...repo,
+      addedAt: 0,
+      hookSettings: { mode: 'override', scripts: { setup: '', archive: '' } }
+    })
+    await store.getState().fetchRepos()
+
+    expect(store.getState().projectHostSetups).not.toBe(setups)
+    expect(store.getState().projectHostSetups[0]).not.toBe(setups[0])
+    expect(store.getState().projectHostSetups[0]?.hookSettings?.mode).toBe('override')
+  })
+})
+
+describe('repo filter identity across catalog refreshes', () => {
+  it('keeps the filterRepoIds array when a refetch prunes nothing', async () => {
+    const store = createTestStore()
+    store.setState({ filterRepoIds: [repo.id] })
+    const first = store.getState().filterRepoIds
+
+    await store.getState().fetchRepos()
+
+    // Why: App.tsx at the root and five sidebar consumers select this array by identity.
+    expect(store.getState().filterRepoIds).toBe(first)
+  })
+
+  it('still prunes a filtered repo id that no longer exists', async () => {
+    const store = createTestStore()
+    store.setState({ filterRepoIds: [repo.id, 'gone'] })
+
+    await store.getState().fetchRepos()
+
+    expect(store.getState().filterRepoIds).toEqual([repo.id])
+  })
+
+  it('prunes only the vanished id and reallocates', async () => {
+    mockRepos(repo)
+    const store = createTestStore()
+    store.setState({ filterRepoIds: [repo.id, secondRepo.id] })
+    const first = store.getState().filterRepoIds
+
+    await store.getState().fetchRepos()
+
+    expect(store.getState().filterRepoIds).toEqual([repo.id])
+    expect(store.getState().filterRepoIds).not.toBe(first)
+  })
+
+  it('keeps a filtered id whose repo merely moved to another host', async () => {
+    const store = createTestStore()
+    store.setState({ filterRepoIds: [repo.id] })
+    const first = store.getState().filterRepoIds
+
+    // Why: the filter is keyed on repo id, not host identity — a rehomed repo is not pruned.
+    mockRepos({ ...repo, executionHostId: 'ssh:host-a', connectionId: 'host-a' })
+    await store.getState().fetchRepos()
+
+    expect(store.getState().filterRepoIds).toBe(first)
+  })
+})
+describe('setup-script dismissal identity across catalog refreshes', () => {
+  it('keeps the dismissal array when a refetch prunes nothing', async () => {
+    const store = createTestStore()
+    store.setState({
+      setupScriptPromptDismissedRepoIds: [
+        getSetupScriptPromptDismissalKey(getRepoHostIdentityForParts(repo.id, 'local'))
+      ]
+    })
+    const first = store.getState().setupScriptPromptDismissedRepoIds
+
+    await store.getState().fetchRepos()
+
+    // Why: SetupScriptPromptCard Object.is-subscribes to this array. A no-op
+    // catalog refresh must not allocate just because the helper rebuilt next.
+    expect(store.getState().setupScriptPromptDismissedRepoIds).toBe(first)
+  })
+})
+
+describe('SSH readoption catalog identity', () => {
+  it('keeps projects and host setups across a no-op recordSshRepoReadoptions([])', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const before = store.getState()
+    const projects = before.projects
+    const setups = before.projectHostSetups
+    expect(projects).toHaveLength(1)
+    expect(setups).toHaveLength(1)
+
+    store.getState().recordSshRepoReadoptions([])
+
+    // Why: the empty-in/empty-pending call must hand the state object back untouched, or the
+    // freshly allocated pendingSshRepoReadoptions alone would wake every store subscriber.
+    expect(store.getState()).toBe(before)
+    expect(store.getState().pendingSshRepoReadoptions).toBe(before.pendingSshRepoReadoptions)
+    expect(store.getState().projects).toBe(projects)
+    expect(store.getState().projects[0]).toBe(projects[0])
+    expect(store.getState().projectHostSetups).toBe(setups)
+    expect(store.getState().projectHostSetups[0]).toBe(setups[0])
+  })
+
+  it('keeps catalog identity for a pending-only readoption while pending updates', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const projects = store.getState().projects
+    const setups = store.getState().projectHostSetups
+    const readoption = { oldTargetId: 'ssh-old', newTargetId: 'ssh-new', repoIds: [repo.id] }
+
+    store.getState().recordSshRepoReadoptions([readoption])
+
+    expect(store.getState().pendingSshRepoReadoptions).toEqual([readoption])
+    expect(store.getState().projects).toBe(projects)
+    expect(store.getState().projects[0]).toBe(projects[0])
+    expect(store.getState().projectHostSetups).toBe(setups)
+    expect(store.getState().projectHostSetups[0]).toBe(setups[0])
+  })
+
+  it('replaces the moved setup on a real prune/rehome', async () => {
+    const oldHostRepo: Repo = {
+      ...repo,
+      connectionId: 'ssh-old',
+      executionHostId: 'ssh:ssh-old'
+    }
+    const newHostRepo: Repo = {
+      ...repo,
+      connectionId: 'ssh-new',
+      executionHostId: 'ssh:ssh-new'
+    }
+    mockRepos(oldHostRepo, newHostRepo)
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const setups = store.getState().projectHostSetups
+    expect(setups).toHaveLength(2)
+    const oldSetup = setups.find((setup) => setup.hostId === 'ssh:ssh-old')
+    const newSetup = setups.find((setup) => setup.hostId === 'ssh:ssh-new')
+    expect(oldSetup).toBeDefined()
+    expect(newSetup).toBeDefined()
+
+    store
+      .getState()
+      .recordSshRepoReadoptions([
+        { oldTargetId: 'ssh-old', newTargetId: 'ssh-new', repoIds: [repo.id] }
+      ])
+
+    const next = store.getState().projectHostSetups
+    expect(next).not.toBe(setups)
+    expect(next).toHaveLength(1)
+    expect(next[0]).not.toBe(oldSetup)
+    expect(next[0]?.hostId).toBe('ssh:ssh-new')
+    expect(store.getState().repos).toHaveLength(1)
+    expect(store.getState().repos[0]?.executionHostId).toBe('ssh:ssh-new')
+    expect(store.getState().pendingSshRepoReadoptions).toEqual([])
+  })
+})
diff --git a/src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts b/src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts
index 15ca69fda3c..69bebba9240 100644
--- a/src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts
+++ b/src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts
@@ -50,7 +50,11 @@ function seedTwoProjects(store: ReturnType<typeof createTestStore>): void {
     groupsByWorktree: { [W1]: [], [W2]: [] },
     browserTabsByWorktree: { [W1]: [], [W2]: [] },
     gitStatusHugeByWorktree: { [W1]: { limit: 1000 }, [W2]: { limit: 2000 } },
-    everActivatedWorktreeIds: new Set([W1, W2])
+    everActivatedWorktreeIds: new Set([W1, W2]),
+    localDetectedAgentIdsByContext: {
+      'repo-1:windows-host': ['claude'],
+      'repo-2:windows-host': ['codex']
+    }
   })
 }
 
@@ -68,6 +72,7 @@ describe('removeProject purges per-worktree state (leak regression)', () => {
     expect(s.browserTabsByWorktree[W1]).toBeUndefined()
     expect(s.gitStatusHugeByWorktree[W1]).toBeUndefined()
     expect(s.everActivatedWorktreeIds.has(W1)).toBe(false)
+    expect(s.localDetectedAgentIdsByContext['repo-1:windows-host']).toBeUndefined()
   })
 
   it('keeps per-worktree state for projects that are NOT removed', async () => {
@@ -83,5 +88,6 @@ describe('removeProject purges per-worktree state (leak regression)', () => {
     expect(s.browserTabsByWorktree[W2]).toBeDefined()
     expect(s.gitStatusHugeByWorktree[W2]).toEqual({ limit: 2000 })
     expect(s.everActivatedWorktreeIds.has(W2)).toBe(true)
+    expect(s.localDetectedAgentIdsByContext['repo-2:windows-host']).toEqual(['codex'])
   })
 })
diff --git a/src/renderer/src/store/slices/repos.ts b/src/renderer/src/store/slices/repos.ts
index afd3db641e3..5a76fbf6963 100644
--- a/src/renderer/src/store/slices/repos.ts
+++ b/src/renderer/src/store/slices/repos.ts
@@ -25,6 +25,8 @@ import type {
 } from '../../../../shared/types'
 import {
   getProjectIdentityKey,
+  mergeCatalogCreatedAt,
+  mergeCatalogUpdatedAt,
   projectHostSetupProjectionFromRepos,
   type ProjectHostSetupProjection
 } from '../../../../shared/project-host-setup-projection'
@@ -47,7 +49,12 @@ import { getProjectGroupSubtreeIds } from '../../../../shared/project-groups'
 import { isPathInsideOrEqual } from '../../../../shared/cross-platform-path'
 import { getRepoIdFromWorktreeId } from '../../../../shared/worktree-id'
 import { selectProjectGroupRemovalTargets } from './project-group-removal-targets'
-import { reconcileFetchedRepos } from './repo-identity-reconcile'
+import {
+  areValuesEqual,
+  reconcileCatalogRows,
+  reconcileFetchedRepos
+} from './repo-identity-reconcile'
+import { retainValidFilterRepoIds } from './repo-filter-selection'
 import {
   mergeSshRepoReadoptions,
   reconcileReadoptedSshRepoRows,
@@ -132,6 +139,7 @@ export type RepoUpdate = Partial<
     | 'externalWorktreeVisibilityPromptDismissedAt'
     | 'externalWorktreeInboxBaselinePaths'
     | 'importedExternalWorktreePaths'
+    | 'agentWorktreeVisibility'
     | 'projectGroupId'
     | 'projectGroupOrder'
   >
@@ -160,6 +168,7 @@ type FolderWorkspaceUpdates = Partial<
     | 'pendingFirstAgentMessageRename'
     | 'firstAgentMessageRenameError'
     | 'lastActivityAt'
+    | 'diffComments'
   >
 >
 
@@ -554,8 +563,10 @@ function mergeProjectCompatibilityProject(base: Project, overlay: Project): Proj
     ...overlay,
     // Why: all-host startup fetches hosts separately; one host's record must not erase repo ownership learned from another host with the same id.
     sourceRepoIds: [...new Set([...base.sourceRepoIds, ...overlay.sourceRepoIds])],
-    createdAt: Math.min(base.createdAt, overlay.createdAt),
-    updatedAt: Math.max(base.updatedAt, overlay.updatedAt)
+    // Why not plain min/max: a host whose repos carry no `addedAt` projects 0, and 0 means
+    // unknown, not epoch — it must not win over the real timestamp the other host knows.
+    createdAt: mergeCatalogCreatedAt(base.createdAt, overlay.createdAt),
+    updatedAt: mergeCatalogUpdatedAt(base.updatedAt, overlay.updatedAt)
   }
   if (localWindowsRuntimePreference === undefined) {
     delete project.localWindowsRuntimePreference
@@ -790,6 +801,81 @@ function getExplicitProjectHostIds(
   return hostIds
 }
 
+function indexProjectHostSetupsByProjectId(
+  setups: readonly ProjectHostSetup[]
+): Map<string, ProjectHostSetup[]> {
+  const setupsByProjectId = new Map<string, ProjectHostSetup[]>()
+  for (const setup of setups) {
+    const existing = setupsByProjectId.get(setup.projectId)
+    if (existing) {
+      existing.push(setup)
+    } else {
+      setupsByProjectId.set(setup.projectId, [setup])
+    }
+  }
+  return setupsByProjectId
+}
+
+function getProjectSourceRepos(
+  project: Project,
+  reposById: ReadonlyMap<string, readonly Repo[]>
+): Repo[] {
+  const sourceRepos: Repo[] = []
+  for (const repoId of project.sourceRepoIds) {
+    for (const repo of reposById.get(repoId) ?? []) {
+      sourceRepos.push(repo)
+    }
+  }
+  return sourceRepos
+}
+
+// Why: the host-id resolvers rescan every setup and repo per project; feeding them the project's own slices keeps a catalog refresh linear.
+function createProjectHostIdIndex(
+  setups: readonly ProjectHostSetup[],
+  reposById: ReadonlyMap<string, readonly Repo[]>,
+  resolveHostIds: (
+    project: Project,
+    setups: readonly ProjectHostSetup[],
+    repos: readonly Repo[]
+  ) => Set<string>
+): (project: Project) => ReadonlySet<string> {
+  const noSetups: readonly ProjectHostSetup[] = []
+  const hostIdsByProject = new Map<Project, ReadonlySet<string>>()
+  let setupsByProjectId: Map<string, ProjectHostSetup[]> | null = null
+  return (project) => {
+    const cached = hostIdsByProject.get(project)
+    if (cached) {
+      return cached
+    }
+    setupsByProjectId ??= indexProjectHostSetupsByProjectId(setups)
+    const hostIds = resolveHostIds(
+      project,
+      setupsByProjectId.get(project.id) ?? noSetups,
+      getProjectSourceRepos(project, reposById)
+    )
+    hostIdsByProject.set(project, hostIds)
+    return hostIds
+  }
+}
+
+// Why: mergePreviousProjectMetadata scans the whole catalog's repo key set; a view holding only this pair's repos keeps that scan per-project.
+function restrictReposToProjectPair(
+  previous: Project,
+  current: Project,
+  reposById: ReadonlyMap<string, readonly Repo[]>
+): Map<string, readonly Repo[]> {
+  const restricted = new Map<string, readonly Repo[]>()
+  for (const project of [previous, current]) {
+    for (const repoId of project.sourceRepoIds) {
+      const matches = reposById.get(repoId)
+      if (matches) {
+        restricted.set(repoId, matches)
+      }
+    }
+  }
+  return restricted
+}
+
 function mergeFetchedProjectCompatibilityForHost({
   previous,
   fetched,
@@ -817,80 +903,78 @@ function mergeFetchedProjectCompatibilityForHost({
   const previousProjectById = new Map(previous.projects.map((project) => [project.id, project]))
   const reposById = getReposById(repos)
   const currentRepoIds = new Set(repos.map((repo) => repo.id))
-  const projectHasHost = (project: Project, setups: readonly ProjectHostSetup[]): boolean =>
-    getProjectHostIds(project, setups, repos).has(hostId)
-  const projectHasCurrentOwnerOutsideHost = (project: Project): boolean =>
-    [...getExplicitProjectHostIds(project, projectHostSetups, repos)].some(
-      (ownerHostId) => ownerHostId !== hostId
-    )
+  const fetchedProjectHostIds = createProjectHostIdIndex(
+    fetched.projectHostSetups,
+    reposById,
+    getProjectHostIds
+  )
+  const previousProjectHostIds = createProjectHostIdIndex(
+    previous.projectHostSetups,
+    reposById,
+    getProjectHostIds
+  )
+  const currentProjectOwnerHostIds = createProjectHostIdIndex(
+    projectHostSetups,
+    reposById,
+    getExplicitProjectHostIds
+  )
+  const projectHasCurrentOwnerOutsideHost = (project: Project): boolean => {
+    for (const ownerHostId of currentProjectOwnerHostIds(project)) {
+      if (ownerHostId !== hostId) {
+        return true
+      }
+    }
+    return false
+  }
   const fetchedProjects = fetched.projects
     .filter((project) => {
       const previousProject = previousProjectById.get(project.id)
       // Why: repo-derived compatibility projects include every host; a one-host refresh should only reconcile or prune that host's ownership.
       return (
-        projectHasHost(project, fetched.projectHostSetups) ||
-        (previousProject ? projectHasHost(previousProject, previous.projectHostSetups) : false)
+        fetchedProjectHostIds(project).has(hostId) ||
+        (previousProject ? previousProjectHostIds(previousProject).has(hostId) : false)
       )
     })
     .map((project) => {
       const previousProject = previousProjectById.get(project.id)
       return previousProject
-        ? mergePreviousProjectMetadata(previousProject, project, reposById, hostId)
+        ? mergePreviousProjectMetadata(
+            previousProject,
+            project,
+            restrictReposToProjectPair(previousProject, project, reposById),
+            hostId
+          )
         : projectWithCurrentSourceRepoIds(project, currentRepoIds)
     })
   const fetchedProjectIds = new Set(fetchedProjects.map((project) => project.id))
   const preservedProjects = previous.projects.filter(
     (project) =>
       !fetchedProjectIds.has(project.id) &&
-      (!getProjectHostIds(project, previous.projectHostSetups, repos).has(hostId) ||
-        projectHasCurrentOwnerOutsideHost(project))
+      (!previousProjectHostIds(project).has(hostId) || projectHasCurrentOwnerOutsideHost(project))
   )
+  // Why: both merges always allocate (sourceRepoIds is rebuilt per project, and fetched setups
+  // arrive freshly cloned over IPC), so reconcile against `previous` to recover identity when a
+  // refresh changed nothing. Each key is what the producing merge already dedups by.
   return {
-    projects: mergeProjectCompatibilityProjects(
-      preservedProjects.map((project) => {
-        const sourceRepoIds = getSourceRepoIdsOutsideHost(project, reposById, hostId)
-        return sourceRepoIds.length === project.sourceRepoIds.length
-          ? project
-          : { ...project, sourceRepoIds }
-      }),
-      fetchedProjects
+    projects: reconcileCatalogRows(
+      previous.projects,
+      mergeProjectCompatibilityProjects(
+        preservedProjects.map((project) => {
+          const sourceRepoIds = getSourceRepoIdsOutsideHost(project, reposById, hostId)
+          return sourceRepoIds.length === project.sourceRepoIds.length
+            ? project
+            : { ...project, sourceRepoIds }
+        }),
+        fetchedProjects
+      ),
+      (project) => project.id
     ),
-    projectHostSetups
-  }
-}
-
-function isPlainCatalogObject(value: unknown): value is Record<string, unknown> {
-  if (typeof value !== 'object' || value === null) {
-    return false
-  }
-  const prototype = Object.getPrototypeOf(value)
-  return prototype === Object.prototype || prototype === null
-}
-
-// Why: catalog fetches rebuild every entry from IPC, so identity alone never matches;
-// structural equality is what lets an unchanged refetch stay a no-op.
-function areCatalogEntriesEqual(a: unknown, b: unknown): boolean {
-  if (a === b) {
-    return true
-  }
-  if (Array.isArray(a) || Array.isArray(b)) {
-    return (
-      Array.isArray(a) &&
-      Array.isArray(b) &&
-      a.length === b.length &&
-      a.every((entry, index) => areCatalogEntriesEqual(entry, b[index]))
+    projectHostSetups: reconcileCatalogRows(
+      previous.projectHostSetups,
+      projectHostSetups,
+      getProjectHostSetupOwnerKey
     )
   }
-  if (!isPlainCatalogObject(a) || !isPlainCatalogObject(b)) {
-    return false
-  }
-  const keys = Object.keys(a)
-  if (keys.length !== Object.keys(b).length) {
-    return false
-  }
-  return keys.every(
-    (key) => Object.prototype.hasOwnProperty.call(b, key) && areCatalogEntriesEqual(a[key], b[key])
-  )
 }
 
 // Why: returning `base` unchanged keeps referential-equality selectors quiet, so a
@@ -912,7 +996,7 @@ function mergeByIdentity<T>(
       changed = true
       continue
     }
-    if (areCatalogEntriesEqual(merged[index], entry)) {
+    if (areValuesEqual(merged[index], entry)) {
       continue
     }
     merged[index] = entry
@@ -1203,7 +1287,7 @@ function filterSetupsForPrunedRepoRows(
   setups: readonly ProjectHostSetup[],
   mergedRepos: readonly Repo[],
   reconciledRepos: readonly Repo[]
-): ProjectHostSetup[] {
+): readonly ProjectHostSetup[] {
   const survivingOwners = new Set(
     reconciledRepos.map((repo) => `${getRepoExecutionHostId(repo)}:${repo.id}`)
   )
@@ -1212,12 +1296,15 @@ function filterSetupsForPrunedRepoRows(
       .filter((repo) => !survivingOwners.has(`${getRepoExecutionHostId(repo)}:${repo.id}`))
       .map((repo) => `${getRepoExecutionHostId(repo)}:${repo.id}`)
   )
+  // Why: this result feeds the compat merge as `previous`, so an unconditional copy would discard
+  // the identity that merge is about to try to preserve.
   if (prunedOwners.size === 0) {
-    return [...setups]
+    return setups
   }
-  return setups.filter(
+  const filtered = setups.filter(
     (setup) => !setup.repoId || !prunedOwners.has(`${setup.hostId}:${setup.repoId}`)
   )
+  return filtered.length === setups.length ? setups : filtered
 }
 
 function reconcileReadoptedSshWorktreeState(
@@ -1690,16 +1777,16 @@ function getFolderWorkspacePathStatusRequestSnapshotForRead(
 
 export type RepoSlice = {
   repos: readonly Repo[]
-  projects: Project[]
-  projectHostSetups: ProjectHostSetup[]
+  projects: readonly Project[]
+  projectHostSetups: readonly ProjectHostSetup[]
   projectGroups: readonly ProjectGroup[]
   folderWorkspaces: readonly FolderWorkspace[]
   folderWorkspacePathStatuses: Record<string, FolderWorkspacePathStatusCacheEntry>
   activeRepoId: string | null
   // Monotonic sequence so overlapping catalog fetches can drop stale same-host results (#7020).
   reposFetchGeneration: number
-  pendingSshRepoReadoptions: SshRepoReadoption[]
-  recordSshRepoReadoptions: (readoptions: SshRepoReadoption[]) => void
+  pendingSshRepoReadoptions: readonly SshRepoReadoption[]
+  recordSshRepoReadoptions: (readoptions: readonly SshRepoReadoption[]) => void
   fetchRepos: (options?: RuntimeCatalogFetchOptions) => Promise<void>
   fetchReposForAllHosts: (options?: AllHostCatalogFetchOptions) => Promise<void>
   awaitLocalRepoCatalogSettlement: () => Promise<void>
@@ -1921,6 +2008,10 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
 
   recordSshRepoReadoptions: (readoptions) =>
     set((s) => {
+      // Why: SshPane importConfig() often reports [] on every Manage-pane open.
+      if (readoptions.length === 0 && s.pendingSshRepoReadoptions.length === 0) {
+        return s
+      }
       const pendingSshRepoReadoptions = mergeSshRepoReadoptions(
         s.pendingSshRepoReadoptions,
         readoptions
@@ -1928,19 +2019,35 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
       const reconciliation = reconcileReadoptedSshRepoRows(s.repos, pendingSshRepoReadoptions)
       const repos = reconciliation.repos
       const worktreeState = reconcileReadoptedSshWorktreeState(s, pendingSshRepoReadoptions)
-      const projectHostSetups = filterSetupsForPrunedRepoRows(s.projectHostSetups, s.repos, repos)
+      const remainingSetups = filterSetupsForPrunedRepoRows(s.projectHostSetups, s.repos, repos)
       const compatibility = mergeProjectHostSetupCompatibility(
         projectCompatibilityFromRepos(repos),
         {
           projects: s.projects,
-          setups: projectHostSetups
+          setups: remainingSetups
         }
       )
+      // Why: mergeProjectHostSetupCompatibility always allocates; a no-op readoption
+      // must not churn catalog identity. This write is all-repos, not host-scoped,
+      // so it cannot go through mergeFetchedProjectCompatibilityForHost. Reconcile
+      // hands the store arrays straight back when nothing moved, so writing them
+      // unconditionally still leaves identity-keyed selectors untouched.
+      const projects = reconcileCatalogRows(
+        s.projects,
+        compatibility.projects,
+        (project) => project.id
+      )
+      const projectHostSetups = reconcileCatalogRows(
+        s.projectHostSetups,
+        compatibility.projectHostSetups,
+        getProjectHostSetupOwnerKey
+      )
       return {
         repos,
         pendingSshRepoReadoptions: reconciliation.pendingReadoptions,
         ...worktreeState,
-        ...compatibility
+        projects,
+        projectHostSetups
       }
     }),
 
@@ -2006,7 +2113,7 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
             ? {}
             : { folderWorkspacePathStatuses: {} }),
           activeRepoId: s.activeRepoId && validRepoIds.has(s.activeRepoId) ? s.activeRepoId : null,
-          filterRepoIds: s.filterRepoIds.filter((projectId) => validRepoIds.has(projectId)),
+          filterRepoIds: retainValidFilterRepoIds(s.filterRepoIds, validRepoIds),
           setupScriptPromptDismissedRepoIds: filterSetupScriptPromptDismissalsToValidRepos(
             s.setupScriptPromptDismissedRepoIds,
             validRepoHostIdentities
@@ -2090,7 +2197,7 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
           ...reconcileReadoptedSshWorktreeState(s, s.pendingSshRepoReadoptions),
           ...mergedProjectCompatibility,
           activeRepoId: s.activeRepoId && validRepoIds.has(s.activeRepoId) ? s.activeRepoId : null,
-          filterRepoIds: s.filterRepoIds.filter((projectId) => validRepoIds.has(projectId)),
+          filterRepoIds: retainValidFilterRepoIds(s.filterRepoIds, validRepoIds),
           setupScriptPromptDismissedRepoIds: filterSetupScriptPromptDismissalsToValidRepos(
             s.setupScriptPromptDismissedRepoIds,
             validRepoHostIdentities
@@ -2172,7 +2279,7 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
         const validRepoHostIdentities = new Set(s.repos.map(getRepoHostIdentity))
         return {
           activeRepoId: s.activeRepoId && validRepoIds.has(s.activeRepoId) ? s.activeRepoId : null,
-          filterRepoIds: s.filterRepoIds.filter((projectId) => validRepoIds.has(projectId)),
+          filterRepoIds: retainValidFilterRepoIds(s.filterRepoIds, validRepoIds),
           setupScriptPromptDismissedRepoIds: filterSetupScriptPromptDismissalsToValidRepos(
             s.setupScriptPromptDismissedRepoIds,
             validRepoHostIdentities
@@ -2194,10 +2301,8 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
     }
     // Why: startup hydration needs the newest local catalog, not unreachable remote hosts.
     settleLocalCatalog(localCatalogOutcome)
-    if (
-      get().reposFetchGeneration !== generation &&
-      !isLatestRepoCatalogGeneration(get, LOCAL_EXECUTION_HOST_ID, generation)
-    ) {
+    // Why: a newer local-only refresh must not cancel this load's unrelated remote catalogs.
+    if (latestAllHostRepoCatalogGenerationByStore.get(get) !== generation) {
       return
     }
     if (options?.remoteHosts === 'skip') {
@@ -2705,6 +2810,20 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
         })
         return false
       }
+      if (updates.diffComments !== undefined && updated.diffComments === undefined) {
+        // Why: older paired runtimes strip this optional field; reconcile instead of showing an unsaved note.
+        await reconcileFailedFolderWorkspaceUpdate({
+          target,
+          folderWorkspaceId,
+          updateIdentity,
+          ownerHostId,
+          ticket: updateTicket,
+          coordinator: folderWorkspaceUpdates,
+          set,
+          get
+        })
+        return false
+      }
       const latestFields = folderWorkspaceUpdates.latestFields(updateIdentity, updateTicket)
       const catalogChanged = folderWorkspaceUpdates.catalogChanged(updateIdentity, updateTicket)
       if (latestFields.length > 0) {
@@ -3424,6 +3543,15 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
 
       // Kill PTYs for all worktrees belonging to this repo
       const worktreeIds = getKnownRepoWorktreeIds(get(), projectId, ownerHostId)
+      const localAgentContextProjectIds =
+        ownerHostId === LOCAL_EXECUTION_HOST_ID
+          ? [
+              projectId,
+              ...(get().worktreesByRepo[projectId] ?? [])
+                .filter((worktree) => worktreeBelongsToHost(worktree, ownerHostId))
+                .flatMap((worktree) => (worktree.projectId ? [worktree.projectId] : []))
+            ]
+          : []
       const killedTabIds = new Set<string>()
       if (target.kind === 'environment') {
         await Promise.allSettled(
@@ -3453,6 +3581,7 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
 
       // Why: use the canonical per-worktree purge to evict all worktree-scoped maps (hand-deletion leaked most); runs before the set() below so it still sees tabsByWorktree.
       get().purgeWorktreeTerminalState(worktreeIds)
+      get().clearLocalDetectedAgentContextsForProjects(localAgentContextProjectIds)
 
       set((s) => {
         const nextWorktrees = { ...s.worktreesByRepo }
diff --git a/src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts b/src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts
index b6c10e014ed..4c917c15a27 100644
--- a/src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts
+++ b/src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts
@@ -226,6 +226,42 @@ describe('runtimePaneTitle → sortEpoch', () => {
     expect(publications).toBe(tabCount * 2)
   })
 
+  it('publishes a bulk tab-title update once across worktrees', () => {
+    const store = createTestStore()
+    const tabCount = 20
+    const worktrees = Array.from({ length: tabCount }, (_, index) =>
+      makeWorktree({ id: `wt-${index}`, repoId: 'repo1', path: `/path/wt-${index}` })
+    )
+    seedStore(store, {
+      worktreesByRepo: { repo1: worktrees },
+      tabsByWorktree: Object.fromEntries(
+        worktrees.map((worktree, index) => [
+          worktree.id,
+          [makeTab({ id: `tab-${index}`, worktreeId: worktree.id })]
+        ])
+      )
+    })
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    store.getState().updateTabTitles(
+      worktrees.map((_, index) => ({
+        tabId: `tab-${index}`,
+        title: `Codex ready ${index}`
+      }))
+    )
+
+    unsubscribe()
+    expect(publications).toBe(1)
+    for (let index = 0; index < tabCount; index += 1) {
+      expect(store.getState().tabsByWorktree[`wt-${index}`]?.[0]?.title).toBe(
+        `Codex ready ${index}`
+      )
+    }
+  })
+
   it('does not enumerate terminal tabs when only the spinner frame changes', () => {
     const store = createTestStore()
     seedStore(store, {
diff --git a/src/renderer/src/store/slices/runtime-status-catalog-identity.test.ts b/src/renderer/src/store/slices/runtime-status-catalog-identity.test.ts
new file mode 100644
index 00000000000..17615ba40bc
--- /dev/null
+++ b/src/renderer/src/store/slices/runtime-status-catalog-identity.test.ts
@@ -0,0 +1,179 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  redactRuntimeEnvironment,
+  type KnownRuntimeEnvironment
+} from '../../../../shared/runtime-environments'
+import type { RuntimeStatus } from '../../../../shared/runtime-types'
+import {
+  clearRuntimeEnvironmentConnectionGenerationsForTests,
+  getRuntimeEnvironmentConnectionGeneration
+} from './runtime-status'
+import { createTestStore } from './store-test-helpers'
+
+vi.mock('sonner', () => ({
+  toast: { warning: vi.fn(), dismiss: vi.fn() }
+}))
+
+// Why: production rows carry nested endpoints. A scalar-only fixture reconciles even
+// when the walker is broken, which is how a redact-only or Object.is fix stays green.
+const pairingRevision = 1_700_000_000_000
+const knownEndpoint: KnownRuntimeEnvironment['endpoints'][number] = {
+  id: 'ws-a',
+  kind: 'websocket',
+  label: 'WebSocket',
+  endpoint: 'wss://box.example:8787',
+  deviceToken: 'device-token-a',
+  publicKeyB64: 'public-key-a'
+}
+const knownEnvironment: KnownRuntimeEnvironment = {
+  id: 'env-a',
+  name: 'Dev Box',
+  createdAt: pairingRevision,
+  updatedAt: pairingRevision,
+  pairingRevision,
+  lastUsedAt: 1_700_000_100_000,
+  runtimeId: 'runtime-a',
+  source: 'manual',
+  endpoints: [knownEndpoint],
+  preferredEndpointId: 'ws-a'
+}
+
+function cloneRedactedCatalog(
+  environment: KnownRuntimeEnvironment = knownEnvironment
+): ReturnType<typeof redactRuntimeEnvironment>[] {
+  return structuredClone([redactRuntimeEnvironment(environment)])
+}
+
+function makeStatus(): RuntimeStatus {
+  return {
+    runtimeId: 'rt',
+    rendererGraphEpoch: 0,
+    graphStatus: 'ready',
+    authoritativeWindowId: null,
+    liveTabCount: 0,
+    liveLeafCount: 0,
+    runtimeProtocolVersion: 3,
+    minCompatibleRuntimeClientVersion: 3
+  }
+}
+
+beforeEach(() => {
+  clearRuntimeEnvironmentConnectionGenerationsForTests()
+  vi.stubGlobal('window', { api: {}, dispatchEvent: vi.fn() })
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('setRuntimeEnvironments catalog identity', () => {
+  it('keeps the array, row, and endpoints across independently cloned no-op lists', () => {
+    const store = createTestStore()
+    store.getState().setRuntimeEnvironments(cloneRedactedCatalog())
+    const previous = store.getState().runtimeEnvironments
+    const second = cloneRedactedCatalog()
+    expect(second).not.toBe(previous)
+    expect(second[0]).not.toBe(previous[0])
+    expect(second[0]?.endpoints).not.toBe(previous[0]?.endpoints)
+
+    store.getState().setRuntimeEnvironments(second)
+    const next = store.getState().runtimeEnvironments
+
+    expect(next).toBe(previous)
+    expect(next[0]).toBe(previous[0])
+    expect(next[0]?.endpoints).toBe(previous[0]?.endpoints)
+  })
+
+  it('keeps the same empty array across two empty lists', () => {
+    const store = createTestStore()
+    store.getState().setRuntimeEnvironments([])
+    const empty = store.getState().runtimeEnvironments
+
+    store.getState().setRuntimeEnvironments([])
+
+    expect(store.getState().runtimeEnvironments).toBe(empty)
+    expect(empty).toEqual([])
+  })
+
+  it('flips catalog hydrated and settled on the first write', () => {
+    const store = createTestStore()
+    expect(store.getState().runtimeEnvironmentCatalogHydrated).toBe(false)
+    expect(store.getState().runtimeEnvironmentCatalogSettled).toBe(false)
+
+    store.getState().setRuntimeEnvironments(cloneRedactedCatalog())
+
+    expect(store.getState().runtimeEnvironmentCatalogHydrated).toBe(true)
+    expect(store.getState().runtimeEnvironmentCatalogSettled).toBe(true)
+  })
+
+  it('allocates a new row when a public name changes', () => {
+    const store = createTestStore()
+    store.getState().setRuntimeEnvironments(cloneRedactedCatalog())
+    const previous = store.getState().runtimeEnvironments
+
+    store
+      .getState()
+      .setRuntimeEnvironments(cloneRedactedCatalog({ ...knownEnvironment, name: 'Lab' }))
+
+    const next = store.getState().runtimeEnvironments
+    expect(next).not.toBe(previous)
+    expect(next[0]).not.toBe(previous[0])
+    expect(next[0]?.name).toBe('Lab')
+  })
+
+  it('allocates a new row when an endpoint URL changes', () => {
+    const store = createTestStore()
+    store.getState().setRuntimeEnvironments(cloneRedactedCatalog())
+    const previous = store.getState().runtimeEnvironments
+
+    store.getState().setRuntimeEnvironments(
+      cloneRedactedCatalog({
+        ...knownEnvironment,
+        endpoints: [{ ...knownEndpoint, endpoint: 'wss://box.example:9999' }]
+      })
+    )
+
+    const next = store.getState().runtimeEnvironments
+    expect(next).not.toBe(previous)
+    expect(next[0]).not.toBe(previous[0])
+    expect(next[0]?.endpoints).not.toBe(previous[0]?.endpoints)
+    expect(next[0]?.endpoints[0]?.endpoint).toBe('wss://box.example:9999')
+  })
+
+  it('allocates a new row when lastUsedAt or updatedAt changes', () => {
+    const store = createTestStore()
+    store.getState().setRuntimeEnvironments(cloneRedactedCatalog())
+    const previous = store.getState().runtimeEnvironments
+
+    store.getState().setRuntimeEnvironments(
+      cloneRedactedCatalog({
+        ...knownEnvironment,
+        lastUsedAt: 1_700_000_200_000,
+        updatedAt: 1_700_000_200_000
+      })
+    )
+
+    const next = store.getState().runtimeEnvironments
+    expect(next).not.toBe(previous)
+    expect(next[0]).not.toBe(previous[0])
+    expect(next[0]?.lastUsedAt).toBe(1_700_000_200_000)
+    expect(next[0]?.updatedAt).toBe(1_700_000_200_000)
+  })
+
+  it('still drops status and advances generation on a pairingRevision change', () => {
+    const store = createTestStore()
+    store.getState().setRuntimeEnvironments(cloneRedactedCatalog())
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: makeStatus(), checkedAt: 1 })
+    const before = getRuntimeEnvironmentConnectionGeneration('env-a')
+
+    store
+      .getState()
+      .setRuntimeEnvironments(
+        cloneRedactedCatalog({ ...knownEnvironment, pairingRevision: pairingRevision + 1 })
+      )
+
+    expect(store.getState().runtimeStatusByEnvironmentId.has('env-a')).toBe(false)
+    expect(getRuntimeEnvironmentConnectionGeneration('env-a')).toBe(before + 1)
+    expect(store.getState().runtimeEnvironments[0]?.pairingRevision).toBe(pairingRevision + 1)
+  })
+})
diff --git a/src/renderer/src/store/slices/runtime-status-hydration.ts b/src/renderer/src/store/slices/runtime-status-hydration.ts
index b8555a38d41..f1ff08d486f 100644
--- a/src/renderer/src/store/slices/runtime-status-hydration.ts
+++ b/src/renderer/src/store/slices/runtime-status-hydration.ts
@@ -19,14 +19,14 @@ export function resetRuntimeCatalogListingForTests(): void {
 
 type RuntimeStatusHydrationDependencies = {
   listEnvironments: () => Promise<PublicKnownRuntimeEnvironment[]>
-  getCurrentEnvironments: () => PublicKnownRuntimeEnvironment[]
-  publishEnvironments: (environments: PublicKnownRuntimeEnvironment[]) => void
+  getCurrentEnvironments: () => readonly PublicKnownRuntimeEnvironment[]
+  publishEnvironments: (environments: readonly PublicKnownRuntimeEnvironment[]) => void
   refreshEnvironmentStatus: (environmentId: string) => Promise<boolean>
   markCatalogSettled: () => void
 }
 
 function environmentRevisions(
-  environments: PublicKnownRuntimeEnvironment[]
+  environments: readonly PublicKnownRuntimeEnvironment[]
 ): ReadonlyMap<string, number> {
   return new Map(
     environments.map((environment) => [
@@ -37,7 +37,7 @@ function environmentRevisions(
 }
 
 function revisionsMatch(
-  environments: PublicKnownRuntimeEnvironment[],
+  environments: readonly PublicKnownRuntimeEnvironment[],
   expected: ReadonlyMap<string, number>
 ): boolean {
   const current = environmentRevisions(environments)
diff --git a/src/renderer/src/store/slices/runtime-status.test.ts b/src/renderer/src/store/slices/runtime-status.test.ts
index afdadb266a9..d2bc9f86af9 100644
--- a/src/renderer/src/store/slices/runtime-status.test.ts
+++ b/src/renderer/src/store/slices/runtime-status.test.ts
@@ -799,7 +799,7 @@ describe('runtime-status slice', () => {
 
     expect(list).toHaveBeenCalledTimes(2)
     expect(getStatus).toHaveBeenCalledTimes(2)
-    expect(publications).toBe(4)
+    expect(publications).toBe(3)
     expect(store.getState().runtimeStatusByEnvironmentId.get('env-a')?.status?.runtimeId).toBe(
       'runtime-2'
     )
diff --git a/src/renderer/src/store/slices/runtime-status.ts b/src/renderer/src/store/slices/runtime-status.ts
index a5bd778273a..1ca61372710 100644
--- a/src/renderer/src/store/slices/runtime-status.ts
+++ b/src/renderer/src/store/slices/runtime-status.ts
@@ -13,6 +13,7 @@ import {
   dismissRuntimeDisconnectedToast,
   showRuntimeDisconnectedToast
 } from './runtime-environment-disconnect-toast'
+import { reconcileCatalogRows } from './repo-identity-reconcile'
 import { createRuntimeStatusHydration } from './runtime-status-hydration'
 import { refreshRuntimeEnvironmentStatus } from './runtime-status-refresh'
 
@@ -31,7 +32,7 @@ export type RuntimeEnvironmentStatus = {
 export type RuntimeStatusSlice = {
   /** Saved remote Orca servers. Host pickers use this to show user-chosen names
    * instead of opaque runtime ids. */
-  runtimeEnvironments: PublicKnownRuntimeEnvironment[]
+  runtimeEnvironments: readonly PublicKnownRuntimeEnvironment[]
   /** True only after the saved-runtime catalog has loaded successfully. Gates
    * fail-closed host routing, so a failed read must NOT flip it. */
   runtimeEnvironmentCatalogHydrated: boolean
@@ -51,7 +52,7 @@ export type RuntimeStatusSlice = {
   removedRuntimeEnvironmentIds: ReadonlySet<string>
   /** Replaces the saved-environment list, trims stale status entries, and
    * retires state owned by any environment that just left the saved list. */
-  setRuntimeEnvironments: (environments: PublicKnownRuntimeEnvironment[]) => void
+  setRuntimeEnvironments: (environments: readonly PublicKnownRuntimeEnvironment[]) => void
   /** Merges one environment's status. Replaces the prior entry for that id. */
   setRuntimeEnvironmentStatus: (
     environmentId: string,
@@ -151,8 +152,25 @@ export const createRuntimeStatusSlice: StateCreator<AppState, [], [], RuntimeSta
           removedChanged = true
         }
       }
+      // Why: list()/hydrate always allocate (IPC structuredClone + redact remaps
+      // endpoints[]). Reuse equal rows so Object.is subscribers don't miss 100%.
+      const reconciled = reconcileCatalogRows(
+        s.runtimeEnvironments,
+        environments,
+        (environment) => environment.id
+      )
+      const catalogUnchanged = reconciled === s.runtimeEnvironments
+      if (
+        catalogUnchanged &&
+        s.runtimeEnvironmentCatalogHydrated &&
+        s.runtimeEnvironmentCatalogSettled &&
+        !statusesChanged &&
+        !removedChanged
+      ) {
+        return s
+      }
       return {
-        runtimeEnvironments: environments,
+        runtimeEnvironments: catalogUnchanged ? s.runtimeEnvironments : reconciled,
         runtimeEnvironmentCatalogHydrated: true,
         runtimeEnvironmentCatalogSettled: true,
         ...(statusesChanged ? { runtimeStatusByEnvironmentId: nextStatuses } : {}),
diff --git a/src/renderer/src/store/slices/ssh-target-cleanup.ts b/src/renderer/src/store/slices/ssh-target-cleanup.ts
index ba2f5211efc..43707fa86d6 100644
--- a/src/renderer/src/store/slices/ssh-target-cleanup.ts
+++ b/src/renderer/src/store/slices/ssh-target-cleanup.ts
@@ -200,10 +200,7 @@ export function buildRemovedSshTargetCleanupPatch(
   const nextTransientClearedConnections = {
     ...state.transientClearedAgentStatusConnectionIds
   }
-  const removedTransientClearBlock = Object.prototype.hasOwnProperty.call(
-    nextTransientClearedConnections,
-    targetId
-  )
+  const removedTransientClearBlock = Object.hasOwn(nextTransientClearedConnections, targetId)
   delete nextTransientClearedConnections[targetId]
   const nextConnectionStates = new Map(state.sshConnectionStates)
   const removedConnectionState = nextConnectionStates.delete(targetId)
@@ -211,18 +208,9 @@ export function buildRemovedSshTargetCleanupPatch(
   const removedLabel = nextLabels.delete(targetId)
   const nextHydrated = new Set(state.remoteWorkspaceHydratedTargetIds)
   const removedHydrated = nextHydrated.delete(targetId)
-  const removedSyncStatus = Object.prototype.hasOwnProperty.call(
-    state.remoteWorkspaceSyncStatusByTargetId,
-    targetId
-  )
-  const removedPortForwards = Object.prototype.hasOwnProperty.call(
-    state.portForwardsByConnection,
-    targetId
-  )
-  const removedDetectedPorts = Object.prototype.hasOwnProperty.call(
-    state.detectedPortsByConnection,
-    targetId
-  )
+  const removedSyncStatus = Object.hasOwn(state.remoteWorkspaceSyncStatusByTargetId, targetId)
+  const removedPortForwards = Object.hasOwn(state.portForwardsByConnection, targetId)
+  const removedDetectedPorts = Object.hasOwn(state.detectedPortsByConnection, targetId)
   const nextSyncStatus = { ...state.remoteWorkspaceSyncStatusByTargetId }
   delete nextSyncStatus[targetId]
   const nextPortForwards = { ...state.portForwardsByConnection }
diff --git a/src/renderer/src/store/slices/superseded-ssh-repo-rows.ts b/src/renderer/src/store/slices/superseded-ssh-repo-rows.ts
index 4b20cfa6edf..c18e0f6e5af 100644
--- a/src/renderer/src/store/slices/superseded-ssh-repo-rows.ts
+++ b/src/renderer/src/store/slices/superseded-ssh-repo-rows.ts
@@ -4,7 +4,7 @@ import { getRepoExecutionHostId, toSshExecutionHostId } from '../../../../shared
 
 export type SshRepoReconciliation = {
   repos: readonly Repo[]
-  pendingReadoptions: SshRepoReadoption[]
+  pendingReadoptions: readonly SshRepoReadoption[]
 }
 
 function repoBelongsToTarget(repo: Repo, targetId: string): boolean {
@@ -69,7 +69,7 @@ export function reconcileReadoptedSshRepoRows(
 export function mergeSshRepoReadoptions(
   pending: readonly SshRepoReadoption[],
   incoming: readonly SshRepoReadoption[]
-): SshRepoReadoption[] {
+): readonly SshRepoReadoption[] {
   const repoIdsByMigration = new Map<string, Set<string>>()
   for (const readoption of [...pending, ...incoming]) {
     const key = `${readoption.oldTargetId}\0${readoption.newTargetId}`
diff --git a/src/renderer/src/store/slices/terminal-tab-title-batch.test.ts b/src/renderer/src/store/slices/terminal-tab-title-batch.test.ts
new file mode 100644
index 00000000000..3a7a1b525ae
--- /dev/null
+++ b/src/renderer/src/store/slices/terminal-tab-title-batch.test.ts
@@ -0,0 +1,266 @@
+import { describe, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { makePaneKey } from '../../../../shared/stable-pane-id'
+
+vi.mock('sonner', () => ({ toast: { info: vi.fn(), success: vi.fn(), error: vi.fn() } }))
+vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
+vi.mock('@/components/terminal-pane/pty-transport', () => ({
+  registerEagerPtyBuffer: vi.fn(),
+  ensurePtyDispatcher: vi.fn(),
+  unregisterPtyDataHandlers: vi.fn()
+}))
+vi.mock('@/components/terminal-pane/shutdown-buffer-captures', () => ({
+  shutdownBufferCaptures: vi.fn()
+}))
+
+// @ts-expect-error -- minimal preload API stub for the slice's IPC writes
+globalThis.window = { api: {} }
+
+import {
+  createTestStore,
+  makeTab,
+  makeUnifiedTab,
+  makeWorktree,
+  seedStore
+} from './store-test-helpers'
+import type { GeneratedTabTitleUpdate } from './terminal-tab-title-batch'
+
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+
+function makeScaleState(count: number) {
+  let idReads = 0
+  const worktrees = Array.from({ length: count }, (_, index) =>
+    makeWorktree({ id: `wt-${index}`, repoId: 'repo1' })
+  )
+  const tabsByWorktree = Object.fromEntries(
+    worktrees.map((worktree, index) => {
+      const tab = makeTab({ id: `tab-${index}`, worktreeId: worktree.id })
+      const id = tab.id
+      Object.defineProperty(tab, 'id', {
+        configurable: true,
+        enumerable: true,
+        get() {
+          idReads += 1
+          return id
+        }
+      })
+      return [worktree.id, [tab]]
+    })
+  )
+  const unifiedTabsByWorktree = Object.fromEntries(
+    worktrees.map((worktree, index) => [
+      worktree.id,
+      [makeUnifiedTab({ id: `tab-${index}`, worktreeId: worktree.id, groupId: 'group-1' })]
+    ])
+  )
+  return {
+    getIdReads: () => idReads,
+    resetIdReads: () => {
+      idReads = 0
+    },
+    tabsByWorktree,
+    unifiedTabsByWorktree,
+    worktrees
+  }
+}
+
+describe('terminal tab title batches', () => {
+  it('updates 100 owners with one publication and a linear owner-index pass', () => {
+    const store = createTestStore()
+    const fixture = makeScaleState(101)
+    seedStore(store, {
+      worktreesByRepo: { repo1: fixture.worktrees },
+      tabsByWorktree: fixture.tabsByWorktree,
+      unifiedTabsByWorktree: fixture.unifiedTabsByWorktree
+    })
+    const untouchedTabs = fixture.tabsByWorktree['wt-100']
+    const baselineSortEpoch = store.getState().sortEpoch
+    fixture.resetIdReads()
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    store.getState().updateTabTitles(
+      Array.from({ length: 100 }, (_, index) => ({
+        tabId: `tab-${index}`,
+        title: `Remote agent ${index}`
+      }))
+    )
+
+    unsubscribe()
+    expect(publications).toBe(1)
+    expect(fixture.getIdReads()).toBeLessThanOrEqual(305)
+    expect(store.getState().tabsByWorktree['wt-100']).toBe(untouchedTabs)
+    expect(store.getState().sortEpoch).toBe(baselineSortEpoch + 100)
+    for (let index = 0; index < 100; index += 1) {
+      expect(store.getState().tabsByWorktree[`wt-${index}`]?.[0]?.title).toBe(
+        `Remote agent ${index}`
+      )
+    }
+  })
+
+  it('preserves ordered duplicate updates and last-owner duplicate-id routing', () => {
+    const store = createTestStore()
+    seedStore(store, {
+      tabsByWorktree: {
+        first: [makeTab({ id: 'duplicate-tab', worktreeId: 'first', title: 'First owner' })],
+        second: [makeTab({ id: 'duplicate-tab', worktreeId: 'second', title: 'Second owner' })]
+      }
+    })
+
+    store.getState().updateTabTitles([
+      { tabId: 'duplicate-tab', title: 'Intermediate' },
+      { tabId: 'duplicate-tab', title: 'Final' }
+    ])
+
+    expect(store.getState().tabsByWorktree.first?.[0]?.title).toBe('First owner')
+    expect(store.getState().tabsByWorktree.second?.[0]?.title).toBe('Final')
+  })
+
+  it('updates every same-owner backing duplicate but only the first unified row', () => {
+    const store = createTestStore()
+    seedStore(store, {
+      settings: { ...getDefaultSettings('/tmp'), tabAutoGenerateTitle: true },
+      tabsByWorktree: {
+        owner: [
+          makeTab({ id: 'duplicate-tab', worktreeId: 'owner', title: 'First backing' }),
+          makeTab({ id: 'duplicate-tab', worktreeId: 'owner', title: 'Second backing' })
+        ]
+      },
+      unifiedTabsByWorktree: {
+        owner: [
+          makeUnifiedTab({
+            id: 'duplicate-tab',
+            worktreeId: 'owner',
+            groupId: 'group-1',
+            label: 'First visible'
+          }),
+          makeUnifiedTab({
+            id: 'duplicate-tab',
+            worktreeId: 'owner',
+            groupId: 'group-2',
+            label: 'Second visible'
+          })
+        ]
+      }
+    })
+
+    store.getState().updateTabTitles([{ tabId: 'duplicate-tab', title: 'Final live title' }])
+    store.getState().setGeneratedTabTitlesFromAgentPrompts([
+      {
+        paneKey: makePaneKey('duplicate-tab', LEAF_ID),
+        prompt: 'Generated duplicate title for remote startup'
+      }
+    ])
+
+    expect(store.getState().tabsByWorktree.owner?.map((tab) => tab.title)).toEqual([
+      'Final live title',
+      'Final live title'
+    ])
+    expect(store.getState().tabsByWorktree.owner?.map((tab) => tab.generatedTitle)).toEqual([
+      'Generated duplicate title for remote',
+      'Generated duplicate title for remote'
+    ])
+    expect(store.getState().unifiedTabsByWorktree.owner?.map((tab) => tab.label)).toEqual([
+      'Final live title',
+      'Second visible'
+    ])
+    expect(store.getState().unifiedTabsByWorktree.owner?.map((tab) => tab.generatedLabel)).toEqual([
+      'Generated duplicate title for remote',
+      undefined
+    ])
+  })
+
+  it('matches sequential live and generated title semantics in event order', () => {
+    const sequentialStore = createTestStore()
+    const batchStore = createTestStore()
+    const fixture = {
+      settings: { ...getDefaultSettings('/tmp'), tabAutoGenerateTitle: true },
+      tabsByWorktree: {
+        owner: [makeTab({ id: 'tab-1', worktreeId: 'owner', title: 'Terminal 1' })]
+      },
+      unifiedTabsByWorktree: {
+        owner: [makeUnifiedTab({ id: 'tab-1', worktreeId: 'owner', groupId: 'group-1' })]
+      }
+    }
+    seedStore(sequentialStore, structuredClone(fixture))
+    seedStore(batchStore, structuredClone(fixture))
+    const liveUpdates = [
+      { tabId: 'tab-1', title: 'Codex' },
+      { tabId: 'tab-1', title: '⠋ Codex is thinking' },
+      { tabId: 'tab-1', title: '⠙ Codex is thinking' },
+      { tabId: 'tab-1', title: '' },
+      { tabId: 'tab-1', title: 'Final stable title' }
+    ]
+    const generatedUpdates = [
+      { paneKey: makePaneKey('tab-1', LEAF_ID), prompt: 'First generated title wins here' },
+      { paneKey: makePaneKey('tab-1', LEAF_ID), prompt: 'Ignored later generated title' },
+      {
+        paneKey: makePaneKey('tab-1', LEAF_ID),
+        prompt: 'Forced replacement generated title',
+        options: { replaceExistingGeneratedTitle: true }
+      }
+    ]
+
+    for (const update of liveUpdates) {
+      sequentialStore.getState().updateTabTitle(update.tabId, update.title)
+    }
+    for (const update of generatedUpdates) {
+      sequentialStore
+        .getState()
+        .setGeneratedTabTitleFromAgentPrompt(update.paneKey, update.prompt, update.options)
+    }
+    batchStore.getState().updateTabTitles(liveUpdates)
+    batchStore.getState().setGeneratedTabTitlesFromAgentPrompts(generatedUpdates)
+
+    expect(batchStore.getState().tabsByWorktree).toEqual(sequentialStore.getState().tabsByWorktree)
+    expect(batchStore.getState().unifiedTabsByWorktree).toEqual(
+      sequentialStore.getState().unifiedTabsByWorktree
+    )
+    expect(batchStore.getState().sortEpoch).toBe(sequentialStore.getState().sortEpoch)
+  })
+
+  it('coalesces generated titles while preserving first-write and replacement semantics', () => {
+    const store = createTestStore()
+    const fixture = makeScaleState(100)
+    seedStore(store, {
+      settings: { ...getDefaultSettings('/tmp'), tabAutoGenerateTitle: true },
+      worktreesByRepo: { repo1: fixture.worktrees },
+      tabsByWorktree: fixture.tabsByWorktree,
+      unifiedTabsByWorktree: fixture.unifiedTabsByWorktree
+    })
+    fixture.resetIdReads()
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+    const updates: GeneratedTabTitleUpdate[] = Array.from({ length: 100 }, (_, index) => ({
+      paneKey: makePaneKey(`tab-${index}`, LEAF_ID),
+      prompt: `Refactor remote module ${index} for startup performance`
+    }))
+    updates.push(
+      {
+        paneKey: makePaneKey('tab-0', LEAF_ID),
+        prompt: 'This later prompt must not replace the first generated title'
+      },
+      {
+        paneKey: makePaneKey('tab-0', LEAF_ID),
+        prompt: 'Replacement title for a newer dispatch',
+        options: { replaceExistingGeneratedTitle: true }
+      }
+    )
+
+    store.getState().setGeneratedTabTitlesFromAgentPrompts(updates)
+
+    unsubscribe()
+    expect(publications).toBe(1)
+    expect(fixture.getIdReads()).toBeLessThanOrEqual(305)
+    expect(store.getState().tabsByWorktree['wt-0']?.[0]?.generatedTitle).toBe(
+      'Replacement title for a newer dispatch'
+    )
+    expect(store.getState().tabsByWorktree['wt-99']?.[0]?.generatedTitle).toBe(
+      'Refactor remote module 99 for startup'
+    )
+  })
+})
diff --git a/src/renderer/src/store/slices/terminal-tab-title-batch.ts b/src/renderer/src/store/slices/terminal-tab-title-batch.ts
new file mode 100644
index 00000000000..21701f3bd9d
--- /dev/null
+++ b/src/renderer/src/store/slices/terminal-tab-title-batch.ts
@@ -0,0 +1,242 @@
+import { deriveGeneratedTabTitle } from '../../../../shared/agent-tab-title'
+import { isDecorativeAgentTitleFrameChange } from '../../../../shared/agent-decorative-title-signature'
+import { parseLegacyNumericPaneKey, parsePaneKey } from '../../../../shared/stable-pane-id'
+import type { Tab, TerminalTab } from '../../../../shared/types'
+import type { AppState } from '../types'
+
+export type TerminalTabTitleUpdate = { tabId: string; title: string }
+
+export type GeneratedTabTitleUpdate = {
+  paneKey: string
+  prompt: string
+  options?: { replaceExistingGeneratedTitle?: boolean }
+}
+
+type TitleState = Pick<
+  AppState,
+  'activeWorktreeId' | 'settings' | 'sortEpoch' | 'tabsByWorktree' | 'unifiedTabsByWorktree'
+>
+
+type TitlePatch = Partial<Pick<AppState, 'sortEpoch' | 'tabsByWorktree' | 'unifiedTabsByWorktree'>>
+
+type TitleUpdateResult = {
+  patch: TitlePatch | null
+  runtimeGraphChanged: boolean
+}
+
+type OwnerStage = {
+  tabs: TerminalTab[]
+  tabsChanged: boolean
+  tabIndexesById: Map<string, number[]>
+  unifiedTabs: Tab[]
+  unifiedTabsChanged: boolean
+  unifiedIndexByTabId: Map<string, number>
+}
+
+function getFallbackTabTitle(tab: TerminalTab): string {
+  return (
+    tab.customTitle?.trim() ||
+    tab.quickCommandLabel?.trim() ||
+    tab.defaultTitle?.trim() ||
+    tab.title ||
+    'Terminal 1'
+  )
+}
+
+function getTabIdFromPaneKey(paneKey: string): string | null {
+  return parsePaneKey(paneKey)?.tabId ?? parseLegacyNumericPaneKey(paneKey)?.tabId ?? null
+}
+
+function buildOwnerIndex(tabsByWorktree: TitleState['tabsByWorktree']): Map<string, string> {
+  const ownerByTabId = new Map<string, string>()
+  for (const [worktreeId, tabs] of Object.entries(tabsByWorktree)) {
+    for (const tab of tabs) {
+      ownerByTabId.set(tab.id, worktreeId)
+    }
+  }
+  return ownerByTabId
+}
+
+function getOwnerStage(
+  state: TitleState,
+  stages: Map<string, OwnerStage>,
+  worktreeId: string
+): OwnerStage {
+  const existing = stages.get(worktreeId)
+  if (existing) {
+    return existing
+  }
+  const tabs = state.tabsByWorktree[worktreeId] ?? []
+  const unifiedTabs = state.unifiedTabsByWorktree[worktreeId] ?? []
+  const tabIndexesById = new Map<string, number[]>()
+  for (let index = 0; index < tabs.length; index += 1) {
+    const tabId = tabs[index].id
+    const indexes = tabIndexesById.get(tabId)
+    if (indexes) {
+      indexes.push(index)
+    } else {
+      tabIndexesById.set(tabId, [index])
+    }
+  }
+  const unifiedIndexByTabId = new Map<string, number>()
+  for (let index = 0; index < unifiedTabs.length; index += 1) {
+    const tab = unifiedTabs[index]
+    if (tab.contentType === 'terminal' && !unifiedIndexByTabId.has(tab.entityId)) {
+      unifiedIndexByTabId.set(tab.entityId, index)
+    }
+  }
+  const stage: OwnerStage = {
+    tabs,
+    tabsChanged: false,
+    tabIndexesById,
+    unifiedTabs,
+    unifiedTabsChanged: false,
+    unifiedIndexByTabId
+  }
+  stages.set(worktreeId, stage)
+  return stage
+}
+
+function updateStageTabs(
+  stage: OwnerStage,
+  indexes: readonly number[],
+  update: (tab: TerminalTab) => TerminalTab
+): void {
+  if (!stage.tabsChanged) {
+    stage.tabs = [...stage.tabs]
+    stage.tabsChanged = true
+  }
+  for (const index of indexes) {
+    stage.tabs[index] = update(stage.tabs[index])
+  }
+}
+
+function updateStageUnifiedLabel(
+  stage: OwnerStage,
+  tabId: string,
+  key: 'generatedLabel' | 'label',
+  value: string
+): void {
+  const index = stage.unifiedIndexByTabId.get(tabId)
+  if (index === undefined || stage.unifiedTabs[index]?.[key] === value) {
+    return
+  }
+  if (!stage.unifiedTabsChanged) {
+    stage.unifiedTabs = [...stage.unifiedTabs]
+    stage.unifiedTabsChanged = true
+  }
+  stage.unifiedTabs[index] = { ...stage.unifiedTabs[index], [key]: value }
+}
+
+function finishTitleStages(
+  state: TitleState,
+  stages: Map<string, OwnerStage>,
+  sortEpochIncrement = 0
+): TitleUpdateResult {
+  const tabsChanged = [...stages.values()].some((stage) => stage.tabsChanged)
+  const unifiedTabsChanged = [...stages.values()].some((stage) => stage.unifiedTabsChanged)
+  if (!tabsChanged && !unifiedTabsChanged) {
+    return { patch: null, runtimeGraphChanged: false }
+  }
+  const patch: TitlePatch = {}
+  if (tabsChanged) {
+    patch.tabsByWorktree = { ...state.tabsByWorktree }
+  }
+  if (unifiedTabsChanged) {
+    patch.unifiedTabsByWorktree = { ...state.unifiedTabsByWorktree }
+  }
+  for (const [worktreeId, stage] of stages) {
+    if (stage.tabsChanged) {
+      patch.tabsByWorktree![worktreeId] = stage.tabs
+    }
+    if (stage.unifiedTabsChanged) {
+      patch.unifiedTabsByWorktree![worktreeId] = stage.unifiedTabs
+    }
+  }
+  if (sortEpochIncrement > 0) {
+    patch.sortEpoch = state.sortEpoch + sortEpochIncrement
+  }
+  return { patch, runtimeGraphChanged: tabsChanged }
+}
+
+export function applyTerminalTabTitleUpdates(
+  state: TitleState,
+  updates: readonly TerminalTabTitleUpdate[],
+  ownerByTabId = buildOwnerIndex(state.tabsByWorktree)
+): TitleUpdateResult {
+  const stages = new Map<string, OwnerStage>()
+  let sortEpochIncrement = 0
+  for (const { tabId, title } of updates) {
+    const ownerWorktreeId = ownerByTabId.get(tabId)
+    if (!ownerWorktreeId) {
+      continue
+    }
+    const stage = getOwnerStage(state, stages, ownerWorktreeId)
+    const tabIndexes = stage.tabIndexesById.get(tabId)
+    const currentTab = tabIndexes ? stage.tabs[tabIndexes[0]] : undefined
+    if (!currentTab || !tabIndexes) {
+      continue
+    }
+    const nextTitle = title.trim() || getFallbackTabTitle(currentTab)
+    if (isDecorativeAgentTitleFrameChange(currentTab.title, nextTitle)) {
+      updateStageUnifiedLabel(stage, tabId, 'label', currentTab.title)
+      continue
+    }
+    updateStageUnifiedLabel(stage, tabId, 'label', nextTitle)
+    if (currentTab.title === nextTitle) {
+      continue
+    }
+    updateStageTabs(stage, tabIndexes, (tab) => ({
+      ...tab,
+      title: nextTitle,
+      defaultTitle:
+        tab.defaultTitle ??
+        (/^Terminal \d+$/.test(tab.title) ? tab.title : undefined) ??
+        (/^Terminal \d+$/.test(nextTitle) ? nextTitle : undefined)
+    }))
+    if (ownerWorktreeId !== state.activeWorktreeId) {
+      sortEpochIncrement += 1
+    }
+  }
+  return finishTitleStages(state, stages, sortEpochIncrement)
+}
+
+export function applyGeneratedTabTitleUpdates(
+  state: TitleState,
+  updates: readonly GeneratedTabTitleUpdate[],
+  ownerByTabId = buildOwnerIndex(state.tabsByWorktree)
+): TitleUpdateResult {
+  if (state.settings?.tabAutoGenerateTitle !== true) {
+    return { patch: null, runtimeGraphChanged: false }
+  }
+  const stages = new Map<string, OwnerStage>()
+  for (const { paneKey, prompt, options } of updates) {
+    const tabId = getTabIdFromPaneKey(paneKey)
+    const ownerWorktreeId = tabId ? ownerByTabId.get(tabId) : undefined
+    if (!tabId || !ownerWorktreeId || prompt.length === 0) {
+      continue
+    }
+    const stage = getOwnerStage(state, stages, ownerWorktreeId)
+    const tabIndexes = stage.tabIndexesById.get(tabId)
+    const currentTab = tabIndexes ? stage.tabs[tabIndexes[0]] : undefined
+    if (
+      !currentTab ||
+      !tabIndexes ||
+      currentTab.customTitle?.trim() ||
+      currentTab.quickCommandLabel?.trim()
+    ) {
+      continue
+    }
+    const existingGeneratedTitle = currentTab.generatedTitle?.trim()
+    if (existingGeneratedTitle && options?.replaceExistingGeneratedTitle !== true) {
+      continue
+    }
+    const generatedTitle = deriveGeneratedTabTitle(prompt)
+    if (!generatedTitle || existingGeneratedTitle === generatedTitle) {
+      continue
+    }
+    updateStageTabs(stage, tabIndexes, (tab) => ({ ...tab, generatedTitle }))
+    updateStageUnifiedLabel(stage, tabId, 'generatedLabel', generatedTitle)
+  }
+  return finishTitleStages(state, stages)
+}
diff --git a/src/renderer/src/store/slices/terminals.ts b/src/renderer/src/store/slices/terminals.ts
index 89fc0657479..c644b6db241 100644
--- a/src/renderer/src/store/slices/terminals.ts
+++ b/src/renderer/src/store/slices/terminals.ts
@@ -28,7 +28,6 @@ import {
   parseWorkspaceKey,
   worktreeWorkspaceKey
 } from '../../../../shared/workspace-scope'
-import { deriveGeneratedTabTitle } from '../../../../shared/agent-tab-title'
 import { isDecorativeAgentTitleFrameChange } from '../../../../shared/agent-decorative-title-signature'
 import {
   isTerminalLeafId,
@@ -72,6 +71,12 @@ import { isClaudeAgent } from '@/lib/agent-status'
 import { recordTerminalInputActivity } from '@/lib/terminal-input-activity-coalescing'
 import { classifyTitleActivity } from '@/lib/pane-agent-evidence'
 import { buildOrphanTerminalCleanupPatch, getOrphanTerminalIds } from './terminal-orphan-helpers'
+import {
+  applyGeneratedTabTitleUpdates,
+  applyTerminalTabTitleUpdates,
+  type GeneratedTabTitleUpdate,
+  type TerminalTabTitleUpdate
+} from './terminal-tab-title-batch'
 import {
   dedupeTabOrder,
   ensureGroup,
@@ -227,16 +232,6 @@ function consumePendingActivationSpawn(
   return count === 2 ? true : count - 1
 }
 
-function getFallbackTabTitle(tab: TerminalTab, index?: number): string {
-  return (
-    tab.customTitle?.trim() ||
-    tab.quickCommandLabel?.trim() ||
-    tab.defaultTitle?.trim() ||
-    tab.title ||
-    `Terminal ${(index ?? 0) + 1}`
-  )
-}
-
 function getPathDisplayName(path: string, fallback: string): string {
   const normalized = path.trim().replace(/[\\/]+$/g, '')
   const basename = normalized.split(/[\\/]/).findLast(Boolean)?.trim()
@@ -339,36 +334,6 @@ function getTerminalTabOwnerWorktreeId(
   return terminalTabOwnerCache.get(tabId) ?? null
 }
 
-function updateUnifiedTerminalLabel(
-  unifiedTabs: Tab[],
-  terminalTabId: string,
-  label: string
-): Tab[] | null {
-  const unifiedIndex = unifiedTabs.findIndex(
-    (entry) => entry.contentType === 'terminal' && entry.entityId === terminalTabId
-  )
-  if (unifiedIndex === -1 || unifiedTabs[unifiedIndex]?.label === label) {
-    return null
-  }
-  return unifiedTabs.map((entry, index) => (index === unifiedIndex ? { ...entry, label } : entry))
-}
-
-function updateUnifiedTerminalGeneratedLabel(
-  unifiedTabs: Tab[],
-  terminalTabId: string,
-  generatedLabel: string
-): Tab[] | null {
-  const unifiedIndex = unifiedTabs.findIndex(
-    (entry) => entry.contentType === 'terminal' && entry.entityId === terminalTabId
-  )
-  if (unifiedIndex === -1 || unifiedTabs[unifiedIndex]?.generatedLabel === generatedLabel) {
-    return null
-  }
-  return unifiedTabs.map((entry, index) =>
-    index === unifiedIndex ? { ...entry, generatedLabel } : entry
-  )
-}
-
 function getTabIdFromPaneKey(paneKey: string): string | null {
   return parsePaneKey(paneKey)?.tabId ?? parseLegacyNumericPaneKey(paneKey)?.tabId ?? null
 }
@@ -690,12 +655,14 @@ export type TerminalSlice = {
   setActiveTab: (tabId: string) => void
   setActiveTabForWorktree: (worktreeId: string, tabId: string) => void
   updateTabTitle: (tabId: string, title: string) => void
+  updateTabTitles: (updates: readonly TerminalTabTitleUpdate[]) => void
   setAiVaultTabTitle: (tabId: string, aiVaultTitle: AiVaultSessionTitle | null) => void
   setGeneratedTabTitleFromAgentPrompt: (
     paneKey: string,
     prompt: string,
     options?: { replaceExistingGeneratedTitle?: boolean }
   ) => void
+  setGeneratedTabTitlesFromAgentPrompts: (updates: readonly GeneratedTabTitleUpdate[]) => void
   clearTabLaunchAgent: (tabId: string) => void
   setRuntimePaneTitle: (tabId: string, paneId: number, title: string) => void
   clearRuntimePaneTitle: (tabId: string, paneId: number) => void
@@ -2002,77 +1969,29 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
   },
 
   updateTabTitle: (tabId, title) => {
-    set((s) => {
-      // Why: update only the owner to preserve selector equality for background worktrees.
-      const ownerWorktreeId = getTerminalTabOwnerWorktreeId(s.tabsByWorktree, tabId)
-      if (!ownerWorktreeId) {
-        return s
+    set((state) => {
+      const ownerWorktreeId = getTerminalTabOwnerWorktreeId(state.tabsByWorktree, tabId)
+      const ownerByTabId = ownerWorktreeId
+        ? new Map([[tabId, ownerWorktreeId]])
+        : new Map<string, string>()
+      const result = applyTerminalTabTitleUpdates(state, [{ tabId, title }], ownerByTabId)
+      if (result.runtimeGraphChanged) {
+        scheduleRuntimeGraphSync()
       }
-      const tabs = s.tabsByWorktree[ownerWorktreeId] ?? []
-      const tabIndex = tabs.findIndex((t) => t.id === tabId)
-      const currentTab = tabs[tabIndex]
-      if (!currentTab) {
-        return s
+      return result.patch ?? state
+    })
+  },
+
+  updateTabTitles: (updates) => {
+    if (updates.length === 0) {
+      return
+    }
+    set((state) => {
+      const result = applyTerminalTabTitleUpdates(state, updates)
+      if (result.runtimeGraphChanged) {
+        scheduleRuntimeGraphSync()
       }
-      const nextTitle = title.trim() || getFallbackTabTitle(currentTab)
-      const currentUnifiedTabs = s.unifiedTabsByWorktree[ownerWorktreeId] ?? []
-      if (isDecorativeAgentTitleFrameChange(currentTab.title, nextTitle)) {
-        const unifiedTabsWithCurrentLabel = updateUnifiedTerminalLabel(
-          currentUnifiedTabs,
-          tabId,
-          currentTab.title
-        )
-        return unifiedTabsWithCurrentLabel
-          ? {
-              unifiedTabsByWorktree: {
-                ...s.unifiedTabsByWorktree,
-                [ownerWorktreeId]: unifiedTabsWithCurrentLabel
-              }
-            }
-          : s
-      }
-      const unifiedTabsWithUpdatedLabel = updateUnifiedTerminalLabel(
-        currentUnifiedTabs,
-        tabId,
-        nextTitle
-      )
-      if (currentTab.title === nextTitle) {
-        return unifiedTabsWithUpdatedLabel
-          ? {
-              unifiedTabsByWorktree: {
-                ...s.unifiedTabsByWorktree,
-                [ownerWorktreeId]: unifiedTabsWithUpdatedLabel
-              }
-            }
-          : s
-      }
-      const ownerTabs = tabs.map((tab) =>
-        tab.id === tabId
-          ? {
-              ...tab,
-              // Why: PTYs can briefly emit an empty title as an agent exits; keep the stable fallback instead of a blank tab.
-              title: nextTitle,
-              defaultTitle:
-                tab.defaultTitle ??
-                (/^Terminal \d+$/.test(tab.title) ? tab.title : undefined) ??
-                (/^Terminal \d+$/.test(nextTitle) ? nextTitle : undefined)
-            }
-          : tab
-      )
-      scheduleRuntimeGraphSync()
-      const nextTabsByWorktree = { ...s.tabsByWorktree, [ownerWorktreeId]: ownerTabs }
-      // Why: title changes affect sorting, except active-worktree remount side effects.
-      const isActive = ownerWorktreeId === s.activeWorktreeId
-      const nextState: Partial<AppState> = isActive
-        ? { tabsByWorktree: nextTabsByWorktree }
-        : { tabsByWorktree: nextTabsByWorktree, sortEpoch: s.sortEpoch + 1 }
-      if (unifiedTabsWithUpdatedLabel) {
-        nextState.unifiedTabsByWorktree = {
-          ...s.unifiedTabsByWorktree,
-          [ownerWorktreeId]: unifiedTabsWithUpdatedLabel
-        }
-      }
-      return nextState
+      return result.patch ?? state
     })
   },
 
@@ -2109,18 +2028,16 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
 
   setGeneratedTabTitleFromAgentPrompt: (paneKey, prompt, options) => {
     // Why: setAgentStatus is high-frequency; skip derive/set unless the feature is on and this tab still needs a (re)generated title.
-    if (get().settings?.tabAutoGenerateTitle !== true) {
-      return
-    }
+    const state = get()
     const tabId = getTabIdFromPaneKey(paneKey)
-    if (!tabId || prompt.length === 0) {
+    if (!tabId || prompt.length === 0 || state.settings?.tabAutoGenerateTitle !== true) {
       return
     }
-    const ownerWorktreeId = getTerminalTabOwnerWorktreeId(get().tabsByWorktree, tabId)
+    const ownerWorktreeId = getTerminalTabOwnerWorktreeId(state.tabsByWorktree, tabId)
     if (!ownerWorktreeId) {
       return
     }
-    const tabs = get().tabsByWorktree[ownerWorktreeId] ?? []
+    const tabs = state.tabsByWorktree[ownerWorktreeId] ?? []
     const currentTab = tabs.find((tab) => tab.id === tabId)
     if (!currentTab || currentTab.customTitle?.trim() || currentTab.quickCommandLabel?.trim()) {
       return
@@ -2129,57 +2046,29 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
     if (existingGeneratedTitle && options?.replaceExistingGeneratedTitle !== true) {
       return
     }
-    const generatedTitle = deriveGeneratedTabTitle(prompt)
-    if (!generatedTitle || existingGeneratedTitle === generatedTitle) {
+    set((latestState) => {
+      const result = applyGeneratedTabTitleUpdates(
+        latestState,
+        [{ paneKey, prompt, options }],
+        new Map([[tabId, ownerWorktreeId]])
+      )
+      if (result.runtimeGraphChanged) {
+        scheduleRuntimeGraphSync()
+      }
+      return result.patch ?? latestState
+    })
+  },
+
+  setGeneratedTabTitlesFromAgentPrompts: (updates) => {
+    if (updates.length === 0) {
       return
     }
-    set((s) => {
-      const ownerTabsForWrite = s.tabsByWorktree[ownerWorktreeId]
-      if (!ownerTabsForWrite) {
-        return s
-      }
-      const tabIndex = ownerTabsForWrite.findIndex((tab) => tab.id === tabId)
-      const tabForWrite = ownerTabsForWrite[tabIndex]
-      // Why: re-check inside set so concurrent renames / setting flips win.
-      if (
-        !tabForWrite ||
-        s.settings?.tabAutoGenerateTitle !== true ||
-        tabForWrite.customTitle?.trim() ||
-        tabForWrite.quickCommandLabel?.trim()
-      ) {
-        return s
-      }
-      const latestGeneratedTitle = tabForWrite.generatedTitle?.trim()
-      if (
-        latestGeneratedTitle &&
-        (latestGeneratedTitle === generatedTitle || options?.replaceExistingGeneratedTitle !== true)
-      ) {
-        return s
-      }
-      const ownerTabs = ownerTabsForWrite.map((tab) =>
-        tab.id === tabId ? { ...tab, generatedTitle } : tab
-      )
-      const currentUnifiedTabs = s.unifiedTabsByWorktree[ownerWorktreeId] ?? []
-      const unifiedTabsWithGeneratedLabel = updateUnifiedTerminalGeneratedLabel(
-        currentUnifiedTabs,
-        tabId,
-        generatedTitle
-      )
-      scheduleRuntimeGraphSync()
-      return {
-        tabsByWorktree: {
-          ...s.tabsByWorktree,
-          [ownerWorktreeId]: ownerTabs
-        },
-        ...(unifiedTabsWithGeneratedLabel
-          ? {
-              unifiedTabsByWorktree: {
-                ...s.unifiedTabsByWorktree,
-                [ownerWorktreeId]: unifiedTabsWithGeneratedLabel
-              }
-            }
-          : {})
+    set((state) => {
+      const result = applyGeneratedTabTitleUpdates(state, updates)
+      if (result.runtimeGraphChanged) {
+        scheduleRuntimeGraphSync()
       }
+      return result.patch ?? state
     })
   },
 
diff --git a/src/renderer/src/store/slices/ui.ts b/src/renderer/src/store/slices/ui.ts
index 1bfa1d68d77..cf2f2b126b7 100644
--- a/src/renderer/src/store/slices/ui.ts
+++ b/src/renderer/src/store/slices/ui.ts
@@ -853,7 +853,7 @@ export type UISlice = {
   ) => void
   markOrcaHookRepoAlwaysTrusted: (repoId: string) => void
   clearOrcaHookTrustForRepo: (repoId: string) => void
-  setupScriptPromptDismissedRepoIds: string[]
+  setupScriptPromptDismissedRepoIds: readonly string[]
   dismissSetupScriptPrompt: (repoHostIdentity: string) => void
   setupGuideSidebarDismissed: boolean
   setSetupGuideSidebarDismissed: (dismissed: boolean) => void
@@ -904,8 +904,8 @@ export type UISlice = {
   showDotfilesByWorktree: Record<string, boolean>
   setShowDotfilesForWorktree: (worktreeId: string, showDotfiles: boolean) => void
   toggleShowDotfilesForWorktree: (worktreeId: string) => void
-  filterRepoIds: string[]
-  setFilterRepoIds: (ids: string[]) => void
+  filterRepoIds: readonly string[]
+  setFilterRepoIds: (ids: readonly string[]) => void
   collapsedGroups: Set<string>
   toggleCollapsedGroup: (key: string) => void
   worktreeCardProperties: WorktreeCardProperty[]
diff --git a/src/renderer/src/store/slices/worktree-helpers.ts b/src/renderer/src/store/slices/worktree-helpers.ts
index ea3ad4bb92f..c2980357ee8 100644
--- a/src/renderer/src/store/slices/worktree-helpers.ts
+++ b/src/renderer/src/store/slices/worktree-helpers.ts
@@ -89,8 +89,8 @@ export type ActiveWorktreeStateTransition = (state: AppState) => {
 export type WorktreeSlice = {
   worktreesByRepo: Record<string, Worktree[]>
   detectedWorktreesByRepo: Record<string, DetectedWorktreeListResult>
-  worktreeLineageById: Record<string, WorktreeLineage>
-  workspaceLineageByChildKey: Record<WorkspaceKey, WorkspaceLineage>
+  worktreeLineageById: Readonly<Record<string, WorktreeLineage>>
+  workspaceLineageByChildKey: Readonly<Record<WorkspaceKey, WorkspaceLineage>>
   activeWorktreeId: string | null
   activeWorkspaceKey: WorkspaceKey | null
   activeWorkspaceExecutionHostId: ExecutionHostId | null
@@ -393,9 +393,7 @@ export function withoutErasedRequiredWorktreeFields(
   updates: Partial<WorktreeMeta>
 ): Partial<WorktreeMeta> {
   const erased = Object.keys(ERASURE_PROTECTED_KEYS).filter(
-    (key) =>
-      updates[key as keyof WorktreeMeta] === undefined &&
-      Object.prototype.hasOwnProperty.call(updates, key)
+    (key) => updates[key as keyof WorktreeMeta] === undefined && Object.hasOwn(updates, key)
   )
   if (erased.length === 0) {
     return updates
diff --git a/src/renderer/src/store/slices/worktree-nav-history.ts b/src/renderer/src/store/slices/worktree-nav-history.ts
index 5a72d3d0530..1582e649017 100644
--- a/src/renderer/src/store/slices/worktree-nav-history.ts
+++ b/src/renderer/src/store/slices/worktree-nav-history.ts
@@ -43,7 +43,7 @@ export type WorktreeNavHistoryTaskDetailEntry =
 export type WorktreeNavHistoryViewEntry =
   | WorktreeNavHistorySimpleViewEntry
   | WorktreeNavHistoryTaskDetailEntry
-export type WorktreeNavHistoryEntry = string | WorktreeNavHistoryViewEntry
+export type WorktreeNavHistoryEntry = (string & {}) | WorktreeNavHistoryViewEntry
 
 export type WorktreeNavHistorySlice = {
   // Linear history, oldest -> newest.
diff --git a/src/renderer/src/store/slices/worktrees.test.ts b/src/renderer/src/store/slices/worktrees.test.ts
index 5ebe9a06116..6077204ba51 100644
--- a/src/renderer/src/store/slices/worktrees.test.ts
+++ b/src/renderer/src/store/slices/worktrees.test.ts
@@ -3187,6 +3187,71 @@ describe('fetchWorktrees', () => {
     expect(store.getState().sortEpoch).toBe(7)
   })
 
+  it('keeps remote lineage map identity when a cloned payload is unchanged', async () => {
+    const store = createTestStore()
+    const worktree = makeWorktree({
+      id: 'repo1::/remote/wt1',
+      repoId: 'repo1',
+      path: '/remote/wt1',
+      branch: 'refs/heads/remote',
+      hostId: 'runtime:env-1'
+    })
+    const lineage = makeLineage({
+      worktreeId: worktree.id,
+      parentWorktreeId: 'repo1::/remote/parent',
+      capture: { source: 'orchestration-context', confidence: 'explicit' },
+      taskId: 'task-42',
+      coordinatorHandle: 'coord-1'
+    })
+    const workspaceLineage = makeWorkspaceLineage({
+      childWorkspaceKey: worktreeWorkspaceKey(worktree.id),
+      parentWorkspaceKey: worktreeWorkspaceKey(lineage.parentWorktreeId),
+      childInstanceId: lineage.worktreeInstanceId,
+      parentInstanceId: lineage.parentWorktreeInstanceId,
+      origin: lineage.origin,
+      capture: lineage.capture,
+      taskId: lineage.taskId,
+      coordinatorHandle: lineage.coordinatorHandle,
+      createdAt: lineage.createdAt
+    })
+    const detected = makeDetectedResult('repo1', [worktree])
+    store.setState({
+      settings: { activeRuntimeEnvironmentId: 'env-1' } as never,
+      worktreesByRepo: { repo1: [worktree] },
+      detectedWorktreesByRepo: { repo1: detected },
+      worktreeLineageById: { [lineage.worktreeId]: lineage },
+      workspaceLineageByChildKey: {
+        [workspaceLineage.childWorkspaceKey]: workspaceLineage
+      },
+      sortEpoch: 7
+    } as Partial<AppState>)
+    runtimeEnvironmentCall.mockImplementation(({ method }: RuntimeEnvironmentCallRequest) => {
+      const result =
+        method === 'worktree.lineageList'
+          ? structuredClone({
+              lineage: { [lineage.worktreeId]: lineage },
+              workspaceLineage: { [workspaceLineage.childWorkspaceKey]: workspaceLineage }
+            })
+          : structuredClone(detected)
+      return Promise.resolve({
+        id: 'rpc-1',
+        ok: true,
+        result,
+        _meta: { runtimeId: 'runtime-remote' }
+      })
+    })
+    const before = store.getState()
+
+    await store.getState().fetchWorktrees('repo1')
+
+    expect(store.getState().worktreeLineageById).toBe(before.worktreeLineageById)
+    expect(store.getState().workspaceLineageByChildKey).toBe(before.workspaceLineageByChildKey)
+    expect(store.getState().worktreeLineageById[lineage.worktreeId]).toBe(lineage)
+    expect(store.getState().workspaceLineageByChildKey[workspaceLineage.childWorkspaceKey]).toBe(
+      workspaceLineage
+    )
+  })
+
   it('defers remote lineage when a caller owns the final host refresh', async () => {
     const store = createTestStore()
     const worktree = makeWorktree({
@@ -3319,6 +3384,135 @@ describe('worktree lineage state', () => {
     })
   })
 
+  it('keeps lineage map and entry identity across a cloned no-op refresh', async () => {
+    const lineage = makeLineage({
+      capture: { source: 'orchestration-context', confidence: 'explicit' },
+      taskId: 'task-42',
+      coordinatorHandle: 'coord-1'
+    })
+    const workspaceLineage = makeWorkspaceLineage({
+      childWorkspaceKey: worktreeWorkspaceKey(lineage.worktreeId),
+      parentWorkspaceKey: worktreeWorkspaceKey(lineage.parentWorktreeId),
+      childInstanceId: lineage.worktreeInstanceId,
+      parentInstanceId: lineage.parentWorktreeInstanceId,
+      origin: lineage.origin,
+      capture: lineage.capture,
+      taskId: lineage.taskId,
+      coordinatorHandle: lineage.coordinatorHandle,
+      createdAt: lineage.createdAt
+    })
+    const store = createLocalLineageTestStore(lineage)
+    const payload = {
+      lineage: { [lineage.worktreeId]: lineage },
+      workspaceLineage: { [workspaceLineage.childWorkspaceKey]: workspaceLineage }
+    }
+    mockApi.worktrees.listLineage.mockImplementation(async () => structuredClone(payload))
+
+    await store.getState().fetchWorktreeLineage()
+    const afterFirst = store.getState()
+    const lineageById = afterFirst.worktreeLineageById
+    const workspaceByKey = afterFirst.workspaceLineageByChildKey
+    const lineageEntry = lineageById[lineage.worktreeId]
+    const workspaceEntry = workspaceByKey[workspaceLineage.childWorkspaceKey]
+    expect(lineageEntry).toEqual(lineage)
+    expect(lineageEntry).not.toBe(lineage)
+    const subscriber = vi.fn()
+    const unsubscribe = store.subscribe(subscriber)
+
+    await store.getState().fetchWorktreeLineage()
+    unsubscribe()
+
+    expect(store.getState().worktreeLineageById).toBe(lineageById)
+    expect(store.getState().workspaceLineageByChildKey).toBe(workspaceByKey)
+    expect(store.getState().worktreeLineageById[lineage.worktreeId]).toBe(lineageEntry)
+    expect(store.getState().workspaceLineageByChildKey[workspaceLineage.childWorkspaceKey]).toBe(
+      workspaceEntry
+    )
+    expect(subscriber).not.toHaveBeenCalled()
+    expect(mockApi.worktrees.listLineage).toHaveBeenCalledTimes(2)
+  })
+
+  it('preserves other-host lineage row identity across a cloned same-host refresh', async () => {
+    const store = createTestStore()
+    const localWorktree = makeWorktree({
+      id: 'repo1::/local/child',
+      repoId: 'repo1',
+      hostId: LOCAL_EXECUTION_HOST_ID
+    })
+    const sshWorktree = makeWorktree({
+      id: 'repo2::/ssh/child',
+      repoId: 'repo2',
+      hostId: 'ssh:ssh-1'
+    })
+    const localLineage = makeLineage({
+      worktreeId: localWorktree.id,
+      parentWorktreeId: 'repo1::/local/parent',
+      capture: { source: 'orchestration-context', confidence: 'explicit' },
+      taskId: 'task-local',
+      coordinatorHandle: 'coord-local'
+    })
+    const sshLineage = makeLineage({
+      worktreeId: sshWorktree.id,
+      parentWorktreeId: 'repo2::/ssh/parent',
+      capture: { source: 'cwd-context', confidence: 'inferred' },
+      taskId: 'task-ssh',
+      coordinatorHandle: 'coord-ssh'
+    })
+    const localWorkspace = makeWorkspaceLineage({
+      childWorkspaceKey: worktreeWorkspaceKey(localWorktree.id),
+      parentWorkspaceKey: worktreeWorkspaceKey(localLineage.parentWorktreeId),
+      childInstanceId: localLineage.worktreeInstanceId,
+      parentInstanceId: localLineage.parentWorktreeInstanceId,
+      origin: localLineage.origin,
+      capture: localLineage.capture,
+      taskId: localLineage.taskId,
+      coordinatorHandle: localLineage.coordinatorHandle
+    })
+    const sshWorkspace = makeWorkspaceLineage({
+      childWorkspaceKey: worktreeWorkspaceKey(sshWorktree.id),
+      parentWorkspaceKey: worktreeWorkspaceKey(sshLineage.parentWorktreeId),
+      childInstanceId: sshLineage.worktreeInstanceId,
+      parentInstanceId: sshLineage.parentWorktreeInstanceId,
+      origin: sshLineage.origin,
+      capture: sshLineage.capture,
+      taskId: sshLineage.taskId,
+      coordinatorHandle: sshLineage.coordinatorHandle
+    })
+    store.setState({
+      worktreesByRepo: {
+        repo1: [localWorktree],
+        repo2: [sshWorktree]
+      },
+      worktreeLineageById: {
+        [localWorktree.id]: localLineage,
+        [sshWorktree.id]: sshLineage
+      },
+      workspaceLineageByChildKey: {
+        [localWorkspace.childWorkspaceKey]: localWorkspace,
+        [sshWorkspace.childWorkspaceKey]: sshWorkspace
+      }
+    } as Partial<AppState>)
+    const payload = {
+      lineage: { [localWorktree.id]: localLineage },
+      workspaceLineage: { [localWorkspace.childWorkspaceKey]: localWorkspace }
+    }
+    mockApi.worktrees.listLineage.mockImplementation(async () => structuredClone(payload))
+    const before = store.getState()
+
+    await store.getState().fetchWorktreeLineage()
+
+    expect(store.getState().worktreeLineageById).toBe(before.worktreeLineageById)
+    expect(store.getState().workspaceLineageByChildKey).toBe(before.workspaceLineageByChildKey)
+    expect(store.getState().worktreeLineageById[localWorktree.id]).toBe(localLineage)
+    expect(store.getState().worktreeLineageById[sshWorktree.id]).toBe(sshLineage)
+    expect(store.getState().workspaceLineageByChildKey[localWorkspace.childWorkspaceKey]).toBe(
+      localWorkspace
+    )
+    expect(store.getState().workspaceLineageByChildKey[sshWorkspace.childWorkspaceKey]).toBe(
+      sshWorkspace
+    )
+  })
+
   it('clears workspace lineage on successful old-shape lineage refresh', async () => {
     const store = createTestStore()
     const lineage = makeLineage()
diff --git a/src/renderer/src/store/slices/worktrees.ts b/src/renderer/src/store/slices/worktrees.ts
index 706fa02de2f..00e421cb7df 100644
--- a/src/renderer/src/store/slices/worktrees.ts
+++ b/src/renderer/src/store/slices/worktrees.ts
@@ -133,6 +133,7 @@ import type {
 import type { DirectSshAuthority } from '../../../../shared/ssh-types'
 import { findIndexedWorktreeOwnerForHost } from '@/lib/worktree-runtime-owner-index'
 import { catalogRowsEqual, reuseEqualCatalogRows } from './worktree-catalog-reconciliation'
+import { reuseEqualRecordMap } from './repo-identity-reconcile'
 export type { WorktreeSlice, WorktreeDeleteState } from './worktree-helpers'
 
 // Why: old runtime servers only have `worktree.list`; preserve the large-list UI hydration parity used before `worktree.detectedList` existed.
@@ -861,6 +862,7 @@ function getFolderWorkspaceMetaUpdates(
     | 'createdWithAgent'
     | 'pendingFirstAgentMessageRename'
     | 'firstAgentMessageRenameError'
+    | 'diffComments'
   >
 > {
   const next: Partial<
@@ -878,6 +880,7 @@ function getFolderWorkspaceMetaUpdates(
       | 'createdWithAgent'
       | 'pendingFirstAgentMessageRename'
       | 'firstAgentMessageRenameError'
+      | 'diffComments'
     >
   > = {}
   if (updates.displayName !== undefined) {
@@ -919,6 +922,9 @@ function getFolderWorkspaceMetaUpdates(
   if (updates.firstAgentMessageRenameError !== undefined) {
     next.firstAgentMessageRenameError = updates.firstAgentMessageRenameError
   }
+  if (updates.diffComments !== undefined) {
+    next.diffComments = updates.diffComments
+  }
   return next
 }
 
@@ -1385,8 +1391,8 @@ async function listWorktreeLineageForRuntime(
   settings: AppState['settings'],
   options: BackgroundRuntimeRefreshOptions = {}
 ): Promise<{
-  worktreeLineageById: Record<string, WorktreeLineage>
-  workspaceLineageByChildKey: Record<string, WorkspaceLineage>
+  worktreeLineageById: Readonly<Record<string, WorktreeLineage>>
+  workspaceLineageByChildKey: Readonly<Record<string, WorkspaceLineage>>
 }> {
   const target = getActiveRuntimeTarget(settings)
   type LineageListResponse = {
@@ -1394,8 +1400,7 @@ async function listWorktreeLineageForRuntime(
     workspaceLineage?: Record<string, WorkspaceLineage>
   }
   const normalizeLineageResponse = (value: Record<string, WorktreeLineage> | LineageListResponse) =>
-    Object.prototype.hasOwnProperty.call(value, 'lineage') ||
-    Object.prototype.hasOwnProperty.call(value, 'workspaceLineage')
+    Object.hasOwn(value, 'lineage') || Object.hasOwn(value, 'workspaceLineage')
       ? {
           worktreeLineageById: (value as LineageListResponse).lineage ?? {},
           workspaceLineageByChildKey: (value as LineageListResponse).workspaceLineage ?? {}
@@ -1566,21 +1571,38 @@ function applyWorktreeLineageUpdate(
   })
 }
 
+function applyHostLineageRefresh(
+  set: Parameters<StateCreator<AppState>>[0],
+  hostId: ExecutionHostId,
+  lineage: {
+    worktreeLineageById: Readonly<Record<string, WorktreeLineage>>
+    workspaceLineageByChildKey: Readonly<Record<string, WorkspaceLineage>>
+  }
+): void {
+  set((s) => {
+    const worktreeLineageById = mergeLineageForHost(s, hostId, lineage.worktreeLineageById)
+    const workspaceLineageByChildKey = mergeWorkspaceLineageForHost(
+      s,
+      hostId,
+      lineage.workspaceLineageByChildKey
+    )
+    if (
+      worktreeLineageById === s.worktreeLineageById &&
+      workspaceLineageByChildKey === s.workspaceLineageByChildKey
+    ) {
+      return s
+    }
+    return { worktreeLineageById, workspaceLineageByChildKey }
+  })
+}
+
 async function refreshWorktreeLineageForSettings(
   settings: AppState['settings'],
   set: Parameters<StateCreator<AppState>>[0],
   options: BackgroundRuntimeRefreshOptions = {}
 ): Promise<void> {
   const lineage = await listWorktreeLineageForRuntime(settings, options)
-  const hostId = getSettingsFocusedExecutionHostId(settings)
-  set((s) => ({
-    worktreeLineageById: mergeLineageForHost(s, hostId, lineage.worktreeLineageById),
-    workspaceLineageByChildKey: mergeWorkspaceLineageForHost(
-      s,
-      hostId,
-      lineage.workspaceLineageByChildKey
-    )
-  }))
+  applyHostLineageRefresh(set, getSettingsFocusedExecutionHostId(settings), lineage)
 }
 
 async function refreshRemoteWorktreeLineageBestEffort(
@@ -1594,15 +1616,7 @@ async function refreshRemoteWorktreeLineageBestEffort(
     const lineage = await listWorktreeLineageForRuntime(settings, {
       reuseRecentCompatibilityFailure: true
     })
-    const hostId = getSettingsFocusedExecutionHostId(settings)
-    set((s) => ({
-      worktreeLineageById: mergeLineageForHost(s, hostId, lineage.worktreeLineageById),
-      workspaceLineageByChildKey: mergeWorkspaceLineageForHost(
-        s,
-        hostId,
-        lineage.workspaceLineageByChildKey
-      )
-    }))
+    applyHostLineageRefresh(set, getSettingsFocusedExecutionHostId(settings), lineage)
   } catch (err) {
     // Why: lineage is supplemental, so a remote timeout here must not discard a successful worktree refresh.
     console.error('Failed to fetch worktree lineage:', err)
@@ -1634,15 +1648,18 @@ function mergeLineageForHost(
     'repos' | 'settings' | 'worktreesByRepo' | 'detectedWorktreesByRepo' | 'worktreeLineageById'
   >,
   hostId: ExecutionHostId,
-  lineage: Record<string, WorktreeLineage>
-): Record<string, WorktreeLineage> {
+  lineage: Readonly<Record<string, WorktreeLineage>>
+): Readonly<Record<string, WorktreeLineage>> {
   const next: Record<string, WorktreeLineage> = {}
   for (const [worktreeId, existing] of Object.entries(state.worktreeLineageById)) {
     if (getWorktreeHostId(state, worktreeId) !== hostId) {
       next[worktreeId] = existing
     }
   }
-  return { ...next, ...lineage }
+  for (const [worktreeId, incoming] of Object.entries(lineage)) {
+    next[worktreeId] = incoming
+  }
+  return reuseEqualRecordMap(state.worktreeLineageById, next)
 }
 
 function mergeWorkspaceLineageForHost(
@@ -1655,8 +1672,8 @@ function mergeWorkspaceLineageForHost(
     | 'workspaceLineageByChildKey'
   >,
   hostId: ExecutionHostId,
-  lineage: Record<string, WorkspaceLineage>
-): Record<string, WorkspaceLineage> {
+  lineage: Readonly<Record<string, WorkspaceLineage>>
+): Readonly<Record<string, WorkspaceLineage>> {
   const next: Record<string, WorkspaceLineage> = {}
   for (const [childKey, existing] of Object.entries(state.workspaceLineageByChildKey)) {
     const childScope = parseWorkspaceKey(existing.childWorkspaceKey)
@@ -1667,7 +1684,10 @@ function mergeWorkspaceLineageForHost(
       next[childKey] = existing
     }
   }
-  return { ...next, ...lineage }
+  for (const [childKey, incoming] of Object.entries(lineage)) {
+    next[childKey] = incoming
+  }
+  return reuseEqualRecordMap(state.workspaceLineageByChildKey, next)
 }
 
 async function persistWorktreeMeta(
@@ -2144,15 +2164,11 @@ function getHostedReviewLinkForMetaRefresh(
   existingWorktree: Worktree | undefined,
   key: HostedReviewLinkKey
 ): number | null {
-  return Object.prototype.hasOwnProperty.call(updates, key)
-    ? (updates[key] ?? null)
-    : (existingWorktree?.[key] ?? null)
+  return Object.hasOwn(updates, key) ? (updates[key] ?? null) : (existingWorktree?.[key] ?? null)
 }
 
 function hasExplicitPushTargetClear(updates: Partial<WorktreeMeta>): boolean {
-  return (
-    Object.prototype.hasOwnProperty.call(updates, 'pushTarget') && updates.pushTarget === undefined
-  )
+  return Object.hasOwn(updates, 'pushTarget') && updates.pushTarget === undefined
 }
 
 type RuntimeWorktreeMetaUpdates = Omit<Partial<WorktreeMeta>, 'pushTarget'> & {
@@ -5557,7 +5573,7 @@ export const createWorktreeSlice: StateCreator<AppState, [], [], WorktreeSlice>
     set((s) => {
       for (const [worktreeId, tabs] of Object.entries(s.tabsByWorktree)) {
         const index = tabs.findIndex((tab) => tab.id === tabId)
-        if (index < 0) {
+        if (index === -1) {
           continue
         }
         const tab = tabs[index]
@@ -6080,7 +6096,7 @@ export const createWorktreeSlice: StateCreator<AppState, [], [], WorktreeSlice>
       const reposChanged = survivingRepos.length !== s.repos.length
 
       // Why: a repoId-less setup on the removed host can still split a surviving project group, so drop every setup it owns.
-      const survivingSetups: AppState['projectHostSetups'] = []
+      const survivingSetups: ProjectHostSetup[] = []
       for (const setup of s.projectHostSetups) {
         if (isRemovedRuntimeHostId(setup.hostId, removed)) {
           if (setup.repoId) {
diff --git a/src/renderer/src/store/worktree-diff-comments-selector.test.ts b/src/renderer/src/store/worktree-diff-comments-selector.test.ts
index 0f6ceb5d99e..db45edec6b3 100644
--- a/src/renderer/src/store/worktree-diff-comments-selector.test.ts
+++ b/src/renderer/src/store/worktree-diff-comments-selector.test.ts
@@ -1,11 +1,12 @@
 import { describe, expect, it } from 'vitest'
-import type { DiffComment, Worktree } from '../../../shared/types'
+import type { DiffComment, FolderWorkspace, Worktree } from '../../../shared/types'
 import type { AppState } from './types'
 import {
   selectWorktreeDiffComments,
   selectWorktreeDiffCommentsOrEmpty
 } from './worktree-diff-comments-selector'
 import { getIndexedWorktreeById } from './worktree-repo-index'
+import { folderWorkspaceKey } from '../../../shared/workspace-scope'
 
 function makeComment(id: string): DiffComment {
   return {
@@ -84,4 +85,25 @@ describe('selectWorktreeDiffComments', () => {
       selectWorktreeDiffCommentsOrEmpty({ worktreesByRepo: next }, undefined)
     )
   })
+
+  it('reads review notes from a folder workspace', () => {
+    const comments = [makeComment('folder-comment')]
+    const folderWorkspace = {
+      id: 'folder-1',
+      executionHostId: 'local',
+      diffComments: comments
+    } as FolderWorkspace
+
+    expect(
+      selectWorktreeDiffComments(
+        {
+          worktreesByRepo: {},
+          activeWorktreeId: folderWorkspaceKey(folderWorkspace.id),
+          activeWorkspaceExecutionHostId: 'local',
+          folderWorkspaces: [folderWorkspace]
+        },
+        folderWorkspaceKey(folderWorkspace.id)
+      )
+    ).toBe(comments)
+  })
 })
diff --git a/src/renderer/src/store/worktree-diff-comments-selector.ts b/src/renderer/src/store/worktree-diff-comments-selector.ts
index c91ef64bc06..31e6edfa9ee 100644
--- a/src/renderer/src/store/worktree-diff-comments-selector.ts
+++ b/src/renderer/src/store/worktree-diff-comments-selector.ts
@@ -1,23 +1,43 @@
 import type { DiffComment } from '../../../shared/types'
 import type { AppState } from './types'
 import { getIndexedWorktreeById } from './worktree-repo-index'
+import { findFolderWorkspaceOwner } from '@/lib/folder-workspace-runtime-owner'
+import { parseWorkspaceKey } from '../../../shared/workspace-scope'
 
 const EMPTY_DIFF_COMMENTS = Object.freeze([]) as unknown as DiffComment[]
 
+type DiffCommentSelectorState = Pick<AppState, 'worktreesByRepo'> &
+  Partial<
+    Pick<
+      AppState,
+      | 'activeWorkspaceExecutionHostId'
+      | 'activeWorktreeId'
+      | 'folderWorkspaces'
+      | 'projectGroups'
+      | 'restoredRuntimeHostIdByWorkspaceSessionKey'
+      | 'runtimeEnvironments'
+      | 'settings'
+    >
+  >
+
 export function selectWorktreeDiffComments(
-  state: Pick<AppState, 'worktreesByRepo'>,
+  state: DiffCommentSelectorState,
   worktreeId: string | null | undefined
 ): DiffComment[] | undefined {
   if (!worktreeId) {
     return undefined
   }
+  const scope = parseWorkspaceKey(worktreeId)
+  if (scope?.type === 'folder') {
+    return findFolderWorkspaceOwner(state, scope.folderWorkspaceId)?.diffComments
+  }
   // Why: mounted Monaco and diff surfaces rerun this selector on every store
   // write, so share the immutable-snapshot index instead of rescanning all worktrees.
   return getIndexedWorktreeById(state.worktreesByRepo, worktreeId)?.diffComments
 }
 
 export function selectWorktreeDiffCommentsOrEmpty(
-  state: Pick<AppState, 'worktreesByRepo'>,
+  state: Parameters<typeof selectWorktreeDiffComments>[0],
   worktreeId: string | null | undefined
 ): DiffComment[] {
   return selectWorktreeDiffComments(state, worktreeId) ?? EMPTY_DIFF_COMMENTS
diff --git a/src/renderer/src/web/web-clipboard-copy-fallback.test.ts b/src/renderer/src/web/web-clipboard-copy-fallback.test.ts
index e6242c11ae4..28e9f1dc4dd 100644
--- a/src/renderer/src/web/web-clipboard-copy-fallback.test.ts
+++ b/src/renderer/src/web/web-clipboard-copy-fallback.test.ts
@@ -44,7 +44,7 @@ function createFakeDocument(options?: FakeDocOptions) {
     removeEventListener: vi.fn((type: string, listener: (event: unknown) => void) => {
       if (type === 'copy') {
         const index = listeners.indexOf(listener)
-        if (index >= 0) {
+        if (index !== -1) {
           listeners.splice(index, 1)
         }
       }
diff --git a/src/renderer/src/web/web-preload-api.ts b/src/renderer/src/web/web-preload-api.ts
index a1e89aa7135..2baa23a7b28 100644
--- a/src/renderer/src/web/web-preload-api.ts
+++ b/src/renderer/src/web/web-preload-api.ts
@@ -1081,7 +1081,7 @@ function removeConflictingWebOverrides(
     const conflictingOverrides = new Set<KeybindingActionId>()
     for (const conflict of conflicts) {
       for (const actionId of conflict.actionIds) {
-        if (Object.prototype.hasOwnProperty.call(next, actionId)) {
+        if (Object.hasOwn(next, actionId)) {
           conflictingOverrides.add(actionId)
         }
       }
@@ -1870,8 +1870,7 @@ function createWorktreesApi(): NonNullable<Partial<PreloadApi>['worktrees']> {
       }),
     updateMeta: async ({ worktreeId, updates }) => {
       const rpcUpdates =
-        Object.prototype.hasOwnProperty.call(updates, 'pushTarget') &&
-        updates.pushTarget === undefined
+        Object.hasOwn(updates, 'pushTarget') && updates.pushTarget === undefined
           ? { ...updates, pushTarget: null }
           : updates
       const owned = await callRuntimeResultWithOwner<{ worktree: Worktree }>('worktree.set', {
diff --git a/src/shared/agent-completion-time.ts b/src/shared/agent-completion-time.ts
new file mode 100644
index 00000000000..4b7ea78c430
--- /dev/null
+++ b/src/shared/agent-completion-time.ts
@@ -0,0 +1,43 @@
+import type { AgentStateHistoryEntry, AgentStatusEntry } from './agent-status-types'
+
+/** The subset of a hook entry a completion time is derived from. */
+export type AgentCompletionSource = Pick<
+  AgentStatusEntry,
+  'state' | 'stateStartedAt' | 'stateHistory' | 'interrupted' | 'sessionBoundary'
+>
+
+function mostRecentCompletedTurnInHistory(
+  history: readonly AgentStateHistoryEntry[] | undefined
+): number | null {
+  let max = 0
+  for (const row of history ?? []) {
+    if (
+      row.state === 'done' &&
+      row.interrupted !== true &&
+      Number.isFinite(row.startedAt) &&
+      row.startedAt > max
+    ) {
+      max = row.startedAt
+    }
+  }
+  return max > 0 ? max : null
+}
+
+/**
+ * When the entry's agent last actually COMPLETED a turn, or null when nothing qualifies.
+ * One clock for both the displayed completion age and Smart Sort's Done eligibility, so a row
+ * can't rank as freshly done while showing an age past the staleness threshold.
+ *
+ * A completion is only:
+ *   - a non-interrupted `done` (its `stateStartedAt` — unmoved by same-state tool/prompt pings); or
+ *   - for a session-boundary `done` (connected idle, not a turn), the real completion it displaced.
+ */
+export function agentEntryCompletionAt(entry: AgentCompletionSource): number | null {
+  if (entry.state !== 'done' || entry.interrupted === true) {
+    return null
+  }
+  if (entry.sessionBoundary === true) {
+    return mostRecentCompletedTurnInHistory(entry.stateHistory)
+  }
+  return Number.isFinite(entry.stateStartedAt) ? entry.stateStartedAt : null
+}
diff --git a/src/shared/agent-decorative-title-signature.ts b/src/shared/agent-decorative-title-signature.ts
index 29f1a65e6a2..317a744d098 100644
--- a/src/shared/agent-decorative-title-signature.ts
+++ b/src/shared/agent-decorative-title-signature.ts
@@ -27,7 +27,10 @@ function normalizeDecorativeAgentTitleText(title: string): string {
   let pendingWhitespace = false
   for (let index = 0; index < title.length; index += 1) {
     const code = title.charCodeAt(index)
-    if (normalized.length === 0 && (isDecorativeTitleWhitespace(code) || isBrailleSpinner(code))) {
+    if (
+      normalized.length === 0 &&
+      (isDecorativeTitleWhitespace(code) || isSpinnerFrameGlyph(code))
+    ) {
       continue
     }
     if (isDecorativeTitleWhitespace(code)) {
@@ -43,8 +46,9 @@ function normalizeDecorativeAgentTitleText(title: string): string {
   return normalized
 }
 
-function isBrailleSpinner(code: number): boolean {
-  return code >= 0x2800 && code <= 0x28ff
+// Why: braille (most agents) plus quarter circles (Claude Code 2.1.228+, #13889).
+function isSpinnerFrameGlyph(code: number): boolean {
+  return (code >= 0x2800 && code <= 0x28ff) || (code >= 0x25d0 && code <= 0x25d3)
 }
 
 function isDecorativeTitleWhitespace(code: number): boolean {
diff --git a/src/shared/agent-detection.test.ts b/src/shared/agent-detection.test.ts
index 53ab82f1fbc..14ee33eb7a8 100644
--- a/src/shared/agent-detection.test.ts
+++ b/src/shared/agent-detection.test.ts
@@ -101,6 +101,55 @@ describe('MiMo title detection', () => {
   )
 })
 
+describe('OpenCode native title detection', () => {
+  // Why: `OC | …` names no agent token, so title-derived display and target surfaces
+  // previously dropped OpenCode panes. Runtime sends corroborate the title separately.
+  it.each(['OC | Implement the Kitty IME preview', 'tmux | OC | Implement the Kitty IME preview'])(
+    'classifies the native session title %j as title-derived idle OpenCode',
+    (title) => {
+      expect(getAgentLabel(title)).toBe('OpenCode')
+      expect(detectAgentStatusFromTitle(title)).toBe('idle')
+    }
+  )
+
+  // Why: a spinner glyph is the one status decoration OpenCode adds to the marker, and
+  // its gate runs before the marker's, so an animating frame still reads working (#8940).
+  it('reads a spinner-decorated native frame as working', () => {
+    const title = 'OC | ⠋ ask claude about this'
+    expect(getAgentLabel(title)).toBe('OpenCode')
+    expect(detectAgentStatusFromTitle(title)).toBe('working')
+  })
+
+  it.each(['OC | ✦ Gemini CLI', 'OC | ✋ review Gemini permission handling'])(
+    'does not let a Gemini glyph in OpenCode session text override identity for %j',
+    (title) => {
+      expect(getAgentLabel(title)).toBe('OpenCode')
+      expect(detectAgentStatusFromTitle(title)).toBe('idle')
+    }
+  )
+
+  // Why: the text after the marker is OpenCode's generated session summary — subject
+  // matter, not status. Routing it through the keyword gates would let an ordinary task
+  // name ("stop the flaky test") park a live pane in working/permission forever, so the
+  // marker asserts presence only. Do not "fix" these into keyword-derived statuses.
+  it.each([
+    'OC | ready to review',
+    'OC | permission prompt keeps reappearing',
+    'OC | waiting on the flaky test',
+    'OC | stop the suite from running'
+  ])('keeps the status word inside the session summary %j inert', (title) => {
+    expect(getAgentLabel(title)).toBe('OpenCode')
+    expect(detectAgentStatusFromTitle(title)).toBe('idle')
+  })
+
+  it.each(['OC |', 'OC|Build', 'oc | lowercase lookalike', 'OCTOPUS | build'])(
+    'does not treat the lookalike title %j as an agent',
+    (title) => {
+      expect(detectAgentStatusFromTitle(title)).toBeNull()
+    }
+  )
+})
+
 describe('Pi-compatible title detection', () => {
   it.each([
     ['\u280b OMP', 'OMP', 'working'],
diff --git a/src/shared/agent-detection.ts b/src/shared/agent-detection.ts
index a2e419c4ff3..c603914b450 100644
--- a/src/shared/agent-detection.ts
+++ b/src/shared/agent-detection.ts
@@ -25,6 +25,7 @@ export {
   clearWorkingIndicators,
   createAgentStatusTracker,
   detectAgentStatusFromTitle,
+  isQuarterCircleSpinnerOnlyAgentTitle,
   normalizeTerminalTitle
 } from './agent-title-status'
 
diff --git a/src/shared/agent-hook-listener.test.ts b/src/shared/agent-hook-listener.test.ts
index 298e7a55c79..9d30dc8a844 100644
--- a/src/shared/agent-hook-listener.test.ts
+++ b/src/shared/agent-hook-listener.test.ts
@@ -801,7 +801,7 @@ describe('shared agent-hook-listener', () => {
     expect(tool?.payload.interactivePrompt).toBeUndefined()
   })
 
-  it('keeps OMP ask_user_question behavior on Pi-compatible events', () => {
+  it('maps OMP ask to blocked without publishing a native prompt', () => {
     const tool = normalizeHookPayload(
       state,
       'omp',
@@ -812,8 +812,8 @@ describe('shared agent-hook-listener', () => {
         env: 'production',
         version: '1',
         payload: {
-          hook_event_name: 'tool_call',
-          tool_name: 'ask_user_question',
+          hook_event_name: 'tool_execution_start',
+          tool_name: 'ask',
           tool_input: {
             questions: [
               {
@@ -827,9 +827,9 @@ describe('shared agent-hook-listener', () => {
       'production'
     )
     expect(tool?.payload).toMatchObject({
-      state: 'working',
+      state: 'blocked',
       agentType: 'omp',
-      toolName: 'ask_user_question'
+      toolName: 'ask'
     })
     expect(tool?.payload.interactivePrompt).toBeUndefined()
   })
diff --git a/src/shared/agent-hook-listener.ts b/src/shared/agent-hook-listener.ts
index 44032c03b24..d7b7422db93 100644
--- a/src/shared/agent-hook-listener.ts
+++ b/src/shared/agent-hook-listener.ts
@@ -1,6 +1,6 @@
 /* eslint-disable max-lines -- Why: canonical transport-agnostic listener; parser, normalizer, per-CLI extractors, and endpoint writer share invariants that must not drift between Orca's main process and the relay. */
 
-// Why: extracted from src/main/agent-hooks/server.ts so the relay can host the pipeline without Electron (Node builtins only). See docs/design/agent-status-over-ssh.md §3.
+// Why: extracted from src/main/agent-hooks/server.ts so the relay can host the same pipeline without Electron — this file must stay on Node builtins and other shared/ modules, or the relay bundle breaks.
 import type { IncomingMessage } from 'node:http'
 import { createHash, randomUUID } from 'node:crypto'
 import { homedir } from 'node:os'
@@ -323,7 +323,8 @@ export type AgentHookEventPayload = {
   launchToken?: string
   tabId?: string
   worktreeId?: string
-  /** SSH connection the event arrived on, or null for local (only ingestRemote stamps it; the HTTP path can't know the mux). See docs/design/agent-status-over-ssh.md §5. */
+  /** SSH connection the event arrived on, or null for local. Only `ingestRemote` can stamp it — the loopback HTTP path has no mux identity — and receivers key off it to drop
+   *  in-flight events from a superseded connection after an SSH reconnect. */
   connectionId: string | null
   /** True when the event carried prompt text directly, not the listener's cached prompt from an earlier event in the pane. */
   hasExplicitPrompt?: boolean
@@ -842,7 +843,7 @@ function readString(record: Record<string, unknown>, key: string): string | unde
 }
 
 function hasOwnField(record: Record<string, unknown>, key: string): boolean {
-  return Object.prototype.hasOwnProperty.call(record, key)
+  return Object.hasOwn(record, key)
 }
 
 function hasAnyOwnField(record: Record<string, unknown>, keys: readonly string[]): boolean {
@@ -3846,13 +3847,14 @@ function normalizePiCompatibleEvent(
     return null
   }
 
-  // Why: gate on the event's own tool_name (not a merged snapshot) so a stale cached ask_user_question can't re-enter blocked.
-  const isPiAskUserQuestion =
-    agentType === 'pi' &&
-    isAskUserQuestionTool(readString(hookPayload, 'tool_name')) &&
+  // Why: gate on the event's own tool_name so a stale cached question can't re-enter blocked.
+  const toolName = readString(hookPayload, 'tool_name')
+  const isPiCompatibleAsk =
+    ((agentType === 'pi' && isAskUserQuestionTool(toolName)) ||
+      (agentType === 'omp' && toolName === 'ask')) &&
     (eventName === 'tool_call' || eventName === 'tool_execution_start')
 
-  const stateName = isPiAskUserQuestion
+  const stateName = isPiCompatibleAsk
     ? 'blocked'
     : eventName === 'before_agent_start' ||
         eventName === 'agent_start' ||
@@ -4361,7 +4363,6 @@ export function normalizeHookPayload(
       break
   }
 
-  // Why: connectionId is null here; ingestRemote stamps it from mux identity on receive. See docs/design/agent-status-over-ssh.md §5.
   const providerSessionOnly =
     (source === 'pi' || source === 'prime-agent') &&
     eventName === 'session_start' &&
@@ -4379,6 +4380,7 @@ export function normalizeHookPayload(
         launchToken,
         tabId,
         worktreeId,
+        // Why: normalization is transport-agnostic — only ingestRemote knows the mux identity to stamp here.
         connectionId: null,
         hasExplicitPrompt:
           source === 'amp'
diff --git a/src/shared/agent-hook-relay.ts b/src/shared/agent-hook-relay.ts
index f71e384b3be..f14db403804 100644
--- a/src/shared/agent-hook-relay.ts
+++ b/src/shared/agent-hook-relay.ts
@@ -8,7 +8,7 @@
 // the renderer-bound IPC + installer contract; this module is the wire envelope
 // between Orca's main process and the remote relay.
 //
-// Per the design doc:
+// Invariants both ends rely on:
 // - The relay normalizes; Orca routes. The envelope's `payload` field has
 //   already been through `normalizeHookPayload` (which calls
 //   `parseAgentStatusPayload` → `normalizeAgentStatusObject`) on the relay
@@ -194,8 +194,9 @@ export function restoreShedStatusFields(
 }
 
 /** JSON-RPC request method Orca issues after `--connect` reattach to ask the
- *  relay to replay its per-paneKey last-payload cache. See §5 Path 3 of the
- *  design doc for the race that ruled out push-on-`setWrite`. */
+ *  relay to replay its per-paneKey last-payload cache. Pull, not push: a relay
+ *  that pushed on `setWrite` can emit before Orca has wired its `agent.hook`
+ *  handler, and those notifications are dropped silently. */
 export const AGENT_HOOK_REQUEST_REPLAY_METHOD = 'agent_hook.requestReplay' as const
 
 /** JSON-RPC request method Orca issues at session-ready to ship the
diff --git a/src/shared/agent-status-types.ts b/src/shared/agent-status-types.ts
index 9f08791eec3..80ce1a4f823 100644
--- a/src/shared/agent-status-types.ts
+++ b/src/shared/agent-status-types.ts
@@ -44,7 +44,9 @@ export type AgentType = WellKnownAgentType | (string & {})
 
 /** A snapshot of a previous agent state, used to render activity blocks.
  *  Why: intentionally narrower than AgentStatusEntry — tool/assistant context is
- *  per-turn, not meaningful on a historical snapshot, and would bloat memory. */
+ *  per-turn, not meaningful on a historical snapshot, and would bloat memory.
+ *  Coalesced-turn output lives in AgentStatusEntry.lastCompletedAssistantMessage,
+ *  one copy per pane, so it can't multiply by AGENT_STATE_HISTORY_MAX. */
 export type AgentStateHistoryEntry = {
   state: AgentStatusState
   prompt: string
@@ -124,6 +126,10 @@ export type AgentStatusEntry = {
   interactivePrompt?: string
   /** Most recent assistant message preview, when the hook carried one. */
   lastAssistantMessage?: string
+  /** Output of the newest completed (non-boundary) turn, kept across the next `working`.
+   *  Why: batched publications can fold a whole done→working turn into one notification,
+   *  so `lastAssistantMessage` is already cleared by the time a subscriber observes it. */
+  lastCompletedAssistantMessage?: string
   /** True when this `done` was reached via interrupt, not normal completion
    *  (agent-reported or Orca's guarded fallback). Undefined otherwise. */
   interrupted?: boolean
@@ -226,7 +232,7 @@ export type AgentStatusIpcPayload = ParsedAgentStatusPayload & {
   tabId?: string
   worktreeId?: string
   /** Identifies the SSH connection the event arrived on, or null for local.
-   *  Only the remote-ingest path (`ingestRemote`) can stamp it; the HTTP path always sets null. See docs/design/agent-status-over-ssh.md §5. */
+   *  Only the remote-ingest path (`ingestRemote`) can stamp it from mux identity; the HTTP path has no mux and always sets null. */
   connectionId: string | null
   /** Timestamp (ms) when the hook server received this latest status event. */
   receivedAt: number
diff --git a/src/shared/agent-title-core.ts b/src/shared/agent-title-core.ts
index 83dcc12bf92..c96121b432c 100644
--- a/src/shared/agent-title-core.ts
+++ b/src/shared/agent-title-core.ts
@@ -47,6 +47,11 @@ export const CURSOR_NATIVE_TITLE_LOWER = 'cursor agent'
 // eslint-disable-next-line no-control-regex -- intentional unicode range
 export const BRAILLE_SPINNER_RE = /[\u2800-\u28ff]/g
 
+// Why: Claude Code 2.1.228 swapped its busy title spinner from braille to
+// quarter circles (#13889), which read as "no agent" and looked like an exit.
+// Reserve the whole quarter-circle block so a later frame addition cannot regress this.
+export const QUARTER_CIRCLE_SPINNER_RE = /[\u25d0-\u25d3]/g
+
 export function isGeminiTerminalTitle(title: string): boolean {
   // Why: Gemini OSC glyphs are stronger evidence than any cwd/session text.
   if (
@@ -83,6 +88,25 @@ export function containsBrailleSpinner(title: string): boolean {
   return false
 }
 
+export function containsQuarterCircleSpinner(title: string): boolean {
+  for (const char of title) {
+    const codePoint = char.codePointAt(0)
+    if (codePoint !== undefined && codePoint >= 0x25d0 && codePoint <= 0x25d3) {
+      return true
+    }
+  }
+  return false
+}
+
+/**
+ * Any spinner frame glyph an agent animates its OSC title with. Use this for
+ * generic "something is running" checks; agent-specific frame shapes (Grok,
+ * Pi, synthetic Cursor) stay pinned to their own glyph set.
+ */
+export function containsAgentSpinnerGlyph(title: string): boolean {
+  return containsBrailleSpinner(title) || containsQuarterCircleSpinner(title)
+}
+
 export function containsLegacyAgentName(title: string): boolean {
   return titleHasAnyLegacyAgentName(title)
 }
diff --git a/src/shared/agent-title-decoration.ts b/src/shared/agent-title-decoration.ts
index bc05badf8aa..47a6db679e7 100644
--- a/src/shared/agent-title-decoration.ts
+++ b/src/shared/agent-title-decoration.ts
@@ -1,11 +1,11 @@
 // Leading status decorations that coding agents prepend to their OSC title —
-// Claude's '✳', Gemini's glyphs (✦ ⏲ ◇ ✋), braille spinners, and Claude's
-// '. '/'* ' working/idle prefixes. Once the tab bar shows the provider icon,
-// this leading glyph reads as a redundant second icon, so strip it from the
-// displayed title. Scoped to titles we already know belong to an agent.
+// Claude's '✳', Gemini's glyphs (✦ ⏲ ◇ ✋), braille and quarter-circle spinners,
+// and Claude's '. '/'* ' working/idle prefixes. Once the tab bar shows the
+// provider icon, this leading glyph reads as a redundant second icon, so strip
+// it from the displayed title. Scoped to titles we already know belong to an agent.
 const LEADING_AGENT_TITLE_DECORATION_RE =
   // eslint-disable-next-line no-control-regex -- intentional unicode status-glyph ranges
-  /^(?:[✳✦⏲◇✋⠀-⣿]+|[.*]\s)\s*/
+  /^(?:[✳✦⏲◇✋⠀-⣿◐-◓]+|[.*]\s)\s*/
 
 export function stripLeadingAgentTitleDecorationOrEmpty(title: string): string {
   return title.replace(LEADING_AGENT_TITLE_DECORATION_RE, '').trimStart()
diff --git a/src/shared/agent-title-identity.ts b/src/shared/agent-title-identity.ts
index af86de1667d..cdfc6946777 100644
--- a/src/shared/agent-title-identity.ts
+++ b/src/shared/agent-title-identity.ts
@@ -3,7 +3,7 @@ import {
   CLAUDE_IDLE,
   DROID_AGENT_NAME_RE,
   HERMES_AGENT_NAME_RE,
-  containsBrailleSpinner,
+  containsAgentSpinnerGlyph,
   isClaudeManagementTitle,
   isCursorAgentTitle,
   isGeminiTerminalTitle,
@@ -31,7 +31,7 @@ export function isClaudeAgent(title: string): boolean {
   if (title.startsWith('. ') || title.startsWith('* ')) {
     return true
   }
-  if (containsBrailleSpinner(title)) {
+  if (containsAgentSpinnerGlyph(title)) {
     // Why: named non-Claude agents carry braille spinners too. Gate Cursor by its
     // identity title, not the token, so a Claude title mentioning a cursor stays Claude.
     return !isCursorAgentTitle(title) && !lower.includes('openclaude')
diff --git a/src/shared/agent-title-status.ts b/src/shared/agent-title-status.ts
index 09ffc07a677..5c13bb56e95 100644
--- a/src/shared/agent-title-status.ts
+++ b/src/shared/agent-title-status.ts
@@ -9,12 +9,14 @@ import {
   GEMINI_SILENT_WORKING,
   GEMINI_WORKING,
   HERMES_AGENT_NAME_RE,
+  QUARTER_CIRCLE_SPINNER_RE,
   STRONG_IDLE_KEYWORDS_RE,
   STRONG_WORKING_KEYWORDS_RE,
   STRONG_WORKING_KEYWORDS_RE_GLOBAL,
   containsAgentName,
+  containsAgentSpinnerGlyph,
   containsAny,
-  containsBrailleSpinner,
+  containsQuarterCircleSpinner,
   containsLegacyAgentName,
   isClaudeManagementTitle,
   isGeminiTerminalTitle,
@@ -22,6 +24,7 @@ import {
   isPiTerminalTitle
 } from './agent-title-core'
 import type { AgentStatus } from './agent-title-core'
+import { isOpenCodeNativeTitle } from './opencode-terminal-title'
 import { getPiCompatibleSyntheticAgentStatus } from './pi-compatible-synthetic-title'
 import { isGrokRotatingWorkingTitle } from './terminal-title-agent-type'
 
@@ -34,6 +37,7 @@ export function clearWorkingIndicators(title: string): string {
   cleaned = cleaned.replace(GEMINI_WORKING, '')
   cleaned = cleaned.replace(GEMINI_SILENT_WORKING, '')
   cleaned = cleaned.replace(BRAILLE_SPINNER_RE, '')
+  cleaned = cleaned.replace(QUARTER_CIRCLE_SPINNER_RE, '')
   if (cleaned.startsWith('. ')) {
     cleaned = cleaned.slice(2)
   }
@@ -158,6 +162,10 @@ export function detectAgentStatusFromTitle(title: string): AgentStatus | null {
     return null
   }
 
+  if (isOpenCodeNativeTitle(title)) {
+    return containsAgentSpinnerGlyph(title) ? 'working' : 'idle'
+  }
+
   if (title.includes(GEMINI_PERMISSION)) {
     return 'permission'
   }
@@ -181,10 +189,9 @@ export function detectAgentStatusFromTitle(title: string): AgentStatus | null {
   if (isPiTerminalTitle(title)) {
     return 'idle'
   }
-  if (containsBrailleSpinner(title)) {
+  if (containsAgentSpinnerGlyph(title)) {
     return 'working'
   }
-
   const hasDroidAgentName = DROID_AGENT_NAME_RE.test(title)
   const hasHermesAgentName = HERMES_AGENT_NAME_RE.test(title)
   const hasAgyAgentName = AGY_AGENT_NAME_RE.test(title)
@@ -217,3 +224,15 @@ export function detectAgentStatusFromTitle(title: string): AgentStatus | null {
 
   return 'idle'
 }
+
+/**
+ * True when a quarter-circle spinner frame is the only agent evidence a title carries.
+ * Any TUI animates those glyphs, so they prove activity, not identity — callers that
+ * authorize writes into the pane need independent evidence (STA-4028, regression #13925).
+ */
+export function isQuarterCircleSpinnerOnlyAgentTitle(title: string | null | undefined): boolean {
+  if (!title || !containsQuarterCircleSpinner(title)) {
+    return false
+  }
+  return detectAgentStatusFromTitle(title.replace(QUARTER_CIRCLE_SPINNER_RE, '').trim()) === null
+}
diff --git a/src/shared/ai-vault-resume-command.ts b/src/shared/ai-vault-resume-command.ts
index 17dd6ba7c66..13c33b8145e 100644
--- a/src/shared/ai-vault-resume-command.ts
+++ b/src/shared/ai-vault-resume-command.ts
@@ -4,6 +4,7 @@
 import { TUI_AGENT_CONFIG } from './tui-agent-config'
 import {
   commandSeparator,
+  isPosixStartupShell,
   quoteStartupArg,
   type AgentStartupShell
 } from './tui-agent-startup-shell'
@@ -98,7 +99,7 @@ function buildResumeShellCommandForShell(args: {
   shell: Exclude<AgentStartupShell, 'cmd'>
 }): string {
   const { cwd, codexHome, shell } = args
-  if (shell === 'posix') {
+  if (isPosixStartupShell(shell)) {
     // Why: git-bash on a Windows host runs a POSIX shell, so reuse the same
     // inline-env + `cd '<cwd>'` prefix as the non-Windows path.
     const envPrefix = codexHome ? `CODEX_HOME=${quoteStartupArg(codexHome, shell)} ` : ''
diff --git a/src/shared/automation-schedules.ts b/src/shared/automation-schedules.ts
index e41ba3ac028..d8a93499287 100644
--- a/src/shared/automation-schedules.ts
+++ b/src/shared/automation-schedules.ts
@@ -301,7 +301,7 @@ export function parseAutomationRrule(rrule: string): {
   }
   const dayCode = rule.byDay[0]
   const dayOfWeek = DAY_CODES.indexOf(dayCode as (typeof DAY_CODES)[number])
-  if (dayOfWeek < 0) {
+  if (dayOfWeek === -1) {
     throw new Error('Invalid recurrence day.')
   }
   return {
diff --git a/src/shared/browser-page-zoom.ts b/src/shared/browser-page-zoom.ts
index 28997ebab4a..83a23d90752 100644
--- a/src/shared/browser-page-zoom.ts
+++ b/src/shared/browser-page-zoom.ts
@@ -23,7 +23,7 @@ export function normalizeBrowserPageZoomLevel(value: unknown): number {
 export function browserPageZoomLevelToPercent(level: number): number {
   // Why: Electron zoom levels are exponential; show the same percentage users
   // expect from Chromium browser zoom controls.
-  return Math.round(100 * Math.pow(1.2, normalizeBrowserPageZoomLevel(level)))
+  return Math.round(100 * 1.2 ** normalizeBrowserPageZoomLevel(level))
 }
 
 export function nextBrowserPageZoomLevel(
diff --git a/src/shared/commit-message-prompt.ts b/src/shared/commit-message-prompt.ts
index 82dc830fd59..efd42f36e5a 100644
--- a/src/shared/commit-message-prompt.ts
+++ b/src/shared/commit-message-prompt.ts
@@ -9,7 +9,7 @@ Rules:
 - First line: imperative mood, <= 72 chars, no trailing period.
 - Optional body: blank line, then wrapped at 72 chars explaining WHY.
 - Output ONLY the commit message - no preamble, no code fences, no quotes.
-- Do not include "Co-authored-by" trailers - Orca appends them after generation when configured.
+- Do not include "Co-authored-by" or other git trailers.
 
 Staged diff:
 \`\`\`diff
diff --git a/src/shared/constants.ts b/src/shared/constants.ts
index 8da7cb5b9d1..a01a778d2dd 100644
--- a/src/shared/constants.ts
+++ b/src/shared/constants.ts
@@ -182,7 +182,6 @@ export function getDefaultSettings(homedir: string): GlobalSettings {
     autoRenameBranchFromWorkDefaultedOn: true,
     branchPrefix: 'git-username',
     branchPrefixCustom: '',
-    enableGitHubAttribution: false,
     theme: 'system',
     leftSidebarAppearanceMode: 'default',
     leftSidebarTintColor: DEFAULT_LEFT_SIDEBAR_TINT_COLOR,
diff --git a/src/shared/cross-platform-path.ts b/src/shared/cross-platform-path.ts
index becf29236bb..aad0981c3a1 100644
--- a/src/shared/cross-platform-path.ts
+++ b/src/shared/cross-platform-path.ts
@@ -57,18 +57,30 @@ export function normalizeRuntimePathForComparison(rawValue: string): string {
 }
 
 export function areLocalWindowsWslPathAliases(left: string, right: string): boolean {
-  const leftWslPath = parseWslUncPath(left)
-  const rightWslPath = parseWslUncPath(right)
-  if (!leftWslPath && !rightWslPath) {
-    return false
+  const leftIdentity = getLocalWindowsWslPathIdentity(left)
+  const rightIdentity = getLocalWindowsWslPathIdentity(right)
+  return (
+    (leftIdentity.isWslUnc || rightIdentity.isWslUnc) &&
+    leftIdentity.aliasComparisonPath === rightIdentity.aliasComparisonPath
+  )
+}
+
+export type LocalWindowsWslPathIdentity = {
+  normalizedPath: string
+  aliasComparisonPath: string
+  isWslUnc: boolean
+}
+
+export function getLocalWindowsWslPathIdentity(value: string): LocalWindowsWslPathIdentity {
+  const wslPath = parseWslUncPath(value)
+  const normalizedPath = normalizeRuntimePathForComparison(value)
+  return {
+    normalizedPath,
+    aliasComparisonPath: wslPath
+      ? normalizeRuntimePathForComparison(toWindowsWslPath(wslPath.linuxPath, wslPath.distro))
+      : normalizedPath,
+    isWslUnc: wslPath !== null
   }
-  const normalize = (value: string): string => {
-    const wslPath = parseWslUncPath(value)
-    return normalizeRuntimePathForComparison(
-      wslPath ? toWindowsWslPath(wslPath.linuxPath, wslPath.distro) : value
-    )
-  }
-  return normalize(left) === normalize(right)
 }
 
 export function isRuntimePathAbsolute(
diff --git a/src/shared/dashboard-snapshot.ts b/src/shared/dashboard-snapshot.ts
index 9367393118e..cd59983ae25 100644
--- a/src/shared/dashboard-snapshot.ts
+++ b/src/shared/dashboard-snapshot.ts
@@ -65,6 +65,8 @@ export type DashboardWorkspace = {
   parentWorktreeId?: string
   hostKind: DashboardCardHostKind
   executionHostId: ExecutionHostId
+  /** Friendly saved-host name for compact host tooltips. */
+  hostLabel?: string
   workspaceKind: DashboardCardWorkspaceKind
   workspaceStatusId?: string
   workspaceStatusLabel?: string
@@ -103,6 +105,8 @@ export type DashboardCard = {
   hostKind?: DashboardCardHostKind
   /** Exact owner used by in-window workspace actions when IDs collide across hosts. */
   executionHostId?: ExecutionHostId
+  /** Friendly saved-host name for compact host tooltips. */
+  hostLabel?: string
   /** Folder workspaces share the ring hierarchy without pretending to be git worktrees. */
   workspaceKind?: DashboardCardWorkspaceKind
   workspaceStatusId?: string
diff --git a/src/shared/diff-comment-schema.ts b/src/shared/diff-comment-schema.ts
new file mode 100644
index 00000000000..369dda682c6
--- /dev/null
+++ b/src/shared/diff-comment-schema.ts
@@ -0,0 +1,19 @@
+import { z } from 'zod'
+
+export const DiffCommentSchema = z.object({
+  id: z.string(),
+  worktreeId: z.string(),
+  filePath: z.string(),
+  source: z.enum(['diff', 'markdown']).optional(),
+  selectedText: z.string().optional(),
+  startLine: z.number().int().positive().optional(),
+  lineNumber: z.number().int().positive(),
+  body: z.string(),
+  createdAt: z.number().finite(),
+  updatedAt: z.number().finite().optional(),
+  sentAt: z.number().finite().optional(),
+  scope: z.enum(['unstaged', 'staged', 'branch']).optional(),
+  oldPath: z.string().optional(),
+  diffIdentity: z.string().optional(),
+  side: z.literal('modified')
+})
diff --git a/src/shared/external-worktree-inbox.test.ts b/src/shared/external-worktree-inbox.test.ts
index 34bfadd7f66..b9a72f62f8c 100644
--- a/src/shared/external-worktree-inbox.test.ts
+++ b/src/shared/external-worktree-inbox.test.ts
@@ -9,8 +9,10 @@ import type {
 } from './types'
 import {
   getHiddenExternalWorktrees,
+  getHiddenImportableExternalWorktrees,
   getNewExternalWorktreeInboxWorktrees,
   getVisibleExternalWorktrees,
+  getVisibleNonOrcaWorktrees,
   mergeExternalWorktreeInboxPaths,
   shouldOfferNewExternalWorktreeInbox
 } from './external-worktree-inbox'
@@ -74,7 +76,6 @@ function makeSettings(): GlobalSettings {
     localBaseRefSuggestionDismissed: false,
     branchPrefix: 'none',
     branchPrefixCustom: '',
-    enableGitHubAttribution: false,
     theme: 'system',
     appFontFamily: 'Geist',
     editorAutoSave: false,
@@ -172,6 +173,41 @@ describe('external worktree inbox', () => {
     })
 
     expect(getVisibleExternalWorktrees(detectedResult([visible, scratch]))).toEqual([visible])
+    expect(getVisibleNonOrcaWorktrees(detectedResult([visible, scratch]))).toEqual([
+      visible,
+      scratch
+    ])
+  })
+
+  it('lists hidden agent scratch among importable worktrees so recovery stays reachable', () => {
+    // Why: the visibility toggle can never reveal scratch (#9388), so if no list
+    // offers it for per-path import, a hidden scratch worktree is lost for good (#10324).
+    const hiddenScratch = detectedWorktree({
+      id: 'hidden-scratch',
+      path: '/repo/.claude/worktrees/scratch-1',
+      ownership: 'agent-scratch'
+    })
+    const hiddenExternal = detectedWorktree({ id: 'hidden-external' })
+    const detected = detectedResult([
+      hiddenScratch,
+      hiddenExternal,
+      detectedWorktree({ id: 'visible-scratch', ownership: 'agent-scratch', visible: true }),
+      detectedWorktree({ id: 'orca-managed', ownership: 'orca-managed' }),
+      detectedWorktree({ id: 'checked-out', selectedCheckout: true })
+    ])
+
+    expect(getHiddenImportableExternalWorktrees(detected)).toEqual([hiddenScratch, hiddenExternal])
+    // Why: scratch stays out of discovery counts even though the dialog controls it.
+    expect(getHiddenExternalWorktrees(detected)).toEqual([hiddenExternal])
+  })
+
+  it('offers no importable worktrees from a non-authoritative snapshot', () => {
+    const scratch = detectedWorktree({ id: 'scratch', ownership: 'agent-scratch' })
+
+    expect(
+      getHiddenImportableExternalWorktrees({ ...detectedResult([scratch]), authoritative: false })
+    ).toEqual([])
+    expect(getHiddenImportableExternalWorktrees(undefined)).toEqual([])
   })
 
   it('offers metadata-free nested Orca workspace worktrees through the inbox', () => {
diff --git a/src/shared/external-worktree-inbox.ts b/src/shared/external-worktree-inbox.ts
index 56aea01ff8b..c42a1249bd7 100644
--- a/src/shared/external-worktree-inbox.ts
+++ b/src/shared/external-worktree-inbox.ts
@@ -55,8 +55,7 @@ export function getVisibleExternalWorktrees(
 }
 
 function isUserFacingExternalWorktree(worktree: DetectedWorktree): boolean {
-  // Why: an explicit scratch import may be visible, but agent plumbing must
-  // stay outside repo-wide discovery and visibility controls (#9388).
+  // Why: agent plumbing stays outside the discovery inbox even when its separate visibility policy shows it.
   return (
     !worktree.selectedCheckout &&
     worktree.ownership !== 'orca-managed' &&
@@ -64,6 +63,34 @@ function isUserFacingExternalWorktree(worktree: DetectedWorktree): boolean {
   )
 }
 
+// Why: per-path recovery remains available while either repo visibility policy is off.
+function isImportableExternalWorktree(worktree: DetectedWorktree): boolean {
+  return !worktree.selectedCheckout && worktree.ownership !== 'orca-managed'
+}
+
+export function getHiddenImportableExternalWorktrees(
+  detected: DetectedWorktreeListResult | undefined
+): DetectedWorktree[] {
+  if (detected?.authoritative !== true) {
+    return []
+  }
+  return detected.worktrees.filter(
+    (worktree) => !worktree.visible && isImportableExternalWorktree(worktree)
+  )
+}
+
+export function getVisibleNonOrcaWorktrees(
+  detected: DetectedWorktreeListResult | undefined
+): DetectedWorktree[] {
+  if (detected?.authoritative !== true) {
+    return []
+  }
+  return detected.worktrees.filter(
+    (worktree) =>
+      worktree.visible && !worktree.selectedCheckout && worktree.ownership !== 'orca-managed'
+  )
+}
+
 export function isExternalWorktreeDiscoverySuppressed(
   repo: Pick<Repo, 'externalWorktreeDiscoverySuppressedAt'>
 ): boolean {
diff --git a/src/shared/external-worktree-visibility.ts b/src/shared/external-worktree-visibility.ts
index be5d24a524c..fc4af8c1681 100644
--- a/src/shared/external-worktree-visibility.ts
+++ b/src/shared/external-worktree-visibility.ts
@@ -30,7 +30,7 @@ export function getExternalWorktreeParentPath(worktreePath: string | undefined):
     return `//${parts.slice(0, -1).join('/')}`
   }
   const lastSeparatorIndex = normalized.lastIndexOf('/')
-  if (lastSeparatorIndex < 0) {
+  if (lastSeparatorIndex === -1) {
     return UNKNOWN_EXTERNAL_WORKTREE_PARENT_PATH
   }
   if (lastSeparatorIndex === 0) {
@@ -67,3 +67,10 @@ export function effectiveExternalWorktreeVisibility(
   }
   return isLegacyRepoForVisibility ? 'show' : 'hide'
 }
+
+export function effectiveAgentWorktreeVisibility(
+  repo: Pick<Repo, 'agentWorktreeVisibility'>
+): ExternalWorktreeVisibility {
+  // Why: scratch worktrees have always defaulted hidden, including for legacy repos.
+  return repo.agentWorktreeVisibility === 'show' ? 'show' : 'hide'
+}
diff --git a/src/shared/file-link-location.test.ts b/src/shared/file-link-location.test.ts
new file mode 100644
index 00000000000..3239b4f367c
--- /dev/null
+++ b/src/shared/file-link-location.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest'
+import { parseFileLinkLocation } from './file-link-location'
+
+describe('parseFileLinkLocation', () => {
+  it('parses agent-style line and column suffixes', () => {
+    expect(parseFileLinkLocation('src/main.ts:12:4')).toEqual({
+      pathText: 'src/main.ts',
+      line: 12,
+      column: 4
+    })
+    expect(parseFileLinkLocation('src/main.ts')).toEqual({
+      pathText: 'src/main.ts',
+      line: null,
+      column: null
+    })
+  })
+
+  it('preserves Windows drive colons', () => {
+    expect(parseFileLinkLocation(String.raw`C:\repo\src\main.ts:12`)).toEqual({
+      pathText: String.raw`C:\repo\src\main.ts`,
+      line: 12,
+      column: null
+    })
+  })
+
+  it('rejects empty paths and zero locations', () => {
+    expect(parseFileLinkLocation('')).toBeNull()
+    expect(parseFileLinkLocation('src/main.ts:0')).toBeNull()
+    expect(parseFileLinkLocation('src/main.ts:12:0')).toBeNull()
+  })
+})
diff --git a/src/shared/file-link-location.ts b/src/shared/file-link-location.ts
new file mode 100644
index 00000000000..1450f130338
--- /dev/null
+++ b/src/shared/file-link-location.ts
@@ -0,0 +1,19 @@
+export type ParsedFileLinkLocation = {
+  pathText: string
+  line: number | null
+  column: number | null
+}
+
+export function parseFileLinkLocation(value: string): ParsedFileLinkLocation | null {
+  const match = /^(.*?)(?::(\d+))?(?::(\d+))?$/.exec(value)
+  const pathText = match?.[1]
+  if (!pathText) {
+    return null
+  }
+  const line = match[2] ? Number.parseInt(match[2], 10) : null
+  const column = match[3] ? Number.parseInt(match[3], 10) : null
+  if ((line !== null && line < 1) || (column !== null && column < 1)) {
+    return null
+  }
+  return { pathText, line, column }
+}
diff --git a/src/shared/fish-binary-requirement.test.ts b/src/shared/fish-binary-requirement.test.ts
new file mode 100644
index 00000000000..e4d57bbf9e4
--- /dev/null
+++ b/src/shared/fish-binary-requirement.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest'
+import {
+  fishRequirementViolation,
+  REQUIRE_FISH_ENV_VAR,
+  resolveFishBinary,
+  type FishBinaryLookup
+} from './fish-binary-requirement'
+
+const FOUND: FishBinaryLookup = { available: true, path: '/usr/bin/fish', majorVersion: 4 }
+const MISSING: FishBinaryLookup = {
+  available: false,
+  path: null,
+  majorVersion: 0,
+  reason: 'no fish binary on PATH'
+}
+
+describe('fishRequirementViolation', () => {
+  it('lets a missing fish skip when the requirement is not set', () => {
+    expect(fishRequirementViolation(MISSING, {})).toBeNull()
+    expect(fishRequirementViolation(MISSING, { [REQUIRE_FISH_ENV_VAR]: '0' })).toBeNull()
+  })
+
+  // The #9993 guard is CI's only end-to-end coverage; a skip there is a silent gap.
+  it('reports a violation naming the reason when CI requires fish and it is absent', () => {
+    const violation = fishRequirementViolation(MISSING, { [REQUIRE_FISH_ENV_VAR]: '1' })
+    expect(violation).toContain(REQUIRE_FISH_ENV_VAR)
+    expect(violation).toContain('no fish binary on PATH')
+  })
+
+  it('reports no violation when fish is present, requirement set or not', () => {
+    expect(fishRequirementViolation(FOUND, { [REQUIRE_FISH_ENV_VAR]: '1' })).toBeNull()
+    expect(fishRequirementViolation(FOUND, {})).toBeNull()
+  })
+})
+
+describe('resolveFishBinary', () => {
+  it('treats an installed fish below the floor as unavailable, with the version in the reason', () => {
+    const lookup = resolveFishBinary(Number.MAX_SAFE_INTEGER)
+    if (lookup.available) {
+      throw new Error('no fish can satisfy an unreachable version floor')
+    }
+    // Only when a fish is actually installed does the reason describe a version.
+    if (lookup.majorVersion > 0) {
+      expect(lookup.reason).toContain(`fish ${Number.MAX_SAFE_INTEGER}+ required`)
+    }
+  })
+
+  it('never reports a path on Windows', () => {
+    if (process.platform !== 'win32') {
+      return
+    }
+    expect(resolveFishBinary().path).toBeNull()
+  })
+})
diff --git a/src/shared/fish-binary-requirement.ts b/src/shared/fish-binary-requirement.ts
new file mode 100644
index 00000000000..9045433956d
--- /dev/null
+++ b/src/shared/fish-binary-requirement.ts
@@ -0,0 +1,65 @@
+import { spawnSync } from 'node:child_process'
+
+/**
+ * Locates the fish binary live shell tests run against, and decides how strict
+ * they are about finding one.
+ *
+ * Why the strictness is configurable: on a developer machine without fish these
+ * suites must skip, but the `shell contracts` CI job is a required check whose
+ * fish lane is the only end-to-end guard for #9993. There, a skip would report
+ * green with nothing exercised, so ORCA_REQUIRE_FISH=1 turns it into a failure.
+ */
+const FISH_CANDIDATES = ['fish', '/opt/homebrew/bin/fish', '/usr/local/bin/fish'] as const
+
+/** Env var CI sets to make a missing or too-old fish fail instead of skip. */
+export const REQUIRE_FISH_ENV_VAR = 'ORCA_REQUIRE_FISH'
+
+export type FishBinaryLookup =
+  | { available: true; path: string; majorVersion: number }
+  | { available: false; path: null; majorVersion: number; reason: string }
+
+export function resolveFishBinary(minMajorVersion = 1): FishBinaryLookup {
+  if (process.platform === 'win32') {
+    return {
+      available: false,
+      path: null,
+      majorVersion: 0,
+      reason: 'fish is not supported on Windows'
+    }
+  }
+
+  for (const path of FISH_CANDIDATES) {
+    const probe = spawnSync(path, ['--version'], { encoding: 'utf8' })
+    if (probe.status !== 0) {
+      continue
+    }
+    const majorVersion = Number(/version (\d+)/.exec(probe.stdout ?? '')?.[1] ?? '0')
+    if (majorVersion < minMajorVersion) {
+      return {
+        available: false,
+        path: null,
+        majorVersion,
+        reason: `fish ${minMajorVersion}+ required, found ${probe.stdout?.trim() || 'an unknown version'} at ${path}`
+      }
+    }
+    return { available: true, path, majorVersion }
+  }
+
+  return { available: false, path: null, majorVersion: 0, reason: 'no fish binary on PATH' }
+}
+
+/**
+ * The message to fail with when CI demanded fish and did not get it, else null.
+ *
+ * Assert this in a test that always runs, so the requirement cannot vanish with
+ * the suite it guards.
+ */
+export function fishRequirementViolation(
+  lookup: FishBinaryLookup,
+  env: NodeJS.ProcessEnv = process.env
+): string | null {
+  if (lookup.available || env[REQUIRE_FISH_ENV_VAR] !== '1') {
+    return null
+  }
+  return `${REQUIRE_FISH_ENV_VAR}=1 but the live fish tests would skip: ${lookup.reason}`
+}
diff --git a/src/shared/folder-workspace-worktree.ts b/src/shared/folder-workspace-worktree.ts
index 61000b2e53f..3bc62acb41f 100644
--- a/src/shared/folder-workspace-worktree.ts
+++ b/src/shared/folder-workspace-worktree.ts
@@ -40,6 +40,7 @@ export function folderWorkspaceToWorktree(folderWorkspace: FolderWorkspace): Wor
     pendingFirstAgentMessageRename: folderWorkspace.pendingFirstAgentMessageRename,
     firstAgentMessageRenameError: folderWorkspace.firstAgentMessageRenameError,
     workspaceStatus: folderWorkspace.workspaceStatus,
+    diffComments: folderWorkspace.diffComments,
     path: folderWorkspace.folderPath,
     head: '',
     branch: '',
diff --git a/src/shared/folder-workspaces.ts b/src/shared/folder-workspaces.ts
index 89f12d4477b..e5badf0d8d6 100644
--- a/src/shared/folder-workspaces.ts
+++ b/src/shared/folder-workspaces.ts
@@ -103,7 +103,10 @@ export function normalizeFolderWorkspaces(
       createdAt:
         typeof raw.createdAt === 'number' && Number.isFinite(raw.createdAt) ? raw.createdAt : now,
       updatedAt:
-        typeof raw.updatedAt === 'number' && Number.isFinite(raw.updatedAt) ? raw.updatedAt : now
+        typeof raw.updatedAt === 'number' && Number.isFinite(raw.updatedAt) ? raw.updatedAt : now,
+      // Legacy read: unreleased #14112 builds wrote notes inline. Canonical home is
+      // PersistedState.folderWorkspaceDiffComments.
+      ...(Array.isArray(raw.diffComments) ? { diffComments: raw.diffComments } : {})
     })
   }
   return workspaces.sort(
diff --git a/src/shared/gitlab-types.ts b/src/shared/gitlab-types.ts
index 703085fb8a2..c9f2a0fffba 100644
--- a/src/shared/gitlab-types.ts
+++ b/src/shared/gitlab-types.ts
@@ -215,7 +215,7 @@ export type GitLabTodo = {
   id: number
   /** Free-form GitLab action name, e.g. 'assigned', 'mentioned', 'build_failed', 'review_requested'. */
   actionName: string
-  targetType: GitLabTodoTargetType | string
+  targetType: GitLabTodoTargetType | (string & {})
   /** iid for MR/Issue targets; absent for Commit/Note targets where the identifier is a SHA or note ID. */
   targetIid: number | null
   targetTitle: string
diff --git a/src/shared/hermes-startup-query.ts b/src/shared/hermes-startup-query.ts
index 60e2705073f..a120305e1ee 100644
--- a/src/shared/hermes-startup-query.ts
+++ b/src/shared/hermes-startup-query.ts
@@ -1,6 +1,7 @@
 import { encodePowerShellCommand } from './powershell-command-encoding'
 import {
   buildShellCommandFromArgv,
+  isPosixStartupShell,
   quoteStartupArg,
   tokenizeStartupCommand,
   type AgentStartupShell
@@ -114,7 +115,7 @@ function normalizeHermesArgv(
     assignmentCount += 1
   }
   if (assignmentCount > 0) {
-    if (shell !== 'posix') {
+    if (!isPosixStartupShell(shell)) {
       return null
     }
     commandPrefix = ['env', ...commandPrefix]
@@ -139,7 +140,7 @@ function normalizeHermesArgv(
 }
 
 function buildQueryCommand(argv: string[], shell: AgentStartupShell): string {
-  if (shell !== 'posix') {
+  if (!isPosixStartupShell(shell)) {
     const invocation = buildShellCommandFromArgv(argv, 'powershell').replace(
       quoteStartupArg(QUERY_ARG_PLACEHOLDER, 'powershell'),
       `"--query=$${POWERSHELL_NATIVE_QUERY_VARIABLE}"`
diff --git a/src/shared/jira-types.ts b/src/shared/jira-types.ts
index ad8e84ecbad..6adaa966ead 100644
--- a/src/shared/jira-types.ts
+++ b/src/shared/jira-types.ts
@@ -19,7 +19,7 @@ export type JiraViewer = {
   avatarUrl?: string
 }
 
-export type JiraSiteSelection = string | 'all'
+export type JiraSiteSelection = (string & {}) | 'all'
 
 export type JiraConnectionStatus = {
   connected: boolean
diff --git a/src/shared/legacy-terminal-attribution-env.test.ts b/src/shared/legacy-terminal-attribution-env.test.ts
new file mode 100644
index 00000000000..1bb84cc5f96
--- /dev/null
+++ b/src/shared/legacy-terminal-attribution-env.test.ts
@@ -0,0 +1,99 @@
+import { describe, expect, it } from 'vitest'
+import {
+  addLegacyTerminalAttributionDisableRequest,
+  hostSupportsSessionTabTerminalCreateAttributionDisable,
+  hostSupportsTerminalCreateAttributionDisable,
+  hostSupportsTerminalSplitAttributionDisable,
+  LEGACY_TERMINAL_ATTRIBUTION_BYPASS_ENV_KEY,
+  LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY,
+  withLegacyTerminalAttributionDisabledEnv
+} from './legacy-terminal-attribution-env'
+
+describe('legacy terminal attribution environment', () => {
+  it('adds the inert old-host gate once', () => {
+    expect(addLegacyTerminalAttributionDisableRequest(['CODEX_HOME'])).toEqual([
+      'CODEX_HOME',
+      LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY
+    ])
+    expect(
+      addLegacyTerminalAttributionDisableRequest([LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY])
+    ).toEqual([LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY])
+  })
+
+  it('fails instead of dropping a caller deletion at the wire limit', () => {
+    const full = Array.from({ length: 32 }, (_, index) => `KEY_${index}`)
+    expect(() => addLegacyTerminalAttributionDisableRequest(full)).toThrow(
+      'Terminal environment deletion limit'
+    )
+  })
+
+  it('adds the wrapper bypass without mutating caller env', () => {
+    const env = { CODEX_HOME: '/tmp/codex' }
+    expect(withLegacyTerminalAttributionDisabledEnv(env)).toEqual({
+      CODEX_HOME: '/tmp/codex',
+      [LEGACY_TERMINAL_ATTRIBUTION_BYPASS_ENV_KEY]: '1'
+    })
+    expect(env).toEqual({ CODEX_HOME: '/tmp/codex' })
+  })
+
+  it('accepts only split hosts that removed attribution for every pane owner', () => {
+    expect(hostSupportsTerminalSplitAttributionDisable({ appVersion: '1.4.18' })).toBe(false)
+    expect(hostSupportsTerminalSplitAttributionDisable({ appVersion: '1.4.19' })).toBe(false)
+    expect(hostSupportsTerminalSplitAttributionDisable({ appVersion: 'v1.4.181' })).toBe(false)
+    expect(hostSupportsTerminalSplitAttributionDisable({ capabilities: ['mobile.tasks.v1'] })).toBe(
+      false
+    )
+    expect(
+      hostSupportsTerminalSplitAttributionDisable({
+        capabilities: ['terminal.attribution-removed.v1']
+      })
+    ).toBe(true)
+  })
+
+  it('accepts only capability-proven terminal creation hosts', () => {
+    expect(hostSupportsSessionTabTerminalCreateAttributionDisable({ appVersion: '1.4.89' })).toBe(
+      false
+    )
+    expect(hostSupportsSessionTabTerminalCreateAttributionDisable({ appVersion: '1.4.90' })).toBe(
+      false
+    )
+    expect(
+      hostSupportsSessionTabTerminalCreateAttributionDisable({ appVersion: 'not-semver' })
+    ).toBe(false)
+    expect(
+      hostSupportsSessionTabTerminalCreateAttributionDisable({
+        capabilities: ['workspace-run-context.v1']
+      })
+    ).toBe(false)
+    expect(
+      hostSupportsSessionTabTerminalCreateAttributionDisable({
+        capabilities: ['terminal.quick-commands.v1']
+      })
+    ).toBe(false)
+  })
+
+  it('accepts capability-proven current hosts regardless of development version', () => {
+    const status = {
+      appVersion: '0.0.0-dev',
+      capabilities: ['terminal.attribution-removed.v1']
+    }
+    expect(hostSupportsTerminalSplitAttributionDisable(status)).toBe(true)
+    expect(hostSupportsTerminalCreateAttributionDisable(status)).toBe(true)
+    expect(hostSupportsSessionTabTerminalCreateAttributionDisable(status)).toBe(true)
+  })
+
+  it('fails closed for malformed host status fields', () => {
+    expect(
+      hostSupportsSessionTabTerminalCreateAttributionDisable({
+        appVersion: 1.49,
+        capabilities: 'terminal.attribution-removed.v1'
+      })
+    ).toBe(false)
+    expect(
+      hostSupportsTerminalSplitAttributionDisable({
+        appVersion: {},
+        capabilities: ['terminal.attribution-removed.v1', 1]
+      })
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/legacy-terminal-attribution-env.ts b/src/shared/legacy-terminal-attribution-env.ts
new file mode 100644
index 00000000000..5237280a486
--- /dev/null
+++ b/src/shared/legacy-terminal-attribution-env.ts
@@ -0,0 +1,68 @@
+import { TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY } from './protocol-version'
+
+export const LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY = 'ORCA_ENABLE_GIT_ATTRIBUTION'
+export const LEGACY_TERMINAL_ATTRIBUTION_BYPASS_ENV_KEY = 'ORCA_ATTRIBUTION_BYPASS'
+export const TERMINAL_SPLIT_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE =
+  'Terminal splitting requires an updated workspace host that can verify attribution removal for every pane owner. Update the host and try again.'
+export const TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE =
+  'Creating terminals requires an updated workspace host that can verify attribution removal. Update the host and try again.'
+export const MOBILE_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE =
+  'Creating terminals from Orca Mobile requires a newer workspace host that can verify safe terminal environment forwarding. Update the host and try again.'
+export const SESSION_TAB_TERMINAL_CREATE_ATTRIBUTION_UPDATE_REQUIRED_MESSAGE =
+  'Creating terminals requires a newer workspace host that can verify safe terminal environment forwarding. Update the host and try again.'
+const MAX_TERMINAL_ENV_DELETION_KEYS = 32
+
+type TerminalAttributionHostStatus = {
+  appVersion?: string
+  capabilities?: string[]
+}
+
+function readTerminalAttributionHostStatus(value: unknown): TerminalAttributionHostStatus {
+  if (!value || typeof value !== 'object') {
+    return {}
+  }
+  const appVersion = Reflect.get(value, 'appVersion')
+  const capabilities = Reflect.get(value, 'capabilities')
+  return {
+    ...(typeof appVersion === 'string' ? { appVersion } : {}),
+    ...(Array.isArray(capabilities) && capabilities.every((entry) => typeof entry === 'string')
+      ? { capabilities }
+      : {})
+  }
+}
+
+export function hostSupportsTerminalSplitAttributionDisable(value: unknown): boolean {
+  const status = readTerminalAttributionHostStatus(value)
+  // Why: only removal-capable hosts cover both runtime- and renderer-owned split targets.
+  return status.capabilities?.includes(TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY) === true
+}
+
+export function hostSupportsTerminalCreateAttributionDisable(value: unknown): boolean {
+  const status = readTerminalAttributionHostStatus(value)
+  return status.capabilities?.includes(TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY) === true
+}
+
+export function hostSupportsSessionTabTerminalCreateAttributionDisable(value: unknown): boolean {
+  const status = readTerminalAttributionHostStatus(value)
+  return status.capabilities?.includes(TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY) === true
+}
+
+export function withLegacyTerminalAttributionDisabledEnv(
+  env: Record<string, string> | undefined
+): Record<string, string> {
+  return { ...env, [LEGACY_TERMINAL_ATTRIBUTION_BYPASS_ENV_KEY]: '1' }
+}
+
+export function addLegacyTerminalAttributionDisableRequest(
+  envToDelete: readonly string[] | undefined
+): string[] | undefined {
+  const deduplicated = [...new Set(envToDelete ?? [])]
+  const gateIndex = deduplicated.indexOf(LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY)
+  if (gateIndex !== -1) {
+    deduplicated.splice(gateIndex, 1)
+  }
+  if (deduplicated.length >= MAX_TERMINAL_ENV_DELETION_KEYS) {
+    throw new Error('Terminal environment deletion limit leaves no room for attribution cleanup')
+  }
+  return [...deduplicated, LEGACY_TERMINAL_ATTRIBUTION_ENABLE_ENV_KEY]
+}
diff --git a/src/shared/linear-agent-access.ts b/src/shared/linear-agent-access.ts
index 2ffa17cb406..69169268767 100644
--- a/src/shared/linear-agent-access.ts
+++ b/src/shared/linear-agent-access.ts
@@ -115,13 +115,13 @@ export type LinearIssueListRequest = {
   filter?: LinearIssueListFilter
   teamInput?: string
   limit?: number
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 }
 
 export type LinearProjectListRequest = {
   query?: string
   limit?: number
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 }
 
 export type LinearStatusSetRequest = LinearWriteTargetRequest & {
diff --git a/src/shared/linear-agent-result-types.ts b/src/shared/linear-agent-result-types.ts
index e986460007b..ae04c842d4d 100644
--- a/src/shared/linear-agent-result-types.ts
+++ b/src/shared/linear-agent-result-types.ts
@@ -144,7 +144,7 @@ export type LinearSearchResult = {
   issues: LinearSearchIssueSummary[]
   meta: {
     query: string
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     limit: number
     returned: number
     limitReached: boolean
@@ -178,7 +178,7 @@ export type LinearTeamSummary = {
 export type LinearTeamListResult = {
   teams: LinearTeamSummary[]
   meta: {
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     returned: number
     partial: boolean
     workspaceErrors: {
@@ -211,7 +211,7 @@ export type LinearIssueListResult = {
   issues: LinearSearchIssueSummary[]
   meta: {
     filter: LinearIssueListFilter
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     team?: LinearTeamSummary
     limit: number
     returned: number
@@ -242,7 +242,7 @@ export type LinearProjectListResult = {
   projects: LinearAgentProjectSummary[]
   meta: {
     query?: string
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     limit: number
     returned: number
     hasMore: boolean
diff --git a/src/shared/linear-issue-view-resume-state.ts b/src/shared/linear-issue-view-resume-state.ts
index 11fbb967570..82c03f87c2e 100644
--- a/src/shared/linear-issue-view-resume-state.ts
+++ b/src/shared/linear-issue-view-resume-state.ts
@@ -173,9 +173,7 @@ export function selectLinearWorkspaceIssueFilter(
   if (!workspaceId) {
     return emptyLinearIssueAttributeFilter()
   }
-  const filter = Object.prototype.hasOwnProperty.call(filters, workspaceId)
-    ? filters[workspaceId]
-    : undefined
+  const filter = Object.hasOwn(filters, workspaceId) ? filters[workspaceId] : undefined
   return filter ? canonicalizeLinearIssueAttributeFilter(filter) : emptyLinearIssueAttributeFilter()
 }
 
diff --git a/src/shared/linear-links.ts b/src/shared/linear-links.ts
index 0f1db592736..bcbb7180e36 100644
--- a/src/shared/linear-links.ts
+++ b/src/shared/linear-links.ts
@@ -1,3 +1,5 @@
+import type { LinearConnectionStatus, LinearIssue, LinearWorkspace } from './types'
+
 export function buildLinearTeamUrl(args: {
   organizationUrlKey?: string | null
   teamKey?: string | null
@@ -56,6 +58,11 @@ export type ParsedLinearIssueInput = {
   organizationUrlKey?: string
 }
 
+export type LinearIssueUrlIntent = {
+  identifier: string
+  organizationUrlKey: string
+}
+
 export type LinearIssueLinkUpdates = {
   linkedLinearIssue: string | null
   linkedLinearIssueWorkspaceId: string | null
@@ -88,7 +95,7 @@ export function parseLinearIssueInput(input: string): ParsedLinearIssueInput | n
     const parts = parsed.pathname.split('/').filter(Boolean)
     const issueIndex = parts.indexOf('issue')
     const organizationUrlKey = parts[0]
-    const rawIdentifier = issueIndex >= 0 ? parts[issueIndex + 1] : undefined
+    const rawIdentifier = issueIndex !== -1 ? parts[issueIndex + 1] : undefined
     if (!organizationUrlKey || !rawIdentifier) {
       return null
     }
@@ -105,6 +112,122 @@ export function parseLinearIssueInput(input: string): ParsedLinearIssueInput | n
   }
 }
 
+export function parseLinearIssueUrlIntent(input: string): LinearIssueUrlIntent | null {
+  const trimmed = input.trim()
+  try {
+    const url = new URL(trimmed)
+    const pathMatch = /^\/([^/]+)\/issue\/([^/]+)(?:\/[^/]+)?\/?$/.exec(url.pathname)
+    if (
+      (url.protocol !== 'https:' && url.protocol !== 'http:') ||
+      url.host !== 'linear.app' ||
+      url.username !== '' ||
+      url.password !== '' ||
+      !pathMatch
+    ) {
+      return null
+    }
+    const organizationUrlKey = decodeURIComponent(pathMatch[1])
+    const identifier = decodeURIComponent(pathMatch[2])
+    if (
+      !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(organizationUrlKey) ||
+      !LINEAR_IDENTIFIER_PATTERN.test(identifier)
+    ) {
+      return null
+    }
+    return { identifier: identifier.toUpperCase(), organizationUrlKey }
+  } catch {
+    return null
+  }
+}
+
+export function findLinearIssueWorkspaceId(
+  intent: LinearIssueUrlIntent,
+  workspaces: readonly Pick<LinearWorkspace, 'id' | 'organizationUrlKey'>[] | undefined
+): string | null {
+  const organizationUrlKey = intent.organizationUrlKey.toLowerCase()
+  return (
+    workspaces?.find(
+      (workspace) => workspace.organizationUrlKey?.toLowerCase() === organizationUrlKey
+    )?.id ?? null
+  )
+}
+
+export function findLinearIssueWorkspaceIdFromStatus(
+  intent: LinearIssueUrlIntent,
+  status: Pick<
+    LinearConnectionStatus,
+    'workspaces' | 'viewer' | 'activeWorkspaceId' | 'selectedWorkspaceId'
+  >
+): string | null {
+  const workspaceId = findLinearIssueWorkspaceId(intent, status.workspaces)
+  if (workspaceId) {
+    return workspaceId
+  }
+  if (
+    status.viewer?.organizationUrlKey?.toLowerCase() !== intent.organizationUrlKey.toLowerCase()
+  ) {
+    return null
+  }
+  const selectedWorkspaceId =
+    status.selectedWorkspaceId && status.selectedWorkspaceId !== 'all'
+      ? status.selectedWorkspaceId
+      : null
+  return selectedWorkspaceId ?? status.activeWorkspaceId ?? null
+}
+
+export function findLinearIssueWorkspaceLookupIds(
+  intent: LinearIssueUrlIntent,
+  status: Pick<
+    LinearConnectionStatus,
+    'workspaces' | 'viewer' | 'activeWorkspaceId' | 'selectedWorkspaceId'
+  >
+): string[] {
+  const ids: string[] = []
+  const seen = new Set<string>()
+  const push = (id: string | null | undefined): void => {
+    if (!id || id === 'all' || seen.has(id)) {
+      return
+    }
+    seen.add(id)
+    ids.push(id)
+  }
+
+  push(findLinearIssueWorkspaceIdFromStatus(intent, status))
+
+  // Why: saved API-key workspaces often omit organizationUrlKey. Probe those
+  // unknown-org workspaces and accept only an issue whose URL matches the org.
+  for (const workspace of status.workspaces ?? []) {
+    if (!workspace.organizationUrlKey) {
+      push(workspace.id)
+    }
+  }
+
+  if (!status.viewer?.organizationUrlKey && (status.workspaces?.length ?? 0) === 0) {
+    const selectedWorkspaceId =
+      status.selectedWorkspaceId && status.selectedWorkspaceId !== 'all'
+        ? status.selectedWorkspaceId
+        : null
+    push(selectedWorkspaceId)
+    push(status.activeWorkspaceId)
+  }
+
+  return ids
+}
+
+export function isLinearIssueUrlResolutionMatch(
+  intent: LinearIssueUrlIntent,
+  issue: Pick<LinearIssue, 'identifier' | 'url'>
+): boolean {
+  if (issue.identifier.toUpperCase() !== intent.identifier.toUpperCase()) {
+    return false
+  }
+  const issueOrganizationUrlKey = getLinearOrganizationUrlKeyFromIssueUrl(issue.url)
+  return (
+    issueOrganizationUrlKey !== null &&
+    issueOrganizationUrlKey.toLowerCase() === intent.organizationUrlKey.toLowerCase()
+  )
+}
+
 export const LINEAR_ISSUE_LINK_CLEARED: LinearIssueLinkUpdates = {
   linkedLinearIssue: null,
   linkedLinearIssueWorkspaceId: null,
diff --git a/src/shared/linear-mcp-issue-list.ts b/src/shared/linear-mcp-issue-list.ts
index c668c848aef..6955eef16ab 100644
--- a/src/shared/linear-mcp-issue-list.ts
+++ b/src/shared/linear-mcp-issue-list.ts
@@ -19,7 +19,7 @@ export type LinearMcpIssueListRequest = {
   createdAt?: string
   updatedAt?: string
   includeArchived?: boolean
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 }
 
 export type LinearMcpIssueListResult = {
@@ -30,7 +30,7 @@ export type LinearMcpIssueListResult = {
     hasMore: boolean
     nextCursor?: string
     orderBy: 'createdAt' | 'updatedAt'
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     partial: boolean
     workspaceErrors: {
       workspace: LinearWorkspaceCandidate
diff --git a/src/shared/mcp-config.ts b/src/shared/mcp-config.ts
index 0cc0ce60d3b..09fbc6d3865 100644
--- a/src/shared/mcp-config.ts
+++ b/src/shared/mcp-config.ts
@@ -165,7 +165,7 @@ export function inspectMcpConfigContent(
 function collectMcpServerEntries(rawServers: Record<string, unknown>): [string, unknown][] | null {
   const entries: [string, unknown][] = []
   for (const name in rawServers) {
-    if (!Object.prototype.hasOwnProperty.call(rawServers, name)) {
+    if (!Object.hasOwn(rawServers, name)) {
       continue
     }
     if (
diff --git a/src/shared/mcp-server-inspection.ts b/src/shared/mcp-server-inspection.ts
index ab7a79cf40b..a475ff413e8 100644
--- a/src/shared/mcp-server-inspection.ts
+++ b/src/shared/mcp-server-inspection.ts
@@ -66,7 +66,7 @@ function inspectMcpEnv(env: unknown): BoundedEnv {
   const masked: Record<string, string> = {}
   let fields = 0
   for (const key in env) {
-    if (!Object.prototype.hasOwnProperty.call(env, key)) {
+    if (!Object.hasOwn(env, key)) {
       continue
     }
     fields += 1
diff --git a/src/shared/native-chat-image-transcript-markers.test.ts b/src/shared/native-chat-image-transcript-markers.test.ts
index 7e66532c469..aff2c6f71fe 100644
--- a/src/shared/native-chat-image-transcript-markers.test.ts
+++ b/src/shared/native-chat-image-transcript-markers.test.ts
@@ -1,6 +1,12 @@
 import { describe, expect, it } from 'vitest'
 import type { NativeChatMessage } from './native-chat-types'
-import { normalizeImageTranscriptMessages } from './native-chat-image-transcript-markers'
+import {
+  isImageSourceUserTurn,
+  normalizeImageTranscriptMessages,
+  normalizeNativeChatUserText,
+  normalizedNativeChatUserMessageText,
+  stripImagePromptMarker
+} from './native-chat-image-transcript-markers'
 
 function userText(id: string, text: string): NativeChatMessage {
   return {
@@ -25,6 +31,91 @@ describe('normalizeImageTranscriptMessages', () => {
     ])
   })
 
+  it('merges a source turn into a prompt with a trailing image marker', () => {
+    const out = normalizeImageTranscriptMessages([
+      userText('a', '[Image: source: /tmp/orca-paste-1-2.png]'),
+      userText('b', 'describe this[Image #1]')
+    ])
+
+    expect(out).toHaveLength(1)
+    expect(out[0]!.blocks).toEqual([
+      { type: 'image-ref', path: '/tmp/orca-paste-1-2.png' },
+      { type: 'text', text: 'describe this' }
+    ])
+  })
+
+  it('folds and strips markers in later text blocks', () => {
+    const prompt: NativeChatMessage = {
+      ...userText('prompt', 'unused'),
+      blocks: [
+        { type: 'text', text: 'describe' },
+        { type: 'image-ref', path: '/tmp/existing.png' },
+        { type: 'text', text: '[Image #1] this' }
+      ]
+    }
+    const out = normalizeImageTranscriptMessages([
+      userText('source', '[Image: source: /tmp/a.png]'),
+      prompt
+    ])
+
+    expect(out).toHaveLength(1)
+    expect(out[0]?.blocks).toEqual([
+      { type: 'image-ref', path: '/tmp/a.png' },
+      { type: 'text', text: 'describe' },
+      { type: 'image-ref', path: '/tmp/existing.png' },
+      { type: 'text', text: 'this' }
+    ])
+  })
+
+  it.each([
+    ['[Image #1] describe this', 'describe this'],
+    ['[Image #1]\t  describe this', 'describe this'],
+    [' \t[Image #1] describe this', 'describe this'],
+    ['describe this [Image #1]', 'describe this'],
+    ['describe this  \t[Image #1]', 'describe this'],
+    ['describe this [Image #1]\t  ', 'describe this'],
+    ['describe [Image #1] this', 'describe  this'],
+    ['describe  [Image #1]\t this', 'describe  \t this'],
+    ['describe[Image #1]\t  this', 'describe\t  this'],
+    ['describe\n[Image #1]\nthis', 'describe\n\nthis'],
+    ['com[Image #1]pare this', 'compare this'],
+    ['[Image #1] [Image #2]', ''],
+    ['literal [Image #x] text', 'literal [Image #x] text']
+  ])('strips image prompt markers anywhere in text', (text, expected) => {
+    expect(stripImagePromptMarker(text)).toBe(expected)
+  })
+
+  it('returns long marker-free whitespace without regex backtracking', () => {
+    const text = ' '.repeat(50_000)
+    expect(stripImagePromptMarker(text)).toBe(text)
+  })
+
+  it('shares marker-aware text matching across multiple text blocks', () => {
+    const message: NativeChatMessage = {
+      ...userText('prompt', 'unused'),
+      blocks: [
+        { type: 'text', text: 'look' },
+        { type: 'image-ref', path: '/tmp/a.png' },
+        { type: 'text', text: '[Image #1]   here' }
+      ]
+    }
+
+    expect(normalizeNativeChatUserText(' look [Image #1]   here ')).toBe('look here')
+    expect(normalizedNativeChatUserMessageText(message)).toBe('look here')
+  })
+
+  it('recognizes only sole-text image-source user turns', () => {
+    const source = userText('source', '[Image: source: /tmp/a.png]')
+    expect(isImageSourceUserTurn(source)).toBe(true)
+    expect(isImageSourceUserTurn({ ...source, role: 'assistant' })).toBe(false)
+    expect(
+      isImageSourceUserTurn({
+        ...source,
+        blocks: [...source.blocks, { type: 'text', text: 'caption' }]
+      })
+    ).toBe(false)
+  })
+
   it('converts a lone [Image: source] turn (no prompt) into an image-ref instead of raw text', () => {
     const out = normalizeImageTranscriptMessages([
       userText('a', '[Image: source: /Users/me/Pictures/hero-image-2.png]')
diff --git a/src/shared/native-chat-image-transcript-markers.ts b/src/shared/native-chat-image-transcript-markers.ts
index a55f0c9c272..df52ec8c12c 100644
--- a/src/shared/native-chat-image-transcript-markers.ts
+++ b/src/shared/native-chat-image-transcript-markers.ts
@@ -1,7 +1,12 @@
 import { isTextBlock, type NativeChatBlock, type NativeChatMessage } from './native-chat-types'
 
 const IMAGE_SOURCE_MARKER = /^\[Image:\s*source:\s*(.+?)\]\s*$/
-const IMAGE_PROMPT_MARKERS = /^(?:\[Image #\d+\]\s*)+/
+const IMAGE_PROMPT_MARKER = /\[Image #\d+\]/
+const IMAGE_PROMPT_MARKERS = /\[Image #\d+\]/g
+const IMAGE_PROMPT_MARKER_AT_START = /^[^\S\r\n]*\[Image #\d+\]/
+const IMAGE_PROMPT_MARKER_AT_END = /\[Image #\d+\][^\S\r\n]*$/
+const HORIZONTAL_WHITESPACE_START = /^[^\S\r\n]+/
+const HORIZONTAL_WHITESPACE_END = /[^\S\r\n]+$/
 
 function soleText(message: NativeChatMessage): string | null {
   return message.blocks.length === 1 && isTextBlock(message.blocks[0])
@@ -13,40 +18,75 @@ export function imageSourcePathFromText(text: string): string | null {
   return text.match(IMAGE_SOURCE_MARKER)?.[1]?.trim() ?? null
 }
 
-export function stripImagePromptMarker(text: string): string {
-  return text.replace(IMAGE_PROMPT_MARKERS, '')
+export function isImageSourceUserTurn(message: NativeChatMessage): boolean {
+  return message.role === 'user' && imageSourcePathFromText(soleText(message) ?? '') !== null
 }
 
-function stripImagePromptMarkersFromFirstText(
+export function stripImagePromptMarker(text: string): string {
+  const stripped = text.replace(IMAGE_PROMPT_MARKERS, '')
+  if (stripped === text) {
+    return text
+  }
+  let result = IMAGE_PROMPT_MARKER_AT_START.test(text)
+    ? stripped.replace(HORIZONTAL_WHITESPACE_START, '')
+    : stripped
+  if (IMAGE_PROMPT_MARKER_AT_END.test(text)) {
+    result = result.replace(HORIZONTAL_WHITESPACE_END, '')
+  }
+  return result
+}
+
+export function normalizeNativeChatUserText(text: string): string {
+  return stripImagePromptMarker(text).trim().replace(/\s+/g, ' ')
+}
+
+export function normalizedNativeChatUserMessageText(message: NativeChatMessage): string | null {
+  if (message.role !== 'user') {
+    return null
+  }
+  const normalized = normalizeNativeChatUserText(
+    message.blocks
+      .filter(isTextBlock)
+      .map((block) => block.text)
+      .join(' ')
+  )
+  return normalized || null
+}
+
+function stripImagePromptMarkersFromTextBlocks(
   blocks: readonly NativeChatBlock[]
 ): NativeChatBlock[] {
-  const textIndex = blocks.findIndex(isTextBlock)
-  if (textIndex < 0) {
-    return blocks as NativeChatBlock[]
+  let sawText = false
+  let next: NativeChatBlock[] | null = null
+  for (let index = 0; index < blocks.length; index += 1) {
+    const block = blocks[index]!
+    if (!isTextBlock(block)) {
+      next?.push(block)
+      continue
+    }
+    const isFirstText = !sawText
+    sawText = true
+    const text = stripImagePromptMarker(block.text)
+    if (!text.trim() && (text !== block.text || isFirstText)) {
+      next ??= blocks.slice(0, index)
+      continue
+    }
+    if (text !== block.text) {
+      next ??= blocks.slice(0, index)
+      next.push({ ...block, text })
+      continue
+    }
+    next?.push(block)
   }
-  const block = blocks[textIndex]
-  if (!block || !isTextBlock(block)) {
-    return blocks as NativeChatBlock[]
-  }
-  const text = stripImagePromptMarker(block.text)
-  if (text.trim().length === 0) {
-    return blocks.filter((_, index) => index !== textIndex)
-  }
-  if (text === block.text) {
-    return blocks as NativeChatBlock[]
-  }
-  const next = [...blocks]
-  next[textIndex] = { ...block, text }
-  return next
+  return next ?? (blocks as NativeChatBlock[])
 }
 
-function imagePromptMarkerStartsMessage(message: NativeChatMessage): boolean {
-  const firstText = message.blocks.find(isTextBlock)
-  return firstText ? IMAGE_PROMPT_MARKERS.test(firstText.text) : false
+export function hasImagePromptMarker(message: NativeChatMessage): boolean {
+  return message.blocks.some((block) => isTextBlock(block) && IMAGE_PROMPT_MARKER.test(block.text))
 }
 
-/** Claude records image paths as source turns followed by one marker-prefixed
- *  prompt. Merge the whole run back into one native user turn. */
+/** Claude records image paths as source turns followed by a prompt carrying
+ *  image markers. Merge the whole run back into one native user turn. */
 export function normalizeImageTranscriptMessages(
   messages: readonly NativeChatMessage[]
 ): NativeChatMessage[] {
@@ -75,13 +115,13 @@ export function normalizeImageTranscriptMessages(
       if (
         prompt?.role === 'user' &&
         prompt.source === message.source &&
-        imagePromptMarkerStartsMessage(prompt)
+        hasImagePromptMarker(prompt)
       ) {
         normalized.push({
           ...prompt,
           blocks: [
             ...imagePaths.map((path) => ({ type: 'image-ref' as const, path })),
-            ...stripImagePromptMarkersFromFirstText(prompt.blocks)
+            ...stripImagePromptMarkersFromTextBlocks(prompt.blocks)
           ]
         })
         index = nextIndex
@@ -93,7 +133,7 @@ export function normalizeImageTranscriptMessages(
       })
       continue
     }
-    const blocks = stripImagePromptMarkersFromFirstText(message.blocks)
+    const blocks = stripImagePromptMarkersFromTextBlocks(message.blocks)
     if (blocks === message.blocks) {
       normalized?.push(message)
     } else {
diff --git a/src/shared/native-chat-session-option-commands.ts b/src/shared/native-chat-session-option-commands.ts
index 6fb5095be8d..e4efd5efdf9 100644
--- a/src/shared/native-chat-session-option-commands.ts
+++ b/src/shared/native-chat-session-option-commands.ts
@@ -22,7 +22,7 @@ export function parseBuiltSessionOptionCommand(
   const marker = '__orca_session_option_value__'
   const template = build(marker)
   const markerIndex = template.indexOf(marker)
-  if (markerIndex < 0) {
+  if (markerIndex === -1) {
     return null
   }
   const prefix = template.slice(0, markerIndex)
diff --git a/src/shared/native-chat-tool-summary.ts b/src/shared/native-chat-tool-summary.ts
index 3f71d997e15..a048e16da0e 100644
--- a/src/shared/native-chat-tool-summary.ts
+++ b/src/shared/native-chat-tool-summary.ts
@@ -283,7 +283,7 @@ function boundedPreviewValue(value: unknown, depth: number, seen: WeakSet<object
   const result: Record<string, unknown> = {}
   let count = 0
   for (const key in value) {
-    if (!Object.prototype.hasOwnProperty.call(value, key)) {
+    if (!Object.hasOwn(value, key)) {
       continue
     }
     if (count >= MAX_PREVIEW_COLLECTION_ITEMS) {
diff --git a/src/shared/new-workspace/smart-workspace-linear-intent.ts b/src/shared/new-workspace/smart-workspace-linear-intent.ts
new file mode 100644
index 00000000000..0995cdd9cb9
--- /dev/null
+++ b/src/shared/new-workspace/smart-workspace-linear-intent.ts
@@ -0,0 +1,69 @@
+import type { LinearIssue } from '../types'
+import {
+  parseLinearIssueInput,
+  parseLinearIssueUrlIntent,
+  type LinearIssueUrlIntent,
+  type ParsedLinearIssueInput
+} from '../linear-links'
+import { isSmartWorkspaceSourceQueryWithinLimit } from './smart-workspace-source-query'
+
+type SmartWorkspaceLinearMode = 'smart' | 'linear' | (string & {})
+
+export function parseBoundedSmartWorkspaceLinearIssueInput(
+  value: string
+): ParsedLinearIssueInput | null {
+  if (!isSmartWorkspaceSourceQueryWithinLimit(value)) {
+    return null
+  }
+  const parsed = parseLinearIssueInput(value)
+  if (!parsed?.organizationUrlKey) {
+    return parsed
+  }
+  return parseLinearIssueUrlIntent(value)
+}
+
+export function parseBoundedSmartWorkspaceLinearIssueUrlIntent(
+  value: string
+): LinearIssueUrlIntent | null {
+  return isSmartWorkspaceSourceQueryWithinLimit(value) ? parseLinearIssueUrlIntent(value) : null
+}
+
+export function getSmartWorkspaceLinearSearchQuery(value: string): string {
+  const trimmed = value.trim()
+  return parseBoundedSmartWorkspaceLinearIssueInput(trimmed)?.identifier ?? trimmed
+}
+
+export function isSmartWorkspaceLinearIssueIntentMatch(
+  intent: ParsedLinearIssueInput,
+  issue: Pick<LinearIssue, 'identifier' | 'url'>
+): boolean {
+  if (issue.identifier.toUpperCase() !== intent.identifier.toUpperCase()) {
+    return false
+  }
+  if (!intent.organizationUrlKey) {
+    return true
+  }
+  const issueInput = parseLinearIssueUrlIntent(issue.url)
+  return issueInput?.organizationUrlKey?.toLowerCase() === intent.organizationUrlKey.toLowerCase()
+}
+
+export function prioritizeSmartWorkspaceLinearIssueResults(
+  value: string,
+  issues: readonly LinearIssue[]
+): LinearIssue[] {
+  const intent = parseBoundedSmartWorkspaceLinearIssueInput(value)
+  if (!intent) {
+    return issues.slice()
+  }
+  return [
+    ...issues.filter((issue) => isSmartWorkspaceLinearIssueIntentMatch(intent, issue)),
+    ...issues.filter((issue) => !isSmartWorkspaceLinearIssueIntentMatch(intent, issue))
+  ]
+}
+
+export function isBlockingLinearUrlIntent(mode: SmartWorkspaceLinearMode, value: string): boolean {
+  if (mode !== 'smart' && mode !== 'linear') {
+    return false
+  }
+  return parseBoundedSmartWorkspaceLinearIssueUrlIntent(value) !== null
+}
diff --git a/src/shared/new-workspace/smart-workspace-source-query.ts b/src/shared/new-workspace/smart-workspace-source-query.ts
new file mode 100644
index 00000000000..5a5a9633f75
--- /dev/null
+++ b/src/shared/new-workspace/smart-workspace-source-query.ts
@@ -0,0 +1,10 @@
+import { isClipboardTextByteLengthOverLimit } from '../clipboard-text'
+
+export const SMART_WORKSPACE_SOURCE_QUERY_MAX_BYTES = 2048
+
+export function isSmartWorkspaceSourceQueryWithinLimit(
+  query: string,
+  maxBytes = SMART_WORKSPACE_SOURCE_QUERY_MAX_BYTES
+): boolean {
+  return !isClipboardTextByteLengthOverLimit(query, maxBytes)
+}
diff --git a/src/shared/new-workspace/smart-workspace-source-results.ts b/src/shared/new-workspace/smart-workspace-source-results.ts
index 73c39adae8c..e17a4029d8e 100644
--- a/src/shared/new-workspace/smart-workspace-source-results.ts
+++ b/src/shared/new-workspace/smart-workspace-source-results.ts
@@ -6,13 +6,20 @@ import type {
   LinearCollectionResult,
   LinearIssue
 } from '../types'
-import { isClipboardTextByteLengthOverLimit } from '../clipboard-text'
 import { JIRA_ISSUE_KEY_PATTERN, parseJiraIssueUrl } from '../jira-issue-url'
+import {
+  isSmartWorkspaceLinearIssueIntentMatch,
+  parseBoundedSmartWorkspaceLinearIssueUrlIntent
+} from './smart-workspace-linear-intent'
+import { isSmartWorkspaceSourceQueryWithinLimit } from './smart-workspace-source-query'
+
+export {
+  SMART_WORKSPACE_SOURCE_QUERY_MAX_BYTES,
+  isSmartWorkspaceSourceQueryWithinLimit
+} from './smart-workspace-source-query'
 
 export type SmartNameMode = 'smart' | 'github' | 'gitlab' | 'branches' | 'linear' | 'jira' | 'text'
 
-export const SMART_WORKSPACE_SOURCE_QUERY_MAX_BYTES = 2048
-
 export type SmartWorkspaceSourceRow =
   | { kind: 'use-name'; value: string; name: string }
   | { kind: 'create-branch'; value: string; name: string }
@@ -38,13 +45,6 @@ export function getSmartWorkspaceEmptyHint(mode: SmartNameMode): string {
   return EMPTY_HINT_BY_MODE[mode]
 }
 
-export function isSmartWorkspaceSourceQueryWithinLimit(
-  query: string,
-  maxBytes = SMART_WORKSPACE_SOURCE_QUERY_MAX_BYTES
-): boolean {
-  return !isClipboardTextByteLengthOverLimit(query, maxBytes)
-}
-
 export function buildJiraIssueSearchJql(query: string): string | null {
   const trimmed = query.trim()
   if (!trimmed || !isSmartWorkspaceSourceQueryWithinLimit(trimmed)) {
@@ -195,6 +195,7 @@ export function buildSmartWorkspaceSourceRows({
   jiraIssues = [],
   linearAvailable,
   linearIssues,
+  linearUrlIntentOwnsResults = false,
   mode,
   resultLimit,
   value
@@ -208,6 +209,7 @@ export function buildSmartWorkspaceSourceRows({
   jiraIssues?: JiraIssue[]
   linearAvailable: boolean
   linearIssues: LinearIssueSourceInput
+  linearUrlIntentOwnsResults?: boolean
   mode: SmartNameMode
   resultLimit: number
   value: string
@@ -221,6 +223,32 @@ export function buildSmartWorkspaceSourceRows({
   }
   const trimmed = value.trim()
   const nextRows: SmartWorkspaceSourceRow[] = []
+  const resolvedLinearIssues = Array.isArray(linearIssues)
+    ? linearIssues
+    : Array.isArray(linearIssues?.items)
+      ? linearIssues.items
+      : []
+  const linearUrlIntent = parseBoundedSmartWorkspaceLinearIssueUrlIntent(trimmed)
+  if (
+    linearUrlIntentOwnsResults &&
+    linearAvailable &&
+    linearUrlIntent &&
+    (mode === 'smart' || mode === 'linear')
+  ) {
+    const linearRows = resolvedLinearIssues
+      .filter((issue) => isSmartWorkspaceLinearIssueIntentMatch(linearUrlIntent, issue))
+      .map((issue) => ({
+        kind: 'linear' as const,
+        value: `linear-${issue.id}`,
+        issue
+      }))
+      .slice(0, resultLimit)
+    // Why: keep "use as workspace name" available; sourceIntent focuses the issue.
+    if (trimmed && mode === 'smart') {
+      return [{ kind: 'use-name' as const, value: 'use-name', name: trimmed }, ...linearRows]
+    }
+    return linearRows
+  }
   if (trimmed && mode === 'smart') {
     // Why: stable cmdk value — embedding the query remounted the row every keystroke.
     nextRows.push({ kind: 'use-name', value: 'use-name', name: trimmed })
@@ -266,11 +294,6 @@ export function buildSmartWorkspaceSourceRows({
   if (linearAvailable && (mode === 'smart' || mode === 'linear')) {
     // Why: mixed-version runtime responses may briefly carry the paginated
     // collection shape into this render path; rendering must stay recoverable.
-    const resolvedLinearIssues = Array.isArray(linearIssues)
-      ? linearIssues
-      : Array.isArray(linearIssues?.items)
-        ? linearIssues.items
-        : []
     nextRows.push(
       ...resolvedLinearIssues.map((issue) => ({
         kind: 'linear' as const,
diff --git a/src/shared/opencode-terminal-title.test.ts b/src/shared/opencode-terminal-title.test.ts
index f1cb825e8cd..35bb339f797 100644
--- a/src/shared/opencode-terminal-title.test.ts
+++ b/src/shared/opencode-terminal-title.test.ts
@@ -4,20 +4,30 @@ import { isMeaningfulOpenCodeTerminalTitle, isOpenCodeNativeTitle } from './open
 describe('OpenCode terminal titles', () => {
   it('recognizes native session titles', () => {
     expect(isMeaningfulOpenCodeTerminalTitle('OC | Native Stable Session')).toBe(true)
-    expect(isMeaningfulOpenCodeTerminalTitle('  OC|Session  ')).toBe(true)
+    expect(isMeaningfulOpenCodeTerminalTitle('  OC | Session  ')).toBe(true)
     expect(isOpenCodeNativeTitle('OC | Understand about the plugin')).toBe(true)
     expect(isOpenCodeNativeTitle('tmux | OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('ssh build-host | OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('user@host: ~/code | OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('▣ OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('⠋ OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('ssh build-host | ⠋ OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('OC |   ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('OC |\tses_123')).toBe(true)
   })
 
   it('rejects generic, incomplete, embedded, and lookalike titles', () => {
     expect(isMeaningfulOpenCodeTerminalTitle('OpenCode')).toBe(false)
     expect(isMeaningfulOpenCodeTerminalTitle('OpenCode ready')).toBe(false)
     expect(isMeaningfulOpenCodeTerminalTitle('OC |')).toBe(false)
+    // Why: the native marker always spaces its separator; `OC|x` is another tool's
+    // pipe-delimited title, so accepting it would make a non-OpenCode pane a send target.
+    expect(isMeaningfulOpenCodeTerminalTitle('OC|Session')).toBe(false)
+    expect(isMeaningfulOpenCodeTerminalTitle('OC |Session')).toBe(false)
     expect(isMeaningfulOpenCodeTerminalTitle(undefined)).toBe(false)
     // Why: lowercase is not OpenCode's native marker; avoid "oc |" cwd/task noise.
     expect(isOpenCodeNativeTitle('oc | Understand about the plugin')).toBe(false)
     // Why: mid-title OC must not steal another agent's braille/task frame.
     expect(isOpenCodeNativeTitle('⠋ Fix foo | OC | bar')).toBe(false)
-    expect(isOpenCodeNativeTitle('my session | OC | task')).toBe(false)
   })
 })
diff --git a/src/shared/opencode-terminal-title.ts b/src/shared/opencode-terminal-title.ts
index 01d3d3819ae..c45cc9fd49c 100644
--- a/src/shared/opencode-terminal-title.ts
+++ b/src/shared/opencode-terminal-title.ts
@@ -1,12 +1,10 @@
-// Why: OpenCode abbreviates native OSC session titles as `OC | <task>` (no
-// agent-name token). Optional single-token multiplexer prefix covers SSH/tmux
-// frames like `tmux | OC | …`. Case-sensitive `OC` avoids ordinary lowercase
-// "oc" lookalikes; require non-whitespace after the marker so bare `OC |` is not
-// identity. Used for both display-title preservation and tab-agent identity.
-const OPENCODE_NATIVE_TITLE_RE = /^(?:[^|\s]+ \| )?OC\s*\|\s*\S/u
+// Why: wrappers may prepend an SSH/tmux label, and OpenCode may prepend one
+// status glyph. A spinner-led task from another agent must not become a wrapper.
+const OPENCODE_NATIVE_TITLE_RE =
+  /^\s*(?:(?![▣\u2800-\u28ff])[^|]+? \| )?(?:[▣\u2800-\u28ff] )?OC \|[ \t]+\S/u
 
 export function isOpenCodeNativeTitle(title: string | null | undefined): boolean {
-  return OPENCODE_NATIVE_TITLE_RE.test(title?.trim() ?? '')
+  return title ? OPENCODE_NATIVE_TITLE_RE.test(title) : false
 }
 
 export function isMeaningfulOpenCodeTerminalTitle(title: string | null | undefined): boolean {
diff --git a/src/shared/orca-attribution.ts b/src/shared/orca-attribution.ts
deleted file mode 100644
index ce81dcffb4e..00000000000
--- a/src/shared/orca-attribution.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-// Why: single source of truth for the commit trailer Orca appends when the
-// "Orca Attribution" toggle (`enableGitHubAttribution`) is on. Used by both
-// the terminal git/gh shim and the AI commit-message generator so the two
-// code paths agree on the exact string.
-
-export const ORCA_GIT_COMMIT_TRAILER = 'Co-authored-by: Orca <help@stably.ai>'
diff --git a/src/shared/persisted-ui-equality.ts b/src/shared/persisted-ui-equality.ts
index b82320737c9..701359c487d 100644
--- a/src/shared/persisted-ui-equality.ts
+++ b/src/shared/persisted-ui-equality.ts
@@ -36,7 +36,7 @@ export function persistedUIValuesEqual(left: unknown, right: unknown): boolean {
 
   for (const key of leftKeys) {
     if (
-      !Object.prototype.hasOwnProperty.call(rightRecord, key) ||
+      !Object.hasOwn(rightRecord, key) ||
       !persistedUIValuesEqual(leftRecord[key], rightRecord[key])
     ) {
       return false
diff --git a/src/shared/project-host-setup-projection.test.ts b/src/shared/project-host-setup-projection.test.ts
index 606eebdc73f..c7573c50784 100644
--- a/src/shared/project-host-setup-projection.test.ts
+++ b/src/shared/project-host-setup-projection.test.ts
@@ -19,6 +19,75 @@ function repo(overrides: Partial<Repo> & Pick<Repo, 'id' | 'path' | 'displayName
 }
 
 describe('project host setup projection', () => {
+  it('keeps timestamps stable when addedAt is 0 across different now values', () => {
+    const target = repo({
+      id: 'repo-1',
+      path: '/Users/alice/orca',
+      displayName: 'orca',
+      addedAt: 0
+    })
+    const first = projectHostSetupProjectionFromRepos([target], 1_000)
+    const second = projectHostSetupProjectionFromRepos([target], 9_999)
+
+    expect(first.projects[0]?.createdAt).toBe(0)
+    expect(first.projects[0]?.updatedAt).toBe(0)
+    expect(first.setups[0]?.createdAt).toBe(0)
+    expect(second.projects[0]?.createdAt).toBe(first.projects[0]?.createdAt)
+    expect(second.projects[0]?.updatedAt).toBe(first.projects[0]?.updatedAt)
+    expect(second.setups[0]?.createdAt).toBe(first.setups[0]?.createdAt)
+    expect(second.setups[0]?.updatedAt).toBe(first.setups[0]?.updatedAt)
+  })
+
+  // Why both orders: repo order comes from disk/host enumeration, so it must not decide the
+  // project's timestamps. The accumulator carries 0 when the *first* sibling is the unknown one.
+  const timestampedSibling = repo({
+    id: 'local-repo',
+    path: '/Users/alice/orca',
+    displayName: 'Orca',
+    addedAt: 100,
+    upstream: { owner: 'StablyAI', repo: 'Orca' }
+  })
+  const unknownSibling = repo({
+    id: 'remote-repo',
+    path: '/home/alice/orca',
+    displayName: 'orca',
+    addedAt: 0,
+    connectionId: 'gpu-vm',
+    upstream: { owner: 'stablyai', repo: 'orca' }
+  })
+
+  it('does not wipe a persisted createdAt when a sibling repo has addedAt 0', () => {
+    const projection = projectHostSetupProjectionFromRepos([timestampedSibling, unknownSibling])
+
+    expect(projection.projects).toHaveLength(1)
+    expect(projection.projects[0]?.createdAt).toBe(100)
+    expect(projection.projects[0]?.updatedAt).toBe(100)
+  })
+
+  it('does not wipe a persisted createdAt when the addedAt 0 sibling comes first', () => {
+    const projection = projectHostSetupProjectionFromRepos([unknownSibling, timestampedSibling])
+
+    expect(projection.projects).toHaveLength(1)
+    expect(projection.projects[0]?.createdAt).toBe(100)
+    expect(projection.projects[0]?.updatedAt).toBe(100)
+  })
+
+  it('keeps per-repo setup timestamps independent of sibling order', () => {
+    for (const repos of [
+      [timestampedSibling, unknownSibling],
+      [unknownSibling, timestampedSibling]
+    ]) {
+      const { setups } = projectHostSetupProjectionFromRepos(repos)
+      const timestamped = setups.find((setup) => setup.repoId === 'local-repo')
+      const unknown = setups.find((setup) => setup.repoId === 'remote-repo')
+      expect(timestamped?.createdAt).toBe(100)
+      expect(timestamped?.updatedAt).toBe(100)
+      // Setups are per repo and never merged, so the unknown one keeps its own 0 either way.
+      expect(unknown?.createdAt).toBe(0)
+      expect(unknown?.updatedAt).toBe(0)
+    }
+  })
+
   it('projects a legacy local repo into one project and one ready local setup', () => {
     const projection = projectHostSetupProjectionFromRepos(
       [repo({ id: 'repo-1', path: '/Users/alice/orca', displayName: 'orca' })],
diff --git a/src/shared/project-host-setup-projection.ts b/src/shared/project-host-setup-projection.ts
index c0c129d643a..00719497740 100644
--- a/src/shared/project-host-setup-projection.ts
+++ b/src/shared/project-host-setup-projection.ts
@@ -13,8 +13,8 @@ type ProjectAccumulator = {
 }
 
 export type ProjectHostSetupProjection = {
-  projects: Project[]
-  setups: ProjectHostSetup[]
+  projects: readonly Project[]
+  setups: readonly ProjectHostSetup[]
 }
 
 function getProjectProviderIdentity(
@@ -205,9 +205,43 @@ function parseGitHubRemoteUrl(remoteUrl: string | undefined): ProjectProviderIde
   }
 }
 
-function createProjectFromRepo(repo: Repo, now: number): Project {
+// Why: `addedAt || now` restamps Date.now() when addedAt is 0 / absent / NaN, so every
+// projection looks dirty and reconcileCatalogRows never reuses the project or setup.
+function catalogTimestampFromAddedAt(addedAt: number): number {
+  return Number.isFinite(addedAt) ? addedAt : 0
+}
+
+// Why: 0 / absent / NaN means "the repo predates timestamped catalog rows", not epoch. Keeping
+// it out of min()/max() stops one unknown sibling from wiping a real timestamp — and unlike the
+// old `|| now` fallback it stays order-independent, so both merge orders agree.
+function knownCatalogTimestamp(value: number): number | undefined {
+  return Number.isFinite(value) && value !== 0 ? value : undefined
+}
+
+/** Oldest of two catalog `createdAt` values, treating 0/NaN on either side as unknown. */
+export function mergeCatalogCreatedAt(left: number, right: number): number {
+  const known = knownCatalogTimestamp(left)
+  const other = knownCatalogTimestamp(right)
+  if (known === undefined || other === undefined) {
+    return known ?? other ?? 0
+  }
+  return Math.min(known, other)
+}
+
+/** Newest of two catalog `updatedAt` values, treating 0/NaN on either side as unknown. */
+export function mergeCatalogUpdatedAt(left: number, right: number): number {
+  const known = knownCatalogTimestamp(left)
+  const other = knownCatalogTimestamp(right)
+  if (known === undefined || other === undefined) {
+    return known ?? other ?? 0
+  }
+  return Math.max(known, other)
+}
+
+function createProjectFromRepo(repo: Repo): Project {
   const identity = getProjectProviderIdentity(repo)
   const gitRemoteIdentity = getProjectGitRemoteIdentity(repo)
+  const addedAt = catalogTimestampFromAddedAt(repo.addedAt)
   return {
     id: getProjectId(repo),
     displayName: repo.displayName,
@@ -217,8 +251,8 @@ function createProjectFromRepo(repo: Repo, now: number): Project {
     ...(identity ? { providerIdentity: identity } : {}),
     ...(gitRemoteIdentity ? { gitRemoteIdentity } : {}),
     sourceRepoIds: [repo.id],
-    createdAt: repo.addedAt || now,
-    updatedAt: repo.addedAt || now
+    createdAt: addedAt,
+    updatedAt: addedAt
   }
 }
 
@@ -226,17 +260,20 @@ function mergeProjectRepo(project: Project, repo: Repo): Project {
   const sourceRepoIds = project.sourceRepoIds.includes(repo.id)
     ? project.sourceRepoIds
     : [...project.sourceRepoIds, repo.id]
+  // Why unknown-aware on both sides: the accumulator itself carries 0 when the first repo of the
+  // project had no addedAt, so a plain min() would let repo order decide the project's createdAt.
+  const addedAt = catalogTimestampFromAddedAt(repo.addedAt)
   return {
     ...project,
     sourceRepoIds,
-    createdAt: Math.min(project.createdAt, repo.addedAt || project.createdAt),
-    updatedAt: Math.max(project.updatedAt, repo.addedAt || project.updatedAt)
+    createdAt: mergeCatalogCreatedAt(project.createdAt, addedAt),
+    updatedAt: mergeCatalogUpdatedAt(project.updatedAt, addedAt)
   }
 }
 
-function createSetupFromRepo(repo: Repo, projectId: string, now: number): ProjectHostSetup {
+function createSetupFromRepo(repo: Repo, projectId: string): ProjectHostSetup {
   const hostId = getRepoExecutionHostId(repo)
-  const createdAt = repo.addedAt || now
+  const createdAt = catalogTimestampFromAddedAt(repo.addedAt)
   const setupMethod = repo.projectHostSetupMethod ?? 'legacy-repo'
   return {
     id: repo.id,
@@ -261,7 +298,7 @@ function createSetupFromRepo(repo: Repo, projectId: string, now: number): Projec
 
 export function projectHostSetupProjectionFromRepos(
   repos: readonly Repo[],
-  now = Date.now()
+  _now?: number
 ): ProjectHostSetupProjection {
   const projectById = new Map<string, ProjectAccumulator>()
   const setups: ProjectHostSetup[] = []
@@ -271,8 +308,8 @@ export function projectHostSetupProjectionFromRepos(
     const existing = projectById.get(projectId)
     const project = existing
       ? mergeProjectRepo(existing.project, repo)
-      : createProjectFromRepo(repo, now)
-    const setup = createSetupFromRepo(repo, projectId, now)
+      : createProjectFromRepo(repo)
+    const setup = createSetupFromRepo(repo, projectId)
     projectById.set(projectId, {
       project
     })
@@ -288,7 +325,7 @@ export function projectHostSetupProjectionFromRepos(
 export function getProjectHostSetupsForProject(
   setups: readonly ProjectHostSetup[],
   projectId: string
-): ProjectHostSetup[] {
+): readonly ProjectHostSetup[] {
   return setups.filter((setup) => setup.projectId === projectId)
 }
 
diff --git a/src/shared/protocol-version.ts b/src/shared/protocol-version.ts
index f1818b901c3..28a89f9814b 100644
--- a/src/shared/protocol-version.ts
+++ b/src/shared/protocol-version.ts
@@ -32,9 +32,12 @@ export const REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY = 'remote-runtime.shared-c
 export const ORCHESTRATION_FEDERATION_RUNTIME_CAPABILITY = 'orchestration.federation.v1' as const
 export const ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY =
   'orchestration.federation-control-mail.v1' as const
+export const ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY =
+  'orchestration.federation-lifecycle-settlement.v1' as const
 export const ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY =
   'orchestration.worker-launch-preferences.v1' as const
 export const ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION = 2 as const
+export const ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION = 3 as const
 export const ORCHESTRATION_CONTRACT_VERSION = 1 as const
 export const ORCHESTRATION_CONTRACT_RUNTIME_CAPABILITY = 'orchestration.contract.v1' as const
 export const FOLDER_WORKSPACE_PATH_STATUS_RUNTIME_CAPABILITY =
@@ -51,6 +54,7 @@ export const AI_VAULT_SESSION_TITLES_RUNTIME_CAPABILITY = 'aiVault.session-title
 // offscreen backend). Advertised only when that backend is actually available, so
 // clients never fall back to a local desktop browser tab for a remote-owned page.
 export const BROWSER_HEADLESS_RUNTIME_CAPABILITY = 'browser.headless.v1' as const
+export const BROWSER_SCREENCAST_RUNTIME_CAPABILITY = 'browser.screencast.v1' as const
 export const BROWSER_CERTIFICATE_TRUST_RUNTIME_CAPABILITY = 'browser.certificate-trust.v1' as const
 // Why: hosts without this strip terminal.send's inputKind (zod object drops
 // unknown keys), so a mobile xterm query reply would land as ordinary
@@ -80,6 +84,9 @@ export const AGENT_SESSION_HOST_AUTHORITY_RUNTIME_CAPABILITY =
   'agent-session.host-authority.v1' as const
 export const AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY =
   'agent-session.omp-resume-path.v1' as const
+// Why: old host-authority launches cannot accept env deletions and may still inject attribution.
+export const TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY =
+  'terminal.attribution-removed.v1' as const
 // Why: older runtimes strip mutation owner fields, so clients must fence writes before RPC.
 export const FILE_MUTATION_OWNERSHIP_RUNTIME_CAPABILITY = 'files.mutation-ownership.v1' as const
 export const FILE_MUTATION_OWNERSHIP_UPDATE_REQUIRED_MESSAGE =
@@ -91,9 +98,10 @@ export const RUNTIME_CAPABILITIES = [
   REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY,
   ORCHESTRATION_FEDERATION_RUNTIME_CAPABILITY,
   ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY,
   ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY,
   ORCHESTRATION_CONTRACT_RUNTIME_CAPABILITY,
-  'browser.screencast.v1',
+  BROWSER_SCREENCAST_RUNTIME_CAPABILITY,
   'terminal.binary-stream.v1',
   'terminal.multiplex.v1',
   'workspace-ports.v1',
@@ -116,6 +124,7 @@ export const RUNTIME_CAPABILITIES = [
   REMOTE_SERVER_UPDATE_CAPABILITY,
   AGENT_SESSION_HOST_AUTHORITY_RUNTIME_CAPABILITY,
   AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
+  TERMINAL_ATTRIBUTION_REMOVED_RUNTIME_CAPABILITY,
   FILE_MUTATION_OWNERSHIP_RUNTIME_CAPABILITY,
   ACCOUNT_IMPORT_RUNTIME_CAPABILITY,
   CODEX_RESET_CREDIT_RUNTIME_CAPABILITY
diff --git a/src/shared/pty-incarnation.ts b/src/shared/pty-incarnation.ts
index a68ccd82e94..c2eb897454c 100644
--- a/src/shared/pty-incarnation.ts
+++ b/src/shared/pty-incarnation.ts
@@ -3,3 +3,16 @@ export type PtyIncarnationId = string
 export function isPtyIncarnationId(value: unknown): value is PtyIncarnationId {
   return typeof value === 'string' && value.length > 0 && value.length <= 128
 }
+
+/** Stand-in minted locally when a host reported no incarnation of its own. */
+export const SYNTHESIZED_PTY_INCARNATION_PREFIX = 'legacy:'
+
+/**
+ * True only for an incarnation the HOST minted. A synthesized one is first-write-wins and is
+ * dropped when provider state resets, so the same live shell can present a different value on a
+ * later reconnect. Durable identity may only be recorded from — and compared against — a value the
+ * host itself attested, or a reconnect would read its own stand-in as a different shell.
+ */
+export function isRelayAttestedPtyIncarnationId(value: unknown): value is PtyIncarnationId {
+  return isPtyIncarnationId(value) && !value.startsWith(SYNTHESIZED_PTY_INCARNATION_PREFIX)
+}
diff --git a/src/shared/pty-slave-line-discipline-echo.test.ts b/src/shared/pty-slave-line-discipline-echo.test.ts
index 4f6c3994a85..c5538f2328c 100644
--- a/src/shared/pty-slave-line-discipline-echo.test.ts
+++ b/src/shared/pty-slave-line-discipline-echo.test.ts
@@ -3,7 +3,11 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 const execFileMock = vi.hoisted(() => vi.fn())
 vi.mock('node:child_process', () => ({ execFile: execFileMock }))
 
-import { createPtySlaveEchoProbe, readPtySlavePath } from './pty-slave-line-discipline-echo'
+import {
+  createPtySlaveEchoProbe,
+  createPtySlaveLineEditorProbe,
+  readPtySlavePath
+} from './pty-slave-line-discipline-echo'
 
 /** Replies to the next stty call with the given output, or an error when `output` is null. */
 function answerStty(output: string | null): void {
@@ -14,6 +18,7 @@ function answerStty(output: string | null): void {
 
 const COOKED = 'speed 38400 baud;\nlflags: icanon isig iexten echo echoe echok echoctl\n'
 const RAW = 'speed 38400 baud;\nlflags: -icanon -isig -iexten -echo -echoe -echok -echoctl\n'
+const LINE_EDITOR = `${RAW}cchars: lnext = <undef>; min = 1; time = 0;\n`
 
 beforeEach(() => {
   execFileMock.mockReset()
@@ -132,3 +137,21 @@ describe('createPtySlaveEchoProbe', () => {
     expect(execFileMock.mock.calls[1]?.[1]).toEqual(['-a', '-F', '/dev/pts/3'])
   })
 })
+
+describe('createPtySlaveLineEditorProbe', () => {
+  it('requires raw quiet mode with the line editor disabling literal-next', async () => {
+    const probe = createPtySlaveLineEditorProbe('/dev/ttys048', 'darwin')
+    answerStty(LINE_EDITOR)
+    await expect(probe?.()).resolves.toBe('line-editor')
+    answerStty(`${RAW}cchars: lnext = ^V; min = 1; time = 0;\n`)
+    await expect(probe?.()).resolves.toBe('other')
+    answerStty(COOKED)
+    await expect(probe?.()).resolves.toBe('other')
+  })
+
+  it('fails closed when the terminal state is incomplete', async () => {
+    const probe = createPtySlaveLineEditorProbe('/dev/ttys048', 'darwin')
+    answerStty('lflags: -echo\ncchars: lnext = <undef>;\n')
+    await expect(probe?.()).resolves.toBe('unknown')
+  })
+})
diff --git a/src/shared/pty-slave-line-discipline-echo.ts b/src/shared/pty-slave-line-discipline-echo.ts
index 3f515066450..1eb6bfde3c9 100644
--- a/src/shared/pty-slave-line-discipline-echo.ts
+++ b/src/shared/pty-slave-line-discipline-echo.ts
@@ -10,10 +10,16 @@ export type PtySlaveLineDisciplineEcho = 'echoing' | 'quiet' | 'unknown'
 
 export type PtySlaveEchoProbe = () => Promise<PtySlaveLineDisciplineEcho>
 
+export type PtySlaveLineEditorState = 'line-editor' | 'other' | 'unknown'
+
+export type PtySlaveLineEditorProbe = () => Promise<PtySlaveLineEditorState>
+
 const STTY_TIMEOUT_MS = 2_000
 // `stty -a` prints the lflags as a space-separated list where a disabled flag is
 // prefixed with `-`, so `echo` and `-echo` are the two tokens that matter.
 const ECHO_FLAG = /(?:^|\s)(-?)echo(?:\s|$)/
+const ICANON_FLAG = /(?:^|\s)(-?)icanon(?:\s|$)/
+const LNEXT_UNDEFINED = /(?:^|[;\s])lnext\s*=\s*<undef>(?:;|\s|$)/
 
 function sttyArgs(ptsName: string, platform: NodeJS.Platform): readonly string[] {
   // BSD/macOS take `-f`; Linux (GNU coreutils) takes `-F`.
@@ -30,7 +36,18 @@ function parseEchoFlag(sttyOutput: string): PtySlaveLineDisciplineEcho {
   return match[1] === '-' ? 'quiet' : 'echoing'
 }
 
-type SttyProbeResult = { state: PtySlaveLineDisciplineEcho; permanent: boolean }
+function parseLineEditorState(sttyOutput: string): PtySlaveLineEditorState {
+  const echo = ECHO_FLAG.exec(sttyOutput)
+  const icanon = ICANON_FLAG.exec(sttyOutput)
+  if (!echo || !icanon) {
+    return 'unknown'
+  }
+  return echo[1] === '-' && icanon[1] === '-' && LNEXT_UNDEFINED.test(sttyOutput)
+    ? 'line-editor'
+    : 'other'
+}
+
+type SttyProbeResult = { stdout: string | null; permanent: boolean }
 
 /**
  * A spawn that never ran (`stty` absent) or a device that answered non-zero (reaped,
@@ -54,8 +71,8 @@ function runStty(ptsName: string, platform: NodeJS.Platform): Promise<SttyProbeR
       (error, stdout) => {
         resolve(
           error
-            ? { state: 'unknown', permanent: isPermanentSttyFailure(error) }
-            : { state: parseEchoFlag(stdout), permanent: false }
+            ? { stdout: null, permanent: isPermanentSttyFailure(error) }
+            : { stdout, permanent: false }
         )
       }
     )
@@ -83,6 +100,21 @@ export function createPtySlaveEchoProbe(
   ptsName: string | undefined,
   platform: NodeJS.Platform = process.platform
 ): PtySlaveEchoProbe | undefined {
+  return createSttyProbe(ptsName, platform, parseEchoFlag)
+}
+
+export function createPtySlaveLineEditorProbe(
+  ptsName: string | undefined,
+  platform: NodeJS.Platform = process.platform
+): PtySlaveLineEditorProbe | undefined {
+  return createSttyProbe(ptsName, platform, parseLineEditorState)
+}
+
+function createSttyProbe<T extends string>(
+  ptsName: string | undefined,
+  platform: NodeJS.Platform,
+  parse: (output: string) => T | 'unknown'
+): (() => Promise<T | 'unknown'>) | undefined {
   if (platform === 'win32' || !ptsName) {
     return undefined
   }
@@ -101,6 +133,6 @@ export function createPtySlaveEchoProbe(
     })
     const result = await inFlight
     unavailable = result.permanent
-    return result.state
+    return result.stdout === null ? 'unknown' : parse(result.stdout)
   }
 }
diff --git a/src/shared/remote-runtime-client.test.ts b/src/shared/remote-runtime-client.test.ts
index 9ead47f4067..4c3bfba011e 100644
--- a/src/shared/remote-runtime-client.test.ts
+++ b/src/shared/remote-runtime-client.test.ts
@@ -35,6 +35,25 @@ afterEach(async () => {
 })
 
 describe('subscribeRemoteRuntimeRequest', () => {
+  it('serializes the expected runtime fence on subscription requests', async () => {
+    const server = await createSubscriptionServer()
+    const subscription = await subscribeRemoteRuntimeRequest(
+      server.pairing,
+      'terminal.subscribe',
+      {},
+      1000,
+      { onResponse: vi.fn(), onError: vi.fn() },
+      undefined,
+      { expectedRuntimeId: 'runtime-1' }
+    )
+
+    await expect(server.nextRequest).resolves.toMatchObject({
+      method: 'terminal.subscribe',
+      expectedRuntimeId: 'runtime-1'
+    })
+    subscription.close()
+  })
+
   it('includes WebSocket close details when subscription admission is rejected', async () => {
     const server = await createClosingServer(1013, 'Maximum connections reached')
 
@@ -335,6 +354,7 @@ async function createSubscriptionServer(
   pairing: PairingOffer
   nextBinary: Promise<Uint8Array>
   nextAuth: Promise<unknown>
+  nextRequest: Promise<Record<string, unknown>>
 }> {
   const serverKeyPair = generateKeyPair()
   let resolveBinary: (bytes: Uint8Array) => void = () => {}
@@ -345,6 +365,10 @@ async function createSubscriptionServer(
   const nextAuth = new Promise<unknown>((resolve) => {
     resolveAuth = resolve
   })
+  let resolveRequest: (request: Record<string, unknown>) => void = () => {}
+  const nextRequest = new Promise<Record<string, unknown>>((resolve) => {
+    resolveRequest = resolve
+  })
   const wss = new WebSocketServer({ port: 0, autoPong: options.disableAutoPong !== true })
   servers.push(wss)
 
@@ -386,7 +410,8 @@ async function createSubscriptionServer(
         return
       }
 
-      const request = JSON.parse(plaintext) as { id: string }
+      const request = JSON.parse(plaintext) as { id: string } & Record<string, unknown>
+      resolveRequest(request)
       sendEncrypted(ws, sharedKey, {
         id: request.id,
         ok: true,
@@ -419,7 +444,7 @@ async function createSubscriptionServer(
   if (!pairing) {
     throw new Error('Failed to create test pairing')
   }
-  return { pairing, nextBinary, nextAuth }
+  return { pairing, nextBinary, nextAuth, nextRequest }
 }
 
 function sendEncrypted(ws: WebSocket, sharedKey: Uint8Array, message: unknown): void {
diff --git a/src/shared/remote-runtime-client.ts b/src/shared/remote-runtime-client.ts
index c53565dc8a2..3b308724b57 100644
--- a/src/shared/remote-runtime-client.ts
+++ b/src/shared/remote-runtime-client.ts
@@ -497,14 +497,16 @@ export async function subscribeRemoteRuntimeRequest<TResult>(
   params: unknown,
   timeoutMs: number,
   callbacks: RemoteRuntimeSubscriptionCallbacks<TResult>,
-  livenessOptions?: RemoteRuntimeSocketLivenessOptions
+  livenessOptions?: RemoteRuntimeSocketLivenessOptions,
+  envelope?: RuntimeOrchestrationEnvelope
 ): Promise<RemoteRuntimeSubscription> {
   const requestId = randomUUID()
   const serializedRequest = serializeRemoteRuntimeRpcRequest({
     requestId,
     deviceToken: pairing.deviceToken,
     method,
-    params
+    params,
+    envelope
   })
   const serializedAuth = serializeRemoteRuntimePayload({
     type: 'e2ee_auth',
diff --git a/src/shared/remote-runtime-memory-limits.ts b/src/shared/remote-runtime-memory-limits.ts
index a41409ffdfe..8b5ce04cc56 100644
--- a/src/shared/remote-runtime-memory-limits.ts
+++ b/src/shared/remote-runtime-memory-limits.ts
@@ -71,6 +71,7 @@ export function serializeRemoteRuntimeRpcRequest(args: {
     deviceToken: args.deviceToken,
     method: args.method,
     params: args.params,
+    expectedRuntimeId: args.envelope?.expectedRuntimeId,
     orchestrationCapability: args.envelope?.orchestrationCapability,
     orchestrationContractVersion: args.envelope?.orchestrationContractVersion,
     orchestrationRequestId: args.envelope?.orchestrationRequestId,
diff --git a/src/shared/remote-runtime-shared-control-admission.ts b/src/shared/remote-runtime-shared-control-admission.ts
index e526ba1bb95..f6638ed7f63 100644
--- a/src/shared/remote-runtime-shared-control-admission.ts
+++ b/src/shared/remote-runtime-shared-control-admission.ts
@@ -12,6 +12,7 @@ export function admitSharedControlSubscription(args: {
   deviceToken: string
   method: string
   params: unknown
+  expectedRuntimeId?: string
 }): number {
   if (args.subscriptions.size >= REMOTE_RUNTIME_MAX_SUBSCRIPTIONS) {
     throw new RemoteRuntimeClientError(
@@ -33,12 +34,18 @@ export function admitSharedControlSubscription(args: {
   return retainedParamsBytes
 }
 
-function serializeRequest(args: { deviceToken: string; method: string; params: unknown }): void {
+function serializeRequest(args: {
+  deviceToken: string
+  method: string
+  params: unknown
+  expectedRuntimeId?: string
+}): void {
   serializeRemoteRuntimeRpcRequest({
     requestId: '00000000-0000-4000-8000-000000000000',
     deviceToken: args.deviceToken,
     method: args.method,
-    params: args.params
+    params: args.params,
+    envelope: { expectedRuntimeId: args.expectedRuntimeId }
   })
 }
 
diff --git a/src/shared/remote-runtime-shared-control-connection.ts b/src/shared/remote-runtime-shared-control-connection.ts
index 4fb40525245..93925ccf15e 100644
--- a/src/shared/remote-runtime-shared-control-connection.ts
+++ b/src/shared/remote-runtime-shared-control-connection.ts
@@ -37,7 +37,7 @@ export class RemoteRuntimeSharedControlConnection {
   private sharedKey: Uint8Array | null = null
   private socketCleanup: (() => void) | null = null
   private readonly reconnect = new SharedControlReconnectScheduler()
-  private readonly readyStableReset: SharedControlReadyStableResetTimer
+  private readonly stableReset: SharedControlReadyStableResetTimer
   private intentionallyClosed = false
   private lastConnectedAt: number | null = null
   private lastClose: { code: number; reason: string } | null = null
@@ -51,15 +51,13 @@ export class RemoteRuntimeSharedControlConnection {
 
   constructor(
     private readonly pairing: PairingOffer,
-    private readonly options: {
+    private readonly opts: {
       environmentId?: string
       reconnectStableResetMs?: number
       liveness?: RemoteRuntimeSocketLivenessOptions
     } = {}
   ) {
-    this.readyStableReset = new SharedControlReadyStableResetTimer(
-      options.reconnectStableResetMs ?? 30_000
-    )
+    this.stableReset = new SharedControlReadyStableResetTimer(opts.reconnectStableResetMs ?? 30_000)
   }
 
   request<TResult>(
@@ -85,13 +83,15 @@ export class RemoteRuntimeSharedControlConnection {
     method: string,
     params: unknown,
     timeoutMs: number,
-    callbacks: SharedControlSubscriptionCallbacks<TResult>
+    callbacks: SharedControlSubscriptionCallbacks<TResult>,
+    expectedRuntimeId?: string
   ): Promise<RemoteRuntimeSharedSubscription> {
     return startSharedControlSubscription({
       subscriptions: this.subscriptions,
       deviceToken: this.pairing.deviceToken,
       method,
       params,
+      expectedRuntimeId,
       callbacks,
       ensureReady: () => this.ensureReadyWithTimeout(timeoutMs),
       sendSubscription: (subscription) => this.sendSubscription(subscription),
@@ -182,7 +182,7 @@ export class RemoteRuntimeSharedControlConnection {
       onError: (error) => this.handleSocketClosed(error, socketGeneration),
       onTextFrame: (frame) => this.handleTextFrame(frame, socketGeneration),
       liveness: {
-        options: this.options.liveness,
+        options: this.opts.liveness,
         onDead: (error) => this.handleSocketClosed(error, socketGeneration)
       }
     })
@@ -204,7 +204,7 @@ export class RemoteRuntimeSharedControlConnection {
       frame,
       state: this.state,
       sharedKey: this.sharedKey,
-      environmentId: this.options.environmentId,
+      environmentId: this.opts.environmentId,
       deviceToken: this.pairing.deviceToken,
       pendingRequests: this.pendingRequests,
       subscriptions: this.subscriptions,
@@ -217,7 +217,7 @@ export class RemoteRuntimeSharedControlConnection {
       sendEncrypted: (payload) => this.sendEncrypted(payload),
       markReady: () => {
         this.lastConnectedAt = Date.now()
-        this.readyStableReset.schedule({
+        this.stableReset.schedule({
           getState: () => this.state,
           getSocket: () => this.ws,
           reset: () => this.reconnect.resetAttempt()
@@ -301,7 +301,7 @@ export class RemoteRuntimeSharedControlConnection {
 
   private closeSocket(error?: Error, preserveReadyWaitersAndPendingRequests = false): void {
     closeSharedControlSocket({
-      environmentId: this.options.environmentId,
+      environmentId: this.opts.environmentId,
       state: this.state,
       pendingRequests: this.pendingRequests,
       subscriptions: this.subscriptions,
@@ -311,7 +311,7 @@ export class RemoteRuntimeSharedControlConnection {
       ws: this.ws,
       error,
       preserveReadyWaitersAndPendingRequests,
-      clearReadyStableTimer: () => this.readyStableReset.clear()
+      clearReadyStableTimer: () => this.stableReset.clear()
     })
     this.ws = this.sharedKey = null
     this.socketCleanup = null
diff --git a/src/shared/remote-runtime-shared-control-ready.ts b/src/shared/remote-runtime-shared-control-ready.ts
index 23461245d0d..9d0a92c500c 100644
--- a/src/shared/remote-runtime-shared-control-ready.ts
+++ b/src/shared/remote-runtime-shared-control-ready.ts
@@ -37,7 +37,7 @@ export function waitForSharedControlReadyWithTimeout(args: {
       }
       settled = true
       const index = args.readyWaiters.indexOf(waiter)
-      if (index >= 0) {
+      if (index !== -1) {
         args.readyWaiters.splice(index, 1)
       }
       reject(remoteRuntimeUnavailableError())
@@ -65,7 +65,7 @@ export function waitForSharedControlReadyWithTimeout(args: {
       args.open()
     } catch (error) {
       const index = args.readyWaiters.indexOf(waiter)
-      if (index >= 0) {
+      if (index !== -1) {
         args.readyWaiters.splice(index, 1)
       }
       waiter.reject(error instanceof Error ? error : remoteRuntimeUnavailableError(String(error)))
diff --git a/src/shared/remote-runtime-shared-control-send.ts b/src/shared/remote-runtime-shared-control-send.ts
index 2a7ff16cfa5..1862751cd6b 100644
--- a/src/shared/remote-runtime-shared-control-send.ts
+++ b/src/shared/remote-runtime-shared-control-send.ts
@@ -36,7 +36,8 @@ export function sendSharedControlSubscription(args: {
       id: args.subscription.requestId,
       deviceToken: args.deviceToken,
       method: args.subscription.method,
-      params: args.subscription.params
+      params: args.subscription.params,
+      expectedRuntimeId: args.subscription.expectedRuntimeId
     })
   ) {
     args.subscription.sent = true
diff --git a/src/shared/remote-runtime-shared-control-subscription-start.ts b/src/shared/remote-runtime-shared-control-subscription-start.ts
index 2b22aaabc5b..1cc4a91a5a8 100644
--- a/src/shared/remote-runtime-shared-control-subscription-start.ts
+++ b/src/shared/remote-runtime-shared-control-subscription-start.ts
@@ -14,6 +14,7 @@ export async function startSharedControlSubscription<TResult>(args: {
   deviceToken: string
   method: string
   params: unknown
+  expectedRuntimeId?: string
   callbacks: SharedControlSubscriptionCallbacks<TResult>
   ensureReady: () => Promise<void>
   sendSubscription: (subscription: SharedControlLogicalSubscription<unknown>) => void
@@ -23,13 +24,15 @@ export async function startSharedControlSubscription<TResult>(args: {
     subscriptions: args.subscriptions,
     deviceToken: args.deviceToken,
     method: args.method,
-    params: args.params
+    params: args.params,
+    expectedRuntimeId: args.expectedRuntimeId
   })
   const requestId = randomUUID()
   const subscription = createSharedControlSubscription({
     requestId,
     method: args.method,
     params: args.params,
+    expectedRuntimeId: args.expectedRuntimeId,
     retainedParamsBytes,
     callbacks: args.callbacks
   })
diff --git a/src/shared/remote-runtime-shared-control-subscriptions.test.ts b/src/shared/remote-runtime-shared-control-subscriptions.test.ts
index de5d5718b55..b61b2eff34e 100644
--- a/src/shared/remote-runtime-shared-control-subscriptions.test.ts
+++ b/src/shared/remote-runtime-shared-control-subscriptions.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { RuntimeRpcResponse } from './runtime-rpc-envelope'
+import { sendSharedControlSubscription } from './remote-runtime-shared-control-send'
 import {
   closeSharedControlLogicalSubscription,
   createSharedControlSubscription,
@@ -33,6 +34,39 @@ function okResponse(subscriptionId: string): RuntimeRpcResponse<unknown> {
 }
 
 describe('closeSharedControlLogicalSubscription — replay-window leak', () => {
+  it('preserves the runtime fence when reconnect replay resends a subscription', () => {
+    const subscriptions = new Map<string, SharedControlLogicalSubscription<unknown>>()
+    const subscription = createSharedControlSubscription({
+      requestId: 'req-fenced',
+      method: 'runtime.clientEvents.subscribe',
+      params: null,
+      expectedRuntimeId: 'runtime-1',
+      retainedParamsBytes: 0,
+      callbacks: { onResponse: vi.fn(), onError: vi.fn() }
+    })
+    subscriptions.set(subscription.requestId, subscription)
+    const payloads: unknown[] = []
+    const send = (current: SharedControlLogicalSubscription<unknown>): void =>
+      sendSharedControlSubscription({
+        subscriptions,
+        subscription: current,
+        deviceToken: 'device-token',
+        send: (payload) => {
+          payloads.push(payload)
+          return true
+        }
+      })
+
+    send(subscription)
+    replaySharedControlSubscriptions({ subscriptions, send })
+
+    expect(payloads).toHaveLength(2)
+    expect(payloads).toEqual([
+      expect.objectContaining({ expectedRuntimeId: 'runtime-1' }),
+      expect.objectContaining({ expectedRuntimeId: 'runtime-1' })
+    ])
+  })
+
   it('sends the unsubscribe when closed after an established subscribe replay completes', () => {
     const { subscriptions, subscription } = makeSubscriptions()
     // First establishment: server assigned a concrete subscription id.
diff --git a/src/shared/remote-runtime-shared-control-subscriptions.ts b/src/shared/remote-runtime-shared-control-subscriptions.ts
index 4a93076d23f..92da86bcd5d 100644
--- a/src/shared/remote-runtime-shared-control-subscriptions.ts
+++ b/src/shared/remote-runtime-shared-control-subscriptions.ts
@@ -14,6 +14,7 @@ export function createSharedControlSubscription<TResult>(args: {
   requestId: string
   method: string
   params: unknown
+  expectedRuntimeId?: string
   retainedParamsBytes: number
   callbacks: SharedControlSubscriptionCallbacks<TResult>
 }): SharedControlLogicalSubscription<TResult> {
@@ -21,6 +22,7 @@ export function createSharedControlSubscription<TResult>(args: {
     requestId: args.requestId,
     method: args.method,
     params: args.params,
+    expectedRuntimeId: args.expectedRuntimeId,
     retainedParamsBytes: args.retainedParamsBytes,
     callbacks: args.callbacks,
     sent: false,
diff --git a/src/shared/remote-runtime-shared-control-types.ts b/src/shared/remote-runtime-shared-control-types.ts
index c6e55134762..592fdc47168 100644
--- a/src/shared/remote-runtime-shared-control-types.ts
+++ b/src/shared/remote-runtime-shared-control-types.ts
@@ -33,6 +33,7 @@ export type SharedControlLogicalSubscription<TResult = unknown> = {
   requestId: string
   method: string
   params: unknown
+  expectedRuntimeId?: string
   retainedParamsBytes: number
   callbacks: SharedControlSubscriptionCallbacks<TResult>
   sent: boolean
diff --git a/src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts b/src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts
new file mode 100644
index 00000000000..6156489a567
--- /dev/null
+++ b/src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts
@@ -0,0 +1,99 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  clearWorkingIndicators,
+  createAgentStatusTracker,
+  detectAgentStatusFromTitle,
+  getAgentLabel,
+  isClaudeAgent
+} from './agent-detection'
+import { isDecorativeAgentTitleFrameChange } from './agent-decorative-title-signature'
+import { stripLeadingAgentTitleDecoration } from './agent-title-decoration'
+import { resolveExplicitTerminalTitleAgentType } from './terminal-title-agent-type'
+
+// Titles captured from real `claude` binaries running the same one-line prompt.
+// 2.1.228 swapped the busy spinner from braille to quarter circles, which read as
+// "no agent" and made the tracker report a confirmed exit mid-turn (#13889).
+const BUSY_2_1_227 = ['⠂ Claude Code', '⠐ Claude Code', '⠂ Say hi in one word'] as const
+const BUSY_2_1_228 = ['◐ Claude Code', '◑ Claude Code', '◑ Say hi in one word'] as const
+
+const CAPTURED_2_1_228_TURN = [
+  '✳ Claude Code',
+  '◐ Claude Code',
+  '◑ Claude Code',
+  '◑ Say hi in one word',
+  '◐ Say hi in one word',
+  '✳ Say hi in one word'
+] as const
+
+function trackTurn(titles: readonly string[]): string[] {
+  const events: string[] = []
+  const tracker = createAgentStatusTracker(
+    () => events.push('idle'),
+    () => events.push('working'),
+    () => events.push('exited')
+  )
+  for (const title of titles) {
+    tracker.handleTitle(title)
+  }
+  return events
+}
+
+describe('Claude Code quarter-circle busy titles (#13889)', () => {
+  it('reports working for every quarter-circle spinner frame', () => {
+    for (const title of ['◐ Claude Code', '◑ Claude Code', '◒ Claude Code', '◓ Claude Code']) {
+      expect(detectAgentStatusFromTitle(title)).toBe('working')
+    }
+  })
+
+  it('reports working when the busy title carries task text instead of the agent name', () => {
+    // Why: the summary-bearing frame has no "claude" token, so it previously fell
+    // through to null — the value the tracker reads as an exit.
+    expect(detectAgentStatusFromTitle('◐ Say hi in one word')).toBe('working')
+  })
+
+  it('keeps Claude identity while busy', () => {
+    for (const title of BUSY_2_1_228) {
+      expect(isClaudeAgent(title)).toBe(true)
+      expect(getAgentLabel(title)).toBe('Claude Code')
+    }
+  })
+
+  it('matches 2.1.227 status and identity frame for frame', () => {
+    BUSY_2_1_228.forEach((title, index) => {
+      const braille = BUSY_2_1_227[index]
+      expect(detectAgentStatusFromTitle(title)).toBe(detectAgentStatusFromTitle(braille))
+      expect(getAgentLabel(title)).toBe(getAgentLabel(braille))
+      expect(resolveExplicitTerminalTitleAgentType(title)).toBe(
+        resolveExplicitTerminalTitleAgentType(braille)
+      )
+    })
+  })
+
+  it('never confirms an agent exit across a real 2.1.228 turn', () => {
+    const events = trackTurn(CAPTURED_2_1_228_TURN)
+    expect(events).not.toContain('exited')
+    expect(events).toEqual(['working', 'idle'])
+  })
+
+  it('tracks the 2.1.228 turn exactly like the 2.1.227 turn', () => {
+    const brailleTurn = CAPTURED_2_1_228_TURN.map((title) =>
+      title.replace('◐', '⠂').replace('◑', '⠐')
+    )
+    expect(trackTurn(CAPTURED_2_1_228_TURN)).toEqual(trackTurn(brailleTurn))
+  })
+
+  it('strips the spinner from stale exit titles and displayed labels', () => {
+    expect(clearWorkingIndicators('◐ Say hi in one word')).toBe('Say hi in one word')
+    expect(stripLeadingAgentTitleDecoration('◐ Claude Code')).toBe('Claude Code')
+  })
+
+  it('treats a spinner tick as decoration, not a title change', () => {
+    expect(isDecorativeAgentTitleFrameChange('◐ Say hi', '◑ Say hi')).toBe(true)
+  })
+
+  it('does not claim Gemini’s ◇ idle glyph, which neighbors the spinner block', () => {
+    expect(detectAgentStatusFromTitle('◇ Gemini CLI')).toBe('idle')
+    expect(getAgentLabel('◇ Gemini CLI')).toBe('Gemini CLI')
+  })
+})
diff --git a/src/shared/runtime-rpc-envelope.ts b/src/shared/runtime-rpc-envelope.ts
index d407de72cb9..38cbc4659b1 100644
--- a/src/shared/runtime-rpc-envelope.ts
+++ b/src/shared/runtime-rpc-envelope.ts
@@ -76,6 +76,8 @@ export type RuntimeRpcFailure = {
 export type RuntimeRpcResponse<TResult> = RuntimeRpcSuccess<TResult> | RuntimeRpcFailure
 
 export type RuntimeOrchestrationEnvelope = {
+  /** Reject before dispatch when the request reaches a replacement runtime. */
+  expectedRuntimeId?: string
   orchestrationCapability?: string
   orchestrationContractVersion?: number
   orchestrationRequestId?: string
diff --git a/src/shared/runtime-types.ts b/src/shared/runtime-types.ts
index af02b02e484..079a416749a 100644
--- a/src/shared/runtime-types.ts
+++ b/src/shared/runtime-types.ts
@@ -404,12 +404,19 @@ export type RuntimeTerminalPathOpenTarget =
       provider: 'local' | 'ssh'
       absolutePath: string
       grantId: string
+      /** Present when the exact-path grant permits preview/read but not mutation. */
+      readOnly?: true
     }
   | {
       kind: 'unsupported'
       reason: string
     }
 
+export type RuntimeNativeChatFileContext = {
+  tabId: string
+  sessionId: string
+}
+
 /** Result of resolving a file path tapped in the mobile terminal against the
  *  selected or sibling workspace root (+ optional cwd). relativePath is null
  *  when no workspace on the same execution host owns the path. */
diff --git a/src/shared/secure-file-fsync-flags.test.ts b/src/shared/secure-file-fsync-flags.test.ts
new file mode 100644
index 00000000000..15505151aef
--- /dev/null
+++ b/src/shared/secure-file-fsync-flags.test.ts
@@ -0,0 +1,89 @@
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import type * as NodeFs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const openedPaths = vi.hoisted(
+  () => [] as { path: string; flags: string | number; ownerWritable: boolean }[]
+)
+
+vi.mock('node:fs', async () => {
+  const actual = await vi.importActual<typeof NodeFs>('node:fs')
+  return {
+    ...actual,
+    openSync: (path: NodeFs.PathLike, flags: string | number, mode?: NodeFs.Mode) => {
+      openedPaths.push({
+        path: String(path),
+        flags,
+        ownerWritable: Boolean(actual.statSync(path).mode & 0o200)
+      })
+      return actual.openSync(path, flags, mode)
+    }
+  }
+})
+
+import {
+  bestEffortFsyncDirectorySync,
+  fsyncFileSync,
+  writeDurableSecureJsonFile
+} from './secure-file'
+
+const createdPaths: string[] = []
+
+afterEach(() => {
+  openedPaths.length = 0
+  for (const path of createdPaths.splice(0)) {
+    rmSync(path, { recursive: true, force: true })
+  }
+})
+
+describe('secure file fsync flags', () => {
+  const windowsIt = process.platform === 'win32' ? it : it.skip
+  windowsIt('opens files read/write before fsync on Windows', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-file-fsync-'))
+    createdPaths.push(directory)
+    const path = join(directory, 'record.json')
+    writeFileSync(path, '{}')
+
+    fsyncFileSync(path)
+
+    expect(openedPaths).toMatchObject([{ path, flags: 'r+' }])
+  })
+
+  const posixIt = process.platform === 'win32' ? it.skip : it
+  posixIt('fsyncs files without owner-write permission', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-file-fsync-read-only-'))
+    createdPaths.push(directory)
+    const path = join(directory, 'record.json')
+    writeFileSync(path, '{}')
+    chmodSync(path, 0o400)
+
+    expect(() => fsyncFileSync(path)).not.toThrow()
+    expect(openedPaths).toEqual([{ path, flags: 'r', ownerWritable: false }])
+  })
+
+  posixIt('durably writes when umask removes owner-write from the temporary file', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-durable-file-fsync-read-only-'))
+    createdPaths.push(directory)
+    const path = join(directory, 'record.json')
+    const originalUmask = process.umask(0o200)
+
+    try {
+      expect(() => writeDurableSecureJsonFile(path, { ok: true })).not.toThrow()
+    } finally {
+      process.umask(originalUmask)
+    }
+
+    expect(openedPaths[0]).toMatchObject({ flags: 'r', ownerWritable: false })
+  })
+
+  posixIt('opens directories read-only before fsync', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-directory-fsync-'))
+    createdPaths.push(directory)
+
+    bestEffortFsyncDirectorySync(directory)
+
+    expect(openedPaths).toMatchObject([{ path: directory, flags: 'r' }])
+  })
+})
diff --git a/src/shared/secure-file.ts b/src/shared/secure-file.ts
index e3c38c70e09..639630c7c65 100644
--- a/src/shared/secure-file.ts
+++ b/src/shared/secure-file.ts
@@ -133,8 +133,8 @@ export function writeSecureFile(
   }
 }
 
-export function fsyncFileSync(path: string): void {
-  const descriptor = openSync(path, 'r')
+function fsyncPathSync(path: string, flags: 'r' | 'r+'): void {
+  const descriptor = openSync(path, flags)
   try {
     fsyncSync(descriptor)
   } finally {
@@ -142,12 +142,17 @@ export function fsyncFileSync(path: string): void {
   }
 }
 
+export function fsyncFileSync(path: string): void {
+  // FlushFileBuffers requires a write-capable handle on Windows.
+  fsyncPathSync(path, process.platform === 'win32' ? 'r+' : 'r')
+}
+
 export function bestEffortFsyncDirectorySync(directory: string): void {
   if (process.platform === 'win32') {
     return
   }
   try {
-    fsyncFileSync(directory)
+    fsyncPathSync(directory, 'r')
   } catch (error) {
     if (
       error instanceof Error &&
diff --git a/src/shared/setup-script-import-codex-environment.ts b/src/shared/setup-script-import-codex-environment.ts
index 77a8e48296d..d684d197497 100644
--- a/src/shared/setup-script-import-codex-environment.ts
+++ b/src/shared/setup-script-import-codex-environment.ts
@@ -136,7 +136,7 @@ function parseTomlMultilineString(
       remainder = lines[index]
     }
     const closeIndex = remainder.indexOf(delimiter)
-    if (closeIndex >= 0) {
+    if (closeIndex !== -1) {
       if (!oversized && !append(remainder.slice(0, closeIndex))) {
         oversized = true
       }
diff --git a/src/shared/setup-script-imports.ts b/src/shared/setup-script-imports.ts
index 5aa698d13d1..5c37b99dab0 100644
--- a/src/shared/setup-script-imports.ts
+++ b/src/shared/setup-script-imports.ts
@@ -186,7 +186,7 @@ function resolveSupersetScriptValue(
   }
 
   for (const field in localRecord) {
-    if (!Object.prototype.hasOwnProperty.call(localRecord, field)) {
+    if (!Object.hasOwn(localRecord, field)) {
       continue
     }
     if (field !== 'before' && field !== 'after') {
@@ -283,7 +283,7 @@ function collectUnsupportedCmuxCommandFields(
   const supportedFields = new Set(['name', 'title', 'description', 'keywords', 'command'])
   const unsupportedFields: string[] = []
   for (const field in command) {
-    if (!Object.prototype.hasOwnProperty.call(command, field)) {
+    if (!Object.hasOwn(command, field)) {
       continue
     }
     if (!supportedFields.has(field)) {
diff --git a/src/shared/shell-process-readiness.test.ts b/src/shared/shell-process-readiness.test.ts
new file mode 100644
index 00000000000..9c3abad9783
--- /dev/null
+++ b/src/shared/shell-process-readiness.test.ts
@@ -0,0 +1,73 @@
+import { mkdir, mkdtemp, rm, symlink } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { parseDarwinExecutablePath, resolveShellExecutablePath } from './shell-process-readiness'
+
+describe('shell process readiness', () => {
+  it('extracts the primary text image from macOS lsof output', () => {
+    expect(parseDarwinExecutablePath('p42\nftxt\nn/bin/zsh\nftxt\nn/usr/lib/zsh/zle.so\n')).toBe(
+      '/bin/zsh'
+    )
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'resolves bare shell commands through the spawn PATH',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-shell-path-'))
+      const link = join(root, 'shell-name')
+      await symlink(process.execPath, link)
+      try {
+        await expect(resolveShellExecutablePath('shell-name', dirname(root), root)).resolves.toBe(
+          await resolveShellExecutablePath(process.execPath, dirname(root), root)
+        )
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'uses the POSIX exec default when PATH is unset',
+    async () => {
+      await expect(resolveShellExecutablePath('sh', process.cwd(), undefined)).resolves.toBe(
+        await resolveShellExecutablePath('/bin/sh', process.cwd(), '')
+      )
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'resolves relative shell paths against the PTY cwd',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-relative-shell-'))
+      const bin = join(root, 'bin')
+      await symlink(dirname(process.execPath), bin)
+      try {
+        await expect(
+          resolveShellExecutablePath(`./bin/${basename(process.execPath)}`, root, '')
+        ).resolves.toBe(await resolveShellExecutablePath(process.execPath, root, ''))
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'skips searchable directories that shadow a later PATH executable',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-shadowed-shell-'))
+      const first = join(root, 'first')
+      const second = join(root, 'second')
+      await mkdir(join(first, 'shell-name'), { recursive: true })
+      await mkdir(second)
+      await symlink(process.execPath, join(second, 'shell-name'))
+      try {
+        await expect(
+          resolveShellExecutablePath('shell-name', root, `${first}:${second}`)
+        ).resolves.toBe(await resolveShellExecutablePath(process.execPath, root, ''))
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/shared/shell-process-readiness.ts b/src/shared/shell-process-readiness.ts
new file mode 100644
index 00000000000..2a631dcd82e
--- /dev/null
+++ b/src/shared/shell-process-readiness.ts
@@ -0,0 +1,80 @@
+import { execFile as execFileCallback } from 'node:child_process'
+import { constants } from 'node:fs'
+import { access, readlink, realpath, stat } from 'node:fs/promises'
+import { delimiter, isAbsolute, resolve } from 'node:path'
+import { promisify } from 'node:util'
+
+const execFile = promisify(execFileCallback)
+const PROCESS_READINESS_TIMEOUT_MS = 3000
+const DEFAULT_POSIX_EXEC_PATH = '/usr/bin:/bin'
+
+export type ShellProcessReadiness = {
+  executablePath: string
+  foreground: boolean
+}
+
+export function parseDarwinExecutablePath(stdout: string): string | null {
+  const lines = stdout.split(/\r?\n/)
+  const textIndex = lines.indexOf('ftxt')
+  const pathLine = textIndex === -1 ? undefined : lines[textIndex + 1]
+  return pathLine?.startsWith('n') ? pathLine.slice(1) : null
+}
+
+async function readExecutablePath(pid: number): Promise<string | null> {
+  if (process.platform === 'linux') {
+    return readlink(`/proc/${pid}/exe`)
+  }
+  if (process.platform !== 'darwin') {
+    return null
+  }
+  const { stdout } = await execFile(
+    '/usr/sbin/lsof',
+    ['-a', '-p', String(pid), '-d', 'txt', '-Fn'],
+    {
+      encoding: 'utf8',
+      timeout: PROCESS_READINESS_TIMEOUT_MS
+    }
+  )
+  return parseDarwinExecutablePath(stdout)
+}
+
+export async function readShellProcessReadiness(
+  pid: number
+): Promise<ShellProcessReadiness | null> {
+  const [executablePath, { stdout }] = await Promise.all([
+    readExecutablePath(pid),
+    execFile('ps', ['-p', String(pid), '-o', 'stat='], {
+      encoding: 'utf8',
+      timeout: PROCESS_READINESS_TIMEOUT_MS
+    })
+  ])
+  const status = stdout.trim()
+  return status && executablePath
+    ? { executablePath: await realpath(executablePath), foreground: status.includes('+') }
+    : null
+}
+
+export async function resolveShellExecutablePath(
+  shellPath: string,
+  cwd: string,
+  pathEnv: string | undefined
+): Promise<string | null> {
+  const candidates = shellPath.includes('/')
+    ? [isAbsolute(shellPath) ? shellPath : resolve(cwd, shellPath)]
+    : (
+        pathEnv ??
+        (process.platform === 'win32' ? (process.env.PATH ?? '') : DEFAULT_POSIX_EXEC_PATH)
+      )
+        .split(delimiter)
+        .map((entry) => resolve(isAbsolute(entry) ? entry : resolve(cwd, entry), shellPath))
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants.X_OK)
+      const canonicalPath = await realpath(candidate)
+      if ((await stat(canonicalPath)).isFile()) {
+        return canonicalPath
+      }
+    } catch {}
+  }
+  return null
+}
diff --git a/src/shared/skills.ts b/src/shared/skills.ts
index c908954d3a9..381ebf6eb3a 100644
--- a/src/shared/skills.ts
+++ b/src/shared/skills.ts
@@ -51,6 +51,9 @@ export type SkillDiscoveryTarget = {
    *  when the caller (e.g. a remote client) cannot supply `projectRuntime`. */
   worktreeId?: string | null
   projectRuntime?: ProjectExecutionRuntimeResolution
+  /** Bypass the host's shared scans because the caller knows disk just changed.
+   *  Optional so an older host simply ignores it and scans as it always did. */
+  refresh?: boolean
 }
 
 const ResolvedProjectRuntimeSchema = z.object({
@@ -100,7 +103,8 @@ export const SkillDiscoveryTargetSchema: z.ZodType<SkillDiscoveryTarget> = z.obj
   worktreeId: z.string().nullable().optional(),
   projectRuntime: z
     .discriminatedUnion('status', [ResolvedProjectRuntimeSchema, RepairProjectRuntimeSchema])
-    .optional()
+    .optional(),
+  refresh: z.boolean().optional()
 })
 
 export type SkillFrontmatterSummary = {
diff --git a/src/shared/source-control-ai-actions.ts b/src/shared/source-control-ai-actions.ts
index 8b1a8acb636..19dc70aa652 100644
--- a/src/shared/source-control-ai-actions.ts
+++ b/src/shared/source-control-ai-actions.ts
@@ -195,7 +195,7 @@ export function renderSourceControlActionCommandTemplate(
       // Why: placeholder names may start with letters or underscores.
       // Why: only own keys are real variables; inherited Object.prototype names
       // (e.g. `constructor`) must stay visible instead of rendering their value.
-      if (!Object.prototype.hasOwnProperty.call(variables, name)) {
+      if (!Object.hasOwn(variables, name)) {
         return match
       }
       const value = variables[name]
diff --git a/src/shared/source-control-ai.ts b/src/shared/source-control-ai.ts
index 2ca3541916a..7445ee5b874 100644
--- a/src/shared/source-control-ai.ts
+++ b/src/shared/source-control-ai.ts
@@ -194,7 +194,7 @@ function normalizeOperationRecord<T>(
   }
   const normalized: Partial<Record<SourceControlAiOperation, T>> = {}
   for (const operation of SOURCE_CONTROL_AI_OPERATIONS) {
-    if (!Object.prototype.hasOwnProperty.call(value, operation)) {
+    if (!Object.hasOwn(value, operation)) {
       continue
     }
     const normalizedValue = normalizeValue(value[operation])
@@ -214,7 +214,7 @@ function normalizeActionRecord<T>(
   }
   const normalized: Partial<Record<SourceControlActionId, T>> = {}
   for (const actionId of SOURCE_CONTROL_ACTION_IDS) {
-    if (!Object.prototype.hasOwnProperty.call(value, actionId)) {
+    if (!Object.hasOwn(value, actionId)) {
       continue
     }
     const normalizedValue = normalizeValue(value[actionId])
@@ -388,7 +388,7 @@ function legacyPromptFromCommandTemplate(
 function hasActionAgentRecipe(recipe: {
   agentId?: TuiAgent | CustomAgentId | null
 }): recipe is { agentId: TuiAgent | CustomAgentId | null } {
-  return Object.prototype.hasOwnProperty.call(recipe, 'agentId')
+  return Object.hasOwn(recipe, 'agentId')
 }
 
 function legacyCommitMessageCoreChanges(
@@ -541,7 +541,7 @@ function mergeLegacyModelSelectionDelta<T>(
   let changed = false
   const keys = new Set([...Object.keys(legacy ?? {}), ...Object.keys(projected ?? {})])
   for (const key of keys) {
-    const legacyHasKey = Object.prototype.hasOwnProperty.call(legacy ?? {}, key)
+    const legacyHasKey = Object.hasOwn(legacy ?? {}, key)
     const legacyValue = legacy?.[key]
     if (JSON.stringify(projected?.[key]) === JSON.stringify(legacyValue)) {
       continue
@@ -994,7 +994,7 @@ function hasOwnInstruction(
   instructions: Partial<Record<SourceControlAiOperation, string | null>> | null | undefined,
   operation: SourceControlAiOperation
 ): boolean {
-  return Object.prototype.hasOwnProperty.call(instructions ?? {}, operation)
+  return Object.hasOwn(instructions ?? {}, operation)
 }
 
 function readRepoInstructionOverride(
diff --git a/src/shared/ssh-pty-failure-tokens.ts b/src/shared/ssh-pty-failure-tokens.ts
new file mode 100644
index 00000000000..8ef34620709
--- /dev/null
+++ b/src/shared/ssh-pty-failure-tokens.ts
@@ -0,0 +1,76 @@
+// Why shared: main publishes these tokens and the renderer decides whether to
+// respawn on them. They lived in two places, and the copies disagreed about
+// what an identity mismatch meant — main marked it, the renderer ignored the
+// mark and respawned a live shell. One definition, so a change reaches both.
+
+import { isRelayAttestedPtyIncarnationId } from './pty-incarnation'
+
+/** The host proved the session is gone. Callers may respawn. */
+export const SSH_SESSION_EXPIRED_ERROR = 'SSH_SESSION_EXPIRED'
+
+/** The relay FOUND the pty and its recorded pane differs, so the shell is
+ *  running. The relay words this as "not found", which is why matching on that
+ *  phrasing alone reads a live shell as a dead one. Never grounds a respawn. */
+export const SSH_PTY_IDENTITY_MISMATCH_ERROR = 'SSH_PTY_IDENTITY_MISMATCH'
+
+/** The shell is alive; only its output source must be re-established. */
+export const SSH_SOURCE_RESTORE_REQUIRED_ERROR = 'SSH_SOURCE_RESTORE_REQUIRED'
+
+/** The relay WATCHED this exit, so it proves death — unlike an unknown id, which a replacement
+ *  relay also answers for shells still running. Worded to never read as `not found`, which older
+ *  clients map to expiry, and expiry authorizes a respawn. */
+export const SSH_PTY_EXITED_ERROR = 'SSH_PTY_EXITED'
+
+/** The carrier is the message: the relay's error transport drops structured payloads. */
+export function formatPtyExitedError(id: string, code: number, incarnationId: string): string {
+  return `${SSH_PTY_EXITED_ERROR}: ${encodeURIComponent(id)} code=${code} incarnation=${encodeURIComponent(incarnationId)}`
+}
+
+/** Whole grammar, not the token: this authorizes replacing a shell, so any text merely quoting the
+ *  token must not qualify. Fields are percent-encoded at the source, so none can forge the next. */
+const SSH_PTY_EXITED_MESSAGE = new RegExp(
+  `(?:^|[^A-Z_])${SSH_PTY_EXITED_ERROR}: ([^\\s]+) code=(-?\\d+) incarnation=([^\\s]+)`
+)
+
+export function isSshPtyExitedMessage(message: string): boolean {
+  return SSH_PTY_EXITED_MESSAGE.test(message)
+}
+
+/** The shell the proof names. Callers must check it themselves: the host applies the same rule, but
+ *  the host is the party whose answer is in question and versions differ. */
+export function parsePtyExitedError(
+  message: string
+): { id: string; code: number; incarnationId: string } | null {
+  const match = SSH_PTY_EXITED_MESSAGE.exec(message)
+  if (!match) {
+    return null
+  }
+  try {
+    return {
+      id: decodeURIComponent(match[1]!),
+      code: Number(match[2]),
+      incarnationId: decodeURIComponent(match[3]!)
+    }
+  } catch {
+    // Malformed encoding cannot be trusted to name a shell, so it names none.
+    return null
+  }
+}
+
+export function parseMatchingPtyExitedError(
+  message: string,
+  expectedId: string,
+  expectedIncarnationId: unknown
+): { id: string; code: number; incarnationId: string } | null {
+  const proof = parsePtyExitedError(message)
+  return proof &&
+    proof.id === expectedId &&
+    isRelayAttestedPtyIncarnationId(expectedIncarnationId) &&
+    proof.incarnationId === expectedIncarnationId
+    ? proof
+    : null
+}
+
+export function isSshPtyIdentityMismatchMessage(message: string): boolean {
+  return message.includes(SSH_PTY_IDENTITY_MISMATCH_ERROR) || /identity mismatch/i.test(message)
+}
diff --git a/src/shared/ssh-types.ts b/src/shared/ssh-types.ts
index fd6a9a3bcb0..d0125b0e317 100644
--- a/src/shared/ssh-types.ts
+++ b/src/shared/ssh-types.ts
@@ -203,6 +203,14 @@ export type SshRemotePtyLease = {
   updatedAt: number
   lastAttachedAt?: number
   lastDetachedAt?: number
+  /**
+   * The shell this record names, as the HOST identified it. `ptyId` alone cannot: a replaced relay
+   * restarts its ids at `pty-1`, so the same id can name somebody else's shell. Only a host-attested
+   * value is stored — a locally synthesized stand-in is not stable across reconnects and would read
+   * as a different shell. Absent on legacy rows and on hosts that report none, which stays
+   * adoption-eligible and must never act as a claim that subtracts a shell.
+   */
+  incarnationId?: string
 }
 
 /** Main-owned relay lease needed to reclaim PTY delivery after a desktop restart. */
diff --git a/src/shared/stable-pane-id.ts b/src/shared/stable-pane-id.ts
index a68117f3d74..47d973022bf 100644
--- a/src/shared/stable-pane-id.ts
+++ b/src/shared/stable-pane-id.ts
@@ -44,6 +44,18 @@ export function parsePaneKey(
   return { tabId, leafId, stablePaneId: leafId }
 }
 
+// Why: only the leaf UUID is remint-stable pane identity (the tab half changes on
+// pane break-out), while opaque legacy keys that do not parse have no safe
+// equivalence beyond exact equality.
+export function isEquivalentPaneKey(a: string, b: string): boolean {
+  if (a === b) {
+    return true
+  }
+  const aLeaf = parsePaneKey(a)?.leafId
+  const bLeaf = parsePaneKey(b)?.leafId
+  return Boolean(aLeaf && bLeaf && aLeaf === bLeaf)
+}
+
 export function parseLegacyNumericPaneKey(
   paneKey: unknown
 ): { tabId: string; numericPaneId: string; paneKey: string } | null {
diff --git a/src/shared/startup-command-submission.test.ts b/src/shared/startup-command-submission.test.ts
index 1006e63aa05..e25ee4c4105 100644
--- a/src/shared/startup-command-submission.test.ts
+++ b/src/shared/startup-command-submission.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import { buildStartupCommandSubmission } from './startup-command-submission'
+import {
+  buildStartupCommandSubmission,
+  isBracketedPasteSafeShell
+} from './startup-command-submission'
 
 describe('buildStartupCommandSubmission', () => {
   it('appends the submit byte to a single-line command unchanged', () => {
@@ -44,3 +47,22 @@ describe('buildStartupCommandSubmission', () => {
     ).toBe(`${command}\n`)
   })
 })
+
+describe('isBracketedPasteSafeShell', () => {
+  it('always trusts bash and zsh', () => {
+    for (const shellName of ['bash', 'zsh', 'BASH']) {
+      expect(isBracketedPasteSafeShell({ shellName, waitsForShellReady: false })).toBe(true)
+    }
+  })
+
+  it('trusts fish only behind the shell-ready barrier', () => {
+    expect(isBracketedPasteSafeShell({ shellName: 'fish', waitsForShellReady: true })).toBe(true)
+    expect(isBracketedPasteSafeShell({ shellName: 'fish', waitsForShellReady: false })).toBe(false)
+  })
+
+  it('rejects shells with no known bracketed-paste line editor', () => {
+    for (const shellName of ['sh', 'dash', 'nu', 'powershell.exe', '']) {
+      expect(isBracketedPasteSafeShell({ shellName, waitsForShellReady: true })).toBe(false)
+    }
+  })
+})
diff --git a/src/shared/startup-command-submission.ts b/src/shared/startup-command-submission.ts
index 7d97f59a271..33d84cd82b2 100644
--- a/src/shared/startup-command-submission.ts
+++ b/src/shared/startup-command-submission.ts
@@ -23,11 +23,33 @@ export type StartupCommandSubmissionOptions = {
    *  byte on `command` is preserved as-is. */
   submit: string
   /** Whether the target line editor has bracketed-paste mode active (Orca's
-   *  wrapped bash/zsh). Only wrap multiline payloads when true — a shell without
-   *  bracketed paste would echo the ESC[200~ markers as literal garbage. */
+   *  wrapped bash/zsh/fish). Only wrap multiline payloads when true — a shell
+   *  without bracketed paste would echo the ESC[200~ markers as literal garbage. */
   bracketedPasteSafe: boolean
 }
 
+/**
+ * Whether a spawned POSIX shell will read a bracketed-paste payload as one
+ * multiline command.
+ *
+ * Why fish needs the ready barrier: bash readline and zsh zle interpret the
+ * ESC[200~ wrapper out of their buffered input, but fish consumes bytes during
+ * its startup terminal-query handshake, so a payload written before its reader
+ * is up lands as literal `200~` text and the command never runs (verified
+ * against fish 4.7). Waiting for the shell-ready barrier is what makes fish
+ * paste-safe, and it is what the daemon and relay backends already require.
+ */
+export function isBracketedPasteSafeShell(args: {
+  shellName: string
+  waitsForShellReady: boolean
+}): boolean {
+  const name = args.shellName.toLowerCase()
+  if (name === 'bash' || name === 'zsh') {
+    return true
+  }
+  return name === 'fish' && args.waitsForShellReady
+}
+
 export function buildStartupCommandSubmission(
   command: string,
   { submit, bracketedPasteSafe }: StartupCommandSubmissionOptions
diff --git a/src/shared/terminal-file-link-conformance.ts b/src/shared/terminal-file-link-conformance.ts
index ec2ea0b9c64..d74af87eab2 100644
--- a/src/shared/terminal-file-link-conformance.ts
+++ b/src/shared/terminal-file-link-conformance.ts
@@ -13,7 +13,7 @@ export type TerminalFileLinkTapConformanceCase = {
 
 export function columnForTerminalFileLinkTap(testCase: TerminalFileLinkTapConformanceCase): number {
   const column = testCase.lineText.indexOf(testCase.tapText)
-  if (column < 0) {
+  if (column === -1) {
     throw new Error(`Tap text "${testCase.tapText}" not found in "${testCase.lineText}"`)
   }
   return column
diff --git a/src/shared/terminal-kitty-keyboard-flags.ts b/src/shared/terminal-kitty-keyboard-flags.ts
new file mode 100644
index 00000000000..c8c7fb735ed
--- /dev/null
+++ b/src/shared/terminal-kitty-keyboard-flags.ts
@@ -0,0 +1,13 @@
+/**
+ * Boundary validation for the optional `kittyKeyboardFlags` snapshot field
+ * shared by Electron IPC, remote JSON decoding, and tracker restore.
+ *
+ * Absent means the snapshot owner could not PROVE the state — an old remote
+ * host, an unsequenced renderer serializer, or a source with no mode metadata.
+ * That is not the same fact as a proven inactive protocol, so an unparseable
+ * value returns `undefined` rather than clamping or coercing to `0`; laundering
+ * it into known zero would make Preview commit raw text against a bit-3 TUI.
+ */
+export function parseTerminalKittyKeyboardFlags(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined
+}
diff --git a/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts b/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
index 9ad2cb4d77a..57bd58abe21 100644
--- a/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
+++ b/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
@@ -147,4 +147,151 @@ describe('TerminalKittyKeyboardModeTracker', () => {
     ranAndExited.scanReplay('\x1b[>1uoutput\x1b[<u')
     expect(ranAndExited.flags).toBe(0)
   })
+
+  // `flags` is the conservative input fallback and `snapshotFlags` is
+  // the provable fact. Collapsing them lets a snapshot that carried no kitty
+  // metadata be republished downstream as "the host proved kitty is inactive",
+  // which is exactly how a Preview on a bit-3 TUI ends up sending legacy text.
+  describe('snapshot provenance', () => {
+    it("separates a fresh PTY's known zero from a snapshot's unproven zero", () => {
+      const fresh = new TerminalKittyKeyboardModeTracker()
+      expect(fresh.flags).toBe(0)
+      expect(fresh.snapshotFlags).toBe(0)
+
+      fresh.resetForSnapshot()
+      expect(fresh.flags).toBe(0)
+      expect(fresh.snapshotFlags).toBeUndefined()
+    })
+
+    it('restores known 0 and known 8 onto the active screen', () => {
+      const inactive = new TerminalKittyKeyboardModeTracker()
+      inactive.resetForSnapshot()
+      inactive.restoreSnapshotFlags(0)
+      expect(inactive.snapshotFlags).toBe(0)
+
+      const negotiated = new TerminalKittyKeyboardModeTracker()
+      negotiated.resetForSnapshot()
+      negotiated.restoreSnapshotFlags(8)
+      expect(negotiated.flags).toBe(8)
+      expect(negotiated.snapshotFlags).toBe(8)
+    })
+
+    it('ignores values that are not non-negative safe integers', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      for (const invalid of [-1, 1.5, Number.NaN, Number.MAX_SAFE_INTEGER + 2]) {
+        tracker.restoreSnapshotFlags(invalid)
+        expect(tracker.snapshotFlags).toBeUndefined()
+      }
+    })
+
+    it('re-proves state on an absolute set but not on a relative update', () => {
+      const relative = new TerminalKittyKeyboardModeTracker()
+      relative.resetForSnapshot()
+      relative.scan('\x1b[=8;2u')
+      expect(relative.flags).toBe(8)
+      // An OR against an unproven baseline cannot prove the result.
+      expect(relative.snapshotFlags).toBeUndefined()
+
+      const absolute = new TerminalKittyKeyboardModeTracker()
+      absolute.resetForSnapshot()
+      absolute.scan('\x1b[=8;1u')
+      expect(absolute.snapshotFlags).toBe(8)
+    })
+
+    it('degrades to unknown on a pop that reaches past omitted push history', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      tracker.restoreSnapshotFlags(8)
+      tracker.scan('\x1b[<u')
+      // The frame under the restored one was never captured, so zero is a guess.
+      expect(tracker.flags).toBe(0)
+      expect(tracker.snapshotFlags).toBeUndefined()
+    })
+
+    it('keeps a live push/pop pair proven when its baseline was proven', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      tracker.restoreSnapshotFlags(0)
+      tracker.scan('\x1b[>8u')
+      expect(tracker.snapshotFlags).toBe(8)
+      tracker.scan('\x1b[<u')
+      expect(tracker.snapshotFlags).toBe(0)
+    })
+
+    it('degrades to unknown on a pop that empties the stack over a nonzero frame', () => {
+      // The app's own emulator still holds pre-snapshot frames, so ITS pop
+      // restores the pushed 8 while the mirror's exhausted stack forces 0 —
+      // the forced zero must not be published as proven.
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      tracker.restoreSnapshotFlags(8)
+      tracker.scan('\x1b[>2u\x1b[<u')
+      expect(tracker.flags).toBe(0)
+      expect(tracker.snapshotFlags).toBeUndefined()
+    })
+
+    it('moves the known bit with the numeric slot across screen switches', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      tracker.restoreSnapshotFlags(8)
+      // The alternate screen's saved slot was never captured.
+      tracker.scan('\x1b[?1049h')
+      expect(tracker.snapshotFlags).toBeUndefined()
+      tracker.scan('\x1b[?1049l')
+      expect(tracker.snapshotFlags).toBe(8)
+    })
+
+    it('re-proves everything on RIS and DECSTR', () => {
+      const ris = new TerminalKittyKeyboardModeTracker()
+      ris.resetForSnapshot()
+      ris.scan('\x1bc')
+      expect(ris.snapshotFlags).toBe(0)
+
+      const softReset = new TerminalKittyKeyboardModeTracker()
+      softReset.resetForSnapshot()
+      softReset.restoreSnapshotFlags(8)
+      softReset.scan('\x1b[!p')
+      expect(softReset.snapshotFlags).toBe(0)
+    })
+  })
+
+  // A constructor-fresh tracker reports known-zero, which is only true for a
+  // PTY it watches from spawn. Grounding lets snapshot appliers refuse to
+  // preserve or carry that default for a pre-existing PTY.
+  describe('baseline grounding', () => {
+    it('starts ungrounded and grounds on an explicit fresh-PTY reset', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      expect(tracker.hasProvenBaseline).toBe(false)
+      tracker.reset()
+      expect(tracker.hasProvenBaseline).toBe(true)
+    })
+
+    it('is not grounded by plain output, only by absolute kitty evidence', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.scan('plain output\x1b[31mcolored\x1b[0m')
+      expect(tracker.hasProvenBaseline).toBe(false)
+      tracker.scan('\x1b[>8u')
+      expect(tracker.hasProvenBaseline).toBe(true)
+    })
+
+    it('grounds on a proven snapshot restore but not on the snapshot reset', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.reset()
+      tracker.resetForSnapshot()
+      expect(tracker.hasProvenBaseline).toBe(false)
+      tracker.restoreSnapshotFlags(8)
+      expect(tracker.hasProvenBaseline).toBe(true)
+    })
+
+    it('grounds on RIS and DECSTR arriving in the stream', () => {
+      const ris = new TerminalKittyKeyboardModeTracker()
+      ris.scan('\x1bc')
+      expect(ris.hasProvenBaseline).toBe(true)
+
+      const softReset = new TerminalKittyKeyboardModeTracker()
+      softReset.scan('\x1b[!p')
+      expect(softReset.hasProvenBaseline).toBe(true)
+    })
+  })
 })
diff --git a/src/shared/terminal-kitty-keyboard-mode-tracker.ts b/src/shared/terminal-kitty-keyboard-mode-tracker.ts
index 2b501a2c9ff..cae87067973 100644
--- a/src/shared/terminal-kitty-keyboard-mode-tracker.ts
+++ b/src/shared/terminal-kitty-keyboard-mode-tracker.ts
@@ -1,3 +1,5 @@
+import { parseTerminalKittyKeyboardFlags } from './terminal-kitty-keyboard-flags'
+
 // Why: PTY/SSH chunks can split an escape sequence before its final byte.
 // Keep parser state far beyond normal sequence lengths while bounding memory.
 const KITTY_SCAN_TAIL_LIMIT = 4096
@@ -6,6 +8,9 @@ const KITTY_SCAN_TAIL_LIMIT = 4096
 // mirrored stacks unboundedly while the renderer's own stacks stay at 16.
 const KITTY_STACK_LIMIT = 16
 
+/** A pushed flags slot plus whether the value it will restore was ever proven. */
+type KittyStackFrame = { flags: number; known: boolean }
+
 /**
  * Mirrors the kitty keyboard protocol flag state (CSI > u push, CSI < u pop,
  * CSI = u set) by scanning the raw PTY output stream, replicating xterm's
@@ -27,16 +32,50 @@ export class TerminalKittyKeyboardModeTracker {
   private currentFlags = 0
   private mainFlags = 0
   private altFlags = 0
-  private mainStack: number[] = []
-  private altStack: number[] = []
+  private currentKnown = true
+  private mainKnown = true
+  private altKnown = true
+  private mainStack: KittyStackFrame[] = []
+  private altStack: KittyStackFrame[] = []
+  /** False once a snapshot replaced state whose push history was never observed. */
+  private mainStackComplete = true
+  private altStackComplete = true
   private alternateScreenActive = false
   private alternateScreenSwitchObserved = false
+  // Why: a constructor-fresh tracker reports known-inactive, which is correct
+  // for a PTY it watches from spawn but was never proven for a pre-existing
+  // one. Grounding flips on evidence only: an explicit fresh-PTY reset, a
+  // proven snapshot restore, or scanned bytes that state flags absolutely.
+  private baselineProven = false
 
-  /** Current effective kitty keyboard flags (0 = protocol inactive). */
+  /**
+   * Current effective kitty keyboard flags. `0` doubles as the conservative
+   * input fallback while the state is unknown — read `snapshotFlags` instead
+   * when the caller must distinguish "proven inactive" from "unproven".
+   */
   get flags(): number {
     return this.currentFlags
   }
 
+  /**
+   * Active screen's proven flags, absent when unknown: after snapshots without
+   * Kitty metadata, or transitions needing uncarried push history. Serializers
+   * publish this, never `flags` — silence must not become a proven zero.
+   */
+  get snapshotFlags(): number | undefined {
+    return this.currentKnown ? this.currentFlags : undefined
+  }
+
+  /**
+   * True once this tracker's knownness is grounded in evidence for the PTY it
+   * mirrors. Consumers use it to refuse to preserve (or carry) a constructor
+   * default across a snapshot that proves nothing — the fresh known-zero must
+   * not be laundered into a host-proven inactive protocol.
+   */
+  get hasProvenBaseline(): boolean {
+    return this.baselineProven
+  }
+
   get isAlternateScreen(): boolean {
     return this.alternateScreenActive
   }
@@ -45,17 +84,57 @@ export class TerminalKittyKeyboardModeTracker {
     return this.alternateScreenSwitchObserved
   }
 
+  /** Full reset to a fresh PTY: known-inactive on both screens. */
   reset(): void {
+    this.baselineProven = true
     this.scanTail = ''
     this.currentFlags = 0
     this.mainFlags = 0
     this.altFlags = 0
+    this.currentKnown = true
+    this.mainKnown = true
+    this.altKnown = true
     this.mainStack = []
     this.altStack = []
+    this.mainStackComplete = true
+    this.altStackComplete = true
     this.alternateScreenActive = false
     this.alternateScreenSwitchObserved = false
   }
 
+  /**
+   * Start applying a replacement or historical snapshot. Production snapshot
+   * ANSI deliberately omits kitty pushes, so scanning it can never recover a
+   * negotiation that predates the capture: keep `0` as the input fallback but
+   * mark both screens and their stacks unproven until `restoreSnapshotFlags`
+   * or explicit application output proves them again.
+   */
+  resetForSnapshot(): void {
+    this.reset()
+    this.baselineProven = false
+    this.currentKnown = false
+    this.mainKnown = false
+    this.altKnown = false
+    this.mainStackComplete = false
+    this.altStackComplete = false
+  }
+
+  /**
+   * Adopt the effective flags the snapshot owner proved at the snapshot's own
+   * sequence boundary. Only the ACTIVE screen becomes known — the inactive
+   * screen's slot and both push stacks stay unproven because current snapshot
+   * authorities expose neither.
+   */
+  restoreSnapshotFlags(flags: number): void {
+    const parsed = parseTerminalKittyKeyboardFlags(flags)
+    if (parsed === undefined) {
+      return
+    }
+    this.currentFlags = parsed
+    this.currentKnown = true
+    this.baselineProven = true
+  }
+
   scan(data: string): void {
     this.scanInternal(data, false)
   }
@@ -106,11 +185,17 @@ export class TerminalKittyKeyboardModeTracker {
     // Why: xterm's DECSTR (CSI ! p) wipes kitty flags and stacks for both
     // screens via coreService.reset but does not switch buffers — mirror that
     // so a soft-resetting TUI stops receiving kitty-encoded Option chords.
+    this.baselineProven = true
     this.currentFlags = 0
     this.mainFlags = 0
     this.altFlags = 0
+    this.currentKnown = true
+    this.mainKnown = true
+    this.altKnown = true
     this.mainStack = []
     this.altStack = []
+    this.mainStackComplete = true
+    this.altStackComplete = true
   }
 
   private applyScreenSwitch(params: string, enabled: boolean): void {
@@ -123,13 +208,19 @@ export class TerminalKittyKeyboardModeTracker {
       // Why: xterm swaps the current flags with the inactive screen's slot on
       // every 47/1047/1049 transition, without an already-active guard —
       // mirror it exactly so this state matches what the renderer encodes.
+      // Why the known bit rides the numeric slot: a screen whose flags were
+      // never proven must not become proven just by being swapped in.
       if (enabled) {
         this.mainFlags = this.currentFlags
+        this.mainKnown = this.currentKnown
         this.currentFlags = this.altFlags
+        this.currentKnown = this.altKnown
         this.alternateScreenActive = true
       } else {
         this.altFlags = this.currentFlags
+        this.altKnown = this.currentKnown
         this.currentFlags = this.mainFlags
+        this.currentKnown = this.mainKnown
         this.alternateScreenActive = false
       }
     }
@@ -143,26 +234,54 @@ export class TerminalKittyKeyboardModeTracker {
         if (stack.length >= KITTY_STACK_LIMIT) {
           stack.shift()
         }
-        stack.push(this.currentFlags)
+        stack.push({ flags: this.currentFlags, known: this.currentKnown })
       }
+      // A push states the new effective flags absolutely, so they are proven
+      // even when the value it displaced was not.
       this.currentFlags = parsed[0] || 0
+      this.currentKnown = true
+      this.baselineProven = true
       return
     }
     if (prefix === '<') {
       const count = Math.max(1, parsed[0] || 1)
-      for (let i = 0; i < count && stack.length > 0; i++) {
-        this.currentFlags = stack.pop() as number
+      let lastPopped: KittyStackFrame | null = null
+      for (let i = 0; i < count; i++) {
+        const frame = stack.pop()
+        if (!frame) {
+          lastPopped = null
+          break
+        }
+        lastPopped = frame
+        this.currentFlags = frame.flags
+        this.currentKnown = frame.known
       }
       if (stack.length === 0) {
+        // Why: xterm zeroes an exhausted stack even over a just-popped value.
+        // With complete history that matches the app's emulator exactly, but a
+        // mirror whose stack omits pre-snapshot pushes empties EARLIER than
+        // the app's — its forced zero is only proven when the popped frame
+        // itself proves 0 (the app restores that same value whatever sits
+        // below it); landing at empty on any other frame, or past it, proves
+        // nothing about the older history.
         this.currentFlags = 0
+        const stackComplete = this.alternateScreenActive
+          ? this.altStackComplete
+          : this.mainStackComplete
+        this.currentKnown =
+          stackComplete || (lastPopped !== null && lastPopped.known && lastPopped.flags === 0)
       }
       return
     }
     const flags = parsed[0] || 0
     const mode = parsed.length > 1 && parsed[1] ? parsed[1] : 1
     if (mode === 1) {
+      // An absolute set re-proves the active screen regardless of its baseline.
       this.currentFlags = flags
+      this.currentKnown = true
+      this.baselineProven = true
     } else if (mode === 2) {
+      // Relative updates only preserve knowledge; they cannot create it.
       this.currentFlags |= flags
     } else if (mode === 3) {
       this.currentFlags &= ~flags
diff --git a/src/shared/terminal-mode-2031-final-state.test.ts b/src/shared/terminal-mode-2031-final-state.test.ts
index b8e04d9f1c0..7e2f8b0cce3 100644
--- a/src/shared/terminal-mode-2031-final-state.test.ts
+++ b/src/shared/terminal-mode-2031-final-state.test.ts
@@ -4,13 +4,19 @@
 // subscription the shell has already dropped, and the reply lands as literal
 // text at the prompt or in a child's stdin (#9993).
 import { describe, expect, it } from 'vitest'
-import { scanMode2031Sequences } from './terminal-color-scheme-protocol'
+import {
+  INITIAL_MODE_2031_REPLY_SCAN_STATE,
+  scanMode2031ReplyDecision,
+  scanMode2031Sequences,
+  type Mode2031ReplyDecision
+} from './terminal-color-scheme-protocol'
 import {
   createTerminalTitleTracker,
   type TerminalTitleTrackerCallbacks
 } from './terminal-output-side-effects'
 
 const ESC = '\x1b'
+const BEL = '\x07'
 
 // A fish prompt cycle: subscribe, paint the prompt, hand the tty to the child.
 const FISH_PROMPT_HANDOFF = `${ESC}[?2031h${ESC}[0m~/orca ${ESC}[32m❯${ESC}[0m ${ESC}[?2031l`
@@ -131,3 +137,73 @@ describe('DECSET 2031 replies follow the chunk-final state (#9993)', () => {
     expect(recorded.subscribes).toBe(1)
   })
 })
+
+/**
+ * Real chunk boundaries captured from fish 4.7.1 over node-pty
+ * (tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs). One prompt-accept:
+ * arm 2031 while painting the prompt, echo the typed line, withdraw 2031, exec the command.
+ * Measured gap between chunks 1 and 4 in that trace: 0.57ms — shorter than a renderer IPC hop.
+ */
+const FISH_PROMPT_ACCEPT_CHUNKS: readonly string[] = [
+  // 1. Prompt setup: capability probes plus the 2031 arm. Ends SUBSCRIBED.
+  `${ESC}]0;~/orca${BEL}${ESC}[m${ESC}]11;?${ESC}\\${ESC}[6n${ESC}[0c${ESC}[?2004h${ESC}[?2031h${ESC}[>4;1m${ESC}=`,
+  // 2. The prompt itself.
+  `${ESC}]133;A;click_events=1${BEL}~/orca ❯ ${ESC}]133;B${BEL}${ESC}[K\r${ESC}[9C`,
+  // 3. Echo of the typed command.
+  `npx${ESC}[12C -y${ESC}[15C`,
+  // 4. Accept: fish withdraws 2031 before handing the tty over. Ends UNSUBSCRIBED.
+  `${ESC}[?2004l${ESC}[?2031l${ESC}[>4;0m${ESC}>\r${ESC}[15C`,
+  // 5. The command is now running and owns the tty — any reply from chunk 1 lands HERE.
+  `${ESC}[m${ESC}]133;C;cmdline_url=npx${BEL}`
+]
+
+function trackerRecordingBothFacts(): {
+  facts: string[]
+  tracker: ReturnType<typeof createTerminalTitleTracker>
+} {
+  const facts: string[] = []
+  return {
+    facts,
+    tracker: createTerminalTitleTracker({
+      onMode2031Subscribe: () => facts.push('2031-subscribe'),
+      onMode2031Unsubscribe: () => facts.push('2031-unsubscribe')
+    })
+  }
+}
+
+describe('a fish prompt-accept burst is tracked, never answered (#9993)', () => {
+  it('yields registry transitions only — subscribe then unsubscribe, two chunks apart', () => {
+    let state = INITIAL_MODE_2031_REPLY_SCAN_STATE
+    const decisions: Mode2031ReplyDecision[] = FISH_PROMPT_ACCEPT_CHUNKS.map((chunk) => {
+      const result = scanMode2031ReplyDecision(state, chunk)
+      state = result.state
+      return result.decision
+    })
+
+    expect(decisions).toEqual(['subscribed', null, null, 'unsubscribed', null])
+    // The subscription is already retired one chunk before the command starts, so a reply
+    // queued on the 'subscribed' decision cannot reach fish — only the child that replaced it.
+    expect(decisions.indexOf('unsubscribed')).toBeLessThan(FISH_PROMPT_ACCEPT_CHUNKS.length - 1)
+  })
+
+  it('still emits both side-effect facts so the subscription registry stays truthful', () => {
+    const recorded = trackerRecordingBothFacts()
+
+    for (const chunk of FISH_PROMPT_ACCEPT_CHUNKS) {
+      recorded.tracker.handleChunk(chunk)
+    }
+
+    // Facts survive the fix: maybePushMode2031Flip needs them to know who is listening.
+    expect(recorded.facts).toEqual(['2031-subscribe', '2031-unsubscribe'])
+  })
+
+  it('contains no color-scheme query, so silence is the whole correct answer', () => {
+    const burst = FISH_PROMPT_ACCEPT_CHUNKS.join('')
+
+    // Verified over a full real session: fish never sends the protocol's query (`CSI ?996n`).
+    // It only ever subscribes, so there is nothing here that a `CSI ?997;Nn` could be a reply to.
+    expect(burst).toContain(`${ESC}[?2031h`)
+    expect(burst).not.toContain('996')
+    expect(burst).not.toContain('997')
+  })
+})
diff --git a/src/shared/terminal-output-side-effects.ts b/src/shared/terminal-output-side-effects.ts
index 31f7df27edf..d8b39e954e1 100644
--- a/src/shared/terminal-output-side-effects.ts
+++ b/src/shared/terminal-output-side-effects.ts
@@ -67,7 +67,7 @@ export type TerminalTitleTrackerCallbacks = {
   onPrLink?: (link: TerminalGitHubPRLink) => void
   /**
    * Fired per chunk containing a DECSET 2031 subscribe (chunk-boundary-safe): lets
-   * hidden-delivery-gated renderer views answer the color-scheme query without byte access.
+   * hidden-delivery-gated renderer views track the subscription without byte access.
    */
   onMode2031Subscribe?: () => void
   /**
diff --git a/src/shared/terminal-preview.ts b/src/shared/terminal-preview.ts
index 41bd7e638d5..0ca380fe8e9 100644
--- a/src/shared/terminal-preview.ts
+++ b/src/shared/terminal-preview.ts
@@ -5,12 +5,27 @@ export type TerminalPreviewSnapshot = {
   seq?: number
   scrollbackAnsi?: string
   pendingEscapeTailAnsi?: string
+  /** Effective kitty keyboard flags the snapshot owner proved at this same
+   *  `seq` boundary. Absent means unknown — Preview then keeps its tracker
+   *  unproven and commits raw text rather than guessing zero. */
+  kittyKeyboardFlags?: number
+}
+
+/**
+ * How the renderer must apply one buffered chunk. `live` is a proven
+ * post-snapshot suffix, so kitty pushes advance the stack; `replay` is
+ * redelivery that may repeat the application's one-time push, so it applies
+ * idempotently (see TerminalKittyKeyboardModeTracker.scanReplay).
+ */
+export type TerminalPreviewReplayChunk = {
+  data: string
+  mode: 'live' | 'replay'
 }
 
 export type TerminalPreviewConnectResult = {
   snapshot: TerminalPreviewSnapshot | null
   /** Live bytes captured while the snapshot was being serialized. */
-  replay: string[]
+  replay: TerminalPreviewReplayChunk[]
   /** Snapshot acquisition overflowed twice; refresh without blanking the existing view. */
   resyncRequired?: boolean
 }
diff --git a/src/shared/terminal-query-reply.ts b/src/shared/terminal-query-reply.ts
index 8e25905447a..e83f0dbcc94 100644
--- a/src/shared/terminal-query-reply.ts
+++ b/src/shared/terminal-query-reply.ts
@@ -92,8 +92,9 @@ function cookedEchoSafeReplyEnd(data: string, start: number): number {
 }
 
 /**
- * If `data` is entirely one or more consecutive cooked-echo-risk replies
- * (e.g. repeated `?997;1n` coalesced by the input write queue), return each reply.
+ * If `data` is entirely one or more consecutive cooked-echo-risk replies, return each
+ * reply. Repeats still arrive coalesced from a rapid theme flip or an older client that
+ * answers 2031 subscribes (this host stopped — #9993), so peel them individually.
  * Mixed payloads (reply + keystroke) return null so hosts fall through to raw write.
  */
 export function extractOnlyCookedEchoSafeQueryReplies(data: string): string[] | null {
diff --git a/src/shared/terminal-reply-query-scan.test.ts b/src/shared/terminal-reply-query-scan.test.ts
index 2a94eaad63d..a29ab3c98da 100644
--- a/src/shared/terminal-reply-query-scan.test.ts
+++ b/src/shared/terminal-reply-query-scan.test.ts
@@ -3,6 +3,24 @@ import {
   EMPTY_TERMINAL_REPLY_QUERY_SCAN_STATE,
   scanTerminalReplyQuerySequences
 } from './terminal-reply-query-scan'
+import {
+  INITIAL_MODE_2031_REPLY_SCAN_STATE,
+  scanMode2031ReplyDecision
+} from './terminal-color-scheme-protocol'
+
+/** Exactly what terminal.ts's subscribe path concatenates into the replay push. */
+function replayDataFor(chunks: readonly string[]): string {
+  let state = EMPTY_TERMINAL_REPLY_QUERY_SCAN_STATE
+  let seq = 0
+  let replay = ''
+  for (const chunk of chunks) {
+    const scan = scanTerminalReplyQuerySequences(chunk, seq, state)
+    state = scan.state
+    seq += chunk.length
+    replay += scan.queries.map((query) => query.data).join('')
+  }
+  return replay
+}
 
 describe('terminal reply query scan', () => {
   it('records reply-eliciting queries with their output high-water sequence', () => {
@@ -39,3 +57,56 @@ describe('terminal reply query scan', () => {
     expect(second.queries).toEqual([])
   })
 })
+
+// A late-attaching remote/mobile client is handed these sequences because the scrollback
+// snapshot it also receives carries no control bytes. Carrying the 2031 arm without its
+// withdraw made the client register a subscription the TUI had already retired, and the
+// remote renderer then pushed CSI ?997;Nn into the shell on the next theme flip (#9993).
+describe('replayed DECSET 2031 state matches the TUI final state (#9993)', () => {
+  it('carries the withdraw alongside the arm', () => {
+    const result = scanTerminalReplyQuerySequences(
+      '\x1b[?2031h\x1b[6nprompt$ \x1b[?2031l',
+      0,
+      EMPTY_TERMINAL_REPLY_QUERY_SCAN_STATE
+    )
+
+    expect(result.queries).toEqual([
+      { data: '\x1b[?2031h', startSeq: 0, endSeq: 8 },
+      { data: '\x1b[6n', startSeq: 8, endSeq: 12 },
+      { data: '\x1b[?2031l', startSeq: 20, endSeq: 28 }
+    ])
+  })
+
+  it('leaves a fish prompt-accept replay UNSUBSCRIBED, as fish actually is', () => {
+    // fish arms 2031 while painting the prompt and withdraws it before exec'ing the command.
+    const replay = replayDataFor([
+      '\x1b[?2004h\x1b[?2031h',
+      '~/orca ❯ ',
+      '\x1b[?2004l\x1b[?2031l',
+      'npx running now'
+    ])
+
+    expect(replay).toBe('\x1b[?2031h\x1b[?2031l')
+    expect(scanMode2031ReplyDecision(INITIAL_MODE_2031_REPLY_SCAN_STATE, replay).decision).toBe(
+      'unsubscribed'
+    )
+  })
+
+  it('leaves a still-armed TUI SUBSCRIBED so it keeps receiving theme flips', () => {
+    const replay = replayDataFor(['\x1b[?2031h', 'a TUI that stays subscribed'])
+
+    expect(replay).toBe('\x1b[?2031h')
+    expect(scanMode2031ReplyDecision(INITIAL_MODE_2031_REPLY_SCAN_STATE, replay).decision).toBe(
+      'subscribed'
+    )
+  })
+
+  it('resolves a rearm after a withdraw to the last toggle, in byte order', () => {
+    const replay = replayDataFor(['\x1b[?2031h', 'x\x1b[?2031l', 'y\x1b[?2031h'])
+
+    expect(replay).toBe('\x1b[?2031h\x1b[?2031l\x1b[?2031h')
+    expect(scanMode2031ReplyDecision(INITIAL_MODE_2031_REPLY_SCAN_STATE, replay).decision).toBe(
+      'subscribed'
+    )
+  })
+})
diff --git a/src/shared/terminal-reply-query-scan.ts b/src/shared/terminal-reply-query-scan.ts
index 434d37041d7..1a0d14741d2 100644
--- a/src/shared/terminal-reply-query-scan.ts
+++ b/src/shared/terminal-reply-query-scan.ts
@@ -24,7 +24,18 @@ export const EMPTY_TERMINAL_REPLY_QUERY_SCAN_STATE: TerminalReplyQueryScanState
   pendingStartSeq: null
 }
 
-function isReplyElicitingCsi(sequence: string): boolean {
+/**
+ * Sequences worth replaying to a late-attaching view, because a scrollback snapshot
+ * carries only rendered cells and drops the control bytes that produced them.
+ *
+ * Most entries are reply-eliciting queries the attaching emulator must answer once.
+ * The DECSET/DECRST 2031 pair is different: since #9993 nothing answers the subscribe,
+ * but a remote renderer derives its color-scheme subscription registry from these very
+ * bytes (pty-connection observeLiveMode2031Chunk), so both toggles must be carried —
+ * an arm without its withdraw would leave the client subscribed for a TUI that already
+ * retired the subscription, and fish rearms/withdraws on every prompt.
+ */
+function isReplayableCsi(sequence: string): boolean {
   if (DEVICE_ATTRIBUTES_QUERY_RE.test(sequence)) {
     return true
   }
@@ -41,7 +52,10 @@ function isReplyElicitingCsi(sequence: string): boolean {
     sequence === '\x1b[16t' ||
     sequence === '\x1b[18t' ||
     sequence === '\x1b[?u' ||
-    sequence === '\x1b[?2031h'
+    sequence === '\x1b[?2031h' ||
+    // Why paired with the arm above, exact-form only: replaying a combined DECRST such as
+    // `CSI ?2004;2031l` would also toggle unrelated modes in the attaching emulator.
+    sequence === '\x1b[?2031l'
   )
 }
 
@@ -81,7 +95,7 @@ export function scanTerminalReplyQuerySequences(
     if (input.startsWith(`${ESC}[`, candidateIndex)) {
       endIndex = findCsiFinalByteIndex(input, candidateIndex + 2)
       if (endIndex !== -1) {
-        matches = isReplyElicitingCsi(input.slice(candidateIndex, endIndex + 1))
+        matches = isReplayableCsi(input.slice(candidateIndex, endIndex + 1))
       }
     } else if (input.startsWith(`${ESC}]`, candidateIndex)) {
       const osc = parseTerminalOscColorQuery(input, candidateIndex)
diff --git a/src/shared/terminal-side-effect-facts.ts b/src/shared/terminal-side-effect-facts.ts
index d9c4ce6e46a..47c416aff5d 100644
--- a/src/shared/terminal-side-effect-facts.ts
+++ b/src/shared/terminal-side-effect-facts.ts
@@ -30,9 +30,8 @@ export type TerminalSideEffectFact =
   | { kind: 'command-code-working'; prompt: string }
   | { kind: 'command-code-done'; prompt: string }
   /** DECSET 2031 color-scheme subscribe observed in the byte stream. Emitted
-   *  so hidden-delivery-gated views (whose bytes never arrive) can still send
-   *  the theme reply — the reply stays renderer-side because query authority
-   *  belongs to the view (model/view contract invariant 6). */
+   *  so hidden-delivery-gated views (whose bytes never arrive) can still record
+   *  the subscription and push later theme flips; subscribing is never answered. */
   | { kind: '2031-subscribe' }
   /** DECSET 2031 withdrawal observed in the byte stream. Gated views never see
    *  these bytes, so without this fact their subscription registry goes stale
diff --git a/src/shared/terminal-title-agent-type.test.ts b/src/shared/terminal-title-agent-type.test.ts
index d20d03b5b6d..ed7203f5af3 100644
--- a/src/shared/terminal-title-agent-type.test.ts
+++ b/src/shared/terminal-title-agent-type.test.ts
@@ -64,7 +64,7 @@ describe('resolveExplicitTerminalTitleAgentType', () => {
     expect(getSharedAgentLabel('OC | Compare Codex and Claude')).toBe('OpenCode')
     expect(getSharedAgentLabel('OC | ✦ Gemini CLI')).toBe('OpenCode')
     expect(resolveExplicitTerminalTitleAgentType('tmux | OC | ses_123')).toBe('opencode')
-    expect(resolveExplicitTerminalTitleAgentType('OC|compact-session')).toBe('opencode')
+    expect(resolveExplicitTerminalTitleAgentType('OC|compact-session')).toBeNull()
     expect(resolveExplicitTerminalTitleAgentType('oc | Understand about the plugin')).toBeNull()
   })
 
diff --git a/src/shared/terminal-title-agent-type.ts b/src/shared/terminal-title-agent-type.ts
index 7e38a227f34..0952d96e63f 100644
--- a/src/shared/terminal-title-agent-type.ts
+++ b/src/shared/terminal-title-agent-type.ts
@@ -4,7 +4,7 @@ import {
   HERMES_AGENT_NAME_RE,
   titleHasAgentName
 } from './agent-name-token-match'
-import { isCursorAgentTitle } from './agent-title-core'
+import { containsAgentSpinnerGlyph, isCursorAgentTitle } from './agent-title-core'
 import { stripLeadingAgentTitleDecorationOrEmpty } from './agent-title-decoration'
 import { isOpenCodeNativeTitle } from './opencode-terminal-title'
 import { getWrapperTitleSegments } from './terminal-title-wrapper-segments'
@@ -96,7 +96,7 @@ export function isClaudeAgent(title: string): boolean {
   if (title.startsWith('. ') || title.startsWith('* ')) {
     return true
   }
-  if (containsBrailleSpinner(title)) {
+  if (containsAgentSpinnerGlyph(title)) {
     // Why: named non-Claude agents carry braille spinners too. Gate Cursor by its
     // identity title, not the token, so a Claude title mentioning a cursor stays Claude.
     return !isCursorAgentTitle(title) && !lower.includes('openclaude')
@@ -231,7 +231,7 @@ const TITLE_LABEL_TO_AGENT: Partial<Record<string, TuiAgent>> = {
 
 function hasGenericClaudeStatusPrefix(title: string): boolean {
   return (
-    containsBrailleSpinner(title) ||
+    containsAgentSpinnerGlyph(title) ||
     title.startsWith('✳ ') ||
     title === '✳' ||
     title.startsWith('. ') ||
diff --git a/src/shared/text-search.ts b/src/shared/text-search.ts
index d3d9b40226a..780164372cb 100644
--- a/src/shared/text-search.ts
+++ b/src/shared/text-search.ts
@@ -393,7 +393,7 @@ export function ingestGitGrepLine(
   const secondNullIdx = rest.indexOf('\0')
   let lineNumberText: string
   let lineContent: string
-  if (secondNullIdx >= 0) {
+  if (secondNullIdx !== -1) {
     lineNumberText = rest.substring(0, secondNullIdx)
     lineContent = rest.substring(secondNullIdx + 1).replace(/\n$/, '')
   } else {
diff --git a/src/shared/tui-agent-config.ts b/src/shared/tui-agent-config.ts
index 06d490342ba..3437e44e560 100644
--- a/src/shared/tui-agent-config.ts
+++ b/src/shared/tui-agent-config.ts
@@ -331,7 +331,7 @@ export const TUI_AGENT_CONFIG: Record<TuiAgent, TuiAgentConfig> = {
 }
 
 export function isTuiAgent(value: unknown): value is TuiAgent {
-  return typeof value === 'string' && Object.prototype.hasOwnProperty.call(TUI_AGENT_CONFIG, value)
+  return typeof value === 'string' && Object.hasOwn(TUI_AGENT_CONFIG, value)
 }
 
 export function getTuiAgentDetectCommands(config: TuiAgentConfig): string[] {
diff --git a/src/shared/tui-agent-launch-defaults.ts b/src/shared/tui-agent-launch-defaults.ts
index 94ca6e103a1..f0f5d3e8bd1 100644
--- a/src/shared/tui-agent-launch-defaults.ts
+++ b/src/shared/tui-agent-launch-defaults.ts
@@ -85,7 +85,7 @@ export function resolveTuiAgentLaunchArgs(
 ): string {
   if (
     configuredArgs &&
-    Object.prototype.hasOwnProperty.call(configuredArgs, agent) &&
+    Object.hasOwn(configuredArgs, agent) &&
     typeof configuredArgs[agent] === 'string'
   ) {
     return configuredArgs[agent] ?? ''
@@ -97,7 +97,7 @@ export function resolveTuiAgentLaunchEnv(
   agent: TuiAgent,
   configuredEnv: Partial<Record<TuiAgent, Record<string, string>>> | null | undefined
 ): Record<string, string> {
-  if (configuredEnv && Object.prototype.hasOwnProperty.call(configuredEnv, agent)) {
+  if (configuredEnv && Object.hasOwn(configuredEnv, agent)) {
     return { ...configuredEnv[agent] }
   }
   return getTuiAgentDefaultEnv(agent)
diff --git a/src/shared/tui-agent-startup-shell.test.ts b/src/shared/tui-agent-startup-shell.test.ts
index 40c8f4ac8ee..2d155063462 100644
--- a/src/shared/tui-agent-startup-shell.test.ts
+++ b/src/shared/tui-agent-startup-shell.test.ts
@@ -1,5 +1,14 @@
 import { describe, expect, it } from 'vitest'
-import { tokenizeStartupCommand } from './tui-agent-startup-shell'
+import {
+  buildShellCommandFromArgv,
+  clearEnvCommand,
+  commandSeparator,
+  isPosixStartupShell,
+  quoteStartupArg,
+  resolveLoginShellStartupDialect,
+  tokenizeStartupCommand
+} from './tui-agent-startup-shell'
+import { buildAgentDraftLaunchPlan } from './tui-agent-startup'
 
 function expectSpansCoverTokens(source: string, shell: 'powershell' | 'cmd'): string[] {
   const result = tokenizeStartupCommand(source, shell)
@@ -56,3 +65,50 @@ describe('tokenizeStartupCommand spans (windows shells)', () => {
     expect(expectSpansCoverTokens('claude ""', 'cmd')).toEqual(['claude', '""'])
   })
 })
+
+describe('fish startup shell dialect', () => {
+  it('clears variables with fish syntax instead of the sh `unset` fish rejects', () => {
+    expect(clearEnvCommand('CODEX_HOME', 'fish')).toBe('set -e CODEX_HOME')
+    expect(clearEnvCommand('CODEX_HOME', 'posix')).toBe('unset CODEX_HOME')
+    expect(clearEnvCommand('CODEX_HOME', 'cmd')).toBe('set "CODEX_HOME="')
+    expect(clearEnvCommand('CODEX_HOME', 'powershell')).toBe(
+      'Remove-Item Env:CODEX_HOME -ErrorAction SilentlyContinue'
+    )
+  })
+
+  it('shares POSIX quoting, tokenizing and chaining', () => {
+    expect(quoteStartupArg("it's", 'fish')).toBe(quoteStartupArg("it's", 'posix'))
+    expect(buildShellCommandFromArgv(['codex', 'resume', 'a b'], 'fish')).toBe(
+      buildShellCommandFromArgv(['codex', 'resume', 'a b'], 'posix')
+    )
+    expect(tokenizeStartupCommand('codex --arg "a b"', 'fish')).toEqual(
+      tokenizeStartupCommand('codex --arg "a b"', 'posix')
+    )
+    expect(commandSeparator('fish')).toBe('; ')
+    expect(isPosixStartupShell('fish')).toBe(true)
+  })
+
+  it('maps login shell paths to their dialect', () => {
+    expect(resolveLoginShellStartupDialect('/opt/homebrew/bin/fish')).toBe('fish')
+    expect(resolveLoginShellStartupDialect('/usr/local/bin/FISH')).toBe('fish')
+    expect(resolveLoginShellStartupDialect('/bin/zsh')).toBe('posix')
+    expect(resolveLoginShellStartupDialect('/bin/bash')).toBe('posix')
+    expect(resolveLoginShellStartupDialect('')).toBe('posix')
+    expect(resolveLoginShellStartupDialect(undefined)).toBe('posix')
+  })
+
+  // Contract-only: no POSIX caller threads a shell into buildAgentDraftLaunchPlan yet
+  // (`selectedRepoStartupShell` is Windows-only), so fish users still get `unset` here.
+  it('clears an agent draft prefill variable with fish syntax', () => {
+    const plan = buildAgentDraftLaunchPlan({
+      agent: 'pi',
+      draft: 'hello',
+      cmdOverrides: {},
+      platform: 'darwin',
+      shell: 'fish'
+    })
+
+    expect(plan?.launchCommand).toBe('pi; set -e ORCA_PI_PREFILL')
+    expect(plan?.env?.ORCA_PI_PREFILL).toBe('hello')
+  })
+})
diff --git a/src/shared/tui-agent-startup-shell.ts b/src/shared/tui-agent-startup-shell.ts
index 744e5a1a27f..ef23b837e0b 100644
--- a/src/shared/tui-agent-startup-shell.ts
+++ b/src/shared/tui-agent-startup-shell.ts
@@ -1,6 +1,27 @@
 import { tokenizeCustomCommandTemplate, type CommandTokenSpan } from './commit-message-prompt'
 
-export type AgentStartupShell = 'posix' | 'powershell' | 'cmd'
+// Why: fish shares POSIX word splitting, quoting and `;` chaining, so it is a
+// separate dialect only where its grammar actually diverges (env clearing).
+export type AgentStartupShell = 'posix' | 'fish' | 'powershell' | 'cmd'
+
+type WindowsStartupShell = Extract<AgentStartupShell, 'powershell' | 'cmd'>
+
+/** True for shells parsed with POSIX quoting/word rules (sh family + fish). */
+export function isPosixStartupShell(shell: AgentStartupShell): boolean {
+  return shell === 'posix' || shell === 'fish'
+}
+
+function isWindowsStartupShell(shell: AgentStartupShell): shell is WindowsStartupShell {
+  return shell === 'powershell' || shell === 'cmd'
+}
+
+/** Maps a POSIX login-shell path (`$SHELL`) to the dialect that parses queued commands. */
+export function resolveLoginShellStartupDialect(
+  loginShell: string | null | undefined
+): AgentStartupShell {
+  const basename = loginShell?.trim().replaceAll('\\', '/').split('/').pop()?.toLowerCase() ?? ''
+  return basename === 'fish' ? 'fish' : 'posix'
+}
 
 export type StartupCommandTokens =
   | { ok: true; tokens: string[]; spans: CommandTokenSpan[] }
@@ -19,7 +40,7 @@ function hasOddBackslashRun(value: string, quoteIndex: number): boolean {
 
 function tokenizeWindowsStartupCommand(
   value: string,
-  shell: Exclude<AgentStartupShell, 'posix'>
+  shell: WindowsStartupShell
 ): StartupCommandTokens {
   const tokens: string[] = []
   const spans: CommandTokenSpan[] = []
@@ -133,9 +154,9 @@ export function tokenizeStartupCommand(
   value: string,
   shell: AgentStartupShell
 ): StartupCommandTokens {
-  return shell === 'posix'
-    ? tokenizeCustomCommandTemplate(value)
-    : tokenizeWindowsStartupCommand(value, shell)
+  return isWindowsStartupShell(shell)
+    ? tokenizeWindowsStartupCommand(value, shell)
+    : tokenizeCustomCommandTemplate(value)
 }
 
 export function resolveStartupShell(
@@ -173,6 +194,11 @@ export function clearEnvCommand(name: string, shell: AgentStartupShell): string
   if (shell === 'cmd') {
     return `set "${name}="`
   }
+  // Why: fish has no `unset`; the sh spelling errors out and silently leaves
+  // the variable exported (e.g. an account-routed CODEX_HOME survives).
+  if (shell === 'fish') {
+    return `set -e ${name}`
+  }
   return `unset ${name}`
 }
 
diff --git a/src/shared/types.ts b/src/shared/types.ts
index 0f7a6685f9a..4d9a2e9b810 100644
--- a/src/shared/types.ts
+++ b/src/shared/types.ts
@@ -289,6 +289,8 @@ export type Repo = {
   externalWorktreeInboxBaselinePaths?: string[]
   /** External worktree paths explicitly imported while global visibility stays hide. */
   importedExternalWorktreePaths?: string[]
+  /** Opt-in repo policy for coding-agent scratch worktrees; absent means hide. */
+  agentWorktreeVisibility?: ExternalWorktreeVisibility
   /** User permanently opted out of the new-external-worktree inbox for this repo. */
   externalWorktreeDiscoverySuppressedAt?: number
   /** Paths (relative to the primary checkout) that should be APFS clone-copied
@@ -357,6 +359,7 @@ export type FolderWorkspace = {
   lastActivityAt: number
   createdAt: number
   updatedAt: number
+  diffComments?: DiffComment[]
 }
 
 export type WorkspaceLinkedItem = {
@@ -1079,6 +1082,7 @@ export type BrowserCookieImportSummary = {
   totalCookies: number
   importedCookies: number
   skippedCookies: number
+  googleCookiesSkipped?: number
   domains: string[]
   warning?: {
     code: 'restart-fallback-unavailable'
@@ -1497,8 +1501,8 @@ export type PRCheckJob = {
 
 export type PRCheckRunDetails = {
   name: string
-  status: PRCheckDetail['status'] | string | null
-  conclusion: PRCheckDetail['conclusion'] | string | null
+  status: PRCheckDetail['status'] | (string & {}) | null
+  conclusion: PRCheckDetail['conclusion'] | (string & {}) | null
   url: string | null
   detailsUrl: string | null
   startedAt: string | null
@@ -1749,7 +1753,7 @@ export type LinearWorkspace = LinearViewer & {
   credentialRevision?: number
 }
 
-export type LinearWorkspaceSelection = string | 'all'
+export type LinearWorkspaceSelection = (string & {}) | 'all'
 export type LinearWorkspaceSelector = LinearWorkspaceSelection | undefined
 export type LinearConcreteWorkspaceId = string
 
@@ -2795,7 +2799,6 @@ export type GlobalSettings = {
   autoRenameBranchFromWorkDefaultedOn?: boolean
   branchPrefix: BranchPrefixStrategy
   branchPrefixCustom: string
-  enableGitHubAttribution: boolean
   theme: 'system' | 'dark' | 'light'
   /** Controls the left sidebar surface without changing terminal brightness. */
   leftSidebarAppearanceMode: LeftSidebarAppearanceMode
@@ -3691,6 +3694,14 @@ export type PersistedState = {
   projectHostSetups: ProjectHostSetup[]
   projectGroups: ProjectGroup[]
   folderWorkspaces: FolderWorkspace[]
+  /** Folder-workspace review notes, keyed by FolderWorkspace.id. Top-level, NOT nested in
+   *  folderWorkspaces[]: normalizeFolderWorkspaces rebuilds each record field-by-field, so an
+   *  older build drops nested fields, while unknown top-level keys round-trip untouched.
+   *
+   *  WRITE-ONLY PROJECTION. FolderWorkspace.diffComments is the single in-memory home; load()
+   *  hydrates from this key and then deletes it from Store state, and buildStateToSave() is the
+   *  only producer of it. Never read Store.state.folderWorkspaceDiffComments outside load(). */
+  folderWorkspaceDiffComments?: Record<string, DiffComment[]>
   /** Sparse-checkout presets keyed by repoId. */
   sparsePresetsByRepo: Record<string, SparsePreset[]>
   /** Per paired device last tab selection by worktree; keeps mobile navigation across host restarts. */
diff --git a/src/shared/workspace-session-schema.sleeping-agent.test.ts b/src/shared/workspace-session-schema.sleeping-agent.test.ts
index 9f58d453969..16f499ac7d5 100644
--- a/src/shared/workspace-session-schema.sleeping-agent.test.ts
+++ b/src/shared/workspace-session-schema.sleeping-agent.test.ts
@@ -219,12 +219,9 @@ describe('parseWorkspaceSession sleeping agents', () => {
 
     expect(result.ok).toBe(true)
     if (result.ok) {
-      expect(
-        Object.prototype.hasOwnProperty.call(
-          result.value.sleepingAgentSessionsByPaneKey ?? {},
-          '__proto__'
-        )
-      ).toBe(false)
+      expect(Object.hasOwn(result.value.sleepingAgentSessionsByPaneKey ?? {}, '__proto__')).toBe(
+        false
+      )
       const record = result.value.sleepingAgentSessionsByPaneKey?.['tab1:pane-1']
       expect(record?.agent).toBe('codex')
       expect(record?.launchConfig).toBeUndefined()
diff --git a/src/shared/worktree-ownership.test.ts b/src/shared/worktree-ownership.test.ts
index 1697b654d5a..f4e5fe23206 100644
--- a/src/shared/worktree-ownership.test.ts
+++ b/src/shared/worktree-ownership.test.ts
@@ -80,7 +80,6 @@ function makeSettings(overrides: Partial<GlobalSettings> = {}): GlobalSettings {
     localBaseRefSuggestionDismissed: false,
     branchPrefix: 'none',
     branchPrefixCustom: '',
-    enableGitHubAttribution: false,
     theme: 'system',
     appFontFamily: 'Geist',
     editorAutoSave: false,
@@ -477,7 +476,7 @@ describe('agent scratch worktrees', () => {
     ).toBe('orca-managed')
   })
 
-  it('hides agent scratch even when the repo shows non-Orca worktrees', () => {
+  it('keeps agent scratch hidden by default for new and legacy repos', () => {
     for (const repo of [
       makeRepo({ externalWorktreeVisibility: 'show' }),
       makeRepo({ addedAt: EXTERNAL_WORKTREE_VISIBILITY_ROLLOUT_AT - 1 })
@@ -494,6 +493,25 @@ describe('agent scratch worktrees', () => {
     }
   })
 
+  it('shows agent scratch when its repo policy is enabled', () => {
+    const repo = makeRepo({
+      externalWorktreeVisibility: 'hide',
+      agentWorktreeVisibility: 'show'
+    })
+    const settings = makeSettings()
+
+    for (const path of [scratchPath, '/repos/app/.gsd-workspaces/phase-1']) {
+      const detected = toDetectedWorktree({
+        repo,
+        settings,
+        worktree: makeWorktree({ path, isMainWorktree: false }),
+        knownOrcaLayouts: buildKnownOrcaWorkspaceLayouts(settings, repo)
+      })
+
+      expect(detected).toMatchObject({ ownership: 'agent-scratch', visible: true })
+    }
+  })
+
   it('still shows agent scratch for the selected checkout or an explicit import', () => {
     const repo = makeRepo({
       externalWorktreeVisibility: 'hide',
diff --git a/src/shared/worktree-ownership.ts b/src/shared/worktree-ownership.ts
index a14523c4d8f..a5260b4adc5 100644
--- a/src/shared/worktree-ownership.ts
+++ b/src/shared/worktree-ownership.ts
@@ -13,6 +13,7 @@ import {
 } from './agent-scratch-worktrees'
 import { isExplicitlyImportedExternalWorktreePath } from './external-worktree-inbox'
 import {
+  effectiveAgentWorktreeVisibility,
   effectiveExternalWorktreeVisibility,
   isLegacyRepoForExternalWorktreeVisibility
 } from './external-worktree-visibility'
@@ -27,6 +28,7 @@ import type {
 } from './types'
 
 export {
+  effectiveAgentWorktreeVisibility,
   effectiveExternalWorktreeVisibility,
   EXTERNAL_WORKTREE_VISIBILITY_ROLLOUT_AT,
   isLegacyRepoForExternalWorktreeVisibility
@@ -221,10 +223,8 @@ export function shouldShowWorktree(args: {
   ) {
     return true
   }
-  // Why: agent scratch stays hidden even when the repo shows non-Orca
-  // worktrees; only an explicit import or selected checkout reveals it.
   if (args.ownership === 'agent-scratch') {
-    return false
+    return effectiveAgentWorktreeVisibility(args.repo) === 'show'
   }
   if (args.ownership === 'unknown-legacy' && args.isLegacyRepoForVisibility) {
     return true
diff --git a/tests/e2e/artificial-opencode-hidden-pressure-scenario.ts b/tests/e2e/artificial-opencode-hidden-pressure-scenario.ts
index ca19daf7395..f65bbeea84a 100644
--- a/tests/e2e/artificial-opencode-hidden-pressure-scenario.ts
+++ b/tests/e2e/artificial-opencode-hidden-pressure-scenario.ts
@@ -54,10 +54,8 @@ type HiddenPressureDeps<TMeasurement, TDebug, TScheduler, TMainPressure, TAckGat
   writeInteractivePromptScript: (scriptPath: string, runId: string) => void
 }
 
-// Why: the renderer hidden-skip counters are gone with the skip grammar —
-// withheld hidden output is observed via main's delivery-drop counters only.
 type HiddenPressureDebug = {
-  hiddenRendererMode2031ReplyCount: number
+  hiddenRendererSkipCount: number
 }
 
 type HiddenPressureMeasurement = {
diff --git a/tests/e2e/artificial-opencode-revisit-pressure-scenario.ts b/tests/e2e/artificial-opencode-revisit-pressure-scenario.ts
index 48643b8d8de..c4300fe7cb5 100644
--- a/tests/e2e/artificial-opencode-revisit-pressure-scenario.ts
+++ b/tests/e2e/artificial-opencode-revisit-pressure-scenario.ts
@@ -27,9 +27,7 @@ type RevisitPressureMeasurement = {
   maxTimerDriftMs: number
 }
 
-// Why: the renderer hidden-skip counters were deleted with the skip grammar;
-// only the mode-2031 fact-reply counter still exists renderer-side.
-type RevisitPressureDebug = { hiddenRendererMode2031ReplyCount: number }
+type RevisitPressureDebug = { hiddenRendererSkipCount: number }
 
 type RevisitPressureSchedulerSnapshot = {
   peakQueuedChars: number
diff --git a/tests/e2e/artificial-opencode-terminal-load.spec.ts b/tests/e2e/artificial-opencode-terminal-load.spec.ts
index 3e857d3258f..0a3e1570769 100644
--- a/tests/e2e/artificial-opencode-terminal-load.spec.ts
+++ b/tests/e2e/artificial-opencode-terminal-load.spec.ts
@@ -56,11 +56,8 @@ type SyntheticOpenCodeWindow = Window & {
   }
 }
 
-// Why: the renderer hidden-skip grammar is deleted — hidden bytes are dropped
-// in main (gate) or ride the background queue. Only the mode-2031 fact-reply
-// counter still has a renderer-side producer.
 type TerminalPtyOutputDebugSnapshot = {
-  hiddenRendererMode2031ReplyCount: number
+  hiddenRendererSkipCount: number
 }
 
 type TerminalOutputSchedulerDebugSnapshot = {
@@ -373,7 +370,7 @@ function annotateTypingMeasurement(
   mainPressure: MainPtyPressureDebugSnapshot | null = null,
   ackGate: TerminalPtyAckGateSnapshot | null = null
 ): void {
-  const mode2031Summary = debug ? ` mode2031Replies=${debug.hiddenRendererMode2031ReplyCount}` : ''
+  const hiddenSkipSummary = debug ? ` hiddenRendererSkips=${debug.hiddenRendererSkipCount}` : ''
   const schedulerSummary = scheduler
     ? ` deferredForegroundEnqueue=${scheduler.deferredForegroundEnqueueCount} deferredForegroundWrite=${scheduler.deferredForegroundWriteCount} scheduledDrains=${scheduler.scheduledDrainCount} rendererQueuedTerminals=${scheduler.queuedTerminalCount} rendererQueuedChars=${scheduler.queuedChars} rendererPeakQueuedTerminals=${scheduler.peakQueuedTerminalCount} rendererPeakQueuedChars=${scheduler.peakQueuedChars} rendererPeakQueuedCharsByTerminal=${scheduler.peakQueuedCharsByTerminal} rendererDroppedBacklogs=${scheduler.droppedBacklogCount}`
     : ''
@@ -391,7 +388,7 @@ function annotateTypingMeasurement(
       1
     )}ms maxTimerDrift=${measurement.maxTimerDriftMs.toFixed(1)}ms samples=${measurement.latencies
       .map((value) => value.toFixed(1))
-      .join(',')}${mode2031Summary}${schedulerSummary}${mainPressureSummary}${ackGateSummary}`
+      .join(',')}${hiddenSkipSummary}${schedulerSummary}${mainPressureSummary}${ackGateSummary}`
   })
 }
 
diff --git a/tests/e2e/browser-fedcm-fallback.spec.ts b/tests/e2e/browser-fedcm-fallback.spec.ts
new file mode 100644
index 00000000000..c782bfed5a6
--- /dev/null
+++ b/tests/e2e/browser-fedcm-fallback.spec.ts
@@ -0,0 +1,139 @@
+import { createServer, type Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import { test, expect } from './helpers/orca-app'
+import { ensureTerminalVisible, getActiveWorktreeId } from './helpers/store'
+
+async function closeServer(server: Server): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()))
+  })
+}
+
+async function startFedCmFallbackServer(): Promise<{
+  url: string
+  close: () => Promise<void>
+}> {
+  const server = createServer((request, response) => {
+    const origin = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
+    const pathname = new URL(request.url ?? '/', origin).pathname
+    response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+    if (pathname === '/popup') {
+      response.end(
+        '<!doctype html><html><head><title>Popup fallback</title></head><body>Popup fallback<script>window.opener?.postMessage("popup-opener-live", window.location.origin)</script></body></html>'
+      )
+      return
+    }
+    response.end(`
+      <!doctype html>
+      <html>
+        <head><title>FedCM fallback oracle</title></head>
+        <body>
+          <output id="capabilities"></output>
+          <button id="sign-in">Sign in</button>
+          <output id="path">pending</output>
+          <script>
+            const hasIdentityCredential = 'IdentityCredential' in window
+            const hasIdentityProvider = 'IdentityProvider' in window
+            window.popupMessages = []
+            window.addEventListener('message', (event) => {
+              window.popupMessages.push(event.data)
+            })
+            document.querySelector('#capabilities').textContent = JSON.stringify({
+              hasIdentityCredential,
+              hasIdentityProvider
+            })
+            document.querySelector('#sign-in').addEventListener('click', () => {
+              if (hasIdentityCredential && hasIdentityProvider) {
+                document.querySelector('#path').textContent = 'fedcm-selected'
+                return
+              }
+              const popup = window.open('/popup', 'google-auth', 'width=480,height=640')
+              document.querySelector('#path').textContent = popup ? 'popup-live' : 'popup-blocked'
+            })
+          </script>
+        </body>
+      </html>
+    `)
+  })
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const port = (server.address() as AddressInfo).port
+  return { url: `http://127.0.0.1:${port}/`, close: () => closeServer(server) }
+}
+
+test('embedded browser omits unusable FedCM and reaches the popup fallback', async ({
+  electronApp,
+  orcaPage
+}) => {
+  const server = await startFedCmFallbackServer()
+  try {
+    await ensureTerminalVisible(orcaPage)
+    const worktreeId = await getActiveWorktreeId(orcaPage)
+    expect(worktreeId).not.toBeNull()
+    const browserTabId = await orcaPage.evaluate(
+      ({ targetWorktreeId, url }) => {
+        const tab = window.__store!.getState().createBrowserTab(targetWorktreeId!, url, {
+          title: 'FedCM fallback oracle',
+          activate: true
+        })
+        return tab.id
+      },
+      { targetWorktreeId: worktreeId, url: server.url }
+    )
+    const readGuest = async <T>(expression: string): Promise<T> =>
+      orcaPage.evaluate(
+        async ({ targetBrowserTabId, script }) => {
+          const slot = document.querySelector(
+            `[data-browser-overlay-tab-id="${targetBrowserTabId}"]`
+          )
+          const webview = slot?.querySelector('webview') as Electron.WebviewTag | null
+          if (!webview) {
+            throw new Error(`Missing webview for browser tab ${targetBrowserTabId}`)
+          }
+          return (await webview.executeJavaScript(script)) as T
+        },
+        { targetBrowserTabId: browserTabId, script: expression }
+      )
+
+    await expect
+      .poll(() => readGuest<string>('document.title'), { timeout: 10_000 })
+      .toBe('FedCM fallback oracle')
+    const capabilities = await readGuest<{
+      hasIdentityCredential: boolean
+      hasIdentityProvider: boolean
+    }>('JSON.parse(document.querySelector("#capabilities").textContent)')
+    expect.soft(capabilities).toEqual({
+      hasIdentityCredential: false,
+      hasIdentityProvider: false
+    })
+
+    await readGuest<void>('document.querySelector("#sign-in").click()')
+    const path = await readGuest<string>('document.querySelector("#path").textContent')
+    expect.soft(path).toBe('popup-live')
+    await expect
+      .poll(() =>
+        electronApp.evaluate(async ({ webContents }) => {
+          const popup = webContents.getAllWebContents().find((contents) => {
+            return contents.getURL().endsWith('/popup')
+          })
+          if (!popup) {
+            return null
+          }
+          return {
+            openerLive: await popup.executeJavaScript('Boolean(window.opener)'),
+            title: await popup.executeJavaScript('document.title'),
+            url: popup.getURL()
+          }
+        })
+      )
+      .toEqual({
+        openerLive: true,
+        title: 'Popup fallback',
+        url: `${server.url}popup`
+      })
+    await expect
+      .poll(() => readGuest<string[]>('window.popupMessages'))
+      .toEqual(['popup-opener-live'])
+  } finally {
+    await server.close()
+  }
+})
diff --git a/tests/e2e/chinese-ime-chat-input-repro.spec.ts b/tests/e2e/chinese-ime-chat-input-repro.spec.ts
index 8c57b8e6a9f..9c72e8cdd4d 100644
--- a/tests/e2e/chinese-ime-chat-input-repro.spec.ts
+++ b/tests/e2e/chinese-ime-chat-input-repro.spec.ts
@@ -305,7 +305,7 @@ async function readPromptState(page: Page): Promise<TerminalPromptState | null>
     .filter((value): value is string => value !== null)
   const promptIndex = content.lastIndexOf(PROMPT)
   const liveLine =
-    promptIndex >= 0 ? (content.slice(promptIndex + PROMPT.length).split(/\r?\n/)[0] ?? '') : ''
+    promptIndex !== -1 ? (content.slice(promptIndex + PROMPT.length).split(/\r?\n/)[0] ?? '') : ''
   return {
     model: liveLine.trimEnd(),
     cursor: Array.from(liveLine.trimEnd()).length,
diff --git a/tests/e2e/codex-composer-echo-latency-probe.ts b/tests/e2e/codex-composer-echo-latency-probe.ts
index 9fc9cabf2c7..c49d98d3708 100644
--- a/tests/e2e/codex-composer-echo-latency-probe.ts
+++ b/tests/e2e/codex-composer-echo-latency-probe.ts
@@ -112,7 +112,7 @@ export async function installCodexEchoLatencyProbe(page: Page, target: string):
     const observeRender = (): void => {
       renderEvents += 1
       const paintedAt = performance.now()
-      for (const entry of awaitingRender.splice(0, awaitingRender.length)) {
+      for (const entry of awaitingRender.splice(0)) {
         entry.sample.keyToRenderMs = paintedAt - entry.startedAt
       }
     }
diff --git a/tests/e2e/cross-version-wire/cross-version-reattach-authorization.unit.test.ts b/tests/e2e/cross-version-wire/cross-version-reattach-authorization.unit.test.ts
new file mode 100644
index 00000000000..50eebfeda95
--- /dev/null
+++ b/tests/e2e/cross-version-wire/cross-version-reattach-authorization.unit.test.ts
@@ -0,0 +1,156 @@
+import { beforeAll, describe, expect, it, vi } from 'vitest'
+
+// Why these three: `main/ipc/pty.ts` and `main/runtime/orca-runtime.ts` are real
+// production modules here, so their Electron/native edges need stand-ins. Nothing
+// on the decision path under test is mocked.
+vi.mock('electron', () => ({
+  BrowserWindow: undefined,
+  app: { isPackaged: true, getPath: () => '/tmp/orca-user-data', getVersion: () => '0.0.0-test' },
+  powerMonitor: { on: vi.fn() },
+  nativeTheme: { shouldUseDarkColors: false },
+  ipcMain: {
+    handle: vi.fn(),
+    on: vi.fn(),
+    removeHandler: vi.fn(),
+    removeAllListeners: vi.fn()
+  }
+}))
+vi.mock('node-pty', () => ({ spawn: vi.fn() }))
+vi.mock('psl', () => ({ parse: () => ({ domain: null }) }))
+
+const { resolveBaselineReleaseRef } = await import('./release-checkout')
+const { driveHostRecoveryAuthorization, SKEW_HOST_PANE } =
+  await import('./reattach-recovery-authorization-skew')
+const { loadTerminalWireBuild, WORKING_TREE } = await import('./versioned-terminal-wire')
+type TerminalWireBuild = Awaited<ReturnType<typeof loadTerminalWireBuild>>
+type Outcome = Awaited<ReturnType<typeof driveHostRecoveryAuthorization>>
+
+const SUITE_TIMEOUT_MS = 180_000
+
+let current: TerminalWireBuild
+let baseline: TerminalWireBuild
+let currentHost: Outcome
+let baselineHost: Outcome
+let currentHostAppIdSpace: Outcome
+let baselineHostAppIdSpace: Outcome
+
+beforeAll(async () => {
+  current = await loadTerminalWireBuild(WORKING_TREE)
+  baseline = await loadTerminalWireBuild(resolveBaselineReleaseRef())
+  // Serial on purpose: `ipc/pty.ts` keeps module-level provider state per build.
+  currentHost = await driveHostRecoveryAuthorization({
+    hostBuild: current,
+    runtimePtyIdSpace: 'relay'
+  })
+  baselineHost = await driveHostRecoveryAuthorization({
+    hostBuild: baseline,
+    runtimePtyIdSpace: 'relay'
+  })
+  currentHostAppIdSpace = await driveHostRecoveryAuthorization({
+    hostBuild: current,
+    runtimePtyIdSpace: 'app'
+  })
+  baselineHostAppIdSpace = await driveHostRecoveryAuthorization({
+    hostBuild: baseline,
+    runtimePtyIdSpace: 'app'
+  })
+}, SUITE_TIMEOUT_MS)
+
+function expectDriveActuallyRan(outcome: Outcome): void {
+  // The anti-vacuous-pass oracle: a host that never attached, never published a
+  // failure, or never reached its recovery gate proves nothing about refusal.
+  expect(outcome.attachedBeforeFault).toBe(true)
+  expect(outcome.publishedFailure).not.toBe('')
+  expect(outcome.recoverPaneOutcome).toMatch(/^(granted|refused)$/)
+}
+
+describe('cross-version reattach recovery authorization', () => {
+  it(
+    'skews a real published release against current code',
+    () => {
+      expect(baseline.revision).toMatch(/^[0-9a-f]{40}$/)
+      expect(baseline.revision).not.toBe(current.revision)
+      expect(currentHost.publishedFailure).not.toBe(baselineHost.publishedFailure)
+    },
+    SUITE_TIMEOUT_MS
+  )
+
+  it(
+    'the current host neither expires its own lease nor grants a replacement shell',
+    () => {
+      expectDriveActuallyRan(currentHost)
+      // Rule 3 of remote-wire-compatibility: what the host publishes reaches old
+      // clients with no wire change. Here the host also acts on it locally — and
+      // a live shell whose output source must be restored is not an expiry, so
+      // no durable state may be destroyed on its behalf.
+      expect(currentHost.leaseWrites).toEqual([])
+      expect(currentHost.leaseStateAfterFailure).toBe('attached')
+      // Any client version may still ASK for a replacement. The host is what
+      // must refuse, before the mutation.
+      expect(currentHost.recoverPaneOutcome).toBe('refused')
+      expect(currentHost.recoverPaneError).toContain('terminal_not_recoverable')
+      expect(currentHost.replacementShellsCreated).toBe(0)
+    },
+    SUITE_TIMEOUT_MS
+  )
+
+  it(
+    'the current host refuses whichever id space the pane was registered under',
+    () => {
+      // The refusal above must not be an id that happened not to match. Under the
+      // id shape production actually registers, the current host still writes no
+      // lease and still creates no shell.
+      expectDriveActuallyRan(currentHostAppIdSpace)
+      expect(currentHostAppIdSpace.leaseWrites).toEqual([])
+      expect(currentHostAppIdSpace.recoverPaneOutcome).toBe('refused')
+      expect(currentHostAppIdSpace.replacementShellsCreated).toBe(0)
+    },
+    SUITE_TIMEOUT_MS
+  )
+
+  it(
+    'the published release expires the lease and grants the duplicate shell',
+    () => {
+      // The control. Same relay answer, same pane, same request — only the host
+      // build differs, and the legacy publication authorizes the mutation the
+      // current host refuses. Without this the case above could pass because the
+      // harness never reaches a grant at all.
+      expectDriveActuallyRan(baselineHost)
+      expect(baselineHost.leaseWrites).toEqual([
+        { ptyId: SKEW_HOST_PANE.relaySessionId, state: 'expired' }
+      ])
+      expect(baselineHost.leaseStateAfterFailure).toBe('expired')
+      expect(baselineHost.recoverPaneOutcome).toBe('granted')
+      expect(baselineHost.replacementShellsCreated).toBe(1)
+      // Recorded, not asserted as desirable: the legacy grant is only reachable
+      // when the pane's runtime PTY id is the RELAY id. `ipc/pty.ts` registers the
+      // APP id while writing the lease under the relay id, and the gate compares
+      // them directly — so under the shape production registers, the legacy host
+      // refuses too. That id-space mismatch needs its own decision; it is not what
+      // this branch changed.
+      expect(baselineHostAppIdSpace.leaseWrites).toEqual([
+        { ptyId: SKEW_HOST_PANE.relaySessionId, state: 'expired' }
+      ])
+      expect(baselineHostAppIdSpace.recoverPaneOutcome).toBe('refused')
+    },
+    SUITE_TIMEOUT_MS
+  )
+
+  it(
+    'the two hosts differ only in what they authorized, from the same relay answer',
+    () => {
+      // Names the skew explicitly so a future change that converges the two builds
+      // cannot quietly turn this file into a pair of tautologies.
+      expect({
+        lease: currentHost.leaseStateAfterFailure,
+        recovery: currentHost.recoverPaneOutcome,
+        shells: currentHost.replacementShellsCreated
+      }).not.toEqual({
+        lease: baselineHost.leaseStateAfterFailure,
+        recovery: baselineHost.recoverPaneOutcome,
+        shells: baselineHost.replacementShellsCreated
+      })
+    },
+    SUITE_TIMEOUT_MS
+  )
+})
diff --git a/tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts b/tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts
index e49e0be3ecb..2deffa15253 100644
--- a/tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts
+++ b/tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts
@@ -1,5 +1,11 @@
 import { afterEach, beforeAll, describe, expect, it } from 'vitest'
-import { resolveBaselineReleaseRef } from './release-checkout'
+import {
+  capturePublishedRestoreRequiredFailure,
+  driveClientReattachFailure,
+  SKEW_PANE,
+  type ClientReattachFailureOutcome
+} from './reattach-failure-publication-skew'
+import { resolveBaselineReleaseRef, selectLatestStableReleaseTag } from './release-checkout'
 import {
   JOURNEY_INPUTS,
   JOURNEY_STEPS,
@@ -92,6 +98,18 @@ function expectWireCompatible(record: JourneyRecord): void {
 }
 
 describe('cross-version remote terminal wire', () => {
+  it('ignores legacy, mobile, and prerelease tags when selecting the baseline', () => {
+    expect(
+      selectLatestStableReleaseTag([
+        'v799',
+        'mobile-v9.0.0',
+        'v1.4.177-rc.3',
+        'v1.4.175',
+        'v1.4.176'
+      ])
+    ).toBe('v1.4.176')
+  })
+
   it(
     'skews current code against a real published release',
     () => {
@@ -134,3 +152,98 @@ describe('cross-version remote terminal wire', () => {
     SUITE_TIMEOUT_MS
   )
 })
+
+/**
+ * The opcode journey above proves frames survive skew. It cannot see this: the
+ * failure token a reattach publishes is a plain string on an existing error
+ * channel, so nothing is rejected and nothing negotiates — yet the token decides
+ * whether the receiving client asks the host to REPLACE the pane's shell.
+ */
+function expectDriveActuallyRan(outcome: ClientReattachFailureOutcome): void {
+  expect(outcome.connectedBeforeFault).toBe(true)
+  expect(outcome.subscribedHandles[0]).toBe(SKEW_PANE.handle)
+  expect(outcome.methodsAfterFailure).toContain('terminal.resolvePane')
+}
+
+describe('cross-version reattach failure publication', () => {
+  let currentPublication: string
+  let baselinePublication: string
+
+  beforeAll(async () => {
+    currentPublication = await capturePublishedRestoreRequiredFailure(current)
+    baselinePublication = await capturePublishedRestoreRequiredFailure(baseline)
+  }, SUITE_TIMEOUT_MS)
+
+  it(
+    'the two builds publish different tokens for the same live-shell reattach',
+    () => {
+      // Guards the whole block: identical publications would make every case below
+      // pass for a reason that has nothing to do with skew.
+      expect(currentPublication).not.toBe(baselinePublication)
+      expect(baselinePublication).toContain('SSH_SESSION_EXPIRED')
+      expect(currentPublication).not.toContain('SSH_SESSION_EXPIRED')
+    },
+    SUITE_TIMEOUT_MS
+  )
+
+  it(
+    'the new host publication mutates nothing on an old client',
+    async () => {
+      const outcome = await driveClientReattachFailure({
+        clientBuild: baseline,
+        publishedFailure: currentPublication
+      })
+      expectDriveActuallyRan(outcome)
+      // The old client has no branch for this token, so it stops at its error
+      // surface — unsupported semantics failing before mutation, not adopting a
+      // replacement shell it was never granted. It fails visibly rather than
+      // silently, which is the difference between "fenced" and "dropped".
+      expect(outcome.paneReplacementRequests).toEqual([])
+      expect(outcome.subscribedHandles).not.toContain(SKEW_PANE.replacementHandle)
+      expect(outcome.surfacedErrors).toHaveLength(1)
+    },
+    SUITE_TIMEOUT_MS
+  )
+
+  it(
+    'the new host publication mutates nothing on a new client',
+    async () => {
+      const outcome = await driveClientReattachFailure({
+        clientBuild: current,
+        publishedFailure: currentPublication
+      })
+      expectDriveActuallyRan(outcome)
+      expect(outcome.paneReplacementRequests).toEqual([])
+      expect(outcome.subscribedHandles).not.toContain(SKEW_PANE.replacementHandle)
+      expect(outcome.surfacedErrors).toHaveLength(1)
+    },
+    SUITE_TIMEOUT_MS
+  )
+
+  it(
+    'the old host publication still replaces the pane on both clients',
+    async () => {
+      // The control that keeps the two cases above honest. The same driver, the
+      // same fault, the same clients: only the publishing build differs, and the
+      // legacy token still authorizes `terminal.recoverPane`. If the current host
+      // regressed to publishing expiry for a live shell, the cases above would
+      // look exactly like this one and fail.
+      for (const clientBuild of [baseline, current]) {
+        const outcome = await driveClientReattachFailure({
+          clientBuild,
+          publishedFailure: baselinePublication
+        })
+        expectDriveActuallyRan(outcome)
+        expect(outcome.paneReplacementRequests).toEqual([
+          {
+            paneKey: SKEW_PANE.paneKey,
+            worktreeId: SKEW_PANE.worktreeId,
+            expectedTerminal: SKEW_PANE.handle
+          }
+        ])
+        expect(outcome.subscribedHandles).toContain(SKEW_PANE.replacementHandle)
+      }
+    },
+    SUITE_TIMEOUT_MS
+  )
+})
diff --git a/tests/e2e/cross-version-wire/reattach-failure-publication-skew.ts b/tests/e2e/cross-version-wire/reattach-failure-publication-skew.ts
new file mode 100644
index 00000000000..b7869c9f72b
--- /dev/null
+++ b/tests/e2e/cross-version-wire/reattach-failure-publication-skew.ts
@@ -0,0 +1,290 @@
+import { expect, vi } from 'vitest'
+import {
+  importBuildModule,
+  type TerminalWireBuild,
+  type WireCodec
+} from './versioned-terminal-wire'
+
+/**
+ * The second half of the cross-version contract: not "does the frame decode", but
+ * "what does the receiving build DO with what the other build publishes".
+ *
+ * A reattach whose output source must be re-established is the case this program
+ * changed. The host publishes a failure token for it, and the client turns that
+ * token into either nothing or `terminal.recoverPane` — a host-side mutation that
+ * replaces the pane's shell. Because the token is a plain string on an existing
+ * error channel, no opcode changes and no decoder rejects anything; the only way
+ * to see the skew is to run a real host build's publication into a real client
+ * build's decision.
+ */
+
+const CONNECTION_ID = 'conn-1'
+const SESSION_ID = 'pty-old'
+const RUNTIME_ENVIRONMENT_ID = 'env-1'
+const PANE_TAB_ID = 'tab-1'
+const PANE_LEAF_ID = 'pane:1'
+const PANE_WORKTREE_ID = 'wt-1'
+const PANE_HANDLE = 'terminal-1'
+const PANE_PTY_ID = `remote:${RUNTIME_ENVIRONMENT_ID}@@${PANE_HANDLE}`
+const REPLACEMENT_HANDLE = 'terminal-2'
+const DRIVE_TIMEOUT_MS = 10_000
+
+type SshProviderModule = {
+  SshPtyProvider: new (
+    connectionId: string,
+    mux: unknown
+  ) => { spawn: (options: unknown) => Promise<unknown> }
+}
+
+/**
+ * Drive a build's REAL `SshPtyProvider` through a reattach the relay answers with
+ * `sourceRecovery.restoreRequired`, and return the message that build publishes.
+ * Nothing here hardcodes a token, so the oracle moves when production moves.
+ */
+export async function capturePublishedRestoreRequiredFailure(
+  build: TerminalWireBuild
+): Promise<string> {
+  const module = (await importBuildModule(
+    build.label,
+    'main/providers/ssh-pty-provider.ts'
+  )) as unknown as SshProviderModule
+  const mux = {
+    request: vi.fn().mockResolvedValue({
+      incarnationId: 'incarnation-reattached',
+      sourceRecovery: { status: 'restoreRequired', reason: 'checkpointUnavailable' }
+    }),
+    notify: vi.fn(),
+    onNotification: vi.fn().mockReturnValue(vi.fn())
+  }
+  const provider = new module.SshPtyProvider(CONNECTION_ID, mux)
+  try {
+    await provider.spawn({ cols: 80, rows: 24, sessionId: SESSION_ID })
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error)
+  }
+  throw new Error(
+    `${build.label}: reattach with sourceRecovery=restoreRequired resolved instead of failing closed`
+  )
+}
+
+export type ClientReattachFailureOutcome = {
+  clientLabel: string
+  /** Runtime RPC methods the client called after the failure, in order. */
+  methodsAfterFailure: string[]
+  /** `terminal.recoverPane` params — a host mutation that replaces the pane's shell. */
+  paneReplacementRequests: Record<string, unknown>[]
+  /** Messages the client put on the pane's red error surface. */
+  surfacedErrors: string[]
+  /** Handles the client subscribed to, including any replacement it adopted. */
+  subscribedHandles: string[]
+  /** The client reached a genuinely connected pane before the fault was injected. */
+  connectedBeforeFault: boolean
+}
+
+type TransportModule = {
+  createRemoteRuntimePtyTransport: (
+    environmentId: string,
+    options: Record<string, unknown>
+  ) => {
+    attach: (options: Record<string, unknown>) => void
+    isConnected: () => boolean
+    destroy?: () => void
+  }
+}
+
+function paneResult(handle: string, paneKey: string, worktreeId: string): unknown {
+  const separator = paneKey.indexOf(':')
+  return {
+    ok: true,
+    result: {
+      terminal: {
+        handle,
+        tabId: paneKey.slice(0, separator),
+        leafId: paneKey.slice(separator + 1),
+        worktreeId
+      }
+    }
+  }
+}
+
+function emitSnapshot(
+  codec: WireCodec,
+  send: (bytes: Uint8Array) => void,
+  streamId: number,
+  data: string
+): void {
+  const opcodes = codec.TerminalStreamOpcode
+  send(
+    codec.encodeTerminalStreamFrame({
+      opcode: Number(opcodes.SnapshotStart),
+      streamId,
+      seq: 1,
+      payload: codec.encodeTerminalStreamJson({ kind: 'scrollback' })
+    })
+  )
+  send(
+    codec.encodeTerminalStreamFrame({
+      opcode: Number(opcodes.SnapshotChunk),
+      streamId,
+      seq: 2,
+      payload: codec.encodeTerminalStreamText(data)
+    })
+  )
+  send(
+    codec.encodeTerminalStreamFrame({
+      opcode: Number(opcodes.SnapshotEnd),
+      streamId,
+      seq: 3,
+      payload: new Uint8Array()
+    })
+  )
+}
+
+async function settle(label: string, predicate: () => boolean): Promise<void> {
+  try {
+    await vi.waitFor(() => expect(predicate()).toBe(true), {
+      timeout: DRIVE_TIMEOUT_MS,
+      interval: 5
+    })
+  } catch {
+    throw new Error(`Reattach-failure skew drive stalled at: ${label}`)
+  }
+}
+
+/**
+ * Attach one client build to a live remote pane, then fail its post-outage
+ * resubscribe with `publishedFailure` — the exact string a host build published.
+ * The fault lands on `terminal.resolvePane` over the same Electron IPC boundary
+ * the transport really uses, so every lifecycle route stays reachable.
+ */
+export async function driveClientReattachFailure(args: {
+  clientBuild: TerminalWireBuild
+  publishedFailure: string
+}): Promise<ClientReattachFailureOutcome> {
+  const { clientBuild, publishedFailure } = args
+  const codec = clientBuild.codec
+  const methodLog: string[] = []
+  const paneReplacementRequests: Record<string, unknown>[] = []
+  const surfacedErrors: string[] = []
+  const sentFrames: Uint8Array[] = []
+  let resolvePaneFailure: Error | null = null
+  let streamCallbacks: {
+    onResponse: (response: unknown) => void
+    onBinary?: (bytes: Uint8Array) => void
+    onClose?: () => void
+  } | null = null
+
+  const call = vi.fn(async (request: { method: string; params?: unknown }) => {
+    methodLog.push(request.method)
+    const params = (request.params ?? {}) as { paneKey?: string; worktreeId?: string }
+    if (request.method === 'terminal.resolvePane') {
+      const failure = resolvePaneFailure
+      if (failure) {
+        resolvePaneFailure = null
+        throw failure
+      }
+      return paneResult(PANE_HANDLE, params.paneKey ?? '', params.worktreeId ?? '')
+    }
+    if (request.method === 'terminal.recoverPane') {
+      paneReplacementRequests.push(request.params as Record<string, unknown>)
+      return paneResult(REPLACEMENT_HANDLE, params.paneKey ?? '', params.worktreeId ?? '')
+    }
+    return { ok: true, result: { terminal: { handle: PANE_HANDLE } } }
+  })
+
+  const subscribe = vi.fn(async (_args: unknown, callbacks: typeof streamCallbacks) => {
+    streamCallbacks = callbacks
+    queueMicrotask(() => callbacks?.onResponse({ ok: true, result: { type: 'ready' } }))
+    return {
+      unsubscribe: vi.fn(),
+      sendBinary: (bytes: Uint8Array) => {
+        sentFrames.push(bytes)
+      }
+    }
+  })
+
+  vi.stubGlobal('window', {
+    api: { runtimeEnvironments: { call, subscribe } },
+    location: { search: '' }
+  })
+
+  const subscribePayloads = (): { streamId: number; terminal: string }[] =>
+    sentFrames.flatMap((bytes) => {
+      const frame = codec.decodeTerminalStreamFrame(bytes)
+      if (!frame || frame.opcode !== Number(codec.TerminalStreamOpcode.Subscribe)) {
+        return []
+      }
+      const payload = codec.decodeTerminalStreamJson<{ streamId: number; terminal: string }>(
+        frame.payload
+      )
+      return payload ? [payload] : []
+    })
+
+  const module = (await importBuildModule(
+    clientBuild.label,
+    'renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts'
+  )) as unknown as TransportModule
+
+  const transport = module.createRemoteRuntimePtyTransport(RUNTIME_ENVIRONMENT_ID, {
+    worktreeId: PANE_WORKTREE_ID,
+    tabId: PANE_TAB_ID,
+    leafId: PANE_LEAF_ID
+  })
+  try {
+    transport.attach({
+      existingPtyId: PANE_PTY_ID,
+      cols: 80,
+      rows: 24,
+      callbacks: {
+        onError: (message: string) => {
+          surfacedErrors.push(message)
+        }
+      }
+    })
+    await settle('client never sent a subscribe frame', () => subscribePayloads().length >= 1)
+    const first = subscribePayloads().at(-1)
+    emitSnapshot(
+      codec,
+      (bytes) => streamCallbacks?.onBinary?.(bytes),
+      first?.streamId ?? 0,
+      'live before the fault'
+    )
+    const connectedBeforeFault = transport.isConnected()
+
+    // Only now does the pane become skew-relevant: the stream drops, and the
+    // host answers the resubscribe with the token its build publishes.
+    const methodsBeforeFault = methodLog.length
+    resolvePaneFailure = new Error(publishedFailure)
+    streamCallbacks?.onClose?.()
+    await settle(
+      'client never reacted to the failed resubscribe',
+      () =>
+        methodLog.length > methodsBeforeFault &&
+        (paneReplacementRequests.length > 0 ||
+          surfacedErrors.length > 0 ||
+          subscribePayloads().length > 1)
+    )
+
+    return {
+      clientLabel: clientBuild.label,
+      methodsAfterFailure: methodLog.slice(methodsBeforeFault),
+      paneReplacementRequests,
+      surfacedErrors,
+      subscribedHandles: subscribePayloads().map((payload) => payload.terminal),
+      connectedBeforeFault
+    }
+  } finally {
+    transport.destroy?.()
+    vi.unstubAllGlobals()
+  }
+}
+
+export const SKEW_PANE = {
+  handle: PANE_HANDLE,
+  replacementHandle: REPLACEMENT_HANDLE,
+  ptyId: PANE_PTY_ID,
+  paneKey: `${PANE_TAB_ID}:${PANE_LEAF_ID}`,
+  worktreeId: PANE_WORKTREE_ID,
+  sessionId: SESSION_ID,
+  connectionId: CONNECTION_ID
+}
diff --git a/tests/e2e/cross-version-wire/reattach-recovery-authorization-skew.ts b/tests/e2e/cross-version-wire/reattach-recovery-authorization-skew.ts
new file mode 100644
index 00000000000..65807ca1fd7
--- /dev/null
+++ b/tests/e2e/cross-version-wire/reattach-recovery-authorization-skew.ts
@@ -0,0 +1,333 @@
+import { vi } from 'vitest'
+import { importBuildModule, type TerminalWireBuild } from './versioned-terminal-wire'
+
+/**
+ * The half of the reattach-failure contract the publication skew harness cannot see.
+ *
+ * `reattach-failure-publication-skew.ts` proves what each CLIENT build DOES with a
+ * published token, but it answers `terminal.recoverPane` from a mock that always
+ * grants a replacement handle. The client's request is not the mutation — the
+ * HOST's grant is. And the host decides that from durable state it wrote itself,
+ * long before any client version is in the picture:
+ *
+ *   relay: sourceRecovery=restoreRequired (the shell is still running)
+ *     -> SshPtyProvider publishes a failure token
+ *     -> ipc/pty.ts marks the SSH lease `expired` iff that token reads as expiry
+ *     -> OrcaRuntimeService.recoverTerminalPane creates a replacement shell iff a
+ *        recent expired lease exists for the pane.
+ *
+ * So the duplicate-agent bug is host-authorized, not client-authorized, and it is
+ * reachable from ANY client version. This harness runs all three of those
+ * production decisions for one build and reports what the host actually did.
+ */
+
+const CONNECTION_ID = 'ssh-1'
+const RELAY_SESSION_ID = 'pty-live-shell'
+const REPO_ID = 'repo-1'
+const WORKTREE_PATH = '/tmp/orca-skew-worktree'
+const WORKTREE_ID = `${REPO_ID}::${WORKTREE_PATH}`
+const TAB_ID = 'tab-skew'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const PANE_KEY = `${TAB_ID}:${LEAF_ID}`
+const REPLACEMENT_HANDLE = 'term-replacement'
+const APP_PTY_ID = `ssh:${CONNECTION_ID}@@${RELAY_SESSION_ID}`
+
+type SshLease = {
+  targetId: string
+  ptyId: string
+  worktreeId: string
+  tabId: string
+  leafId: string
+  state: string
+  createdAt: number
+  updatedAt: number
+}
+
+type LeaseLedger = {
+  leases: SshLease[]
+  writes: { ptyId: string; state: string }[]
+  markSshRemotePtyLease: (targetId: string, ptyId: string, state: string) => void
+  upsertSshRemotePtyLease: (lease: Record<string, unknown>) => void
+  removeSshRemotePtyLease: (targetId: string, ptyId: string) => void
+  getSshRemotePtyLeases: () => SshLease[]
+  persistPtyBinding: (binding: Record<string, unknown>) => void
+  removePtyBinding: (ptyId: string) => void
+  getPtyBindings: () => Record<string, unknown>[]
+}
+
+/**
+ * Stands in for the sqlite lease table only. Every decision about WHAT to write
+ * and HOW to read it stays in production code on both ends.
+ */
+function createLeaseLedger(): LeaseLedger {
+  const now = Date.now()
+  const leases: SshLease[] = [
+    {
+      targetId: CONNECTION_ID,
+      ptyId: RELAY_SESSION_ID,
+      worktreeId: WORKTREE_ID,
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      state: 'attached',
+      createdAt: now,
+      updatedAt: now
+    }
+  ]
+  const writes: { ptyId: string; state: string }[] = []
+  return {
+    leases,
+    writes,
+    markSshRemotePtyLease: (targetId, ptyId, state) => {
+      writes.push({ ptyId, state })
+      const lease = leases.find((entry) => entry.targetId === targetId && entry.ptyId === ptyId)
+      if (lease) {
+        lease.state = state
+        lease.updatedAt = Date.now()
+      }
+    },
+    upsertSshRemotePtyLease: () => {},
+    removeSshRemotePtyLease: () => {},
+    getSshRemotePtyLeases: () => leases,
+    persistPtyBinding: () => {},
+    removePtyBinding: () => {},
+    getPtyBindings: () => []
+  }
+}
+
+// The repo/settings surface OrcaRuntimeService reads while resolving a pane.
+const RUNTIME_STORE_BASE = {
+  getRepo: (id: string) => RUNTIME_STORE_BASE.getRepos().find((repo) => repo.id === id),
+  getRepos: () => [
+    { id: REPO_ID, path: WORKTREE_PATH, displayName: 'repo', badgeColor: 'blue', addedAt: 1 }
+  ],
+  getAllWorktreeMeta: () => ({
+    [WORKTREE_ID]: {
+      displayName: 'skew',
+      comment: '',
+      linkedIssue: null,
+      linkedPR: null,
+      linkedLinearIssue: null,
+      linkedGitLabMR: null,
+      linkedGitLabIssue: null,
+      isArchived: false,
+      isUnread: false,
+      isPinned: false,
+      sortOrder: 0,
+      lastActivityAt: 0
+    }
+  }),
+  getWorktreeMeta: (worktreeId: string) => RUNTIME_STORE_BASE.getAllWorktreeMeta()[worktreeId],
+  getSettings: () => ({
+    workspaceDir: '/tmp/workspaces',
+    nestWorkspaces: false,
+    refreshLocalBaseRefOnWorktreeCreate: false,
+    branchPrefix: 'none',
+    branchPrefixCustom: ''
+  }),
+  getProjects: () => [],
+  getSparsePresets: () => []
+}
+
+type PtyIpcModule = {
+  registerPtyHandlers: (...args: unknown[]) => void
+  registerSshPtyProvider: (connectionId: string, provider: unknown) => void
+  unregisterSshPtyProvider: (connectionId: string) => void
+}
+
+type SshProviderModule = {
+  SshPtyProvider: new (connectionId: string, mux: unknown) => unknown
+}
+
+type RuntimeModule = {
+  OrcaRuntimeService: new (store: unknown) => {
+    registerPty: (
+      ptyId: string,
+      worktreeId: string,
+      connectionId: string | null,
+      identity: { tabId: string; leafId: string }
+    ) => void
+    resolveTerminalPane: (paneKey: string, worktreeId: string) => { handle: string }
+    onPtyExit: (ptyId: string, code: number) => void
+    createTerminal: (...args: unknown[]) => Promise<unknown>
+  }
+}
+
+export type HostRecoveryAuthorizationOutcome = {
+  hostLabel: string
+  /** Which id space the pane's PTY was registered under for this drive. */
+  runtimePtyIdSpace: 'relay' | 'app'
+  /** The token this build's real SshPtyProvider threw for a live-shell source loss. */
+  publishedFailure: string
+  /** Lease-state writes this build's real ipc/pty.ts made while failing the reattach. */
+  leaseWrites: { ptyId: string; state: string }[]
+  /** The pane's lease state after the failed reattach, as the host would persist it. */
+  leaseStateAfterFailure: string
+  /** How the host's real `terminal.recoverPane` answered the client's request. */
+  recoverPaneOutcome: 'granted' | 'refused'
+  recoverPaneError: string | null
+  /** Replacement shells the host actually created. The mutation, counted. */
+  replacementShellsCreated: number
+  /** The pane was genuinely attached before the fault, so the drive is not vacuous. */
+  attachedBeforeFault: boolean
+}
+
+/**
+ * Run one host build end to end: real SSH provider, real `pty:spawn` handler, real
+ * runtime recovery gate, real RPC dispatcher. Nothing here names a token, so the
+ * oracle tracks production rather than restating it.
+ */
+export async function driveHostRecoveryAuthorization(args: {
+  hostBuild: TerminalWireBuild
+  /**
+   * Which id the pane's PTY is registered under in the runtime graph.
+   *
+   * `ipc/pty.ts` writes the lease with the RELAY id but calls `runtime.registerPty`
+   * with the APP id (`ssh:<conn>@@<relay>`), and the recovery gate compares the two
+   * directly. `relay` is the space where a legacy grant is reachable at all; `app`
+   * is the shape production registers. Both are driven so a refusal cannot be
+   * mistaken for an id that simply never matched.
+   */
+  runtimePtyIdSpace: 'relay' | 'app'
+}): Promise<HostRecoveryAuthorizationOutcome> {
+  const { hostBuild } = args
+  const runtimePtyId = args.runtimePtyIdSpace === 'app' ? APP_PTY_ID : RELAY_SESSION_ID
+  const [ptyIpc, providerModule, runtimeModule] = (await Promise.all([
+    importBuildModule(hostBuild.label, 'main/ipc/pty.ts'),
+    importBuildModule(hostBuild.label, 'main/providers/ssh-pty-provider.ts'),
+    importBuildModule(hostBuild.label, 'main/runtime/orca-runtime.ts')
+  ])) as unknown as [PtyIpcModule, SshProviderModule, RuntimeModule]
+
+  const ledger = createLeaseLedger()
+  let attachAnswer: Record<string, unknown> = { incarnationId: 'incarnation-attached' }
+  const mux = {
+    request: vi.fn(async (method: string) => (method === 'pty.attach' ? attachAnswer : {})),
+    notify: vi.fn(),
+    onNotification: vi.fn().mockReturnValue(vi.fn())
+  }
+  const provider = new providerModule.SshPtyProvider(CONNECTION_ID, mux)
+
+  const handlers = new Map<string, (event: unknown, payload: unknown) => Promise<unknown>>()
+  const { ipcMain } = (await import('electron')) as unknown as {
+    ipcMain: { handle: { mockImplementation: (fn: unknown) => void } }
+  }
+  ipcMain.handle.mockImplementation(
+    (channel: string, handler: (event: unknown, payload: unknown) => Promise<unknown>) => {
+      handlers.set(channel, handler)
+    }
+  )
+
+  const mainWindow = {
+    isDestroyed: () => false,
+    webContents: {
+      id: 1,
+      send: vi.fn(),
+      on: vi.fn(),
+      once: vi.fn(),
+      removeListener: vi.fn(),
+      removeAllListeners: vi.fn(),
+      setBackgroundThrottling: vi.fn(),
+      isDestroyed: () => false
+    }
+  }
+
+  ptyIpc.registerSshPtyProvider(CONNECTION_ID, provider)
+  try {
+    ptyIpc.registerPtyHandlers(mainWindow, undefined, undefined, undefined, undefined, ledger)
+    const spawn = handlers.get('pty:spawn')
+    if (!spawn) {
+      throw new Error(`${hostBuild.label}: pty:spawn handler was never registered`)
+    }
+    const spawnArgs = {
+      cols: 80,
+      rows: 24,
+      env: {},
+      connectionId: CONNECTION_ID,
+      sessionId: RELAY_SESSION_ID,
+      worktreeId: WORKTREE_ID,
+      tabId: TAB_ID,
+      leafId: LEAF_ID
+    }
+
+    // The pane is genuinely attached first: a refusal below must mean the host
+    // withheld a replacement, not that nothing ever connected.
+    const attached = await spawn(null, spawnArgs)
+    const attachedBeforeFault =
+      typeof (attached as { id?: unknown })?.id === 'string' &&
+      ledger.leases[0]?.state === 'attached'
+
+    // The relay now answers the reattach the way it does for a live shell whose
+    // output source must be re-established.
+    attachAnswer = {
+      incarnationId: 'incarnation-reattached',
+      sourceRecovery: { status: 'restoreRequired', reason: 'checkpointUnavailable' }
+    }
+    let publishedFailure = ''
+    try {
+      await spawn(null, spawnArgs)
+    } catch (error) {
+      publishedFailure = error instanceof Error ? error.message : String(error)
+    }
+    if (!publishedFailure) {
+      throw new Error(
+        `${hostBuild.label}: reattach with sourceRecovery=restoreRequired resolved instead of failing closed`
+      )
+    }
+
+    // The client asks the host to replace the pane's shell. Whether that request
+    // is granted is the host's decision, and it reads the lease written above.
+    const runtime = new runtimeModule.OrcaRuntimeService({
+      ...RUNTIME_STORE_BASE,
+      getSshRemotePtyLeases: ledger.getSshRemotePtyLeases
+    })
+    runtime.registerPty(runtimePtyId, WORKTREE_ID, null, { tabId: TAB_ID, leafId: LEAF_ID })
+    const paneHandle = runtime.resolveTerminalPane(PANE_KEY, WORKTREE_ID).handle
+    runtime.onPtyExit(runtimePtyId, -1)
+    const createTerminal = vi.spyOn(runtime, 'createTerminal').mockResolvedValue({
+      handle: REPLACEMENT_HANDLE,
+      tabId: TAB_ID,
+      paneKey: PANE_KEY,
+      ptyId: 'pty-replacement',
+      worktreeId: WORKTREE_ID,
+      title: null,
+      surface: 'background'
+    })
+
+    const dispatcher = new hostBuild.host.RpcDispatcher({
+      runtime,
+      methods: hostBuild.host.TERMINAL_METHODS
+    }) as unknown as {
+      dispatch: (request: Record<string, unknown>) => Promise<Record<string, unknown>>
+    }
+    const response = await dispatcher.dispatch({
+      id: 'recover-1',
+      authToken: 'cross-version-token',
+      method: 'terminal.recoverPane',
+      params: { paneKey: PANE_KEY, worktreeId: WORKTREE_ID, expectedTerminal: paneHandle }
+    })
+    const granted = response.ok === true
+    const error = response.error as { message?: string } | undefined
+
+    return {
+      hostLabel: hostBuild.label,
+      runtimePtyIdSpace: args.runtimePtyIdSpace,
+      publishedFailure,
+      leaseWrites: ledger.writes,
+      leaseStateAfterFailure: ledger.leases[0]?.state ?? 'missing',
+      recoverPaneOutcome: granted ? 'granted' : 'refused',
+      recoverPaneError: granted ? null : (error?.message ?? String(response.error ?? 'unknown')),
+      replacementShellsCreated: createTerminal.mock.calls.length,
+      attachedBeforeFault
+    }
+  } finally {
+    ptyIpc.unregisterSshPtyProvider(CONNECTION_ID)
+    vi.restoreAllMocks()
+  }
+}
+
+export const SKEW_HOST_PANE = {
+  paneKey: PANE_KEY,
+  worktreeId: WORKTREE_ID,
+  relaySessionId: RELAY_SESSION_ID,
+  connectionId: CONNECTION_ID,
+  replacementHandle: REPLACEMENT_HANDLE
+}
diff --git a/tests/e2e/cross-version-wire/release-checkout.ts b/tests/e2e/cross-version-wire/release-checkout.ts
index 205885a5e87..069375f4c18 100644
--- a/tests/e2e/cross-version-wire/release-checkout.ts
+++ b/tests/e2e/cross-version-wire/release-checkout.ts
@@ -21,6 +21,7 @@ const CHECKOUT_FORMAT = 1
 const ARCHIVE_PATHS = ['src/main', 'src/shared', 'src/preload', 'src/renderer', 'src/types']
 
 const BASELINE_REF_ENV = 'ORCA_CROSS_VERSION_BASELINE_REF'
+const STABLE_DESKTOP_RELEASE_TAG = /^v\d+\.\d+\.\d+$/
 
 export type ReleaseCheckout = {
   /** The ref as requested, e.g. `v1.4.169`. */
@@ -61,7 +62,7 @@ function compareReleaseTags(a: string, b: string): number {
 
 /**
  * The version point the harness pairs current code against. An explicit
- * {@link BASELINE_REF_ENV} wins; otherwise the newest non-prerelease `v*` tag.
+ * {@link BASELINE_REF_ENV} wins; otherwise the newest stable desktop release tag.
  *
  * Throws rather than skipping: a cross-version lane that quietly runs nothing is
  * the exact failure this harness exists to prevent.
@@ -80,11 +81,10 @@ export function resolveBaselineReleaseRef(): string {
         `Run it inside a git checkout, or pin a ref with ${BASELINE_REF_ENV}.`
     )
   }
-  const releases = tags.filter((tag) => !tag.includes('-')).sort(compareReleaseTags)
-  const latest = releases.at(-1)
+  const latest = selectLatestStableReleaseTag(tags)
   if (!latest) {
     throw new Error(
-      `Cross-version harness found no release tags matching v[0-9]* (saw ${tags.length} tag(s) total). ` +
+      `Cross-version harness found no stable desktop release tags matching vX.Y.Z (saw ${tags.length} tag(s) total). ` +
         'CI checkouts default to a shallow clone with no tags: use `actions/checkout` with `fetch-depth: 0`, ' +
         `or pin a ref with ${BASELINE_REF_ENV}.`
     )
@@ -92,6 +92,15 @@ export function resolveBaselineReleaseRef(): string {
   return latest
 }
 
+export function selectLatestStableReleaseTag(tags: string[]): string | null {
+  return (
+    tags
+      .filter((tag) => STABLE_DESKTOP_RELEASE_TAG.test(tag))
+      .sort(compareReleaseTags)
+      .at(-1) ?? null
+  )
+}
+
 function resolveCommit(ref: string): string {
   try {
     return git(['rev-parse', `${ref}^{commit}`])
diff --git a/tests/e2e/cross-version-wire/versioned-terminal-wire.ts b/tests/e2e/cross-version-wire/versioned-terminal-wire.ts
index 6a0fd0f467b..812dc18d83a 100644
--- a/tests/e2e/cross-version-wire/versioned-terminal-wire.ts
+++ b/tests/e2e/cross-version-wire/versioned-terminal-wire.ts
@@ -1,4 +1,4 @@
-import { materializeReleaseCheckout, type ReleaseCheckout } from './release-checkout'
+import { materializeReleaseCheckout, REPO_ROOT, type ReleaseCheckout } from './release-checkout'
 
 /**
  * Structural views of the three modules that make up the remote terminal wire.
@@ -138,6 +138,22 @@ async function loadReleaseBuild(checkout: ReleaseCheckout): Promise<TerminalWire
   }
 }
 
+/**
+ * Import one `src/…`-relative module from a build. Lets a skew case reach code the
+ * fixed {@link TerminalWireBuild} surface does not name — e.g. the SSH provider that
+ * publishes a failure token, or the client that decides what to do with it.
+ */
+export async function importBuildModule(
+  ref: string,
+  pathUnderSrc: string
+): Promise<Record<string, unknown>> {
+  if (ref === WORKING_TREE) {
+    return await importFromCheckout(`${REPO_ROOT}/src/${pathUnderSrc}`)
+  }
+  const checkout = materializeReleaseCheckout(ref)
+  return await importFromCheckout(`${checkout.root}/src/${pathUnderSrc}`)
+}
+
 /**
  * Load the wire modules for one build. `WORKING_TREE` imports current source (so a
  * locally injected violation is exercised); any other value is a git ref extracted
diff --git a/tests/e2e/daemon-restart-session-liveness.spec.ts b/tests/e2e/daemon-restart-session-liveness.spec.ts
new file mode 100644
index 00000000000..fc0eeb87788
--- /dev/null
+++ b/tests/e2e/daemon-restart-session-liveness.spec.ts
@@ -0,0 +1,424 @@
+/**
+ * Journey 2 (daemon half): the same PTY — the same *OS shell process* — must
+ * survive both a client restart and a daemon restart, and an operation carrying
+ * a stale daemon generation must be refused without killing or replacing the
+ * live successor.
+ *
+ * What "daemon restart" means here, precisely: the PTY leader is a child of the
+ * daemon that spawned it, so a same-generation daemon exit takes its shells with
+ * it. The only PTY-preserving daemon restart Orca has is generation succession —
+ * a new protocol generation becomes `current` while the generation holding live
+ * sessions is preserved and stays reachable through a legacy adapter. That is
+ * the boundary these tests cross.
+ *
+ * Oracle notes:
+ *   - Identity is the OS process: the shell reports its own PID through the
+ *     production write path (`DaemonPtyRouter.write` -> daemon -> PTY) and the
+ *     PID is then resolved to a kernel start time. A same-id/new-process respawn
+ *     passes a session-id check, a `hasPty` check, and an `isReattach` check, and
+ *     fails only this one.
+ *   - Each phase uses a fresh nonce, because reattach replays scrollback and an
+ *     earlier phase's answer is still in the stream.
+ *
+ * Clause separation is deliberate — one clause per test, so a mutation that
+ * reddens one leaves the others green:
+ *   1. off-socket inventory reads `unknown`, never `dead`;
+ *   2. the same OS shell survives client quit + daemon generation restart;
+ *   3. a stale-incarnation operation is refused and the live successor is intact.
+ *
+ * Discrimination protocol (each guard removal must turn the named test red):
+ *   1. `daemon-pty-adapter.ts` `hasPty` -> `return this.activeSessionIds.has(id)`
+ *      → test 1 fails (a disconnected daemon makes a live session read dead);
+ *      tests 2 and 3 stay green.
+ *   2. `daemon-session-owner-resolution.ts` `resolveInventory` — drop
+ *      `!expectedIncarnationIsAuthoritative &&` from the sole-provider fallback
+ *      → test 3 fails (the stale-generation operation is applied); tests 1 and 2
+ *      stay green.
+ */
+
+import { randomUUID } from 'node:crypto'
+import { expect, test, type TestInfo } from '@playwright/test'
+import { DaemonPtyAdapter } from '../../src/main/daemon/daemon-pty-adapter'
+import { DaemonPtyRouter } from '../../src/main/daemon/daemon-pty-router'
+import { PROTOCOL_VERSION } from '../../src/main/daemon/types'
+import {
+  cleanupDaemonGenerationFixtures,
+  createDaemonGenerationRuntime,
+  launchDaemonGeneration,
+  type DaemonGeneration,
+  type DaemonGenerationRuntime
+} from './helpers/daemon-generation-safety-fixtures'
+import {
+  processIdentityLiveness,
+  type RecordedProcessIdentity
+} from './helpers/daemon-generation-processes'
+import {
+  disposeDaemonShellSessions,
+  readShellProcessIdentity,
+  recordSessionOutput,
+  spawnDaemonShellSession,
+  type DaemonShellSession
+} from './helpers/daemon-shell-process-identity'
+
+/** The generation that already holds live shells when the newer one starts. */
+const PRESERVED_PROTOCOL_VERSION = 23
+
+type ReattachOptions = { cwd: string; expectedIncarnationId?: string }
+
+/** Rebuilds exactly what a restarted app constructs: cold adapters, no route, no inventory. */
+function restartedAppRouter(generations: readonly DaemonGeneration[]): {
+  router: DaemonPtyRouter
+  adapters: DaemonPtyAdapter[]
+} {
+  const adapters = generations.map(
+    (generation) =>
+      new DaemonPtyAdapter({
+        socketPath: generation.socketPath,
+        tokenPath: generation.tokenPath,
+        protocolVersion: generation.protocolVersion
+      })
+  )
+  const current = adapters[0]!
+  return {
+    router: new DaemonPtyRouter({ current, legacy: adapters.slice(1) }),
+    adapters
+  }
+}
+
+/** Models the app process going away while the daemon keeps the PTY. */
+async function quitAppSideOf(shell: DaemonShellSession): Promise<void> {
+  await shell.adapter.disconnectOnly()
+  shell.adapter.dispose()
+}
+
+/** The production reattach: attach-only, never a create. */
+async function reattach(
+  router: DaemonPtyRouter,
+  sessionId: string,
+  options: ReattachOptions
+): Promise<{ id: string; isReattach?: boolean }> {
+  return await router.spawn({
+    sessionId,
+    isNewSession: false,
+    attachOnly: true,
+    cols: 200,
+    rows: 30,
+    cwd: options.cwd,
+    ...(options.expectedIncarnationId === undefined
+      ? {}
+      : {
+          expectedIncarnationId: options.expectedIncarnationId,
+          expectedIncarnationIsAuthoritative: true
+        })
+  })
+}
+
+/** Every session this daemon generation actually created or attached. */
+function sessionOwnershipEvents(generation: DaemonGeneration, sessionId: string): string[] {
+  return generation
+    .logEvents()
+    .filter(
+      (event) =>
+        event.sessionId === sessionId &&
+        (event.event === 'session-created' || event.event === 'session-attached')
+    )
+    .map((event) => String(event.event))
+}
+
+async function inspectionVerdict(router: DaemonPtyRouter, sessionId: string): Promise<string> {
+  try {
+    await router.inspectProcess(sessionId)
+    return 'resolved'
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error)
+  }
+}
+
+/** Exact incarnation, not just the PID: a recycled PID must not read as alive. */
+async function shellLeaderIsAlive(shell: DaemonShellSession): Promise<boolean> {
+  const liveness = await processIdentityLiveness([shell.rootIdentity])
+  return liveness.get(shell.rootIdentity.pid) === true
+}
+
+/** Reads the shell's own PID through the router — the production write path. */
+async function shellIdentityThroughRouter(
+  router: DaemonPtyRouter,
+  shell: DaemonShellSession,
+  phase: string
+): Promise<RecordedProcessIdentity> {
+  const recorder = recordSessionOutput(router, shell.sessionId)
+  try {
+    return await readShellProcessIdentity({
+      phase,
+      write: (data) => router.write(shell.sessionId, data),
+      readOutput: recorder.text
+    })
+  } finally {
+    recorder.stop()
+  }
+}
+
+async function cleanup(options: {
+  runtime: DaemonGenerationRuntime
+  generations: readonly DaemonGeneration[]
+  shells: readonly DaemonShellSession[]
+  adapters: readonly DaemonPtyAdapter[]
+  retainDiagnostics: boolean
+}): Promise<void> {
+  for (const adapter of options.adapters) {
+    adapter.dispose()
+  }
+  if (options.retainDiagnostics) {
+    options.runtime.retainDiagnostics(options.generations)
+  }
+  try {
+    await disposeDaemonShellSessions(options.shells)
+    await cleanupDaemonGenerationFixtures({
+      generations: options.generations,
+      canaries: []
+    })
+  } catch (error) {
+    options.runtime.retainDiagnostics(options.generations)
+    throw error
+  }
+  options.runtime.remove()
+}
+
+test.describe.configure({ mode: 'serial' })
+
+test('a restarted client reads a daemon-held PTY as unknown, never dead', async (// oxlint-disable-next-line no-empty-pattern -- Playwright requires the fixture argument before testInfo.
+{}, testInfo: TestInfo) => {
+  test.setTimeout(180_000)
+  const runtime = await createDaemonGenerationRuntime(testInfo)
+  const generations: DaemonGeneration[] = []
+  const shells: DaemonShellSession[] = []
+  let adapters: DaemonPtyAdapter[] = []
+  let assertionsComplete = false
+
+  try {
+    const daemon = await launchDaemonGeneration({
+      runtime,
+      label: `generation-v${PROTOCOL_VERSION}`,
+      protocolVersion: PROTOCOL_VERSION
+    })
+    generations.push(daemon)
+    const shell = await spawnDaemonShellSession({
+      runtime,
+      generation: daemon,
+      role: 'live'
+    })
+    shells.push(shell)
+
+    await quitAppSideOf(shell)
+    // Ground truth for every assertion below: the shell is still running.
+    expect(await shellLeaderIsAlive(shell)).toBe(true)
+
+    const restarted = restartedAppRouter(generations)
+    adapters = restarted.adapters
+    const { router } = restarted
+
+    // A restarted client has an empty session cache and a socket it has not
+    // dialled yet. Absence of evidence is not evidence of absence — the only
+    // honest answer is "unknown". Answering false hands the renderer's
+    // dead-session reconcile a licence to exit a pane whose shell is running.
+    expect(router.hasPty(shell.sessionId)).toBeNull()
+    expect(await inspectionVerdict(router, shell.sessionId)).not.toBe('terminal_gone')
+    expect(await shellLeaderIsAlive(shell)).toBe(true)
+    assertionsComplete = true
+  } finally {
+    await cleanup({
+      runtime,
+      generations,
+      shells,
+      adapters,
+      retainDiagnostics: !assertionsComplete
+    })
+  }
+})
+
+test('the same OS shell process survives a client quit and a daemon generation restart', async (// oxlint-disable-next-line no-empty-pattern -- Playwright requires the fixture argument before testInfo.
+{}, testInfo: TestInfo) => {
+  test.setTimeout(180_000)
+  const runtime = await createDaemonGenerationRuntime(testInfo)
+  const generations: DaemonGeneration[] = []
+  const shells: DaemonShellSession[] = []
+  let adapters: DaemonPtyAdapter[] = []
+  let assertionsComplete = false
+
+  try {
+    // The daemon the app is talking to when the shell is created.
+    const preserved = await launchDaemonGeneration({
+      runtime,
+      label: `generation-v${PRESERVED_PROTOCOL_VERSION}`,
+      protocolVersion: PRESERVED_PROTOCOL_VERSION
+    })
+    generations.push(preserved)
+    const shell = await spawnDaemonShellSession({
+      runtime,
+      generation: preserved,
+      role: 'live'
+    })
+    shells.push(shell)
+
+    const bootRecorder = recordSessionOutput(shell.adapter, shell.sessionId)
+    const bootIdentity = await readShellProcessIdentity({
+      phase: 'BOOT',
+      write: (data) => shell.adapter.write(shell.sessionId, data),
+      readOutput: bootRecorder.text
+    })
+    bootRecorder.stop()
+    // The PTY leader the daemon reported is the shell that just answered.
+    expect(bootIdentity.pid).toBe(shell.spawnPid)
+
+    // --- client restart boundary ---
+    await quitAppSideOf(shell)
+
+    // --- daemon restart boundary: a newer generation takes over as `current` ---
+    const successor = await launchDaemonGeneration({
+      runtime,
+      label: `generation-v${PROTOCOL_VERSION}`,
+      protocolVersion: PROTOCOL_VERSION
+    })
+    generations.unshift(successor)
+
+    const restarted = restartedAppRouter(generations)
+    adapters = restarted.adapters
+    const { router } = restarted
+
+    await router.discoverLegacySessions()
+    const reattached = await reattach(router, shell.sessionId, {
+      cwd: runtime.rootDir
+    })
+    expect(reattached).toMatchObject({ id: shell.sessionId, isReattach: true })
+
+    // The whole journey: not the same id, the same *process*. PID plus kernel
+    // start time, answered over the new connection by the shell itself.
+    expect(await shellIdentityThroughRouter(router, shell, 'AFTER_DAEMON_RESTART')).toEqual(
+      bootIdentity
+    )
+
+    // Nothing was created or adopted on the new generation.
+    expect(sessionOwnershipEvents(successor, shell.sessionId)).toEqual([])
+    expect(sessionOwnershipEvents(preserved, shell.sessionId)).toContain('session-attached')
+    assertionsComplete = true
+  } finally {
+    await cleanup({
+      runtime,
+      generations,
+      shells,
+      adapters,
+      retainDiagnostics: !assertionsComplete
+    })
+  }
+})
+
+test('a stale daemon generation operation is refused and the live successor is neither killed nor replaced', async (// oxlint-disable-next-line no-empty-pattern -- Playwright requires the fixture argument before testInfo.
+{}, testInfo: TestInfo) => {
+  test.setTimeout(180_000)
+  const runtime = await createDaemonGenerationRuntime(testInfo)
+  const generations: DaemonGeneration[] = []
+  const shells: DaemonShellSession[] = []
+  let adapters: DaemonPtyAdapter[] = []
+  let assertionsComplete = false
+
+  try {
+    const successor = await launchDaemonGeneration({
+      runtime,
+      label: `generation-v${PROTOCOL_VERSION}`,
+      protocolVersion: PROTOCOL_VERSION
+    })
+    const preserved = await launchDaemonGeneration({
+      runtime,
+      label: `generation-v${PRESERVED_PROTOCOL_VERSION}`,
+      protocolVersion: PRESERVED_PROTOCOL_VERSION
+    })
+    generations.push(successor, preserved)
+
+    // Two live shells: one held by the preserved generation, one by the
+    // successor. Skew has to leave *both* alone.
+    const preservedShell = await spawnDaemonShellSession({
+      runtime,
+      generation: preserved,
+      role: 'preserved-live'
+    })
+    const successorShell = await spawnDaemonShellSession({
+      runtime,
+      generation: successor,
+      role: 'successor-live'
+    })
+    shells.push(preservedShell, successorShell)
+
+    const bootIdentities = new Map<string, RecordedProcessIdentity>()
+    for (const shell of shells) {
+      const recorder = recordSessionOutput(shell.adapter, shell.sessionId)
+      bootIdentities.set(
+        shell.sessionId,
+        await readShellProcessIdentity({
+          phase: 'BOOT',
+          write: (data) => shell.adapter.write(shell.sessionId, data),
+          readOutput: recorder.text
+        })
+      )
+      recorder.stop()
+      await quitAppSideOf(shell)
+    }
+
+    const restarted = restartedAppRouter(generations)
+    adapters = restarted.adapters
+    const { router } = restarted
+    const successorAdapter = adapters[0]!
+    await router.discoverLegacySessions()
+
+    // Skew A — an operation aimed at the wrong generation. The successor has
+    // never seen this session; it must refuse rather than create a lookalike.
+    await expect(successorAdapter.attach(preservedShell.sessionId)).rejects.toThrow()
+    expect(sessionOwnershipEvents(successor, preservedShell.sessionId)).toEqual([])
+
+    // Skew B — an attach that carries an authoritative incarnation the owning
+    // generation cannot match. Production sends exactly this shape from
+    // `src/main/ipc/pty.ts` when runtime state pins the expected incarnation.
+    // It must fail closed, not fall back to "the only candidate I can see".
+    await expect(
+      reattach(router, preservedShell.sessionId, {
+        cwd: runtime.rootDir,
+        expectedIncarnationId: randomUUID()
+      })
+    ).rejects.toThrow()
+    await expect(
+      reattach(router, successorShell.sessionId, {
+        cwd: runtime.rootDir,
+        expectedIncarnationId: randomUUID()
+      })
+    ).rejects.toThrow()
+
+    // Refused means refused: neither live shell was killed or replaced. The
+    // exact incarnation still reattaches and the original process answers.
+    for (const shell of shells) {
+      const reattached = await reattach(router, shell.sessionId, {
+        cwd: runtime.rootDir,
+        expectedIncarnationId: shell.incarnationId
+      })
+      expect(reattached).toMatchObject({
+        id: shell.sessionId,
+        isReattach: true
+      })
+      expect(await shellIdentityThroughRouter(router, shell, 'AFTER_SKEW')).toEqual(
+        bootIdentities.get(shell.sessionId)
+      )
+    }
+
+    // The preserved generation's session never touched the successor, and the
+    // successor's own session never migrated to the preserved generation.
+    expect(sessionOwnershipEvents(successor, preservedShell.sessionId)).toEqual([])
+    expect(sessionOwnershipEvents(preserved, successorShell.sessionId)).toEqual([])
+    assertionsComplete = true
+  } finally {
+    await cleanup({
+      runtime,
+      generations,
+      shells,
+      adapters,
+      retainDiagnostics: !assertionsComplete
+    })
+  }
+})
diff --git a/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts b/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
index b9bbb621597..730ebbeffc9 100644
--- a/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
+++ b/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
@@ -62,7 +62,7 @@ const OBSERVER = {
 
 function readConfig(): FixtureConfig {
   const configIndex = process.argv.indexOf('--config')
-  const configPath = configIndex >= 0 ? process.argv[configIndex + 1] : undefined
+  const configPath = configIndex !== -1 ? process.argv[configIndex + 1] : undefined
   if (!configPath) {
     throw new Error('Legacy close client requires --config <path>')
   }
diff --git a/tests/e2e/fixtures/daemon-generation-reconnect-client.ts b/tests/e2e/fixtures/daemon-generation-reconnect-client.ts
index 28c0a6686a7..6bd163cc474 100644
--- a/tests/e2e/fixtures/daemon-generation-reconnect-client.ts
+++ b/tests/e2e/fixtures/daemon-generation-reconnect-client.ts
@@ -41,7 +41,7 @@ const MAX_OUTPUT_CHARS = 32_768
 
 function readConfig(): ClientConfig {
   const configIndex = process.argv.indexOf('--config')
-  const configPath = configIndex >= 0 ? process.argv[configIndex + 1] : undefined
+  const configPath = configIndex !== -1 ? process.argv[configIndex + 1] : undefined
   if (!configPath) {
     throw new Error('Reconnect client requires --config <path>')
   }
diff --git a/tests/e2e/fixtures/visible-tui-scroll-fixture.cjs b/tests/e2e/fixtures/visible-tui-scroll-fixture.cjs
index 3702ad21a9f..63b7683916a 100644
--- a/tests/e2e/fixtures/visible-tui-scroll-fixture.cjs
+++ b/tests/e2e/fixtures/visible-tui-scroll-fixture.cjs
@@ -12,7 +12,7 @@ const MOUSE_REPORT_PATTERN = new RegExp(`${ESC}\\[<(64|65);\\d+;\\d+M`, 'g')
 //                  at 120 reports/s) instead of minimal rows.
 const args = process.argv.slice(2)
 const logIndex = args.indexOf('--log')
-const LOG_PATH = logIndex >= 0 ? args[logIndex + 1] : null
+const LOG_PATH = logIndex !== -1 ? args[logIndex + 1] : null
 const HEAVY_FRAMES = args.includes('--heavy')
 
 let offset = 0
diff --git a/tests/e2e/git-history-tooltip-wrap.spec.ts b/tests/e2e/git-history-tooltip-wrap.spec.ts
new file mode 100644
index 00000000000..6a8c4f5895b
--- /dev/null
+++ b/tests/e2e/git-history-tooltip-wrap.spec.ts
@@ -0,0 +1,144 @@
+import { execFileSync } from 'node:child_process'
+import { rmSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { expect, test } from './helpers/orca-app'
+import { waitForSessionReady } from './helpers/store'
+import { openSourceControlForWorktree } from './helpers/worktree-registration'
+
+const subject = 'brew-install: source shared brew context before resolving prefixes'
+const reportedLine = 'Sources bin/lib/brew-context.sh, mirroring the brew-install update:'
+const conventionalLine = 'Keep this conventional commit-message body line intact through column 72'
+const unbrokenLine = `https://example.com/${'commit-message-segment-'.repeat(8)}`
+const commitMessage = `${subject}
+
+${reportedLine}
+${conventionalLine}
+${unbrokenLine}
+the resolved prefix list now feeds both the cask audit and the formula
+path checks, so a missing context aborts before any network call runs.
+
+Verified by running the full tap audit locally with both prefixes set.`
+
+function createCommitWorktree(repoPath: string): { branchName: string; worktreePath: string } {
+  const suffix = `${Date.now()}-${Math.random().toString(16).slice(2)}`
+  const branchName = `e2e-tooltip-wrap-${suffix}`
+  const worktreePath = path.join(os.tmpdir(), branchName)
+  execFileSync('git', ['worktree', 'add', worktreePath, '-b', branchName], {
+    cwd: repoPath,
+    stdio: 'pipe'
+  })
+  return { branchName, worktreePath }
+}
+
+async function cleanupCommitWorktree(
+  repoPath: string,
+  worktreePath: string,
+  branchName: string
+): Promise<void> {
+  try {
+    execFileSync('git', ['worktree', 'remove', '--force', worktreePath], {
+      cwd: repoPath,
+      stdio: 'pipe'
+    })
+  } catch {
+    rmSync(worktreePath, { recursive: true, force: true })
+    execFileSync('git', ['worktree', 'prune'], { cwd: repoPath, stdio: 'pipe' })
+  }
+  execFileSync('git', ['branch', '-D', branchName], { cwd: repoPath, stdio: 'pipe' })
+}
+
+test('keeps conventional commit-message lines intact in the history tooltip', async ({
+  orcaPage,
+  testRepoPath,
+  registerPostElectronShutdownCleanup
+}) => {
+  const fixture = createCommitWorktree(testRepoPath)
+  registerPostElectronShutdownCleanup(() =>
+    cleanupCommitWorktree(testRepoPath, fixture.worktreePath, fixture.branchName)
+  )
+  execFileSync('git', ['commit', '--allow-empty', '--file', '-'], {
+    cwd: fixture.worktreePath,
+    input: commitMessage,
+    stdio: ['pipe', 'pipe', 'pipe']
+  })
+
+  await orcaPage.setViewportSize({ width: 1440, height: 900 })
+  await waitForSessionReady(orcaPage)
+  await openSourceControlForWorktree(orcaPage, testRepoPath, fixture.worktreePath)
+
+  const commitsToggle = orcaPage.getByRole('button', { name: /Commits/ })
+  await expect(commitsToggle).toBeVisible()
+  await commitsToggle.click()
+
+  const row = orcaPage.getByTestId('git-history-row').filter({ hasText: subject })
+  await expect(row).toBeVisible({ timeout: 10_000 })
+  const trigger = row.locator('[data-slot="tooltip-trigger"]').filter({ hasText: subject })
+  await trigger.hover({ position: { x: 20, y: 10 } })
+  await trigger.hover({ position: { x: 40, y: 10 } })
+
+  const tooltip = orcaPage
+    .locator('[data-slot="tooltip-content"]')
+    .filter({ hasText: reportedLine })
+  await expect(tooltip).toBeVisible()
+  await expect(tooltip).toContainText(commitMessage)
+  await orcaPage.evaluate(async () => {
+    await document.fonts.ready
+  })
+
+  const layout = await tooltip.evaluate(
+    (element, targetLines) => {
+      const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT)
+      let textNode: Text | null = null
+      while (walker.nextNode()) {
+        const candidate = walker.currentNode as Text
+        if (targetLines.every((line) => candidate.data.includes(line))) {
+          textNode = candidate
+          break
+        }
+      }
+      if (!textNode) {
+        throw new Error('Commit message text node was not found in the tooltip')
+      }
+
+      const visualLineCounts = targetLines.map((targetLine) => {
+        const start = textNode.data.indexOf(targetLine)
+        const range = document.createRange()
+        range.setStart(textNode, start)
+        range.setEnd(textNode, start + targetLine.length)
+        const rectTops = Array.from(range.getClientRects())
+          .filter((rect) => rect.width > 0.5)
+          .map((rect) => rect.top)
+        const visualLineTops = rectTops.reduce<number[]>((tops, top) => {
+          if (!tops.some((existing) => Math.abs(existing - top) < 2)) {
+            tops.push(top)
+          }
+          return tops
+        }, [])
+        return visualLineTops.length
+      })
+
+      const style = getComputedStyle(element)
+      const tooltipRect = element.getBoundingClientRect()
+      return {
+        visualLineCounts,
+        tooltipLeft: tooltipRect.left,
+        tooltipRight: tooltipRect.right,
+        tooltipWidth: tooltipRect.width,
+        viewportWidth: window.innerWidth,
+        overflowContained: element.scrollWidth <= element.clientWidth,
+        textWrap: style.textWrap,
+        whiteSpace: style.whiteSpace
+      }
+    },
+    [reportedLine, conventionalLine]
+  )
+
+  expect(layout.whiteSpace).toBe('pre-wrap')
+  expect(layout.tooltipWidth).toBeGreaterThan(0)
+  expect(layout.tooltipLeft).toBeGreaterThanOrEqual(0)
+  expect(layout.tooltipRight).toBeLessThanOrEqual(layout.viewportWidth)
+  expect(layout.visualLineCounts).toEqual([1, 1])
+  expect(layout.overflowContained).toBe(true)
+  expect(layout.textWrap).toBe('wrap')
+})
diff --git a/tests/e2e/golden-posix-fresh-startup.spec.ts b/tests/e2e/golden-posix-fresh-startup.spec.ts
new file mode 100644
index 00000000000..ba30f550498
--- /dev/null
+++ b/tests/e2e/golden-posix-fresh-startup.spec.ts
@@ -0,0 +1,15 @@
+import { expect, test } from './helpers/orca-app'
+
+test.skip(process.platform === 'win32', 'POSIX fresh-startup golden; Windows has its own suite')
+
+test.describe('POSIX fresh startup golden', () => {
+  test.use({ dismissOnboarding: false, seedTestRepo: false })
+
+  test('fresh profile reaches onboarding normally @posix-profile-index-golden', async ({
+    orcaPage
+  }) => {
+    await expect(orcaPage.getByRole('heading', { name: /Pick your default agent/i })).toBeVisible({
+      timeout: 30_000
+    })
+  })
+})
diff --git a/tests/e2e/golden-posix-profile-index-fsync.spec.ts b/tests/e2e/golden-posix-profile-index-fsync.spec.ts
new file mode 100644
index 00000000000..d3d34d6743d
--- /dev/null
+++ b/tests/e2e/golden-posix-profile-index-fsync.spec.ts
@@ -0,0 +1,45 @@
+import { readFileSync, rmSync, statSync } from 'node:fs'
+import path from 'node:path'
+import { expect, test } from './helpers/orca-app'
+
+test.use({ seedTestRepo: false })
+test.skip(process.platform === 'win32', 'Restrictive-umask fsync regression is POSIX-only')
+
+test('recreates a fresh profile index on disk with a restrictive umask @posix-profile-index-golden', async ({
+  electronApp,
+  orcaPage
+}) => {
+  const userDataDir = await electronApp.evaluate(({ app }) => app.getPath('userData'))
+  const indexPath = path.join(userDataDir, 'orca-profile-index.json')
+  // Why: the index tmp file is written with 0o666 & ~umask, so a umask that clears
+  // owner-write is what made the pre-fix fsync open(path, 'r+') fail with EACCES.
+  const originalUmask = await electronApp.evaluate(() => process.umask(0o200))
+
+  try {
+    rmSync(indexPath, { force: true })
+    rmSync(`${indexPath}.bak`, { force: true })
+    // Why: orcaProfiles:list reads the index from disk on every call and rebuilds
+    // it when missing, so this drives the real create + fsync + rename path.
+    const listed = await orcaPage.evaluate(async () => {
+      const result = await window.api.orcaProfiles.list()
+      window.__store!.getState().openSettingsPage()
+      return result
+    })
+    expect(listed.profiles.length).toBeGreaterThan(0)
+
+    // The rebuilt index must be on disk and complete — a cached in-memory list is
+    // not proof that the restrictive-umask write survived fsync.
+    const persisted = JSON.parse(readFileSync(indexPath, 'utf-8'))
+    expect(persisted.activeProfileId).toBe(listed.activeProfileId)
+    expect(persisted.profiles.map((profile: { id: string }) => profile.id)).toEqual(
+      listed.profiles.map((profile) => profile.id)
+    )
+    // Owner-write cleared proves the file was created under the restrictive umask
+    // rather than left over from startup's normal-umask write.
+    expect(statSync(indexPath).mode & 0o200).toBe(0)
+  } finally {
+    await electronApp.evaluate((_electron, umask) => process.umask(umask), originalUmask)
+  }
+
+  await expect(orcaPage.getByPlaceholder('Search settings')).toBeVisible()
+})
diff --git a/tests/e2e/golden-windows-fresh-startup.spec.ts b/tests/e2e/golden-windows-fresh-startup.spec.ts
new file mode 100644
index 00000000000..f153f765dcd
--- /dev/null
+++ b/tests/e2e/golden-windows-fresh-startup.spec.ts
@@ -0,0 +1,12 @@
+import { expect, test } from './helpers/orca-app'
+
+test.use({ dismissOnboarding: false, seedTestRepo: false })
+test.skip(process.platform !== 'win32', 'Fresh-profile fsync regression is Windows-only')
+
+test('fresh Windows profile reaches onboarding @windows-fresh-startup-golden', async ({
+  orcaPage
+}) => {
+  await expect(orcaPage.getByRole('heading', { name: /Pick your default agent/i })).toBeVisible({
+    timeout: 30_000
+  })
+})
diff --git a/tests/e2e/helpers/completed-worker-retirement-fixture.ts b/tests/e2e/helpers/completed-worker-retirement-fixture.ts
index d1211234258..564f52e2f5f 100644
--- a/tests/e2e/helpers/completed-worker-retirement-fixture.ts
+++ b/tests/e2e/helpers/completed-worker-retirement-fixture.ts
@@ -86,7 +86,7 @@ export function readCompletedWorkerLedger(): LifecycleEvent[] {
   }
   const contents = readFileSync(lifecycleLedgerPath, 'utf8')
   const lastCompleteLine = contents.lastIndexOf('\n')
-  if (lastCompleteLine < 0) {
+  if (lastCompleteLine === -1) {
     return []
   }
   return contents
diff --git a/tests/e2e/helpers/daemon-shell-process-identity.ts b/tests/e2e/helpers/daemon-shell-process-identity.ts
new file mode 100644
index 00000000000..c0177508c1d
--- /dev/null
+++ b/tests/e2e/helpers/daemon-shell-process-identity.ts
@@ -0,0 +1,151 @@
+import { randomUUID } from 'node:crypto'
+import { DaemonPtyAdapter } from '../../../src/main/daemon/daemon-pty-adapter'
+import type { IPtyProvider } from '../../../src/main/providers/pty-provider-contract'
+import { DAEMON_GENERATION_WORKTREE_ID } from '../fixtures/daemon-generation-fixture-contract'
+import {
+  recordProcessIdentity,
+  recordProcessTree,
+  terminateRecordedTree,
+  waitForCondition,
+  type RecordedProcessIdentity
+} from './daemon-generation-processes'
+import type { DaemonGeneration, DaemonGenerationRuntime } from './daemon-generation-safety-fixtures'
+
+const MAX_CAPTURED_CHARS = 65_536
+const PROBE_WIDTH_COLS = 200
+const PROBE_HEIGHT_ROWS = 30
+
+export type DaemonShellSession = {
+  generation: DaemonGeneration
+  sessionId: string
+  adapter: DaemonPtyAdapter
+  /** The PID the daemon reported for the PTY leader at spawn time. */
+  spawnPid: number
+  rootIdentity: RecordedProcessIdentity
+  treeIdentities: RecordedProcessIdentity[]
+  incarnationId: string | undefined
+  output(): string
+}
+
+/** Buffers one session's stream off any provider that fans out `onData`. */
+export function recordSessionOutput(
+  provider: Pick<IPtyProvider, 'onData'>,
+  sessionId: string
+): { text(): string; stop(): void } {
+  let text = ''
+  const unsubscribe = provider.onData((event) => {
+    if (event.id === sessionId) {
+      text = `${text}${event.data}`.slice(-MAX_CAPTURED_CHARS)
+    }
+  })
+  return { text: () => text, stop: unsubscribe }
+}
+
+/**
+ * A real login shell under the daemon — not a fixture script. Journey 2 has to
+ * compare the *shell* the user is typing into across the restart boundary, so
+ * the PTY leader must be the shell itself.
+ */
+export async function spawnDaemonShellSession(options: {
+  runtime: DaemonGenerationRuntime
+  generation: DaemonGeneration
+  role: string
+  worktreeId?: string
+}): Promise<DaemonShellSession> {
+  const { runtime, generation, role, worktreeId = DAEMON_GENERATION_WORKTREE_ID } = options
+  // Why the durable prefix: daemon inventory infers ownership from it, so a bare
+  // id would resolve to unknown for reasons unrelated to what is under test.
+  const sessionId = `${worktreeId}@@orca-j2-${generation.label}-${role}-${randomUUID().slice(0, 8)}`
+  const adapter = new DaemonPtyAdapter({
+    socketPath: generation.socketPath,
+    tokenPath: generation.tokenPath,
+    protocolVersion: generation.protocolVersion
+  })
+  const recorder = recordSessionOutput(adapter, sessionId)
+  const result = await adapter.spawn({
+    sessionId,
+    isNewSession: true,
+    cols: PROBE_WIDTH_COLS,
+    rows: PROBE_HEIGHT_ROWS,
+    cwd: runtime.rootDir,
+    ...(process.platform === 'win32' ? { shellOverride: 'powershell.exe' } : {})
+  })
+  if (!result.pid) {
+    throw new Error(`${generation.label}-${role} shell did not expose its PTY leader PID`)
+  }
+  const rootIdentity = await recordProcessIdentity(result.pid)
+  return {
+    generation,
+    sessionId,
+    adapter,
+    spawnPid: result.pid,
+    rootIdentity,
+    treeIdentities: await recordProcessTree(rootIdentity),
+    incarnationId: result.incarnationId,
+    output: recorder.text
+  }
+}
+
+/** Disposable fixture teardown: exact-identity kills only, never a bare PID. */
+export async function disposeDaemonShellSessions(
+  shells: readonly DaemonShellSession[]
+): Promise<void> {
+  for (const shell of shells) {
+    shell.adapter.dispose()
+  }
+  if (shells.length > 0) {
+    await terminateRecordedTree(shells.flatMap((shell) => shell.treeIdentities))
+  }
+}
+
+/**
+ * Ask the live shell for its own PID over the production write path, then read
+ * the kernel's start time for that PID.
+ *
+ * Both halves are load-bearing. The write path proves *this* connection reaches
+ * a shell that is still executing; the kernel start time proves the PID was not
+ * recycled by a replacement shell. A same-id/new-process respawn passes every
+ * weaker check and fails this one.
+ */
+export async function readShellProcessIdentity(options: {
+  phase: string
+  write: (data: string) => void
+  readOutput: () => string
+  timeoutMs?: number
+}): Promise<RecordedProcessIdentity> {
+  const { phase, write, readOutput, timeoutMs = 30_000 } = options
+  // Why a per-phase nonce: reattach replays scrollback, so an earlier phase's
+  // answer is sitting in the stream and would otherwise satisfy this probe.
+  const marker = `ORCA_J2_SHELL_PID_${phase}_${randomUUID().replaceAll('-', '')}`
+  // Why match the *expanded* value: the echoed command line carries the literal
+  // `$$`/`$PID`, so only the shell's own reply contains digits.
+  const reported = new RegExp(`${marker}=(\\d+)`)
+  const command = process.platform === 'win32' ? `echo ${marker}=$PID\r` : `echo ${marker}=$$\r`
+
+  let pid: number | null = null
+  const deadline = Date.now() + timeoutMs
+  // Why re-issue: a freshly spawned shell may still be sourcing its rc files and
+  // will discard the first line. Repeats are idempotent for `echo`.
+  while (Date.now() <= deadline && pid === null) {
+    write(command)
+    try {
+      await waitForCondition(
+        `${phase} shell PID reply`,
+        () => {
+          const match = reported.exec(readOutput())
+          pid = match ? Number(match[1]) : null
+          return pid !== null
+        },
+        3_000
+      )
+    } catch {
+      // Fall through and re-issue until the outer deadline.
+    }
+  }
+  if (pid === null) {
+    throw new Error(
+      `Shell never reported its PID for phase ${phase}. Tail: ${readOutput().slice(-500)}`
+    )
+  }
+  return await recordProcessIdentity(pid)
+}
diff --git a/tests/e2e/helpers/docker-ssh-host-probe-observations.ts b/tests/e2e/helpers/docker-ssh-host-probe-observations.ts
new file mode 100644
index 00000000000..e972b082e01
--- /dev/null
+++ b/tests/e2e/helpers/docker-ssh-host-probe-observations.ts
@@ -0,0 +1,102 @@
+/**
+ * "Did anything dial this host?" — measured on the host, not in a log line the
+ * app controls.
+ *
+ * Three independent signals, because each one alone can miss a probe:
+ *  - `acceptedAuths` is cumulative (sshd's own auth log), so a connection that
+ *    opens and closes between two samples still shows up;
+ *  - `sshdSessions` catches a connection that is still open;
+ *  - `connectBridges` catches Orca's `relay.js --connect` transport even if the
+ *    sshd session were somehow invisible.
+ *
+ * `docker exec` does not go through sshd, so this helper's own probes never
+ * contaminate the counters they read.
+ */
+import { spawnSync } from 'node:child_process'
+import {
+  execDockerSshRelayTargetCommand,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+
+export type DockerSshHostProbeObservation = {
+  /** Cumulative count of completed public-key authentications since boot. */
+  acceptedAuths: number
+  /** Live `sshd: root@...` sessions right now. */
+  sshdSessions: number
+  /** Live `relay.js --connect` transport bridges right now. */
+  connectBridges: number
+  /** `kind pid cmdline` for each of the above, so a failure names the process. */
+  transportProcesses: string[]
+}
+
+// Why argv[0] and not the joined cmdline: this probe runs as `bash -lc <script>`,
+// so the script text is itself a process cmdline in /proc. Matching on the
+// joined string counts the probe as a connection — the exact false positive
+// that would make "nothing dialed this host" unfalsifiable. sshd rewrites argv[0]
+// to its session title, and the relay bridge is a node process, so both kinds are
+// identified by argv[0] plus a needle that is assembled at runtime rather than
+// written as one literal.
+const LIST_LIVE_TRANSPORT_COMMAND = `
+needle="relay.js --con""nect"
+for proc in /proc/[0-9]*; do
+  [ -r "$proc/cmdline" ] || continue
+  argv=()
+  mapfile -d '' -t argv < "$proc/cmdline" 2>/dev/null || continue
+  kind=
+  case "\${argv[0]}" in
+    "sshd: root@"*) kind=sshd ;;
+  esac
+  if [ "\${argv[0]##*/}" = node ]; then
+    case "\${argv[*]}" in *"$needle"*) kind=bridge ;; esac
+  fi
+  [ -n "$kind" ] || continue
+  printf '%s\\t%s\\t%s\\n' "$kind" "\${proc##*/}" "\${argv[*]}"
+done
+exit 0
+`
+
+function countAcceptedAuths(target: DockerSshRelayTarget): number {
+  // Why docker logs and not a file inside the container: sshd runs with -e, so
+  // its auth log is the container's stderr and cannot be truncated by anything
+  // the app does on the host. Both streams are read because that is the one
+  // sshd writes to — reading stdout alone silently returns zero forever.
+  const result = spawnSync('docker', ['logs', target.containerName], {
+    encoding: 'utf8',
+    timeout: 30_000
+  })
+  if (result.status !== 0) {
+    throw new Error(`docker logs failed for ${target.containerName}: ${result.stderr}`)
+  }
+  const logs = `${result.stdout}\n${result.stderr}`
+  return logs.split('\n').filter((line) => line.includes('Accepted publickey for')).length
+}
+
+export function readDockerSshHostProbeObservation(
+  target: DockerSshRelayTarget
+): DockerSshHostProbeObservation {
+  const acceptedAuths = countAcceptedAuths(target)
+  const output = execDockerSshRelayTargetCommand(target, LIST_LIVE_TRANSPORT_COMMAND)
+  const rows = output ? output.split('\n') : []
+  const transportProcesses: string[] = []
+  let sshdSessions = 0
+  let connectBridges = 0
+  for (const row of rows) {
+    const [kind, pid, cmdline] = row.split('\t')
+    if ((kind !== 'sshd' && kind !== 'bridge') || !pid || !cmdline) {
+      throw new Error(`Unexpected SSH transport row for ${target.containerName}: ${row}`)
+    }
+    transportProcesses.push(`${kind} ${pid} ${cmdline}`)
+    if (kind === 'sshd') {
+      sshdSessions += 1
+    } else {
+      connectBridges += 1
+    }
+  }
+  return { acceptedAuths, sshdSessions, connectBridges, transportProcesses }
+}
+
+export function describeDockerSshHostProbeObservation(
+  observation: DockerSshHostProbeObservation
+): string {
+  return `auths=${observation.acceptedAuths} sshd=${observation.sshdSessions} bridges=${observation.connectBridges} [${observation.transportProcesses.join(' | ')}]`
+}
diff --git a/tests/e2e/helpers/docker-ssh-relay-host-partition.ts b/tests/e2e/helpers/docker-ssh-relay-host-partition.ts
new file mode 100644
index 00000000000..a8815cb4131
--- /dev/null
+++ b/tests/e2e/helpers/docker-ssh-relay-host-partition.ts
@@ -0,0 +1,35 @@
+/**
+ * Whole-partition census of the PTY ids a durable workspace session names.
+ *
+ * Why not `readDurablePaneBindings`: that one is scoped to a worktree, so it
+ * can only see contamination that lands under a worktree the caller already
+ * knows about. Journey 7 has to answer "does any id belonging to host A appear
+ * anywhere under host B", which needs the whole partition.
+ */
+import type { Page } from '@stablyai/playwright-test'
+
+type DurableSession = {
+  tabsByWorktree?: Record<string, { id: string; ptyId?: string | null }[]>
+  terminalLayoutsByTabId?: Record<string, { ptyIdsByLeafId?: Record<string, string> }>
+  terminalPtyIncarnationsByPaneKey?: Record<string, string>
+}
+
+/** Every PTY id named anywhere in one durable partition, sorted. */
+export async function readDurablePartitionPtyIds(
+  page: Page,
+  partition: string | null
+): Promise<string[]> {
+  return page.evaluate(async (partition) => {
+    const session = (await window.api.session.get(partition ?? undefined)) as DurableSession | null
+    if (!session) {
+      return []
+    }
+    const tabPtyIds = Object.values(session.tabsByWorktree ?? {})
+      .flat()
+      .flatMap((tab) => (tab.ptyId ? [tab.ptyId] : []))
+    const layoutPtyIds = Object.values(session.terminalLayoutsByTabId ?? {}).flatMap((layout) =>
+      Object.values(layout.ptyIdsByLeafId ?? {})
+    )
+    return [...tabPtyIds, ...layoutPtyIds].sort()
+  }, partition)
+}
diff --git a/tests/e2e/helpers/docker-ssh-relay-processes.ts b/tests/e2e/helpers/docker-ssh-relay-processes.ts
index 769b0bd1372..cc715dcbc2a 100644
--- a/tests/e2e/helpers/docker-ssh-relay-processes.ts
+++ b/tests/e2e/helpers/docker-ssh-relay-processes.ts
@@ -151,6 +151,37 @@ export function terminateDockerSshRelay(
   )
 }
 
+// Drops the app's SSH transport the way a real network fault does: the sshd
+// session and the `relay.js --connect` bridge die, while the detached relay and
+// every shell it hosts keep running. A clean `ssh:disconnect` releases the PTY
+// sources first, so only this shape reaches the reattach-after-fault path.
+const SEVER_RELAY_TRANSPORT_COMMAND = `
+killed=0
+for proc in /proc/[0-9]*; do
+  [ -r "$proc/cmdline" ] || continue
+  argv=()
+  mapfile -d '' -t argv < "$proc/cmdline" 2>/dev/null || continue
+  joined="\${argv[*]}"
+  match=
+  case "$joined" in
+    "sshd: root@"*) match=1 ;;
+    *"relay.js --connect"*) match=1 ;;
+  esac
+  [ -n "$match" ] || continue
+  case "$joined" in *"relay.js --detached"*) continue ;; esac
+  kill -KILL "\${proc##*/}" 2>/dev/null && killed=$((killed + 1))
+done
+printf '%s' "$killed"
+`
+
+export function severDockerSshRelayTransport(target: DockerSshRelayTarget): number {
+  const killed = Number(execDockerSshRelayTargetCommand(target, SEVER_RELAY_TRANSPORT_COMMAND))
+  if (!Number.isInteger(killed) || killed <= 0) {
+    throw new Error('No Docker SSH relay transport process was severed')
+  }
+  return killed
+}
+
 export function isDockerSshRelayPidRunning(
   target: DockerSshRelayTarget,
   relayPid: number
diff --git a/tests/e2e/helpers/docker-ssh-relay-remote-ptys.ts b/tests/e2e/helpers/docker-ssh-relay-remote-ptys.ts
new file mode 100644
index 00000000000..f74d4bb4451
--- /dev/null
+++ b/tests/e2e/helpers/docker-ssh-relay-remote-ptys.ts
@@ -0,0 +1,149 @@
+import {
+  execDockerSshRelayTargetCommand,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+
+/** One live remote shell the relay is hosting on the Docker target. */
+export type DockerSshRelayRemotePty = {
+  pid: number
+  relayPid: number
+  pts: string
+  /** Kernel start time in clock ticks since boot; a recycled pid cannot match it. */
+  startTicks: number
+  paneKey: string | null
+  tabId: string | null
+  worktreeId: string | null
+}
+
+// A remote PTY is a direct child of a detached relay whose stdin is a pts —
+// node-pty's forkpty child. That excludes relay-watcher.js and every sshd
+// session, so the count is exactly "shells the relay is hosting right now".
+const LIST_RELAY_REMOTE_PTYS_COMMAND = `
+relay_pids=()
+for proc in /proc/[0-9]*; do
+  [ -r "$proc/cmdline" ] || continue
+  argv=()
+  mapfile -d '' -t argv < "$proc/cmdline" 2>/dev/null || continue
+  [ "\${argv[1]##*/}" = relay.js ] || continue
+  case " \${argv[*]:2} " in *" --detached "*) relay_pids+=("\${proc##*/}") ;; esac
+done
+[ \${#relay_pids[@]} -gt 0 ] || exit 0
+for proc in /proc/[0-9]*; do
+  [ -r "$proc/status" ] || continue
+  ppid="$(awk '/^PPid:/{print $2}' "$proc/status" 2>/dev/null)"
+  [ -n "$ppid" ] || continue
+  matched=
+  for relay in "\${relay_pids[@]}"; do
+    if [ "$relay" = "$ppid" ]; then matched=1; break; fi
+  done
+  [ -n "$matched" ] || continue
+  pts="$(readlink "$proc/fd/0" 2>/dev/null)"
+  case "$pts" in /dev/pts/*) ;; *) continue ;; esac
+  # Field 22 of /proc/pid/stat, addressed past the parenthesised comm so a name
+  # with spaces cannot shift the columns.
+  stat_line="$(cat "$proc/stat" 2>/dev/null)" || continue
+  [ -n "$stat_line" ] || continue
+  start="$(printf '%s' "\${stat_line##*) }" | awk '{print $20}')"
+  [ -n "$start" ] || continue
+  pane=; tab=; worktree=
+  [ -r "$proc/environ" ] || continue
+  while IFS= read -r -d '' entry; do
+    case "$entry" in
+      ORCA_PANE_KEY=*) pane="\${entry#ORCA_PANE_KEY=}" ;;
+      ORCA_TAB_ID=*) tab="\${entry#ORCA_TAB_ID=}" ;;
+      ORCA_WORKTREE_ID=*) worktree="\${entry#ORCA_WORKTREE_ID=}" ;;
+    esac
+  done < "$proc/environ" || continue
+  printf '%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n' "\${proc##*/}" "$ppid" "$pts" "$start" "\${pane:--}" "\${tab:--}" "\${worktree:--}"
+done
+# Why: a shell that exits a proc scan should not fail the census. /proc entries
+# vanish mid-scan, and the last one that does would otherwise leave a non-zero
+# status that discards every row already printed. Malformed rows are still
+# rejected on parse, and docker's own failures never reach this line.
+exit 0
+`
+
+function optional(value: string | undefined): string | null {
+  return value === undefined || value === '' || value === '-' ? null : value
+}
+
+export function readDockerSshRelayRemotePtys(
+  target: DockerSshRelayTarget
+): DockerSshRelayRemotePty[] {
+  const output = execDockerSshRelayTargetCommand(target, LIST_RELAY_REMOTE_PTYS_COMMAND)
+  if (!output) {
+    return []
+  }
+  return output
+    .split('\n')
+    .map((line) => {
+      const [rawPid, rawRelayPid, pts, rawStartTicks, paneKey, tabId, worktreeId] = line.split('\t')
+      const pid = Number(rawPid)
+      const relayPid = Number(rawRelayPid)
+      const startTicks = Number(rawStartTicks)
+      // Why: a vanished /proc entry must throw so expect.poll retries rather
+      // than folding a half-read row into the census as pid 0.
+      if (
+        !Number.isInteger(pid) ||
+        !Number.isInteger(relayPid) ||
+        !Number.isInteger(startTicks) ||
+        rawStartTicks === '' ||
+        !pts?.startsWith('/dev/pts/')
+      ) {
+        throw new Error(`Unexpected Docker SSH relay remote PTY row: ${line}`)
+      }
+      return {
+        pid,
+        relayPid,
+        pts,
+        startTicks,
+        paneKey: optional(paneKey),
+        tabId: optional(tabId),
+        worktreeId: optional(worktreeId)
+      }
+    })
+    .sort((left, right) => left.pid - right.pid)
+}
+
+// Why not pgrep -f: the `bash -lc` running the probe carries the marker in its
+// own cmdline and would count itself. Requiring argv[0] to be node counts only
+// the writers the panes started.
+const COUNT_REMOTE_STREAM_WRITERS_COMMAND = `
+count=0
+for proc in /proc/[0-9]*; do
+  [ -r "$proc/cmdline" ] || continue
+  argv=()
+  mapfile -d '' -t argv < "$proc/cmdline" 2>/dev/null || continue
+  [ "\${argv[0]##*/}" = node ] || continue
+  case "\${argv[*]}" in *MARKER*) count=$((count + 1)) ;; esac
+done
+printf '%s' "$count"
+`
+
+export function countDockerSshRelayRemoteStreamWriters(
+  target: DockerSshRelayTarget,
+  marker: string
+): number {
+  if (!/^[A-Za-z0-9_]+$/.test(marker)) {
+    throw new Error(`Stream marker must be shell-safe: ${marker}`)
+  }
+  const count = Number(
+    execDockerSshRelayTargetCommand(
+      target,
+      COUNT_REMOTE_STREAM_WRITERS_COMMAND.replace('MARKER', marker)
+    )
+  )
+  if (!Number.isInteger(count)) {
+    throw new Error(`Unexpected remote stream writer count for ${marker}`)
+  }
+  return count
+}
+
+export function describeDockerSshRelayRemotePtys(ptys: DockerSshRelayRemotePty[]): string {
+  return ptys
+    .map(
+      (pty) =>
+        `${pty.pid}@${pty.relayPid} ${pty.pts} start=${pty.startTicks} pane=${pty.paneKey ?? '-'}`
+    )
+    .join(', ')
+}
diff --git a/tests/e2e/helpers/docker-ssh-relay-sshd-session-cap.ts b/tests/e2e/helpers/docker-ssh-relay-sshd-session-cap.ts
new file mode 100644
index 00000000000..490ab7c4680
--- /dev/null
+++ b/tests/e2e/helpers/docker-ssh-relay-sshd-session-cap.ts
@@ -0,0 +1,64 @@
+/**
+ * The container's own view of its SSH session cap.
+ *
+ * `MaxSessions` bounds concurrent session channels *per network connection*, so
+ * a leaked connection is the observable that a cap of 1 exposes: sshd forks one
+ * `sshd: <user>@<tty>` process per authenticated connection, and that count is
+ * the number of cap slots the host is currently holding open for Orca.
+ */
+import {
+  execDockerSshRelayTargetCommand,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+
+export type DockerSshdSessionCap = {
+  /** What sshd actually enforces, read back from its effective config. */
+  maxSessions: number
+  /** One per authenticated network connection, each holding up to `maxSessions` channels. */
+  connectionPids: number[]
+}
+
+// `sshd -T` prints the effective configuration, so this reads what the daemon
+// enforces rather than what the fixture wrote into sshd_config.
+const READ_SSHD_SESSION_CAP_COMMAND = `
+/usr/sbin/sshd -T | awk '/^maxsessions /{print "max\\t" $2}'
+for proc in /proc/[0-9]*; do
+  [ -r "$proc/cmdline" ] || continue
+  argv=()
+  mapfile -d '' -t argv < "$proc/cmdline" 2>/dev/null || continue
+  case "\${argv[*]}" in
+    "sshd: "*"@"*) printf 'conn\\t%s\\n' "\${proc##*/}" ;;
+  esac
+done
+exit 0
+`
+
+export function readDockerSshdSessionCap(target: DockerSshRelayTarget): DockerSshdSessionCap {
+  const output = execDockerSshRelayTargetCommand(target, READ_SSHD_SESSION_CAP_COMMAND)
+  let maxSessions: number | null = null
+  const connectionPids: number[] = []
+  for (const line of output.split('\n')) {
+    if (!line) {
+      continue
+    }
+    const [kind, value] = line.split('\t')
+    if (kind === 'max') {
+      maxSessions = Number(value)
+      continue
+    }
+    if (kind !== 'conn') {
+      throw new Error(`Unexpected sshd session-cap row: ${line}`)
+    }
+    const pid = Number(value)
+    // Why throw: a vanished /proc entry must make the caller re-read rather than
+    // fold a half-read row into the census as connection pid 0.
+    if (!Number.isInteger(pid) || pid <= 0) {
+      throw new Error(`Unexpected sshd connection pid: ${line}`)
+    }
+    connectionPids.push(pid)
+  }
+  if (maxSessions === null || !Number.isInteger(maxSessions)) {
+    throw new Error(`sshd did not report a MaxSessions value: ${output}`)
+  }
+  return { maxSessions, connectionPids: connectionPids.sort((left, right) => left - right) }
+}
diff --git a/tests/e2e/helpers/docker-ssh-relay-stall.ts b/tests/e2e/helpers/docker-ssh-relay-stall.ts
new file mode 100644
index 00000000000..89e3e3eefba
--- /dev/null
+++ b/tests/e2e/helpers/docker-ssh-relay-stall.ts
@@ -0,0 +1,70 @@
+/**
+ * Freezes the detached relay without killing it.
+ *
+ * Why this fault and not a transport sever: a sever reconnects through the
+ * checkpoint path and never classifies a reattach failure at all (see the header
+ * of ssh-maxsessions-remote-pid-binding-identity.spec.ts). A stopped relay still
+ * holds every shell it hosts — SIGSTOP suspends one process, not its children —
+ * so a `pty.attach` aimed at it runs out its request timeout while the shell the
+ * pane owns keeps running. That is the shape STA-3077 is about: a reattach that
+ * failed, over a session that is provably still alive.
+ *
+ * SIGCONT puts it back, so the same shell can be reattached afterwards.
+ */
+import {
+  execDockerSshRelayTargetCommand,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+
+/** Guards every signal: only a detached relay may be stopped or resumed. */
+function signalDetachedRelay(
+  target: DockerSshRelayTarget,
+  relayPid: number,
+  signal: 'STOP' | 'CONT'
+): void {
+  if (!Number.isInteger(relayPid) || relayPid <= 0) {
+    throw new Error(`Docker SSH relay process ID must be a positive integer: ${relayPid}`)
+  }
+  execDockerSshRelayTargetCommand(
+    target,
+    [
+      `proc=/proc/${relayPid}`,
+      '[ -r "$proc/cmdline" ]',
+      'argv=()',
+      'mapfile -d \'\' -t argv < "$proc/cmdline"',
+      '[ "${argv[1]##*/}" = relay.js ]',
+      '[[ " ${argv[*]:2} " = *" --detached "* ]]',
+      `kill -${signal} ${relayPid}`
+    ].join(' && ')
+  )
+}
+
+export function stallDockerSshRelay(target: DockerSshRelayTarget, relayPid: number): void {
+  signalDetachedRelay(target, relayPid, 'STOP')
+  // Read the stop back off /proc rather than trusting the signal: an attach that
+  // is answered anyway would make every oracle downstream vacuous.
+  const state = execDockerSshRelayTargetCommand(
+    target,
+    `awk '/^State:/{print $2}' /proc/${relayPid}/status`
+  )
+  if (state !== 'T') {
+    throw new Error(`The detached relay did not stop; /proc reports state ${state || '<gone>'}`)
+  }
+}
+
+export function resumeDockerSshRelay(target: DockerSshRelayTarget, relayPid: number): void {
+  signalDetachedRelay(target, relayPid, 'CONT')
+}
+
+/** True while the relay process still exists, whatever state it is in. */
+export function isDockerSshRelayProcessPresent(
+  target: DockerSshRelayTarget,
+  relayPid: number
+): boolean {
+  return (
+    execDockerSshRelayTargetCommand(
+      target,
+      `test -r /proc/${relayPid}/status && echo PRESENT || echo GONE`
+    ) === 'PRESENT'
+  )
+}
diff --git a/tests/e2e/helpers/docker-ssh-relay-target.ts b/tests/e2e/helpers/docker-ssh-relay-target.ts
index 6c6f75dfc75..cc21fd65229 100644
--- a/tests/e2e/helpers/docker-ssh-relay-target.ts
+++ b/tests/e2e/helpers/docker-ssh-relay-target.ts
@@ -45,6 +45,21 @@ export function execDockerSshRelayTargetCommand(
   })
 }
 
+export function execDockerSshRelayTargetControlCommand(
+  target: DockerSshRelayTarget,
+  command: string
+): string {
+  return run('docker', [
+    'exec',
+    target.containerName,
+    'bash',
+    '--noprofile',
+    '--norc',
+    '-c',
+    command
+  ])
+}
+
 function sshArgs(target: DockerSshRelayTarget, command: string): string[] {
   return [
     '-i',
@@ -122,7 +137,23 @@ export function writeDockerSshRelayTargetFile(
   )
 }
 
-export function startDockerSshRelayTarget(testInfo: TestInfo): DockerSshRelayTarget {
+export type DockerSshRelayTargetOptions = {
+  /**
+   * `MaxSessions` for the container's sshd. OpenSSH caps *concurrent* session
+   * channels per network connection, so `1` forces every extra channel onto a
+   * new connection and makes a multiplexing failure observable instead of silent.
+   */
+  sshdMaxSessions?: number
+}
+
+export function startDockerSshRelayTarget(
+  testInfo: TestInfo,
+  options: DockerSshRelayTargetOptions = {}
+): DockerSshRelayTarget {
+  const { sshdMaxSessions } = options
+  if (sshdMaxSessions !== undefined && !Number.isInteger(sshdMaxSessions)) {
+    throw new Error(`sshdMaxSessions must be an integer: ${sshdMaxSessions}`)
+  }
   const host = process.env.ORCA_E2E_SSH_TARGET_HOST?.trim() || '127.0.0.1'
   if (host === 'localhost' || host === '::1' || host.startsWith('127.')) {
     if (process.env.ORCA_E2E_SSH_TARGET_HOST) {
@@ -158,6 +189,9 @@ export function startDockerSshRelayTarget(testInfo: TestInfo): DockerSshRelayTar
           'chmod 600 /root/.ssh/authorized_keys',
           'git config --global user.email e2e@test.local',
           'git config --global user.name "Orca Docker SSH E2E"',
+          ...(sshdMaxSessions === undefined
+            ? []
+            : [`printf '\\nMaxSessions %d\\n' ${sshdMaxSessions} >> /etc/ssh/sshd_config`]),
           'exec /usr/sbin/sshd -D -e'
         ].join(' && ')
       ],
diff --git a/tests/e2e/helpers/docker-ssh-relay-workspace-census.ts b/tests/e2e/helpers/docker-ssh-relay-workspace-census.ts
new file mode 100644
index 00000000000..7e99cc23b8c
--- /dev/null
+++ b/tests/e2e/helpers/docker-ssh-relay-workspace-census.ts
@@ -0,0 +1,111 @@
+/**
+ * Everything Journey 6 requires counted before and after a settle interval:
+ * remote processes, panes, tabs, durable bindings, leases, and session-cap slots.
+ *
+ * Each dimension is read from the place that owns it — the container for
+ * processes and cap slots, the durable session for bindings, the profile state
+ * file for leases, the renderer store for what the user can see — so no single
+ * source can make the census agree with itself while the host disagrees.
+ */
+import type { Page } from '@stablyai/playwright-test'
+import { readDurablePaneBindings } from './remote-pane-durable-session'
+import { readSshRemotePtyLeases } from './ssh-remote-pty-lease-file'
+import { readDockerSshdSessionCap } from './docker-ssh-relay-sshd-session-cap'
+import { readDockerSshRelayRemotePtys } from './docker-ssh-relay-remote-ptys'
+import type { DockerSshRelayTarget } from './docker-ssh-relay-target'
+
+export type RemoteWorkspaceCensus = {
+  /** `pid@startTicks pane=<paneKey>`; the start time keeps a recycled pid from passing. */
+  remoteShells: string[]
+  tabIds: string[]
+  /** `tabId/leafId` for every pane the user can see. */
+  paneIds: string[]
+  /** `partition tabId/leafId=ptyId` across both durable partitions. */
+  durableBindings: string[]
+  /** `leafId=state`; lease PTY ids are relay-local and unstable, leaf identity is not. */
+  leases: string[]
+  /** Authenticated sshd connections, each capped at `MaxSessions` channels. */
+  sshdConnectionCount: number
+}
+
+export type RemoteWorkspaceCensusScope = {
+  target: DockerSshRelayTarget
+  hostId: string
+  worktreeId: string
+  targetId: string
+  stateFile: string
+}
+
+async function readVisiblePanes(
+  page: Page,
+  worktreeId: string
+): Promise<{ tabIds: string[]; paneIds: string[] }> {
+  return page.evaluate((worktreeId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Store unavailable')
+    }
+    type LayoutNode =
+      | { type: 'leaf'; leafId: string }
+      | { type: 'split'; first: LayoutNode; second: LayoutNode }
+      | null
+    const collectLeafIds = (node: LayoutNode): string[] => {
+      if (!node) {
+        return []
+      }
+      return node.type === 'leaf'
+        ? [node.leafId]
+        : [...collectLeafIds(node.first), ...collectLeafIds(node.second)]
+    }
+    const tabs = state.tabsByWorktree[worktreeId] ?? []
+    const paneIds = tabs.flatMap((tab) => {
+      const leafIds = collectLeafIds(
+        (state.terminalLayoutsByTabId[tab.id]?.root ?? null) as LayoutNode
+      )
+      // `root: null` is the implicit single-pane layout a fresh tab carries until
+      // it is first split, so it still counts as one visible pane.
+      return leafIds.length > 0
+        ? leafIds.map((leafId) => `${tab.id}/${leafId}`)
+        : [`${tab.id}/<root>`]
+    })
+    return { tabIds: tabs.map((tab) => tab.id).sort(), paneIds: paneIds.sort() }
+  }, worktreeId)
+}
+
+export async function readRemoteWorkspaceCensus(
+  page: Page,
+  scope: RemoteWorkspaceCensusScope
+): Promise<RemoteWorkspaceCensus> {
+  const visible = await readVisiblePanes(page, scope.worktreeId)
+  return {
+    remoteShells: readDockerSshRelayRemotePtys(scope.target)
+      .map((pty) => `${pty.pid}@${pty.startTicks} pane=${pty.paneKey ?? '-'}`)
+      .sort(),
+    tabIds: visible.tabIds,
+    paneIds: visible.paneIds,
+    durableBindings: await readDurablePaneBindings(page, scope.hostId, scope.worktreeId),
+    leases: readSshRemotePtyLeases(scope.stateFile, scope.targetId)
+      .map((lease) => `${lease.leafId ?? '-'}=${lease.state}`)
+      .sort(),
+    sshdConnectionCount: readDockerSshdSessionCap(scope.target).connectionPids.length
+  }
+}
+
+/** The census minus the connection count, which a reconnect legitimately churns. */
+export function bindingIdentityOf(
+  census: RemoteWorkspaceCensus
+): Omit<RemoteWorkspaceCensus, 'sshdConnectionCount'> {
+  const { sshdConnectionCount: _slots, ...identity } = census
+  return identity
+}
+
+export function describeRemoteWorkspaceCensus(census: RemoteWorkspaceCensus): string {
+  return [
+    `shells=[${census.remoteShells.join(' | ')}]`,
+    `tabs=${census.tabIds.length}`,
+    `panes=[${census.paneIds.join(' | ')}]`,
+    `bindings=[${census.durableBindings.join(' | ')}]`,
+    `leases=[${census.leases.join(' | ')}]`,
+    `sshdConnections=${census.sshdConnectionCount}`
+  ].join(' ')
+}
diff --git a/tests/e2e/helpers/docker-ssh-remote-shell-identity.ts b/tests/e2e/helpers/docker-ssh-remote-shell-identity.ts
new file mode 100644
index 00000000000..7c55cd8b18c
--- /dev/null
+++ b/tests/e2e/helpers/docker-ssh-remote-shell-identity.ts
@@ -0,0 +1,112 @@
+/**
+ * Kernel identity of the shells a Docker SSH relay is hosting.
+ *
+ * Why not the pid alone: a pid proves nothing across a restart. Journey 1
+ * caught a case where every id matched while the process underneath was new,
+ * so this pairs each pid with the kernel's start time for it (field 22 of
+ * /proc/<pid>/stat, in clock ticks since boot). A respawned look-alike gets a
+ * different start time even if it reuses the pid, and the boot id makes the
+ * pair meaningless to compare across a container restart.
+ */
+import {
+  execDockerSshRelayTargetCommand,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+
+export type DockerSshRemoteShellIdentity = {
+  pid: number
+  /** Clock ticks since boot, from /proc/<pid>/stat. */
+  startTicks: number
+  bootId: string
+  paneKey: string | null
+  tabId: string | null
+  worktreeId: string | null
+}
+
+// Same shape as the remote-PTY census (a direct child of a detached relay whose
+// stdin is a pts), plus start time. Kept separate from that helper so Journey 7
+// keeps reading exactly what it reads today.
+const LIST_RELAY_SHELL_IDENTITIES_COMMAND = `
+boot="$(cat /proc/sys/kernel/random/boot_id)"
+relay_pids=()
+for proc in /proc/[0-9]*; do
+  [ -r "$proc/cmdline" ] || continue
+  argv=()
+  mapfile -d '' -t argv < "$proc/cmdline" 2>/dev/null || continue
+  [ "\${argv[1]##*/}" = relay.js ] || continue
+  case " \${argv[*]:2} " in *" --detached "*) relay_pids+=("\${proc##*/}") ;; esac
+done
+[ \${#relay_pids[@]} -gt 0 ] || exit 0
+for proc in /proc/[0-9]*; do
+  [ -r "$proc/status" ] || continue
+  ppid="$(awk '/^PPid:/{print $2}' "$proc/status" 2>/dev/null)"
+  [ -n "$ppid" ] || continue
+  matched=
+  for relay in "\${relay_pids[@]}"; do
+    if [ "$relay" = "$ppid" ]; then matched=1; break; fi
+  done
+  [ -n "$matched" ] || continue
+  pts="$(readlink "$proc/fd/0" 2>/dev/null)"
+  case "$pts" in /dev/pts/*) ;; *) continue ;; esac
+  stat_line="$(cat "$proc/stat" 2>/dev/null)" || continue
+  # Why the trailing ')' split: the comm field can contain spaces, so fields are
+  # only stable after it. starttime is field 22 overall = field 20 after comm.
+  after_comm="\${stat_line#*) }"
+  start="$(printf '%s' "$after_comm" | awk '{print $20}')"
+  [ -n "$start" ] || continue
+  pane=; tab=; worktree=
+  [ -r "$proc/environ" ] || continue
+  while IFS= read -r -d '' entry; do
+    case "$entry" in
+      ORCA_PANE_KEY=*) pane="\${entry#ORCA_PANE_KEY=}" ;;
+      ORCA_TAB_ID=*) tab="\${entry#ORCA_TAB_ID=}" ;;
+      ORCA_WORKTREE_ID=*) worktree="\${entry#ORCA_WORKTREE_ID=}" ;;
+    esac
+  done < "$proc/environ" || continue
+  printf '%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n' "\${proc##*/}" "$start" "$boot" "\${pane:--}" "\${tab:--}" "\${worktree:--}"
+done
+exit 0
+`
+
+function optional(value: string | undefined): string | null {
+  return value === undefined || value === '' || value === '-' ? null : value
+}
+
+export function readDockerSshRemoteShellIdentities(
+  target: DockerSshRelayTarget
+): DockerSshRemoteShellIdentity[] {
+  const output = execDockerSshRelayTargetCommand(target, LIST_RELAY_SHELL_IDENTITIES_COMMAND)
+  if (!output) {
+    return []
+  }
+  return output
+    .split('\n')
+    .map((line) => {
+      const [rawPid, rawStart, bootId, paneKey, tabId, worktreeId] = line.split('\t')
+      const pid = Number(rawPid)
+      const startTicks = Number(rawStart)
+      // Why throw: a half-read /proc row must make the caller's poll retry, not
+      // enter the census as pid 0 and silently satisfy an equality assertion.
+      if (!Number.isInteger(pid) || !Number.isInteger(startTicks) || !bootId) {
+        throw new Error(`Unexpected remote shell identity row: ${line}`)
+      }
+      return {
+        pid,
+        startTicks,
+        bootId,
+        paneKey: optional(paneKey),
+        tabId: optional(tabId),
+        worktreeId: optional(worktreeId)
+      }
+    })
+    .sort((left, right) => left.pid - right.pid)
+}
+
+/** Stable, comparable rendering of one host's shells: pid, start time, pane. */
+export function describeDockerSshRemoteShellIdentities(
+  identities: DockerSshRemoteShellIdentity[]
+): string[] {
+  return identities
+    .map((shell) => `${shell.pid}@${shell.startTicks}:${shell.bootId} pane=${shell.paneKey ?? '-'}`)
+    .sort()
+}
diff --git a/tests/e2e/helpers/docker-ssh-remote-shell-pid.ts b/tests/e2e/helpers/docker-ssh-remote-shell-pid.ts
new file mode 100644
index 00000000000..0f7205ae01f
--- /dev/null
+++ b/tests/e2e/helpers/docker-ssh-remote-shell-pid.ts
@@ -0,0 +1,64 @@
+/**
+ * Asks a remote pane's own shell for its pid, through the production write path.
+ *
+ * Why not read it from app state: a pane id, a leaf id and a PTY id can all
+ * match while a different process runs underneath. The shell answers on the
+ * container's filesystem, so the pid is observed where the process actually
+ * lives — and a pane that no longer reaches its shell cannot answer at all.
+ */
+import type { Page } from '@stablyai/playwright-test'
+import { expect } from '@stablyai/playwright-test'
+import { sendToTerminal } from './terminal'
+import {
+  execDockerSshRelayTargetCommand,
+  shellQuote,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+
+function readRemoteFile(target: DockerSshRelayTarget, remotePath: string): string | null {
+  try {
+    return execDockerSshRelayTargetCommand(target, `cat ${shellQuote(remotePath)}`)
+  } catch {
+    return null
+  }
+}
+
+/**
+ * `probePath` must be unique per probe: a stale file from an earlier phase would
+ * answer for a shell that is no longer there.
+ */
+export async function readRemoteShellPid(
+  page: Page,
+  target: DockerSshRelayTarget,
+  args: { ptyId: string; probePath: string; timeoutMs?: number }
+): Promise<number> {
+  if (readRemoteFile(target, args.probePath) !== null) {
+    throw new Error(`Remote shell pid probe path already exists: ${args.probePath}`)
+  }
+  // Write-then-rename: the redirect creates the file before printf fills it, and
+  // a poll that caught it empty would read pid 0.
+  await sendToTerminal(
+    page,
+    args.ptyId,
+    `printf '%s\\n' "$$" > ${args.probePath}.part && mv ${args.probePath}.part ${args.probePath}\r`
+  )
+  let pid: number | null = null
+  await expect
+    .poll(
+      () => {
+        const raw = readRemoteFile(target, args.probePath)
+        const parsed = raw === null ? Number.NaN : Number(raw.trim())
+        pid = Number.isInteger(parsed) && parsed > 0 ? parsed : null
+        return pid
+      },
+      {
+        timeout: args.timeoutMs ?? 60_000,
+        message: `Remote pane ${args.ptyId} never reported its shell pid to ${args.probePath}`
+      }
+    )
+    .not.toBeNull()
+  if (pid === null) {
+    throw new Error(`Remote pane ${args.ptyId} reported no shell pid`)
+  }
+  return pid
+}
diff --git a/tests/e2e/helpers/orca-app.ts b/tests/e2e/helpers/orca-app.ts
index b083e37f36d..434a3297df3 100644
--- a/tests/e2e/helpers/orca-app.ts
+++ b/tests/e2e/helpers/orca-app.ts
@@ -252,6 +252,7 @@ export const test = base.extend<OrcaTestFixtures, OrcaWorkerFixtures>({
         ...(headful ? { ORCA_E2E_HEADFUL: '1' } : { ORCA_E2E_HEADLESS: '1' })
       }
     })
+    forwardElectronProcessLogs(app, testInfo)
     try {
       const resolvedHome = await app.evaluate(({ app }) => app.getPath('home'))
       assertElectronResolvedIsolatedHome(resolvedHome, homeIsolation)
@@ -261,7 +262,6 @@ export const test = base.extend<OrcaTestFixtures, OrcaWorkerFixtures>({
       await removeUserDataDirAfterShutdown(userDataDir)
       throw error
     }
-    forwardElectronProcessLogs(app, testInfo)
     await provideFixture(app)
     // Why: the Playwright close promise can settle before all Electron and PTY
     // descendants are gone in CI; worker teardown then hangs on open handles.
diff --git a/tests/e2e/helpers/paired-electron-client.ts b/tests/e2e/helpers/paired-electron-client.ts
index 07bb467780f..b103cf05f76 100644
--- a/tests/e2e/helpers/paired-electron-client.ts
+++ b/tests/e2e/helpers/paired-electron-client.ts
@@ -141,7 +141,9 @@ export async function launchPairedWebClient(
 export async function launchPairedElectronClient(
   offer: RuntimeDesktopPairingOffer,
   testInfo: TestInfo,
-  name: string
+  name: string,
+  /** Repo root of the build to launch; defaults to this working tree. */
+  appRoot: string = process.cwd()
 ): Promise<PairedElectronClient> {
   const userDataDir = mkdtempSync(path.join(os.tmpdir(), 'orca-e2e-paired-desktop-'))
   const directSshProbePath = path.join(userDataDir, 'forbidden-local-ssh-connects.jsonl')
@@ -157,7 +159,7 @@ export async function launchPairedElectronClient(
     extraEnv: {},
     userDataDir
   })
-  const mainPath = path.join(process.cwd(), 'out', 'main', 'index.js')
+  const mainPath = path.join(appRoot, 'out', 'main', 'index.js')
   const app = await electron.launch({
     args: getOrcaElectronLaunchArgs(mainPath, false),
     env: {
diff --git a/tests/e2e/helpers/remote-pane-durable-session.ts b/tests/e2e/helpers/remote-pane-durable-session.ts
new file mode 100644
index 00000000000..b0cd902efc0
--- /dev/null
+++ b/tests/e2e/helpers/remote-pane-durable-session.ts
@@ -0,0 +1,58 @@
+/**
+ * Durable (main-process) view of an SSH host's terminal panes.
+ *
+ * Why durable and not the renderer store: a reconnect binds PTYs in main. A
+ * pane grafted there is invisible to the running renderer and only surfaces on
+ * the next hydration — so the renderer census cannot see the defect at all.
+ */
+import type { Page } from '@stablyai/playwright-test'
+
+/** `partition tabId/leafId=ptyId` for every pane a durable session names, sorted. */
+export type DurablePaneBindings = string[]
+
+/** Why both partitions: the renderer persists a remote worktree's panes to the
+ *  host partition, while the reconnect binding path writes the local one. A
+ *  census of either alone cannot see a pane grafted into the other. */
+const LOCAL_PARTITION = 'local'
+
+type DurableSession = {
+  tabsByWorktree?: Record<string, { id: string }[]>
+  terminalLayoutsByTabId?: Record<
+    string,
+    {
+      root: unknown
+      activeLeafId: string | null
+      expandedLeafId: string | null
+      ptyIdsByLeafId?: Record<string, string>
+    }
+  >
+  terminalPtyIncarnationsByPaneKey?: Record<string, string>
+}
+
+export function sshExecutionHostId(targetId: string): string {
+  return `ssh:${encodeURIComponent(targetId)}`
+}
+
+export async function readDurablePaneBindings(
+  page: Page,
+  hostId: string,
+  worktreeId: string
+): Promise<DurablePaneBindings> {
+  return page.evaluate(
+    async ({ hostId, worktreeId, localPartition }) => {
+      const readPartition = async (partition: string): Promise<string[]> => {
+        const session = (await window.api.session.get(
+          partition === localPartition ? undefined : partition
+        )) as DurableSession | null
+        const tabs = session?.tabsByWorktree?.[worktreeId] ?? []
+        return tabs.flatMap((tab) =>
+          Object.entries(session?.terminalLayoutsByTabId?.[tab.id]?.ptyIdsByLeafId ?? {}).map(
+            ([leafId, ptyId]) => `${partition} ${tab.id}/${leafId}=${ptyId}`
+          )
+        )
+      }
+      return [...(await readPartition(localPartition)), ...(await readPartition(hostId))].sort()
+    },
+    { hostId, worktreeId, localPartition: LOCAL_PARTITION }
+  )
+}
diff --git a/tests/e2e/helpers/remote-pane-launch-transcript.ts b/tests/e2e/helpers/remote-pane-launch-transcript.ts
new file mode 100644
index 00000000000..94918b1b69b
--- /dev/null
+++ b/tests/e2e/helpers/remote-pane-launch-transcript.ts
@@ -0,0 +1,65 @@
+/**
+ * A stand-in for an agent's transcript, recorded by the host rather than by the app.
+ *
+ * The STA-3077 report's second failure is "a coding agent was resumed twice into
+ * one transcript". Driving a real coding agent inside the Docker OpenSSH fixture
+ * is not possible — no agent binary ships in the image and no provider session
+ * exists to resume — so the observable is moved to the thing that actually goes
+ * wrong: a second shell launching for a pane that already has one. Every shell
+ * the relay starts for a pane appends one line here, keyed by pane, so "resumed
+ * twice" reads as two lines for one pane key and needs no app-side reporting to
+ * be believed.
+ *
+ * The hook is installed before the first pane exists, and each test asserts the
+ * first launch was recorded before asserting no second one was — a hook that
+ * silently failed to fire would otherwise make every clause pass vacuously.
+ */
+import {
+  execDockerSshRelayTargetCommand,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+
+const TRANSCRIPT_PATH = '/tmp/orca-pane-launch-transcript.log'
+
+// Prepended, not appended: Debian's stock /root/.bashrc returns early for a
+// non-interactive shell, and a hook placed after that guard would only fire
+// sometimes. `ORCA_PANE_KEY` is injected by the pane launch path alone, so a
+// `docker exec` probe shell adds nothing.
+const INSTALL_TRANSCRIPT_HOOK_COMMAND = `
+set -e
+hook=/root/.orca-pane-launch-transcript.sh
+cat > "$hook" <<'HOOK'
+if [ -n "$ORCA_PANE_KEY" ]; then
+  printf '%s\\t%s\\n' "$ORCA_PANE_KEY" "$$" >> ${TRANSCRIPT_PATH}
+fi
+HOOK
+touch /root/.bashrc ${TRANSCRIPT_PATH}
+if ! grep -q orca-pane-launch-transcript /root/.bashrc; then
+  printf '. %s\\n' "$hook" | cat - /root/.bashrc > /root/.bashrc.next
+  mv /root/.bashrc.next /root/.bashrc
+fi
+grep -c orca-pane-launch-transcript /root/.bashrc
+`
+
+export function installRemotePaneLaunchTranscript(target: DockerSshRelayTarget): void {
+  const installed = Number(
+    execDockerSshRelayTargetCommand(target, INSTALL_TRANSCRIPT_HOOK_COMMAND).split('\n').pop()
+  )
+  if (installed !== 1) {
+    throw new Error(`The pane launch transcript hook was not installed exactly once: ${installed}`)
+  }
+}
+
+/** Every shell launch the host recorded, oldest first, as `paneKey\tpid`. */
+export function readRemotePaneLaunchTranscript(target: DockerSshRelayTarget): string[] {
+  return execDockerSshRelayTargetCommand(target, `cat ${TRANSCRIPT_PATH} 2>/dev/null || true`)
+    .split('\n')
+    .filter((line) => line.includes('\t'))
+}
+
+/** The pids the host launched a shell for under one pane key. */
+export function readRemotePaneLaunchPids(target: DockerSshRelayTarget, paneKey: string): number[] {
+  return readRemotePaneLaunchTranscript(target)
+    .filter((line) => line.split('\t')[0] === paneKey)
+    .map((line) => Number(line.split('\t')[1]))
+}
diff --git a/tests/e2e/helpers/ssh-pane-incarnation-fault.ts b/tests/e2e/helpers/ssh-pane-incarnation-fault.ts
new file mode 100644
index 00000000000..b46bc76fa97
--- /dev/null
+++ b/tests/e2e/helpers/ssh-pane-incarnation-fault.ts
@@ -0,0 +1,74 @@
+/**
+ * Induce the one state the unreachable-pane affordance needs: the SSH target CONNECTED while
+ * exactly ONE pane's `pty.attach` fails with an error that does not prove the shell exited.
+ *
+ * Why this exists: host-side faults cannot produce it. Stalling the relay takes the whole
+ * connection down with it, so the client shows the connection-level overlay and the pane never
+ * even attempts the attach that has to fail. That is why the decisive cases sat at `fixme`.
+ *
+ * How this does produce it: the relay refuses an attach whose `expectedIncarnationId` names a
+ * different shell, with `PTY "<id>" identity mismatch` — per-pty, connection untouched, and
+ * explicitly never grounds a respawn. Rewriting the pane's RECORDED incarnation while the app is
+ * closed makes the next attach carry an expectation the host cannot match, so the relay refuses
+ * that one pane and nothing else.
+ *
+ * This is the same shape as the real failure it stands in for: a replaced relay reissues ids from
+ * `pty-1`, so the shell now answering to a pane's id is not the shell the pane recorded.
+ */
+import { readFileSync, writeFileSync } from 'node:fs'
+
+/** Not a UUID the host could ever mint, so a match would mean the fence did not run. */
+export const FOREIGN_PTY_INCARNATION = 'incarnation-from-a-relay-that-is-not-this-one'
+
+type MutablePersistedState = {
+  workspaceSession?: {
+    terminalPtyIncarnationsByPaneKey?: Record<string, string>
+  }
+  sshRemotePtyLeases?: { targetId: string; ptyId: string; incarnationId?: string }[]
+}
+
+/**
+ * Point the pane's recorded shell identity at a shell the host does not have.
+ *
+ * Both homes are rewritten because the two attach routes read different ones: the pane-driven
+ * restore sends the binding's incarnation, the relay-session reconnect sends the lease's. Leaving
+ * either untouched would let that route attach cleanly and the pane would never reach the card.
+ *
+ * Call only while the app is closed — the running app holds this state in memory and would
+ * overwrite the file on its next flush.
+ */
+export function recordForeignShellIdentityForPane(
+  stateFile: string,
+  paneKey: string,
+  targetId: string
+): {
+  paneIncarnationBefore: string | undefined
+  leasesRewritten: number
+  /** Everything the state file actually held, so a miss reports why instead of just failing. */
+  diagnostics: string
+} {
+  const state = JSON.parse(readFileSync(stateFile, 'utf-8')) as MutablePersistedState
+  const incarnations = (state.workspaceSession ??= {}).terminalPtyIncarnationsByPaneKey ?? {}
+  const paneIncarnationBefore = incarnations[paneKey]
+  incarnations[paneKey] = FOREIGN_PTY_INCARNATION
+  state.workspaceSession.terminalPtyIncarnationsByPaneKey = incarnations
+
+  let leasesRewritten = 0
+  for (const lease of state.sshRemotePtyLeases ?? []) {
+    if (lease.targetId === targetId) {
+      lease.incarnationId = FOREIGN_PTY_INCARNATION
+      leasesRewritten += 1
+    }
+  }
+
+  writeFileSync(stateFile, `${JSON.stringify(state, null, 2)}\n`, 'utf-8')
+  const knownPaneKeys = Object.keys(incarnations)
+  const leases = (state.sshRemotePtyLeases ?? []).map(
+    (lease) => `${lease.targetId}/${lease.ptyId}${lease.incarnationId ? '@known' : '@none'}`
+  )
+  return {
+    paneIncarnationBefore,
+    leasesRewritten,
+    diagnostics: `paneKey=${paneKey} incarnationKeys=[${knownPaneKeys.join(', ')}] leases=[${leases.join(', ')}]`
+  }
+}
diff --git a/tests/e2e/helpers/ssh-remote-pty-lease-file.ts b/tests/e2e/helpers/ssh-remote-pty-lease-file.ts
new file mode 100644
index 00000000000..167d29c10da
--- /dev/null
+++ b/tests/e2e/helpers/ssh-remote-pty-lease-file.ts
@@ -0,0 +1,62 @@
+/**
+ * Durable SSH remote-PTY leases, read straight off the profile state file.
+ *
+ * Why the file: no renderer channel exposes leases, and the lease is the only
+ * record that says whether reconnect's reattach fan-out actually reached a
+ * given remote PTY. Without it, a reattach that silently skipped a PTY looks
+ * exactly like a reattach that correctly refused to bind it.
+ */
+import type { ElectronApplication } from '@stablyai/playwright-test'
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import type { SshRemotePtyLease } from '../../../src/shared/ssh-types'
+
+/** Path of the running app's active-profile state file. */
+export async function resolveOrcaProfileStateFile(app: ElectronApplication): Promise<string> {
+  const userDataPath = await app.evaluate(({ app }) => app.getPath('userData'))
+  const indexPath = path.join(userDataPath, 'orca-profile-index.json')
+  if (existsSync(indexPath)) {
+    const activeProfileId = (
+      JSON.parse(readFileSync(indexPath, 'utf-8')) as {
+        activeProfileId?: string
+      }
+    ).activeProfileId
+    const profileFile = activeProfileId
+      ? path.join(userDataPath, 'profiles', activeProfileId, 'orca-data.json')
+      : null
+    if (profileFile && existsSync(profileFile)) {
+      return profileFile
+    }
+  }
+  // Pre-profile layout: the state file sits directly under userData.
+  const legacyFile = path.join(userDataPath, 'orca-data.json')
+  if (existsSync(legacyFile)) {
+    return legacyFile
+  }
+  throw new Error(`No Orca profile state file under ${userDataPath}`)
+}
+
+export function readSshRemotePtyLeases(stateFile: string, targetId: string): SshRemotePtyLease[] {
+  const parsed = JSON.parse(readFileSync(stateFile, 'utf-8')) as {
+    sshRemotePtyLeases?: SshRemotePtyLease[]
+  }
+  return (parsed.sshRemotePtyLeases ?? []).filter((lease) => lease.targetId === targetId)
+}
+
+/** The lease a pane owns, by pane identity — lease `ptyId`s are relay-local and unstable across ids. */
+export function findSshRemotePtyLeaseForLeaf(
+  stateFile: string,
+  targetId: string,
+  leafId: string
+): SshRemotePtyLease | undefined {
+  return readSshRemotePtyLeases(stateFile, targetId).find((lease) => lease.leafId === leafId)
+}
+
+export function describeSshRemotePtyLeases(leases: readonly SshRemotePtyLease[]): string {
+  return leases
+    .map(
+      (lease) =>
+        `${lease.ptyId} ${lease.state} leaf=${lease.leafId ?? '-'} attachedAt=${lease.lastAttachedAt ?? '-'}`
+    )
+    .join(', ')
+}
diff --git a/tests/e2e/helpers/startup-exec-readiness-oracle.ts b/tests/e2e/helpers/startup-exec-readiness-oracle.ts
new file mode 100644
index 00000000000..48b2928ed6d
--- /dev/null
+++ b/tests/e2e/helpers/startup-exec-readiness-oracle.ts
@@ -0,0 +1,274 @@
+import { rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import type { Page } from '@stablyai/playwright-test'
+import type {
+  RuntimeTerminalListResult,
+  RuntimeTerminalRead,
+  RuntimeTerminalShow
+} from '../../../src/shared/runtime-types'
+import { toWebTerminalSurfaceTabId } from '../../../src/shared/terminal-surface-id'
+import { expect } from './orca-app'
+import { getTerminalContent, waitForActivePanePtyId } from './terminal'
+
+const RECOVERY_DEADLINE_MS = 8_000
+
+export type StartupExecTerminal = {
+  hostPtyId: string
+  panePtyId: string
+  parentTabId: string
+  startupMarker: string
+  tabId: string
+  terminal: string
+  worktreeId: string
+}
+
+export type BashExecProfileBarrier = {
+  releasePath: string
+  startedPath: string
+}
+
+const BASH_EXEC_LINE = 'exec -a figterm-sta4067 /bin/bash --noprofile --norc -l -i'
+const ZSH_EXEC_LINE = 'exec -a figterm-sta4067 /bin/zsh -o noglobalrcs -l -i'
+
+function execProfileContents(
+  runId: string,
+  execLine: string,
+  barrier?: BashExecProfileBarrier
+): string {
+  const guard = `ORCA_STA4067_EXEC_${runId.replaceAll(/[^A-Za-z0-9_]/g, '_')}`
+  const barrierScript = barrier
+    ? [
+        `: > ${shellQuote(barrier.startedPath)}`,
+        `while [[ ! -e ${shellQuote(barrier.releasePath)} ]]; do sleep 0.02; done`
+      ].join('\n  ')
+    : ''
+  return `if [[ -z "\${${guard}:-}" ]]; then
+  export ${guard}=1
+  ${barrierScript}
+  ${execLine}
+fi
+`
+}
+
+export function bashExecProfileContents(runId: string, barrier?: BashExecProfileBarrier): string {
+  return execProfileContents(runId, BASH_EXEC_LINE, barrier)
+}
+
+export function zshExecProfileContents(runId: string, barrier?: BashExecProfileBarrier): string {
+  return execProfileContents(runId, ZSH_EXEC_LINE, barrier)
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", `'\\''`)}'`
+}
+
+function splitMarker(marker: string): [string, string] {
+  const midpoint = Math.floor(marker.length / 2)
+  return [marker.slice(0, midpoint), marker.slice(midpoint)]
+}
+
+function markerCommand(marker: string): string {
+  const [left, right] = splitMarker(marker)
+  return `printf '%s%s\\n' ${shellQuote(left)} ${shellQuote(right)}`
+}
+
+function count(text: string, marker: string): number {
+  return text.split(marker).length - 1
+}
+
+async function expectSingleOwningPty(
+  page: Page,
+  worktreeId: string,
+  tabId: string,
+  terminal: string,
+  ptyId: string
+): Promise<void> {
+  const listed = await callStartupExecRuntime<RuntimeTerminalListResult>(page, 'terminal.list', {
+    worktree: `id:${worktreeId}`,
+    requireFreshPtyLiveness: true
+  })
+  expect(
+    listed.terminals
+      .filter((candidate) => candidate.tabId === tabId)
+      .map((candidate) => ({ handle: candidate.handle, ptyId: candidate.ptyId }))
+  ).toEqual([{ handle: terminal, ptyId }])
+}
+
+export async function callStartupExecRuntime<TResult>(
+  page: Page,
+  method: string,
+  params: unknown
+): Promise<TResult> {
+  return page.evaluate(
+    async ({ method, params }) => {
+      const response = await window.api.runtime.call({ method, params })
+      if (!response.ok) {
+        throw new Error(`${response.error.code}: ${response.error.message}`)
+      }
+      return response.result
+    },
+    { method, params }
+  ) as Promise<TResult>
+}
+
+export function installBashExecProfile(
+  homePath: string,
+  runId: string,
+  barrier?: BashExecProfileBarrier
+): () => void {
+  const profilePath = path.join(homePath, '.bash_profile')
+  writeFileSync(profilePath, bashExecProfileContents(runId, barrier))
+  return () => rmSync(profilePath, { force: true })
+}
+
+export function installZshExecProfile(
+  homePath: string,
+  runId: string,
+  barrier?: BashExecProfileBarrier
+): () => void {
+  const profilePath = path.join(homePath, '.zprofile')
+  writeFileSync(profilePath, zshExecProfileContents(runId, barrier))
+  return () => rmSync(profilePath, { force: true })
+}
+
+export async function createStartupExecTerminal(
+  page: Page,
+  worktreeId: string,
+  runId: string,
+  ledgerPath: string,
+  tabIdNamespace: 'owning-client' | 'paired-client',
+  shell: '/bin/bash' | '/bin/zsh' = '/bin/bash',
+  shellEnv: Record<string, string> = {}
+): Promise<StartupExecTerminal> {
+  const startupMarker = `STA4067_STARTUP_READY_${runId}`
+  const command = [
+    `printf '%s|%s\\n' "$$" "$(tty)" > ${shellQuote(ledgerPath)}`,
+    markerCommand(startupMarker)
+  ].join('; ')
+  const created = await callStartupExecRuntime<{
+    tab: { parentTabId: string; terminal: string | null }
+  }>(page, 'session.tabs.createTerminal', {
+    worktree: `id:${worktreeId}`,
+    command,
+    env: { ...shellEnv, SHELL: shell },
+    startupCommandDelivery: 'shell-ready',
+    activate: false,
+    select: false,
+    navigation: 'caller'
+  })
+  if (!created.tab.terminal) {
+    throw new Error('Startup-exec terminal did not publish an authoritative handle')
+  }
+  const terminal = created.tab.terminal
+  const tabId =
+    tabIdNamespace === 'paired-client'
+      ? toWebTerminalSurfaceTabId(created.tab.parentTabId)
+      : created.tab.parentTabId
+  await page.evaluate((id) => window.__store?.getState().setActiveWorktree(id), worktreeId)
+  const tab = page.locator(`[data-testid="sortable-tab"][data-tab-id="${tabId}"]`)
+  await expect(tab).toBeVisible({ timeout: 30_000 })
+  await tab.click()
+  await expect(tab).toHaveAttribute('data-active', 'true')
+  const panePtyId = await waitForActivePanePtyId(page, 30_000)
+  const shown = await callStartupExecRuntime<{ terminal: RuntimeTerminalShow }>(
+    page,
+    'terminal.show',
+    { terminal }
+  )
+  if (!shown.terminal.ptyId) {
+    throw new Error('Startup-exec terminal has no owning PTY identity')
+  }
+  await expectSingleOwningPty(
+    page,
+    worktreeId,
+    created.tab.parentTabId,
+    terminal,
+    shown.terminal.ptyId
+  )
+  return {
+    hostPtyId: shown.terminal.ptyId,
+    panePtyId,
+    parentTabId: created.tab.parentTabId,
+    startupMarker,
+    tabId,
+    terminal,
+    worktreeId
+  }
+}
+
+async function readTerminal(page: Page, terminal: string): Promise<RuntimeTerminalRead> {
+  return (
+    await callStartupExecRuntime<{ terminal: RuntimeTerminalRead }>(page, 'terminal.read', {
+      terminal
+    })
+  ).terminal
+}
+
+export async function expectStartupExecRecovery(
+  page: Page,
+  created: StartupExecTerminal,
+  runId: string
+): Promise<void> {
+  await expect
+    .poll(() => readTerminal(page, created.terminal), { timeout: RECOVERY_DEADLINE_MS })
+    .toMatchObject({
+      tail: expect.arrayContaining([expect.stringContaining(created.startupMarker)])
+    })
+  await expect
+    .poll(() => getTerminalContent(page), { timeout: RECOVERY_DEADLINE_MS })
+    .toContain(created.startupMarker)
+  const painted = await getTerminalContent(page)
+  expect(count(painted, created.startupMarker)).toBe(1)
+
+  const authoritative = await readTerminal(page, created.terminal)
+  expect(authoritative.status).toBe('running')
+  expect(count(authoritative.tail.join('\n'), created.startupMarker)).toBe(1)
+  const shown = await callStartupExecRuntime<{ terminal: RuntimeTerminalShow }>(
+    page,
+    'terminal.show',
+    { terminal: created.terminal }
+  )
+  expect(shown.terminal).toMatchObject({
+    connected: true,
+    ptyId: created.hostPtyId,
+    writable: true
+  })
+  await expectSingleOwningPty(
+    page,
+    created.worktreeId,
+    created.parentTabId,
+    created.terminal,
+    created.hostPtyId
+  )
+
+  const inputMarker = `STA4067_FIRST_INPUT_${runId}`
+  const textarea = page.locator('.xterm-helper-textarea:visible').first()
+  await textarea.focus()
+  await page.keyboard.type(markerCommand(inputMarker))
+  await page.keyboard.press('Enter')
+  await expect
+    .poll(() => getTerminalContent(page), { timeout: RECOVERY_DEADLINE_MS })
+    .toContain(inputMarker)
+  expect(count(await getTerminalContent(page), inputMarker)).toBe(1)
+  expect(count((await readTerminal(page, created.terminal)).tail.join('\n'), inputMarker)).toBe(1)
+  expect(await waitForActivePanePtyId(page, 30_000)).toBe(created.panePtyId)
+}
+
+export async function expectStartupCommandQueuedByCompatibilityFallback(
+  page: Page,
+  created: StartupExecTerminal
+): Promise<void> {
+  const [commandEchoMarker] = splitMarker(created.startupMarker)
+  await expect
+    .poll(() => readTerminal(page, created.terminal), { timeout: RECOVERY_DEADLINE_MS })
+    .toMatchObject({ tail: expect.arrayContaining([expect.stringContaining(commandEchoMarker)]) })
+  expect(
+    count((await readTerminal(page, created.terminal)).tail.join('\n'), commandEchoMarker)
+  ).toBe(1)
+}
+
+export async function closeStartupExecTerminal(page: Page, terminal: string | null): Promise<void> {
+  if (terminal) {
+    await callStartupExecRuntime(page, 'terminal.closeTab', { terminal }).catch(() => undefined)
+  }
+}
diff --git a/tests/e2e/helpers/unbound-remote-pty-lease.ts b/tests/e2e/helpers/unbound-remote-pty-lease.ts
new file mode 100644
index 00000000000..6d4b201d60b
--- /dev/null
+++ b/tests/e2e/helpers/unbound-remote-pty-lease.ts
@@ -0,0 +1,109 @@
+/**
+ * Seeds the divergence STA-3077 is about: a live remote PTY whose lease names a
+ * pane that no durable session holds.
+ *
+ * Why seeded and not induced: the field induction is "close a pane while the
+ * link is down and hope `pty:kill` fails". It does not — once the severed
+ * transport tears the SSH providers down, `pty:kill` takes its tombstone branch
+ * and terminates the lease, so reattach never fans out over it and any oracle
+ * downstream passes vacuously. Here the PTY is spawned against a leaf that
+ * never becomes a pane, and the durable pane record the spawn minted is rolled
+ * back, so the precondition holds by construction with no race in it.
+ */
+import type { Page } from '@stablyai/playwright-test'
+import { expect } from '@stablyai/playwright-test'
+import { readDurablePaneBindings } from './remote-pane-durable-session'
+
+export type UnboundRemotePtyLease = {
+  /** Leaf the lease names. No pane, in either partition, ever claims it. */
+  leafId: string
+  /** App-scoped PTY id the spawn returned. */
+  ptyId: string
+}
+
+type DurableWorkspaceSession = Record<string, unknown>
+
+async function readDurableWorkspaceSession(
+  page: Page,
+  hostId: string
+): Promise<DurableWorkspaceSession> {
+  const session = await page.evaluate(
+    async (hostId) => (await window.api.session.get(hostId)) as DurableWorkspaceSession | null,
+    hostId
+  )
+  if (!session) {
+    throw new Error(`No durable workspace session for ${hostId}`)
+  }
+  return session
+}
+
+/**
+ * Full-partition replace, the same shape the renderer's own snapshot write uses.
+ * That is deliberate: it is how a durable pane record actually disappears in the
+ * field, and it leaves the lease and the remote shell untouched.
+ */
+async function restoreDurableWorkspaceSession(
+  page: Page,
+  hostId: string,
+  session: DurableWorkspaceSession
+): Promise<void> {
+  await page.evaluate(
+    async ({ hostId, session }) => {
+      await window.api.session.set(session as never, hostId)
+    },
+    { hostId, session }
+  )
+}
+
+export async function seedUnboundRemotePtyLease(
+  page: Page,
+  args: {
+    targetId: string
+    hostId: string
+    worktreeId: string
+    tabId: string
+    leafId: string
+    cols?: number
+    rows?: number
+  }
+): Promise<UnboundRemotePtyLease> {
+  // Captured before the spawn so the rollback restores a layout that provably
+  // predates the leaf, rather than one edited to look like it does.
+  const sessionBeforeSpawn = await readDurableWorkspaceSession(page, args.hostId)
+  const ptyId = await page.evaluate(
+    async ({ targetId, worktreeId, tabId, leafId, cols, rows }) => {
+      const result = await window.api.pty.spawn({
+        cols: cols ?? 80,
+        rows: rows ?? 24,
+        cwdFallback: 'worktree',
+        connectionId: targetId,
+        worktreeId,
+        tabId,
+        leafId
+      })
+      return result.id
+    },
+    {
+      targetId: args.targetId,
+      worktreeId: args.worktreeId,
+      tabId: args.tabId,
+      leafId: args.leafId,
+      cols: args.cols ?? 80,
+      rows: args.rows ?? 24
+    }
+  )
+  await restoreDurableWorkspaceSession(page, args.hostId, sessionBeforeSpawn)
+  await expect
+    .poll(
+      async () =>
+        (await readDurablePaneBindings(page, args.hostId, args.worktreeId)).filter((binding) =>
+          binding.includes(args.leafId)
+        ).length,
+      {
+        timeout: 30_000,
+        message: 'a durable partition still named the seeded leaf after the rollback'
+      }
+    )
+    .toBe(0)
+  return { leafId: args.leafId, ptyId }
+}
diff --git a/tests/e2e/korean-ime-terminal-shift-enter-commit.spec.ts b/tests/e2e/korean-ime-terminal-shift-enter-commit.spec.ts
index 208e79a8928..1ddfd56adb4 100644
--- a/tests/e2e/korean-ime-terminal-shift-enter-commit.spec.ts
+++ b/tests/e2e/korean-ime-terminal-shift-enter-commit.spec.ts
@@ -339,7 +339,7 @@ async function dispatchPlainEnter(session: CDPSession): Promise<void> {
 async function readPromptLine(page: Page): Promise<string> {
   const content = stripTerminalControls(await getTerminalContent(page, 20_000))
   const promptIndex = content.lastIndexOf(PROMPT)
-  if (promptIndex < 0) {
+  if (promptIndex === -1) {
     return ''
   }
   return (content.slice(promptIndex + PROMPT.length).split(/\r?\n/)[0] ?? '').trimEnd()
diff --git a/tests/e2e/linear-url-workspace-entry.spec.ts b/tests/e2e/linear-url-workspace-entry.spec.ts
new file mode 100644
index 00000000000..ccdf1d00c4a
--- /dev/null
+++ b/tests/e2e/linear-url-workspace-entry.spec.ts
@@ -0,0 +1,230 @@
+import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import type { LinearIssue } from '../../src/shared/types'
+
+const LINEAR_URL =
+  'https://linear.app/stably/issue/STA-4084/restore-osc-133-shell-integration-when-an-exec-in-user-rc-files-strips'
+const EXPECTED_WORKSPACE_NAME = 'sta-4084-restore-osc-133-shell-integration-when'
+
+const LINEAR_ISSUE: LinearIssue = {
+  id: 'linear-sta-4084',
+  workspaceId: 'workspace-1',
+  workspaceName: 'Stably',
+  identifier: 'STA-4084',
+  title: 'Restore OSC 133 shell integration when an exec in user rc files strips',
+  branchName: 'sta-4084-restore-osc-133-shell-integration',
+  url: LINEAR_URL,
+  state: { name: 'Todo', type: 'unstarted', color: '#999999' },
+  team: { id: 'team-sta', name: 'Stably', key: 'STA' },
+  labels: [],
+  labelIds: [],
+  priority: 2,
+  estimate: null,
+  updatedAt: '2026-08-12T00:00:00.000Z'
+}
+
+function pasteChord(): string {
+  return process.platform === 'darwin' ? 'Meta+V' : 'Control+V'
+}
+
+async function installLinearFixture(
+  page: Page,
+  issue: LinearIssue | null = LINEAR_ISSUE,
+  lookupDelayMs: number | null = 150
+): Promise<void> {
+  await page.evaluate(
+    ({ resolvedIssue, lookupDelayMs }) => {
+      Reflect.deleteProperty(window, '__orcaTestReleaseLinearLookup')
+      const store = window.__store
+      if (!store) {
+        throw new Error('window.__store is not available')
+      }
+      store.setState({
+        linearStatus: {
+          connected: true,
+          viewer: null,
+          activeWorkspaceId: 'workspace-other',
+          selectedWorkspaceId: 'workspace-other',
+          workspaces: [
+            {
+              id: 'workspace-other',
+              displayName: 'Other User',
+              email: null,
+              organizationId: 'organization-other',
+              organizationName: 'Other',
+              organizationUrlKey: 'other'
+            },
+            {
+              id: 'workspace-1',
+              displayName: 'Stably User',
+              email: null,
+              organizationId: 'organization-stably',
+              organizationName: 'Stably',
+              organizationUrlKey: 'stably'
+            }
+          ]
+        },
+        linearStatusChecked: true,
+        checkLinearConnection: async () => {},
+        searchLinearIssues: async () => [],
+        listLinearIssues: async () => ({ items: [] }),
+        fetchLinearIssue: async (_identifier: string, workspaceId?: string | null) => {
+          await (lookupDelayMs === null
+            ? new Promise<void>((resolve) => {
+                Reflect.set(window, '__orcaTestReleaseLinearLookup', resolve)
+              })
+            : new Promise<void>((resolve) => window.setTimeout(resolve, lookupDelayMs)))
+          return resolvedIssue && workspaceId === resolvedIssue.workspaceId ? resolvedIssue : null
+        }
+      })
+    },
+    { resolvedIssue: issue, lookupDelayMs }
+  )
+}
+
+async function releaseHeldLinearLookup(page: Page): Promise<void> {
+  await page.evaluate(() => {
+    const release = Reflect.get(window, '__orcaTestReleaseLinearLookup')
+    if (typeof release !== 'function') {
+      throw new Error('Linear lookup is not held')
+    }
+    Reflect.deleteProperty(window, '__orcaTestReleaseLinearLookup')
+    release()
+  })
+}
+
+async function pasteLinearUrl(page: Page, input: ReturnType<Page['locator']>): Promise<void> {
+  await page.evaluate((text) => window.api.ui.writeClipboardText(text), LINEAR_URL)
+  await input.focus()
+  await page.keyboard.press(pasteChord())
+}
+
+async function openJumpPalette(electronApp: ElectronApplication): Promise<void> {
+  // Headless Playwright keys bypass Electron's before-input-event shortcut path.
+  await electronApp.evaluate(({ BrowserWindow }) => {
+    BrowserWindow.getAllWindows()[0]?.webContents.send('ui:toggleWorktreePalette')
+  })
+}
+
+test.describe('Linear URL workspace entry', () => {
+  test.beforeEach(async ({ orcaPage }) => {
+    await waitForSessionReady(orcaPage)
+    await waitForActiveWorktree(orcaPage)
+    await installLinearFixture(orcaPage)
+  })
+
+  test('pasting into the composer selects the Linear issue without ArrowDown', async ({
+    orcaPage
+  }, testInfo) => {
+    await installLinearFixture(orcaPage, LINEAR_ISSUE, null)
+    await orcaPage.getByRole('button', { name: 'New workspace', exact: true }).click()
+    const dialog = orcaPage.getByRole('dialog', { name: /Create (Workspace|Worktree)/i })
+    const input = dialog.locator('[data-workspace-name-input="true"]')
+    await expect(input).toBeVisible()
+
+    await pasteLinearUrl(orcaPage, input)
+    await expect
+      .poll(() =>
+        orcaPage.evaluate(
+          () => typeof Reflect.get(window, '__orcaTestReleaseLinearLookup') === 'function'
+        )
+      )
+      .toBe(true)
+    await input.press('Enter')
+    await expect(input).toHaveValue(LINEAR_URL)
+    await expect(dialog.locator('[data-workspace-source-pill="true"]')).toHaveCount(0)
+    await releaseHeldLinearLookup(orcaPage)
+
+    const issueRow = orcaPage.getByRole('option', {
+      name: `${LINEAR_ISSUE.identifier} ${LINEAR_ISSUE.title}`,
+      exact: true
+    })
+    const useNameRow = orcaPage.getByRole('option', {
+      name: `Use "${LINEAR_URL}" as workspace name`,
+      exact: true
+    })
+    await expect(useNameRow).toBeVisible()
+    await expect(useNameRow).not.toHaveAttribute('data-selected', 'true')
+    await expect(issueRow).toContainText(LINEAR_ISSUE.title)
+    await expect(issueRow).toHaveAttribute('data-selected', 'true')
+    await testInfo.attach('linear-url-smart-entry-selected.png', {
+      body: await dialog.screenshot(),
+      contentType: 'image/png'
+    })
+
+    await input.press('Enter')
+    const sourcePill = dialog.locator('[data-workspace-source-pill="true"]')
+    await expect(sourcePill).toContainText(LINEAR_ISSUE.title)
+    await expect(dialog.getByPlaceholder('Workspace name')).toHaveValue(EXPECTED_WORKSPACE_NAME)
+    await expect(dialog.getByRole('button', { name: /Create (Workspace|Worktree)/i })).toBeEnabled()
+    await testInfo.attach('linear-url-smart-entry-composer.png', {
+      body: await dialog.screenshot(),
+      contentType: 'image/png'
+    })
+  })
+
+  test('a Linear URL lookup miss falls back to an arbitrary workspace name', async ({
+    orcaPage
+  }) => {
+    await installLinearFixture(orcaPage, null)
+    await orcaPage.getByRole('button', { name: 'New workspace', exact: true }).click()
+    const dialog = orcaPage.getByRole('dialog', { name: /Create (Workspace|Worktree)/i })
+    const input = dialog.locator('[data-workspace-name-input="true"]')
+
+    await pasteLinearUrl(orcaPage, input)
+    const useNameRow = orcaPage.getByRole('option', {
+      name: `Use "${LINEAR_URL}" as workspace name`,
+      exact: true
+    })
+    await expect(useNameRow).toHaveAttribute('data-selected', 'true')
+    await expect(input).not.toHaveAttribute('aria-busy', 'true')
+
+    await input.press('Enter')
+    await expect(input).toHaveValue(LINEAR_URL)
+    await expect(dialog.locator('[data-workspace-source-pill="true"]')).toHaveCount(0)
+    const suggestions = dialog.locator('[data-workspace-source-suggestions="true"]')
+    if (await suggestions.isVisible()) {
+      await input.press('Escape')
+    }
+    await expect(input).not.toHaveAttribute('aria-busy', 'true')
+    await input.press('Enter')
+    await expect(dialog.locator('[data-agent-combobox-root="true"][role="combobox"]')).toBeFocused()
+  })
+
+  test('pasting into Cmd+J previews the Linear issue and opens the linked composer', async ({
+    electronApp,
+    orcaPage
+  }, testInfo) => {
+    await openJumpPalette(electronApp)
+    const palette = orcaPage.getByRole('dialog', { name: 'Jump to...' })
+    const input = palette.getByPlaceholder(
+      'Search chats, terminals, worktrees, settings, and actions...'
+    )
+    await expect(input).toBeVisible()
+
+    await pasteLinearUrl(orcaPage, input)
+
+    const preview = palette.locator(
+      '[data-cmd-j-linear-issue-preview="true"][data-cmd-j-linear-issue-state="resolved"]'
+    )
+    await expect(preview).toContainText(LINEAR_ISSUE.identifier)
+    await expect(preview).toContainText(LINEAR_ISSUE.title)
+    await expect(preview).toHaveAttribute('data-selected', 'true')
+    await testInfo.attach('linear-url-cmd-j-preview.png', {
+      body: await palette.screenshot(),
+      contentType: 'image/png'
+    })
+
+    await input.press('Enter')
+    const dialog = orcaPage.getByRole('dialog', { name: /Create (Workspace|Worktree)/i })
+    const sourcePill = dialog.locator('[data-workspace-source-pill="true"]')
+    await expect(sourcePill).toContainText(LINEAR_ISSUE.title)
+    await expect(dialog.getByPlaceholder('Workspace name')).toHaveValue(EXPECTED_WORKSPACE_NAME)
+    await expect(dialog.getByRole('button', { name: /Create (Workspace|Worktree)/i })).toBeEnabled()
+    await testInfo.attach('linear-url-cmd-j-composer.png', {
+      body: await dialog.screenshot(),
+      contentType: 'image/png'
+    })
+  })
+})
diff --git a/tests/e2e/local-terminal-restart-binding-identity.spec.ts b/tests/e2e/local-terminal-restart-binding-identity.spec.ts
new file mode 100644
index 00000000000..ad0b01de9ce
--- /dev/null
+++ b/tests/e2e/local-terminal-restart-binding-identity.spec.ts
@@ -0,0 +1,325 @@
+/**
+ * Journey 1 (local half): the same pane, the same durable PTY binding, and the
+ * same OS shell process must survive a renderer reload and a full app restart,
+ * and a stale exact operation naming an older pane generation must be rejected
+ * rather than applied.
+ *
+ * Oracle notes:
+ *   - Process identity is the *OS* process, checked by PID **and** kernel start
+ *     time (`ps -o lstart=`), so a recycled PID cannot pass as "survived".
+ *   - The stale operation is a real `session:set` payload of the shape an
+ *     older/lagging renderer publishes when its snapshot predates the spawn
+ *     commit (issue #217): live layout, empty `ptyIdsByLeafId`. Main must keep
+ *     the durable binding instead of letting the stale write erase it.
+ *   - Asserting the *binding* alone would not discriminate: with the daemon
+ *     torn down at quit, the pane and the PTY id both come back identical and
+ *     only the OS process differs. A persisted row is not a live process.
+ *
+ * Discrimination protocol (each guard removal must turn the named test red):
+ *   1. `src/main/index.ts` will-quit — force `shutdownDaemon()` instead of
+ *      `isDevParentShutdownRequested() ? shutdownDaemon() : disconnectDaemon()`
+ *      → the reload/restart test fails on a changed shell PID.
+ *   2. `src/main/persistence.ts` `setLocalWorkspaceSession` — delete the
+ *      `restorableBindings` reconciliation → the stale-write test fails with an
+ *      erased `ptyIdsByLeafId` entry, while test 1 stays green.
+ *
+ * Run with an isolated `TMPDIR`: the seeded-repo pointer lives at
+ * `os.tmpdir()/orca-e2e-test-repo-path.txt`, so a concurrent e2e run on the
+ * same machine deletes this run's repo mid-test.
+ */
+
+import { execFileSync } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { TEST_REPO_PATH_FILE } from './global-setup'
+import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
+import {
+  discoverActivePtyId,
+  execInTerminal,
+  getTerminalContent,
+  readPaneIdentitySnapshot,
+  waitForActiveTerminalManager,
+  waitForPaneCount
+} from './helpers/terminal'
+import {
+  ensureTerminalVisible,
+  getActiveWorktreeId,
+  waitForActiveWorktree,
+  waitForSessionReady
+} from './helpers/store'
+
+// Why: two Electron launches per test; serial keeps the profile lock and the
+// daemon handoff interpretable when something fails.
+test.describe.configure({ mode: 'serial' })
+
+type PaneBinding = {
+  tabId: string
+  leafId: string
+  ptyId: string
+}
+
+type OsProcessIdentity = {
+  pid: number
+  startedAt: string
+}
+
+function seededRepoPathOrSkip(): string {
+  const repoPath = existsSync(TEST_REPO_PATH_FILE)
+    ? readFileSync(TEST_REPO_PATH_FILE, 'utf-8').trim()
+    : ''
+  test.skip(!repoPath || !existsSync(repoPath), 'Global setup did not produce a seeded test repo')
+  return repoPath
+}
+
+/** Kernel-reported start time; distinguishes a survivor from a recycled PID. */
+function readOsProcessIdentity(pid: number): OsProcessIdentity {
+  // Why two probes: `ps` does not exist on Windows, and a PID alone cannot tell
+  // a survivor from a reused number — both platforms must report a start time.
+  const startedAt = (
+    process.platform === 'win32'
+      ? execFileSync(
+          'powershell.exe',
+          [
+            '-NoProfile',
+            '-Command',
+            `(Get-Process -Id ${pid} -ErrorAction SilentlyContinue).StartTime.ToString('o')`
+          ],
+          { encoding: 'utf8' }
+        )
+      : execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8' })
+  )
+    .trim()
+    .replace(/\s+/g, ' ')
+  if (!startedAt) {
+    throw new Error(`PID ${pid} is not alive`)
+  }
+  return { pid, startedAt }
+}
+
+async function readPaneBinding(page: Page): Promise<PaneBinding> {
+  // Why poll: the binding is read off a DOM dataset attribute, and a reload
+  // remounts the pane before it republishes. A single read here failed every
+  // run on a slower host while the app was demonstrably healthy — the
+  // assertion is unchanged, it is just awaited.
+  await expect
+    .poll(async () => (await readPaneIdentitySnapshot(page))?.panes[0]?.ptyId ?? null, {
+      timeout: 30_000,
+      message: 'No bound terminal pane is mounted'
+    })
+    .not.toBeNull()
+  const snapshot = await readPaneIdentitySnapshot(page)
+  const pane = snapshot?.panes[0]
+  if (!snapshot || !pane?.ptyId) {
+    throw new Error('No bound terminal pane is mounted')
+  }
+  return { tabId: snapshot.tabId, leafId: pane.leafId, ptyId: pane.ptyId }
+}
+
+/**
+ * Ask the live shell for its own PID. `$$` is the shell process itself, so an
+ * equal value across a restart means the daemon handed back the same process,
+ * not a look-alike respawn.
+ */
+async function readShellProcessIdentity(
+  page: Page,
+  ptyId: string,
+  phase: string
+): Promise<OsProcessIdentity> {
+  const marker = `ORCA_SHELL_PID_${phase}`
+  // Why: the echoed command line also contains the marker, so match the
+  // *expanded* value — only the shell's own output carries digits.
+  const reported = new RegExp(`${marker}=(\\d+)`)
+  // `$$` is POSIX; PowerShell exposes the same thing as `$PID`.
+  await execInTerminal(
+    page,
+    ptyId,
+    process.platform === 'win32' ? `echo ${marker}=$PID` : `echo ${marker}=$$`
+  )
+  let pid: number | null = null
+  await expect
+    .poll(
+      async () => {
+        const match = (await getTerminalContent(page, 20_000)).match(reported)
+        pid = match ? Number(match[1]) : null
+        return pid !== null
+      },
+      {
+        timeout: 20_000,
+        message: `Shell never reported its PID for phase ${phase}`
+      }
+    )
+    .toBe(true)
+  return readOsProcessIdentity(pid!)
+}
+
+async function readPersistedPaneBinding(
+  page: Page,
+  binding: PaneBinding
+): Promise<string | undefined> {
+  return page.evaluate(
+    async ({ tabId, leafId }) =>
+      (await window.api.session.get())?.terminalLayoutsByTabId?.[tabId]?.ptyIdsByLeafId?.[leafId],
+    { tabId: binding.tabId, leafId: binding.leafId }
+  )
+}
+
+async function settleRestoredLaunch(page: Page, expectedWorktreeId: string): Promise<void> {
+  await waitForSessionReady(page)
+  await expect.poll(() => getActiveWorktreeId(page), { timeout: 30_000 }).toBe(expectedWorktreeId)
+  await ensureTerminalVisible(page)
+  await waitForActiveTerminalManager(page, 30_000)
+  await waitForPaneCount(page, 1, 30_000)
+}
+
+type BootstrappedPane = {
+  worktreeId: string
+  binding: PaneBinding
+  process: OsProcessIdentity
+}
+
+async function bootstrapBoundPane(page: Page, repoPath: string): Promise<BootstrappedPane> {
+  const worktreeId = await attachRepoAndOpenTerminal(page, repoPath)
+  await waitForSessionReady(page)
+  await waitForActiveWorktree(page)
+  await ensureTerminalVisible(page)
+  await waitForActiveTerminalManager(page, 30_000)
+  await waitForPaneCount(page, 1, 30_000)
+
+  const ptyId = await discoverActivePtyId(page)
+  const binding = await readPaneBinding(page)
+  expect(binding.ptyId).toBe(ptyId)
+  return {
+    worktreeId,
+    binding,
+    process: await readShellProcessIdentity(page, ptyId, 'BOOT')
+  }
+}
+
+async function reloadRenderer(page: Page, worktreeId: string): Promise<void> {
+  await page.reload()
+  await page.waitForLoadState('domcontentloaded')
+  await page.waitForFunction(() => Boolean(window.__store), null, {
+    timeout: 30_000
+  })
+  await settleRestoredLaunch(page, worktreeId)
+}
+
+function expectSamePane(actual: PaneBinding, expected: PaneBinding): void {
+  expect(actual.ptyId).toBe(expected.ptyId)
+  expect(actual.leafId).toBe(expected.leafId)
+  expect(actual.tabId).toBe(expected.tabId)
+}
+
+test.describe('Local terminal pane/binding/process identity across restart', () => {
+  test('the same pane, PTY binding, and OS shell process survive renderer reload and app restart', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+    const session = createRestartSession(testInfo)
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+
+    try {
+      const first = await session.launch()
+      firstApp = first.app
+      const {
+        worktreeId,
+        binding,
+        process: bootProcess
+      } = await bootstrapBoundPane(first.page, repoPath)
+
+      await reloadRenderer(first.page, worktreeId)
+      expectSamePane(await readPaneBinding(first.page), binding)
+      expect(await readShellProcessIdentity(first.page, binding.ptyId, 'RELOAD')).toEqual(
+        bootProcess
+      )
+
+      await session.close(firstApp)
+      firstApp = null
+
+      const second = await session.launch()
+      secondApp = second.app
+      await settleRestoredLaunch(second.page, worktreeId)
+      expectSamePane(await readPaneBinding(second.page), binding)
+      expect(await readPersistedPaneBinding(second.page, binding)).toBe(binding.ptyId)
+      expect(await readShellProcessIdentity(second.page, binding.ptyId, 'RESTART')).toEqual(
+        bootProcess
+      )
+    } finally {
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+    }
+  })
+
+  test('a stale pre-spawn session write is rejected instead of retiring the live pane binding', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+    const session = createRestartSession(testInfo)
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+
+    try {
+      const first = await session.launch()
+      firstApp = first.app
+      const {
+        worktreeId,
+        binding,
+        process: bootProcess
+      } = await bootstrapBoundPane(first.page, repoPath)
+
+      // A lagging renderer republishes a snapshot taken before the spawn
+      // committed: the pane is still live, but it carries no binding at all.
+      const staleWriteDelivered = await first.page.evaluate(async (tabId: string) => {
+        const current = await window.api.session.get()
+        const layout = current?.terminalLayoutsByTabId?.[tabId]
+        if (!layout || Object.keys(layout.ptyIdsByLeafId ?? {}).length === 0) {
+          return false
+        }
+        await window.api.session.set({
+          ...current,
+          terminalLayoutsByTabId: {
+            ...current.terminalLayoutsByTabId,
+            [tabId]: { ...layout, ptyIdsByLeafId: {} }
+          }
+        })
+        await window.api.session.flush()
+        return true
+      }, binding.tabId)
+      expect(staleWriteDelivered).toBe(true)
+
+      expect(await readPersistedPaneBinding(first.page, binding)).toBe(binding.ptyId)
+
+      // The rejection has to hold through both restore boundaries, or the pane
+      // comes back cold on a different OS process.
+      await reloadRenderer(first.page, worktreeId)
+      expectSamePane(await readPaneBinding(first.page), binding)
+      expect(await readShellProcessIdentity(first.page, binding.ptyId, 'RELOAD')).toEqual(
+        bootProcess
+      )
+
+      await session.close(firstApp)
+      firstApp = null
+
+      const second = await session.launch()
+      secondApp = second.app
+      await settleRestoredLaunch(second.page, worktreeId)
+      expectSamePane(await readPaneBinding(second.page), binding)
+      expect(await readShellProcessIdentity(second.page, binding.ptyId, 'RESTART')).toEqual(
+        bootProcess
+      )
+    } finally {
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+    }
+  })
+})
diff --git a/tests/e2e/multi-client-navigation-isolation.spec.ts b/tests/e2e/multi-client-navigation-isolation.spec.ts
index 399ae5d963f..2c1018a75fa 100644
--- a/tests/e2e/multi-client-navigation-isolation.spec.ts
+++ b/tests/e2e/multi-client-navigation-isolation.spec.ts
@@ -1,5 +1,7 @@
 import { execFileSync } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
+import { mkdtempSync, rmSync } from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
@@ -176,3 +178,98 @@ test('keeps two paired browser clients and the host on independent worktrees', a
     await clientA?.close()
   }
 })
+
+test('shows only provider-backed creation actions in paired web', async ({
+  electronApp,
+  orcaPage
+}, testInfo) => {
+  const visibleWorktreeId = await orcaPage.evaluate(
+    () => window.__store?.getState().activeWorktreeId
+  )
+  if (!visibleWorktreeId) {
+    throw new Error('Host worktree was not active before paired web validation')
+  }
+
+  const offer = await createPairingOffer(orcaPage)
+  const client = await openPairedClient(electronApp, offer, visibleWorktreeId)
+  try {
+    await selectWorktree(client, visibleWorktreeId)
+    await expect
+      .poll(() =>
+        client.evaluate(() => {
+          const state = window.__store?.getState()
+          const worktree = state
+            ?.allWorktrees()
+            .find((candidate) => candidate.id === state.activeWorktreeId)
+          const environmentId = worktree?.runtimeOwnerEnvironmentId
+          return environmentId
+            ? state.runtimeStatusByEnvironmentId
+                .get(environmentId)
+                ?.status.capabilities?.includes('browser.screencast.v1') === true
+            : false
+        })
+      )
+      .toBe(true)
+
+    await client.getByRole('button', { name: 'New tab' }).first().click()
+    await expect(client.getByRole('menuitem', { name: /New Terminal/i })).toBeVisible()
+    await expect(client.getByRole('menuitem', { name: /New Browser Tab/i })).toBeVisible()
+    await expect(client.getByRole('menuitem', { name: /New Markdown/i })).toBeVisible()
+    await expect(client.getByRole('menuitem', { name: /Mobile Emulator/i })).toHaveCount(0)
+
+    const screenshotPath = testInfo.outputPath('paired-web-provider-backed-create-menu.png')
+    await client.screenshot({ path: screenshotPath })
+    await testInfo.attach('paired-web-provider-backed-create-menu', {
+      path: screenshotPath,
+      contentType: 'image/png'
+    })
+  } finally {
+    await client.close()
+  }
+})
+
+test('routes Add Project folder browsing through the paired host', async ({
+  electronApp,
+  orcaPage,
+  registerPostElectronShutdownCleanup
+}) => {
+  const hostFolder = mkdtempSync(path.join(os.tmpdir(), 'orca-paired-web-folder-'))
+  const folderName = path.basename(hostFolder)
+  registerPostElectronShutdownCleanup(async () => {
+    rmSync(hostFolder, { recursive: true, force: true })
+  })
+  const visibleWorktreeId = await orcaPage.evaluate(
+    () => window.__store?.getState().activeWorktreeId
+  )
+  if (!visibleWorktreeId) {
+    throw new Error('Host worktree was not active before paired web validation')
+  }
+
+  const offer = await createPairingOffer(orcaPage)
+  const client = await openPairedClient(electronApp, offer, visibleWorktreeId)
+  try {
+    await client
+      .getByRole('button', { name: /Add Project/i })
+      .first()
+      .click()
+    const addDialog = client.getByRole('dialog', { name: /Add a project/i })
+    await expect(addDialog).toBeVisible()
+    await expect(addDialog).not.toContainText('Local Mac')
+
+    await addDialog.getByRole('button', { name: /Browse folder/i }).click()
+    const browser = client.getByRole('dialog', { name: /Browse host filesystem/i })
+    await expect(browser).toBeVisible()
+    await expect(browser.getByRole('button', { name: /Select folder/i })).toBeVisible()
+    await browser.getByRole('button', { name: /^Cancel$/i }).click()
+
+    const manualPathDialog = client.getByRole('dialog', { name: /Open host project/i })
+    await manualPathDialog.locator('#server-project-path').fill(hostFolder)
+    await manualPathDialog.getByRole('button', { name: /Open as Folder/i }).click()
+    await expect(manualPathDialog).toBeHidden({ timeout: 30_000 })
+    await expect(
+      client.locator('[data-worktree-sidebar]').getByText(folderName, { exact: true }).first()
+    ).toBeVisible({ timeout: 30_000 })
+  } finally {
+    await client.close()
+  }
+})
diff --git a/tests/e2e/orchestration-worker-settlement-release-cli.spec.ts b/tests/e2e/orchestration-worker-settlement-release-cli.spec.ts
new file mode 100644
index 00000000000..33ea97e13b0
--- /dev/null
+++ b/tests/e2e/orchestration-worker-settlement-release-cli.spec.ts
@@ -0,0 +1,290 @@
+import { spawnSync } from 'node:child_process'
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { test as base, expect } from './helpers/orca-app'
+import { waitForActivePaneHookDescriptor, waitForActivePanePtyId } from './helpers/terminal'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import { RuntimeClient } from '../../src/cli/runtime-client'
+import Database from '../../src/main/sqlite/sync-database'
+import type { RuntimeTerminalListResult, RuntimeTerminalRead } from '../../src/shared/runtime-types'
+
+const fakeCliDir = mkdtempSync(path.join(os.tmpdir(), 'orca-e2e-settlement-release-'))
+const cliLedgerPath = path.join(fakeCliDir, 'cli.jsonl')
+const cliEntry = path.join(process.cwd(), 'out', 'cli', 'index.js')
+const fakeCodexSource = `
+const { appendFileSync } = require('node:fs')
+const { spawnSync } = require('node:child_process')
+let capability = null
+let acknowledged = false
+process.stdout.write('\\u001b]0;Codex Ready\\u0007OpenAI Codex\\nmodel: e2e\\ndirectory: e2e\\n')
+process.stdin.on('data', (chunk) => {
+  const input = chunk.toString()
+  capability ||= input.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1] || null
+  if (!acknowledged && input.includes('\\r')) {
+    acknowledged = true
+    process.stdout.write('ACK\\n')
+  }
+  const encoded = input.match(/ORCA_E2E_WORKER_DONE:([A-Za-z0-9+/=]+)/)?.[1]
+  if (!encoded || !capability) return
+  const request = JSON.parse(Buffer.from(encoded, 'base64').toString('utf8'))
+  const args = [
+    'orchestration', 'send',
+    '--from', request.mismatch ? 'term_foreign' : process.env.ORCA_TERMINAL_HANDLE,
+    '--dispatch-capability', capability,
+    '--to', request.coordinator,
+    '--type', 'worker_done',
+    '--subject', request.mismatch ? 'wrong sender' : 'completed',
+    '--body', 'Compiled CLI E2E worker completion.',
+    '--task-id', request.taskId,
+    '--dispatch-id', request.dispatchId,
+    '--outcome', 'succeeded',
+    '--json'
+  ]
+  const result = spawnSync(process.execPath, [process.env.ORCA_E2E_CLI_ENTRY, ...args], {
+    env: process.env,
+    encoding: 'utf8'
+  })
+  appendFileSync(
+    process.env.ORCA_E2E_CLI_LEDGER,
+    JSON.stringify({ mismatch: request.mismatch, args, status: result.status, stdout: result.stdout, stderr: result.stderr }) + '\\n'
+  )
+})
+process.stdin.resume()
+setInterval(() => {}, 60_000)
+`
+
+if (process.platform === 'win32') {
+  writeFileSync(path.join(fakeCliDir, 'fake-codex.js'), fakeCodexSource)
+  writeFileSync(
+    path.join(fakeCliDir, 'codex.cmd'),
+    '@echo off\r\nnode "%~dp0\\fake-codex.js" %*\r\n'
+  )
+} else {
+  const executable = path.join(fakeCliDir, 'codex')
+  writeFileSync(executable, `#!/usr/bin/env node\n${fakeCodexSource}`)
+  chmodSync(executable, 0o755)
+}
+
+const test = base.extend({
+  launchEnv: [
+    {
+      PATH: `${fakeCliDir}${path.delimiter}${process.env.PATH ?? ''}`,
+      ORCA_E2E_CLI_ENTRY: cliEntry,
+      ORCA_E2E_CLI_LEDGER: cliLedgerPath
+    },
+    { option: true }
+  ]
+})
+
+type CliLedgerEntry = {
+  mismatch: boolean
+  status: number
+  stdout: string
+  stderr: string
+}
+
+function readCliLedger(): CliLedgerEntry[] {
+  if (!existsSync(cliLedgerPath)) {
+    return []
+  }
+  return readFileSync(cliLedgerPath, 'utf8')
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((line) => JSON.parse(line) as CliLedgerEntry)
+}
+
+function invokeCompiledCli(userDataDir: string, args: string[]) {
+  return spawnSync(process.execPath, [cliEntry, ...args], {
+    env: { ...process.env, ORCA_USER_DATA_PATH: userDataDir, ORCA_DEV_CLI_INVOCATION: '1' },
+    encoding: 'utf8'
+  })
+}
+
+function encodeWorkerDone(input: {
+  coordinator: string
+  taskId: string
+  dispatchId: string
+  mismatch: boolean
+}): string {
+  return Buffer.from(JSON.stringify(input)).toString('base64')
+}
+
+test.afterAll(() => {
+  rmSync(fakeCliDir, { recursive: true, force: true })
+})
+
+test('compiled CLI rejects false completion then reconciles the dead retained worker', async ({
+  orcaPage,
+  electronApp
+}) => {
+  test.setTimeout(180_000)
+  rmSync(cliLedgerPath, { force: true })
+  await waitForSessionReady(orcaPage)
+  const worktreeId = await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+  await waitForActivePanePtyId(orcaPage)
+  const coordinatorPane = await waitForActivePaneHookDescriptor(orcaPage)
+  const userDataDir = await electronApp.evaluate(({ app }) => app.getPath('userData'))
+  const client = new RuntimeClient(userDataDir, 30_000, null, null)
+  const coordinator = await client.call<{ terminal: { handle: string } }>('terminal.resolvePane', {
+    paneKey: coordinatorPane.paneKey
+  })
+  const run = await client.call<{ run: { id: string } }>('orchestration.runCreate', {
+    objective: 'Compiled CLI settlement and release E2E',
+    from: coordinator.result.terminal.handle
+  })
+  const task = await client.call<{ task: { id: string } }>('orchestration.taskCreate', {
+    spec: 'Respond ACK and await the completion marker.',
+    run: run.result.run.id,
+    callerTerminalHandle: coordinator.result.terminal.handle
+  })
+  const coordinatorTerminal = await client.call<{ terminal: { worktreeId: string } }>(
+    'terminal.show',
+    { terminal: coordinator.result.terminal.handle }
+  )
+  await expect
+    .poll(async () => {
+      const listed = await client.call<{ worktrees: { id: string }[] }>('worktree.list', {})
+      return listed.result.worktrees.some(
+        (worktree) => worktree.id === coordinatorTerminal.result.terminal.worktreeId
+      )
+    })
+    .toBe(true)
+  const started = await client.call<{ effects: { kind: string; role?: string; id?: string }[] }>(
+    'orchestration.workerStart',
+    {
+      task: task.result.task.id,
+      from: coordinator.result.terminal.handle,
+      agent: 'codex',
+      timeoutMs: 15_000
+    }
+  )
+  const workerHandle = started.result.effects.find(
+    (effect) => effect.kind === 'terminal' && effect.role === 'agent'
+  )?.id
+  expect(workerHandle).toBeTruthy()
+
+  let worker = (
+    await client.call<RuntimeTerminalListResult>('terminal.list')
+  ).result.terminals.find((terminal) => terminal.handle === workerHandle)
+  await expect
+    .poll(async () => {
+      const listed = await client.call<RuntimeTerminalListResult>('terminal.list')
+      worker = listed.result.terminals.find((terminal) => terminal.handle === workerHandle)
+      if (!worker) {
+        return ''
+      }
+      const read = await client.call<{ terminal: RuntimeTerminalRead }>('terminal.read', {
+        terminal: worker.handle,
+        limit: 200
+      })
+      return read.result.terminal.tail.join('\n')
+    })
+    .toContain('ACK')
+  const dispatch = await client.call<{ dispatch: { id: string; status: string } | null }>(
+    'orchestration.dispatchShow',
+    { task: task.result.task.id }
+  )
+  expect(dispatch.result.dispatch?.status).toBe('dispatched')
+
+  const baseMarker = {
+    coordinator: coordinator.result.terminal.handle,
+    taskId: task.result.task.id,
+    dispatchId: dispatch.result.dispatch!.id
+  }
+  await client.call('terminal.send', {
+    terminal: workerHandle,
+    text: `ORCA_E2E_WORKER_DONE:${encodeWorkerDone({ ...baseMarker, mismatch: true })}`,
+    enter: true
+  })
+  await expect.poll(() => readCliLedger()).toHaveLength(1)
+  const rejected = readCliLedger()[0]!
+  expect.soft(rejected.status).not.toBe(0)
+  expect.soft(JSON.parse(rejected.stdout)).toMatchObject({
+    ok: false,
+    error: { code: 'dispatch_capability_invalid' }
+  })
+  const stillDispatched = await client.call<{ dispatch: { status: string } | null }>(
+    'orchestration.dispatchShow',
+    { task: task.result.task.id }
+  )
+  expect(stillDispatched.result.dispatch?.status).toBe('dispatched')
+
+  await client.call('terminal.send', {
+    terminal: workerHandle,
+    text: `ORCA_E2E_WORKER_DONE:${encodeWorkerDone({ ...baseMarker, mismatch: false })}`,
+    enter: true
+  })
+  await expect.poll(() => readCliLedger()).toHaveLength(2)
+  const completed = readCliLedger()[1]!
+  expect(completed.status).toBe(0)
+  expect.soft(JSON.parse(completed.stdout)).toMatchObject({
+    ok: true,
+    result: { lifecycle: { action: 'completed' } }
+  })
+  await expect
+    .poll(async () => {
+      const current = await client.call<{ dispatch: { status: string } | null }>(
+        'orchestration.dispatchShow',
+        { task: task.result.task.id }
+      )
+      return current.result.dispatch?.status
+    })
+    .toBe('completed')
+
+  await client.call('terminal.close', { terminal: workerHandle })
+  await expect
+    .poll(async () => {
+      const listed = await client.call<RuntimeTerminalListResult>('terminal.list')
+      return listed.result.terminals.some((terminal) => terminal.handle === workerHandle)
+    })
+    .toBe(false)
+  const db = new Database(path.join(userDataDir, 'orchestration.db'))
+  try {
+    db.prepare(
+      `UPDATE worker_terminal_resources
+       SET ownership_state = 'external', release_state = 'retained',
+           retained_reason = 'external_terminal'
+       WHERE owner_dispatch_id = ?`
+    ).run(dispatch.result.dispatch!.id)
+  } finally {
+    db.close()
+  }
+
+  const released = invokeCompiledCli(userDataDir, [
+    'orchestration',
+    'worker-release',
+    '--dispatch',
+    dispatch.result.dispatch!.id,
+    '--json'
+  ])
+  expect(released.status).toBe(0)
+  expect.soft(JSON.parse(released.stdout)).toMatchObject({
+    ok: true,
+    result: { state: 'released', processAction: 'none' }
+  })
+  const verified = new Database(path.join(userDataDir, 'orchestration.db'))
+  try {
+    expect
+      .soft(
+        verified
+          .prepare(
+            `SELECT ownership_state, release_state
+           FROM worker_terminal_resources WHERE owner_dispatch_id = ?`
+          )
+          .get(dispatch.result.dispatch!.id)
+      )
+      .toEqual({ ownership_state: 'released', release_state: 'released' })
+  } finally {
+    verified.close()
+  }
+  const coordinatorStillLive = await client.call<RuntimeTerminalListResult>('terminal.list', {
+    worktree: `id:${worktreeId}`
+  })
+  expect(
+    coordinatorStillLive.result.terminals.some(
+      (terminal) => terminal.handle === coordinator.result.terminal.handle
+    )
+  ).toBe(true)
+})
diff --git a/tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts b/tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts
new file mode 100644
index 00000000000..1e8de3f5287
--- /dev/null
+++ b/tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts
@@ -0,0 +1,394 @@
+import { writeFileSync } from 'node:fs'
+import path from 'node:path'
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { RuntimeClient } from '../../src/cli/runtime/client'
+import type { RuntimeMobileSessionTabsResult } from '../../src/shared/runtime-types'
+import { expect, test } from './helpers/orca-app'
+import { openFileExplorer } from './helpers/file-explorer'
+import {
+  launchHeadlessPairedRuntimeHost,
+  type HeadlessPairedRuntimeHost
+} from './helpers/headless-paired-runtime-host'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedElectronClient,
+  type PairedElectronClient,
+  type RuntimeDesktopPairingOffer
+} from './helpers/paired-electron-client'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+const FIXTURE_NAME = 'paired-browser-reconcile-failure.html'
+
+type FaultSnapshot = {
+  armed: boolean
+  capabilityRejectionArmed: boolean
+  createdPageId: string | null
+  suppressedPageIds: string[]
+}
+
+type FaultWindow = Window & {
+  __webRuntimeBrowserCreationFault?: {
+    arm: () => void
+    armCapabilityRejection: () => void
+    release: () => boolean
+    reset: () => void
+    snapshot: () => FaultSnapshot
+  }
+}
+
+type ClientTabState = {
+  browserTabIds: string[]
+  browserWorkspaceIds: string[]
+  editorTabIds: string[]
+  groupIds: string[]
+  terminalTabIds: string[]
+}
+
+async function readHostTabs(
+  hostClient: RuntimeClient,
+  repoPath: string
+): Promise<RuntimeMobileSessionTabsResult> {
+  const response = await hostClient.call<RuntimeMobileSessionTabsResult>('session.tabs.list', {
+    worktree: `path:${repoPath}`
+  })
+  return response.result
+}
+
+async function readClientTabs(page: Page, worktreeId: string): Promise<ClientTabState> {
+  return page.evaluate((targetWorktreeId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Paired client store unavailable')
+    }
+    const unifiedTabs = state.unifiedTabsByWorktree[targetWorktreeId] ?? []
+    return {
+      browserTabIds: unifiedTabs
+        .filter((tab) => tab.contentType === 'browser')
+        .map((tab) => tab.id),
+      browserWorkspaceIds: (state.browserTabsByWorktree[targetWorktreeId] ?? []).map(
+        (workspace) => workspace.id
+      ),
+      editorTabIds: unifiedTabs.filter((tab) => tab.contentType === 'editor').map((tab) => tab.id),
+      groupIds: (state.groupsByWorktree[targetWorktreeId] ?? []).map((group) => group.id),
+      terminalTabIds: unifiedTabs
+        .filter((tab) => tab.contentType === 'terminal')
+        .map((tab) => tab.id)
+    }
+  }, worktreeId)
+}
+
+async function runReconciliationFailureJourney(args: {
+  hostClient: RuntimeClient
+  offer: RuntimeDesktopPairingOffer
+  repoPath: string
+  testInfo: TestInfo
+  topology: 'headed' | 'headless'
+}): Promise<void> {
+  let client: PairedElectronClient | null = null
+  try {
+    client = await launchPairedElectronClient(
+      args.offer,
+      args.testInfo,
+      `${args.topology} browser reconciliation failure`
+    )
+    await client.app.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows()[0]?.show())
+    const page = client.page
+    const worktreeId = await expect
+      .poll(
+        () =>
+          page.evaluate((repoPath) => {
+            const state = window.__store?.getState()
+            return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+          }, args.repoPath),
+        { timeout: 60_000, message: 'paired client never received the host worktree' }
+      )
+      .not.toBeNull()
+      .then(() =>
+        page.evaluate((repoPath) => {
+          const state = window.__store?.getState()
+          return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+        }, args.repoPath)
+      )
+    if (!worktreeId) {
+      throw new Error('Paired client worktree disappeared after discovery')
+    }
+    await page.evaluate(
+      ({ environmentId, worktreeId }) => {
+        window.__store?.getState().setActiveWorktree(worktreeId, `runtime:${environmentId}`)
+      },
+      { environmentId: client.environmentId, worktreeId }
+    )
+    await expect
+      .poll(() => readClientTabs(page, worktreeId), {
+        timeout: 60_000,
+        message: 'paired client did not materialize the host terminal'
+      })
+      .toMatchObject({ terminalTabIds: expect.arrayContaining([expect.any(String)]) })
+
+    await openFileExplorer(page)
+    const fixtureRow = page.locator('[data-file-explorer-row]').filter({ hasText: FIXTURE_NAME })
+    await expect(fixtureRow).toBeVisible({ timeout: 30_000 })
+    await fixtureRow.click()
+    const openPreviewToSide = page.getByRole('button', { name: 'Open Preview to the Side' })
+    await expect(openPreviewToSide).toBeVisible({ timeout: 30_000 })
+    const baselineClient = await readClientTabs(page, worktreeId)
+    expect(baselineClient.editorTabIds).not.toHaveLength(0)
+    expect(baselineClient.terminalTabIds).not.toHaveLength(0)
+    const baselineHost = await readHostTabs(args.hostClient, args.repoPath)
+    const baselineHostBrowserIds = baselineHost.tabs
+      .filter((tab) => tab.type === 'browser')
+      .map((tab) => tab.browserPageId)
+
+    await page.evaluate(() => {
+      const fault = (window as FaultWindow).__webRuntimeBrowserCreationFault
+      if (!fault) {
+        throw new Error('Browser reconciliation E2E fault seam unavailable')
+      }
+      fault.arm()
+    })
+    await openPreviewToSide.click()
+
+    const faultSnapshot = await expect
+      .poll(
+        () =>
+          page.evaluate(
+            () => (window as FaultWindow).__webRuntimeBrowserCreationFault?.snapshot() ?? null
+          ),
+        { timeout: 30_000, message: 'host browser creation never reached the held fault seam' }
+      )
+      .toMatchObject({ armed: true, createdPageId: expect.any(String) })
+      .then(() =>
+        page.evaluate(
+          () => (window as FaultWindow).__webRuntimeBrowserCreationFault?.snapshot() ?? null
+        )
+      )
+    const createdPageId = faultSnapshot?.createdPageId
+    if (!createdPageId) {
+      throw new Error('Held browser creation did not expose its exact host page id')
+    }
+
+    const heldHost = await readHostTabs(args.hostClient, args.repoPath)
+    expect(
+      heldHost.tabs.some((tab) => tab.type === 'browser' && tab.browserPageId === createdPageId)
+    ).toBe(true)
+    const heldClient = await readClientTabs(page, worktreeId)
+    expect(heldClient.browserTabIds).toEqual(baselineClient.browserTabIds)
+    expect(heldClient.browserWorkspaceIds).toEqual(baselineClient.browserWorkspaceIds)
+    expect(heldClient.editorTabIds).toEqual(baselineClient.editorTabIds)
+    expect(heldClient.terminalTabIds).toEqual(baselineClient.terminalTabIds)
+    expect(heldClient.groupIds).toHaveLength(baselineClient.groupIds.length + 1)
+
+    await page.screenshot({
+      path: args.testInfo.outputPath(`${args.topology}-browser-reconciliation-held.png`),
+      fullPage: true
+    })
+    expect(
+      await page.evaluate(
+        () => (window as FaultWindow).__webRuntimeBrowserCreationFault?.release() ?? false
+      )
+    ).toBe(true)
+
+    await expect(page.getByText('Unable to open this file in Orca Browser.')).toBeVisible({
+      timeout: 30_000
+    })
+    await expect
+      .poll(
+        async () => {
+          const snapshot = await readHostTabs(args.hostClient, args.repoPath)
+          return snapshot.tabs.some(
+            (tab) => tab.type === 'browser' && tab.browserPageId === createdPageId
+          )
+        },
+        { timeout: 30_000, message: 'rollback did not close the exact host browser page' }
+      )
+      .toBe(false)
+    const settledClient = await expect
+      .poll(() => readClientTabs(page, worktreeId), {
+        timeout: 30_000,
+        message: 'client split and browser state did not settle after rollback'
+      })
+      .toMatchObject({
+        browserTabIds: baselineClient.browserTabIds,
+        browserWorkspaceIds: baselineClient.browserWorkspaceIds,
+        editorTabIds: baselineClient.editorTabIds,
+        groupIds: baselineClient.groupIds,
+        terminalTabIds: baselineClient.terminalTabIds
+      })
+      .then(() => readClientTabs(page, worktreeId))
+    expect(settledClient).toEqual(baselineClient)
+    expect(
+      (await readHostTabs(args.hostClient, args.repoPath)).tabs
+        .filter((tab) => tab.type === 'browser')
+        .map((tab) => tab.browserPageId)
+    ).toEqual(baselineHostBrowserIds)
+    await page.evaluate(() => (window as FaultWindow).__webRuntimeBrowserCreationFault?.reset())
+  } finally {
+    await client?.dispose()
+  }
+}
+
+async function runCapabilityFailureJourney(args: {
+  hostClient: RuntimeClient
+  offer: RuntimeDesktopPairingOffer
+  repoPath: string
+  testInfo: TestInfo
+  topology: 'headed' | 'headless'
+}): Promise<void> {
+  let client: PairedElectronClient | null = null
+  try {
+    client = await launchPairedElectronClient(
+      args.offer,
+      args.testInfo,
+      `${args.topology} browser capability failure`
+    )
+    await client.app.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows()[0]?.show())
+    const page = client.page
+    const worktreeId = await expect
+      .poll(
+        () =>
+          page.evaluate((repoPath) => {
+            const state = window.__store?.getState()
+            return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+          }, args.repoPath),
+        { timeout: 60_000, message: 'paired client never received the host worktree' }
+      )
+      .not.toBeNull()
+      .then(() =>
+        page.evaluate((repoPath) => {
+          const state = window.__store?.getState()
+          return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+        }, args.repoPath)
+      )
+    if (!worktreeId) {
+      throw new Error('Paired client worktree disappeared after discovery')
+    }
+    await page.evaluate(
+      ({ environmentId, worktreeId }) => {
+        window.__store?.getState().setActiveWorktree(worktreeId, `runtime:${environmentId}`)
+      },
+      { environmentId: client.environmentId, worktreeId }
+    )
+    await expect
+      .poll(() => readClientTabs(page, worktreeId), {
+        timeout: 60_000,
+        message: 'paired client did not materialize the host terminal'
+      })
+      .toMatchObject({ terminalTabIds: expect.arrayContaining([expect.any(String)]) })
+
+    await openFileExplorer(page)
+    const fixtureRow = page.locator('[data-file-explorer-row]').filter({ hasText: FIXTURE_NAME })
+    await expect(fixtureRow).toBeVisible({ timeout: 30_000 })
+    await fixtureRow.click()
+    const openPreviewToSide = page.getByRole('button', { name: 'Open Preview to the Side' })
+    await expect(openPreviewToSide).toBeVisible({ timeout: 30_000 })
+    const baselineClient = await readClientTabs(page, worktreeId)
+    const baselineHost = await readHostTabs(args.hostClient, args.repoPath)
+
+    await page.evaluate(() => {
+      const fault = (window as FaultWindow).__webRuntimeBrowserCreationFault
+      if (!fault) {
+        throw new Error('Browser capability E2E fault seam unavailable')
+      }
+      fault.armCapabilityRejection()
+    })
+    await openPreviewToSide.click()
+
+    await expect(page.getByText('Unable to open this file in Orca Browser.')).toBeVisible({
+      timeout: 30_000
+    })
+    await expect
+      .poll(() => readClientTabs(page, worktreeId), {
+        timeout: 30_000,
+        message: 'client split state did not settle after capability rejection'
+      })
+      .toEqual(baselineClient)
+    expect(await readHostTabs(args.hostClient, args.repoPath)).toEqual(baselineHost)
+    await page.screenshot({
+      path: args.testInfo.outputPath(`${args.topology}-browser-capability-rejected.png`),
+      fullPage: true
+    })
+    await page.evaluate(() => (window as FaultWindow).__webRuntimeBrowserCreationFault?.reset())
+  } finally {
+    await client?.dispose()
+  }
+}
+
+test('rolls back a headed-host browser when client reconciliation times out @headful', async ({
+  electronApp,
+  orcaPage,
+  testRepoPath
+}, testInfo) => {
+  test.setTimeout(300_000)
+  writeFileSync(
+    path.join(testRepoPath, FIXTURE_NAME),
+    '<!doctype html><html><body><h1>browser reconciliation fault</h1></body></html>\n'
+  )
+  await waitForSessionReady(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+  const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+  const userDataDir = await electronApp.evaluate(({ app }) => app.getPath('userData'))
+  await runReconciliationFailureJourney({
+    hostClient: new RuntimeClient(userDataDir, 5_000),
+    offer,
+    repoPath: testRepoPath,
+    testInfo,
+    topology: 'headed'
+  })
+})
+
+test('cleans up a headed-host preview when capability rejects after preflight @headful', async ({
+  electronApp,
+  orcaPage,
+  testRepoPath
+}, testInfo) => {
+  test.setTimeout(300_000)
+  writeFileSync(
+    path.join(testRepoPath, FIXTURE_NAME),
+    '<!doctype html><html><body><h1>browser capability fault</h1></body></html>\n'
+  )
+  await waitForSessionReady(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+  const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+  const userDataDir = await electronApp.evaluate(({ app }) => app.getPath('userData'))
+  await runCapabilityFailureJourney({
+    hostClient: new RuntimeClient(userDataDir, 5_000),
+    offer,
+    repoPath: testRepoPath,
+    testInfo,
+    topology: 'headed'
+  })
+})
+
+test('keeps browser failure cleanup on a headless host', async ({ testRepoPath }, testInfo) => {
+  test.setTimeout(300_000)
+  writeFileSync(
+    path.join(testRepoPath, FIXTURE_NAME),
+    '<!doctype html><html><body><h1>headless capability fault</h1></body></html>\n'
+  )
+  const host: HeadlessPairedRuntimeHost = await launchHeadlessPairedRuntimeHost()
+  try {
+    await host.client.call('repo.add', { path: testRepoPath, kind: 'git' })
+    await host.client.call('terminal.create', {
+      worktree: `path:${testRepoPath}`,
+      title: 'Browser failure cleanup canary'
+    })
+    await runReconciliationFailureJourney({
+      hostClient: host.client,
+      offer: host.offer,
+      repoPath: testRepoPath,
+      testInfo,
+      topology: 'headless'
+    })
+    await runCapabilityFailureJourney({
+      hostClient: host.client,
+      offer: host.offer,
+      repoPath: testRepoPath,
+      testInfo,
+      topology: 'headless'
+    })
+  } finally {
+    await host.dispose()
+  }
+})
diff --git a/tests/e2e/paired-remote-browser-link-open-routing.spec.ts b/tests/e2e/paired-remote-browser-link-open-routing.spec.ts
new file mode 100644
index 00000000000..6da4965703e
--- /dev/null
+++ b/tests/e2e/paired-remote-browser-link-open-routing.spec.ts
@@ -0,0 +1,310 @@
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import type { Page } from '@stablyai/playwright-test'
+import { LOCAL_EXECUTION_HOST_ID } from '../../src/shared/execution-host'
+import {
+  launchHeadlessPairedRuntimeHost,
+  type HeadlessPairedRuntimeHost
+} from './helpers/headless-paired-runtime-host'
+import { expect, test } from './helpers/orca-app'
+import {
+  launchPairedElectronClient,
+  type PairedElectronClient
+} from './helpers/paired-electron-client'
+
+// The link is a dev-server URL, so a client-local fallback would silently load a *different
+// machine's* server while looking successful.
+
+const PANE_PATH = '/remote-pane'
+const LINK_PATH = '/remote-link-target'
+const LINK_MARKER = 'remote link target'
+
+type LinkFixtureServer = {
+  close: () => Promise<void>
+  linkLoadCount: () => number
+  linkUrl: string
+  paneUrl: string
+}
+
+async function startLinkFixtureServer(): Promise<LinkFixtureServer> {
+  let linkLoadCount = 0
+  const server: Server = createServer((request: IncomingMessage, response: ServerResponse) => {
+    const requestPath = request.url ?? '/'
+    if (requestPath.startsWith(LINK_PATH)) {
+      linkLoadCount += 1
+      response.writeHead(200, {
+        'cache-control': 'no-store',
+        'content-type': 'text/html; charset=utf-8'
+      })
+      response.end(`<!doctype html><html><body><h1>${LINK_MARKER}</h1></body></html>`)
+      return
+    }
+    if (requestPath.startsWith(PANE_PATH)) {
+      response.writeHead(200, {
+        'cache-control': 'no-store',
+        'content-type': 'text/html; charset=utf-8'
+      })
+      // Why the viewport-filling anchor: the context menu reads the link with
+      // elementFromPoint over the screencast, so covering the viewport keeps the test off
+      // screencast coordinate mapping — any right-click lands on the link.
+      response.end(
+        `<!doctype html><html><body style="margin:0"><a href="${LINK_PATH}" style="position:fixed;inset:0;display:block;background:#fff;color:#000;font:24px sans-serif">open me</a></body></html>`
+      )
+      return
+    }
+    response.writeHead(404, { 'content-type': 'text/plain' })
+    response.end('not found')
+  })
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => {
+      server.off('error', reject)
+      resolve()
+    })
+  })
+  const { port } = server.address() as AddressInfo
+  const origin = `http://127.0.0.1:${port}`
+  return {
+    close: () =>
+      new Promise<void>((resolve, reject) => {
+        // Keep-alive sockets from either browser would otherwise hold the close open.
+        server.closeAllConnections()
+        server.close((error) => (error ? reject(error) : resolve()))
+      }),
+    linkLoadCount: () => linkLoadCount,
+    linkUrl: `${origin}${LINK_PATH}`,
+    paneUrl: `${origin}${PANE_PATH}`
+  }
+}
+
+/** Asked over the host's own connection, not proxied through the client under test. */
+async function readHostBrowserUrls(
+  host: HeadlessPairedRuntimeHost,
+  worktreeId: string
+): Promise<string[]> {
+  const response = await host.client.call<{ tabs: { type: string; url?: string }[] }>(
+    'session.tabs.list',
+    { worktree: `id:${worktreeId}` },
+    { timeoutMs: 15_000 }
+  )
+  return response.result.tabs.filter((tab) => tab.type === 'browser').map((tab) => tab.url ?? '')
+}
+
+/** A remote pane is a screencast image; a <webview> means the page really loaded on this machine. */
+async function readLocalBrowserViewUrls(page: Page): Promise<string[]> {
+  return page.evaluate(() =>
+    Array.from(document.querySelectorAll('webview')).map(
+      (view) => (view as HTMLElement & { src?: string }).src || view.getAttribute('src') || ''
+    )
+  )
+}
+
+async function readRemotePaneUrls(page: Page, worktreeId: string): Promise<string[]> {
+  return page.evaluate((worktreeId) => {
+    const state = window.__store?.getState()
+    const workspaces = state?.browserTabsByWorktree[worktreeId] ?? []
+    return workspaces
+      .flatMap((workspace) => state?.browserPagesByWorkspace[workspace.id] ?? [])
+      .filter(
+        (browserPage) => state?.remoteBrowserPageHandlesByPageId[browserPage.id]?.environmentId
+      )
+      .map((browserPage) => browserPage.url)
+  }, worktreeId)
+}
+
+/** The client mirrors host browser tabs on its own; this finds the mirrored page for one URL. */
+async function findMirroredPage(
+  page: Page,
+  worktreeId: string,
+  url: string
+): Promise<{ handleEnvironmentId: string | null; pageId: string } | null> {
+  return page.evaluate(
+    ({ url, worktreeId }) => {
+      const state = window.__store?.getState()
+      for (const workspace of state?.browserTabsByWorktree[worktreeId] ?? []) {
+        for (const browserPage of state?.browserPagesByWorkspace[workspace.id] ?? []) {
+          if (browserPage.url.startsWith(url)) {
+            return {
+              handleEnvironmentId:
+                state?.remoteBrowserPageHandlesByPageId[browserPage.id]?.environmentId ?? null,
+              pageId: browserPage.id
+            }
+          }
+        }
+      }
+      return null
+    },
+    { url, worktreeId }
+  )
+}
+
+async function focusMirroredPage(page: Page, worktreeId: string, pageId: string): Promise<void> {
+  await page.evaluate(
+    ({ pageId, worktreeId }) => {
+      window.__store?.getState().focusBrowserTabInWorktree(worktreeId, pageId, {
+        surfacePane: true
+      })
+    },
+    { pageId, worktreeId }
+  )
+}
+
+type LinkOpenOutcome = 'opened on this machine' | 'pending' | 'refused'
+
+async function readLinkOpenOutcome(page: Page, linkUrl: string): Promise<LinkOpenOutcome> {
+  if ((await readLocalBrowserViewUrls(page)).some((url) => url.startsWith(linkUrl))) {
+    return 'opened on this machine'
+  }
+  const notice = page.getByTestId('remote-browser-stream-error')
+  const text = (await notice.count()) > 0 ? ((await notice.first().textContent()) ?? '') : ''
+  return text.includes('Unable to open URL.') ? 'refused' : 'pending'
+}
+
+async function openLinkFromRemotePaneContextMenu(page: Page): Promise<void> {
+  const remoteFrame = page.locator('[data-testid="remote-browser-frame"]:visible').first()
+  await expect(remoteFrame).toBeVisible({ timeout: 60_000 })
+  await remoteFrame.click({ button: 'right', position: { x: 60, y: 60 }, force: true })
+  await expect(page.getByTestId('remote-browser-context-menu')).toBeVisible({ timeout: 30_000 })
+  // The item only renders once the remote hit-test resolves an anchor, so this wait is the
+  // wait for the link lookup itself.
+  const openInOrca = page.getByRole('menuitem', { name: 'Open Link In Orca Browser' })
+  await expect(openInOrca).toBeVisible({ timeout: 30_000 })
+  await openInOrca.click()
+}
+
+test('opens a remote pane link on the pane runtime and refuses to fall back to the client', async ({
+  testRepoPath
+}, testInfo) => {
+  test.setTimeout(300_000)
+  const fixture = await startLinkFixtureServer()
+  const host: HeadlessPairedRuntimeHost = await launchHeadlessPairedRuntimeHost()
+  let client: PairedElectronClient | null = null
+
+  try {
+    await host.client.call('repo.add', { path: testRepoPath, kind: 'git' })
+    client = await launchPairedElectronClient(host.offer, testInfo, 'Remote browser link routing')
+    const page = client.page
+    const environmentId = client.environmentId
+
+    await expect
+      .poll(() => page.evaluate(() => window.__store?.getState().allWorktrees().length ?? 0), {
+        timeout: 60_000,
+        message: 'paired client never saw a host worktree'
+      })
+      .toBeGreaterThan(0)
+    const worktreeId = await page.evaluate(
+      () => window.__store?.getState().allWorktrees()[0]?.id ?? null
+    )
+    if (!worktreeId) {
+      throw new Error('paired client did not receive the host worktree')
+    }
+
+    // The workspace runs on the paired runtime, the way it does when the user picks that host.
+    await page.evaluate(
+      ({ environmentId, worktreeId }) => {
+        window.__store?.getState().setActiveWorktree(worktreeId, `runtime:${environmentId}`)
+      },
+      { environmentId, worktreeId }
+    )
+
+    // The host opens the page on itself: this is the "remote server" whose links must stay remote.
+    await host.client.call(
+      'browser.tabCreate',
+      { worktree: `id:${worktreeId}`, url: fixture.paneUrl, activate: true },
+      { timeoutMs: 30_000 }
+    )
+    await expect
+      .poll(() => findMirroredPage(page, worktreeId, fixture.paneUrl), {
+        timeout: 60_000,
+        message: 'the client never mirrored the host browser page'
+      })
+      .not.toBeNull()
+    const pane = await findMirroredPage(page, worktreeId, fixture.paneUrl)
+    if (!pane) {
+      throw new Error('mirrored host browser page disappeared')
+    }
+    expect(pane.handleEnvironmentId).toBe(environmentId)
+    await focusMirroredPage(page, worktreeId, pane.pageId)
+    const paneCountBeforeOpen = await page.getByTestId('remote-browser-pane').count()
+
+    // Act 1: the healthy path must land on the runtime, end to end.
+    await openLinkFromRemotePaneContextMenu(page)
+
+    await expect
+      .poll(
+        async () =>
+          (await readHostBrowserUrls(host, worktreeId)).filter((url) =>
+            url.startsWith(fixture.linkUrl)
+          ).length,
+        { timeout: 60_000, message: 'the link never opened as a browser tab on the host runtime' }
+      )
+      .toBe(1)
+    // The host's browser really fetched it; a tab record alone would not prove a load.
+    expect(fixture.linkLoadCount()).toBeGreaterThan(0)
+    // One more remote pane, and still nothing rendered by this machine's own browser.
+    await expect(page.getByTestId('remote-browser-pane')).toHaveCount(paneCountBeforeOpen + 1, {
+      timeout: 60_000
+    })
+    expect(await readRemotePaneUrls(page, worktreeId)).toContainEqual(
+      expect.stringContaining(fixture.linkUrl)
+    )
+    expect(await readLocalBrowserViewUrls(page)).toHaveLength(0)
+
+    // Drop every tab except the pane's, so the second act drives the pane it started with.
+    await page.evaluate(
+      ({ paneUrl, worktreeId }) => {
+        const state = window.__store?.getState()
+        for (const workspace of state?.browserTabsByWorktree[worktreeId] ?? []) {
+          const pages = state?.browserPagesByWorkspace[workspace.id] ?? []
+          if (!pages.some((browserPage) => browserPage.url.startsWith(paneUrl))) {
+            state?.closeBrowserTab(workspace.id)
+          }
+        }
+      },
+      { paneUrl: fixture.paneUrl, worktreeId }
+    )
+    await expect(page.getByTestId('remote-browser-pane')).toHaveCount(paneCountBeforeOpen, {
+      timeout: 60_000
+    })
+
+    // Act 2: the user moves this workspace onto their own machine while the runtime's page is
+    // still on screen. Opening the link must fail in the pane, not load the runtime's dev server
+    // here — the client has no business serving a page for a workspace it does not run.
+    await page.evaluate(
+      ({ localHostId, worktreeId }) => {
+        window.__store?.getState().setActiveWorktree(worktreeId, localHostId)
+      },
+      { localHostId: LOCAL_EXECUTION_HOST_ID, worktreeId }
+    )
+    await focusMirroredPage(page, worktreeId, pane.pageId)
+    const hostUrlsBefore = await readHostBrowserUrls(host, worktreeId)
+    const linkLoadsBefore = fixture.linkLoadCount()
+
+    await openLinkFromRemotePaneContextMenu(page)
+
+    // Wait for the click to produce an outcome — refusal or a local page — so the assertion below
+    // reports which one happened instead of racing past a fallback that lands a moment later.
+    await expect
+      .poll(() => readLinkOpenOutcome(page, fixture.linkUrl), {
+        timeout: 30_000,
+        message: 'the link open produced neither a refusal nor a page'
+      })
+      .not.toBe('pending')
+    expect(await readLinkOpenOutcome(page, fixture.linkUrl)).toBe('refused')
+
+    // The workspace must still be the local one, or the refusal above proved nothing.
+    expect(
+      await page.evaluate(() => window.__store?.getState().activeWorkspaceExecutionHostId ?? null)
+    ).toBe(LOCAL_EXECUTION_HOST_ID)
+    // Nothing rendered here, nothing new on the host, and nobody fetched the link anywhere.
+    expect(await readLocalBrowserViewUrls(page)).toHaveLength(0)
+    expect(await readHostBrowserUrls(host, worktreeId)).toEqual(hostUrlsBefore)
+    expect(fixture.linkLoadCount()).toBe(linkLoadsBefore)
+  } finally {
+    if (client) {
+      await client.dispose()
+    }
+    await host.dispose()
+    await fixture.close()
+  }
+})
diff --git a/tests/e2e/paired-remote-html-browser-focus.spec.ts b/tests/e2e/paired-remote-html-browser-focus.spec.ts
new file mode 100644
index 00000000000..5a70fa10465
--- /dev/null
+++ b/tests/e2e/paired-remote-html-browser-focus.spec.ts
@@ -0,0 +1,460 @@
+import { writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { expect, test } from './helpers/orca-app'
+import { openFileExplorer } from './helpers/file-explorer'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedElectronClient,
+  type PairedElectronClient
+} from './helpers/paired-electron-client'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+const FIXTURE_NAME = 'paired-html-focus.html'
+
+test('keeps remote HTML preview placement and focuses it only after a click', async ({
+  orcaPage,
+  testRepoPath
+}, testInfo) => {
+  test.setTimeout(240_000)
+  writeFileSync(
+    path.join(testRepoPath, FIXTURE_NAME),
+    '<!doctype html><html><body><h1>paired html focus</h1></body></html>\n'
+  )
+  await waitForSessionReady(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+
+  const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+  let client: PairedElectronClient | null = null
+  try {
+    client = await launchPairedElectronClient(offer, testInfo, 'Remote HTML focus')
+    const page = client.page
+    const worktreeId = await expect
+      .poll(
+        () =>
+          page.evaluate((repoPath) => {
+            const state = window.__store?.getState()
+            return state
+              ? (state.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null)
+              : null
+          }, testRepoPath),
+        { timeout: 60_000, message: 'paired client never received the host worktree' }
+      )
+      .not.toBeNull()
+      .then(() =>
+        page.evaluate((repoPath) => {
+          const state = window.__store?.getState()
+          return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+        }, testRepoPath)
+      )
+    if (!worktreeId) {
+      throw new Error('paired client worktree disappeared after discovery')
+    }
+    await page.evaluate(
+      ({ environmentId, worktreeId }) => {
+        window.__store?.getState().setActiveWorktree(worktreeId, `runtime:${environmentId}`)
+      },
+      { environmentId: client.environmentId, worktreeId }
+    )
+    await openFileExplorer(page)
+    const fixtureRow = page.locator('[data-file-explorer-row]').filter({ hasText: FIXTURE_NAME })
+    await expect(fixtureRow).toBeVisible({ timeout: 30_000 })
+    await fixtureRow.click()
+    const openPreviewToSide = page.getByRole('button', { name: 'Open Preview to the Side' })
+    await expect(openPreviewToSide).toBeVisible({ timeout: 30_000 })
+    const sourceEditor = await page.evaluate((targetWorktreeId) => {
+      const state = window.__store?.getState()
+      const groupId = state?.activeGroupIdByWorktree[targetWorktreeId]
+      const group = (state?.groupsByWorktree[targetWorktreeId] ?? []).find(
+        (candidate) => candidate.id === groupId
+      )
+      const tab = (state?.unifiedTabsByWorktree[targetWorktreeId] ?? []).find(
+        (candidate) => candidate.id === group?.activeTabId && candidate.contentType === 'editor'
+      )
+      return groupId && tab ? { groupId, tabId: tab.id } : null
+    }, worktreeId)
+    if (!sourceEditor) {
+      throw new Error('paired client editor had no source identity before side preview')
+    }
+    const sourceGroupId = sourceEditor.groupId
+    const browserBaseline = await page.evaluate(
+      async ({ environmentId, worktreeId }) => {
+        const state = window.__store?.getState()
+        const response = await window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'session.tabs.list',
+          params: { worktree: `id:${worktreeId}` },
+          timeoutMs: 15_000
+        })
+        return {
+          clientUnified: (state?.unifiedTabsByWorktree[worktreeId] ?? []).filter(
+            (tab) => tab.contentType === 'browser'
+          ).length,
+          clientWorkspaces: (state?.browserTabsByWorktree[worktreeId] ?? []).length,
+          host: response.ok
+            ? response.result.tabs.filter((tab) => tab.type === 'browser').length
+            : -1
+        }
+      },
+      { environmentId: client.environmentId, worktreeId }
+    )
+    await openPreviewToSide.click()
+
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({ environmentId, fixtureName, worktreeId }) => {
+              const state = window.__store?.getState()
+              if (!state) {
+                return null
+              }
+              const browser = (state.browserTabsByWorktree[worktreeId] ?? []).find((tab) =>
+                tab.url.endsWith(`/${fixtureName}`)
+              )
+              const browserPage = browser
+                ? (state.browserPagesByWorkspace[browser.id] ?? [])[0]
+                : null
+              const handle = browserPage
+                ? state.remoteBrowserPageHandlesByPageId[browserPage.id]
+                : null
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              const hostHasHtml =
+                response.ok &&
+                response.result.tabs.some(
+                  (tab) => tab.type === 'browser' && tab.url.endsWith(`/${fixtureName}`)
+                )
+              return {
+                browserRuntimeEnvironmentId: browserPage?.browserRuntimeEnvironmentId ?? null,
+                handleEnvironmentId: handle?.environmentId ?? null,
+                handleRemotePageId: handle?.remotePageId ?? null,
+                hostHasHtml
+              }
+            },
+            { environmentId: client!.environmentId, fixtureName: FIXTURE_NAME, worktreeId }
+          ),
+        { timeout: 60_000, message: 'remote HTML browser ownership never converged' }
+      )
+      .toMatchObject({
+        browserRuntimeEnvironmentId: client.environmentId,
+        handleEnvironmentId: client.environmentId,
+        hostHasHtml: true
+      })
+    const htmlTabInventory = await page.evaluate(
+      async ({ environmentId, fixtureName, worktreeId }) => {
+        const state = window.__store?.getState()
+        const response = await window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'session.tabs.list',
+          params: { worktree: `id:${worktreeId}` },
+          timeoutMs: 15_000
+        })
+        const clientWorkspaceIds = (state?.browserTabsByWorktree[worktreeId] ?? [])
+          .filter((tab) => tab.url.endsWith(`/${fixtureName}`))
+          .map((tab) => tab.id)
+        return {
+          clientWorkspaceIds,
+          clientUnifiedTabs: (state?.unifiedTabsByWorktree[worktreeId] ?? [])
+            .filter(
+              (tab) => tab.contentType === 'browser' && clientWorkspaceIds.includes(tab.entityId)
+            )
+            .map((tab) => ({ groupId: tab.groupId, id: tab.id })),
+          hostTabIds: response.ok
+            ? response.result.tabs
+                .filter((tab) => tab.type === 'browser' && tab.url.endsWith(`/${fixtureName}`))
+                .map((tab) => tab.id)
+            : [],
+          hostTabGroups: response.ok ? (response.result.tabGroups ?? []) : [],
+          totalClientUnified: (state?.unifiedTabsByWorktree[worktreeId] ?? []).filter(
+            (tab) => tab.contentType === 'browser'
+          ).length,
+          totalClientWorkspaces: (state?.browserTabsByWorktree[worktreeId] ?? []).length,
+          totalHost: response.ok
+            ? response.result.tabs.filter((tab) => tab.type === 'browser').length
+            : -1
+        }
+      },
+      { environmentId: client.environmentId, fixtureName: FIXTURE_NAME, worktreeId }
+    )
+    expect(htmlTabInventory.clientWorkspaceIds).toHaveLength(1)
+    expect(htmlTabInventory.clientUnifiedTabs).toHaveLength(1)
+    expect(htmlTabInventory.hostTabIds).toHaveLength(1)
+    expect(htmlTabInventory.totalClientUnified).toBe(browserBaseline.clientUnified + 1)
+    expect(htmlTabInventory.totalClientWorkspaces).toBe(browserBaseline.clientWorkspaces + 1)
+    expect(htmlTabInventory.totalHost).toBe(browserBaseline.host + 1)
+    expect(htmlTabInventory.clientUnifiedTabs[0]?.groupId).not.toBe(sourceGroupId)
+    expect(
+      htmlTabInventory.hostTabGroups.some(
+        (group) => group.id === htmlTabInventory.clientUnifiedTabs[0]?.groupId
+      )
+    ).toBe(false)
+    const hostBrowserGroupId = htmlTabInventory.hostTabGroups.find((group) =>
+      group.tabOrder.includes(htmlTabInventory.hostTabIds[0]!)
+    )?.id
+    expect(hostBrowserGroupId).toBeTruthy()
+    await expect(page.locator(`[data-tab-group-body-id="${sourceGroupId}"]`)).toBeVisible()
+    await expect(
+      page.locator(`[data-tab-group-body-id="${htmlTabInventory.clientUnifiedTabs[0]!.groupId}"]`)
+    ).toBeVisible()
+    await expect(page.getByTestId('remote-browser-frame')).toBeVisible({ timeout: 60_000 })
+
+    const previewFocus = await page.evaluate(
+      ({ sourceGroupId, sourceTabId, worktreeId: targetWorktreeId }) => {
+        const state = window.__store?.getState()
+        const activeGroup = (state?.groupsByWorktree[targetWorktreeId] ?? []).find(
+          (group) => group.id === state?.activeGroupIdByWorktree[targetWorktreeId]
+        )
+        return {
+          activeGroupId: activeGroup?.id ?? null,
+          activeTabId: activeGroup?.activeTabId ?? null,
+          activeTabType: state?.activeTabTypeByWorktree[targetWorktreeId] ?? null,
+          sourceGroupId,
+          sourceTabId
+        }
+      },
+      { sourceGroupId, sourceTabId: sourceEditor.tabId, worktreeId }
+    )
+    expect(previewFocus).toEqual({
+      activeGroupId: sourceGroupId,
+      activeTabId: sourceEditor.tabId,
+      activeTabType: 'editor',
+      sourceGroupId,
+      sourceTabId: sourceEditor.tabId
+    })
+
+    const tabIds = await page.evaluate(
+      ({ fixtureName, worktreeId: targetWorktreeId }) => {
+        const state = window.__store?.getState()
+        if (!state) {
+          return null
+        }
+        const terminalId = state.tabsByWorktree[targetWorktreeId]?.[0]?.id ?? null
+        const browserId = (state.browserTabsByWorktree[targetWorktreeId] ?? []).find((tab) =>
+          tab.url.endsWith(`/${fixtureName}`)
+        )?.id
+        return terminalId && browserId ? { browserId, terminalId } : null
+      },
+      { fixtureName: FIXTURE_NAME, worktreeId }
+    )
+    if (!tabIds) {
+      throw new Error('paired client did not retain both terminal and HTML browser tabs')
+    }
+    await page.locator(`[data-tab-id="${tabIds.terminalId}"]`).click()
+    await expect
+      .poll(
+        () =>
+          page.evaluate((targetWorktreeId) => {
+            const state = window.__store?.getState()
+            return state?.activeTabTypeByWorktree[targetWorktreeId] ?? null
+          }, worktreeId),
+        { message: 'terminal tab never became active before the browser click' }
+      )
+      .toBe('terminal')
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({ environmentId, worktreeId }) => {
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              if (!response.ok) {
+                return false
+              }
+              return (
+                response.result.tabs.find((tab) => tab.id === response.result.activeTabId)?.type ===
+                'terminal'
+              )
+            },
+            { environmentId: client.environmentId, worktreeId }
+          ),
+        { timeout: 30_000, message: 'host never accepted terminal activation' }
+      )
+      .toBe(true)
+    const hostBrowserTab = await page.evaluate(
+      async ({ environmentId, fixtureName, worktreeId }) => {
+        const response = await window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'session.tabs.list',
+          params: { worktree: `id:${worktreeId}` },
+          timeoutMs: 15_000
+        })
+        const tab = response.ok
+          ? response.result.tabs.find(
+              (candidate) =>
+                candidate.type === 'browser' && candidate.url.endsWith(`/${fixtureName}`)
+            )
+          : null
+        return tab?.type === 'browser' ? { browserPageId: tab.browserPageId, id: tab.id } : null
+      },
+      { environmentId: client.environmentId, fixtureName: FIXTURE_NAME, worktreeId }
+    )
+    if (!hostBrowserTab?.browserPageId) {
+      throw new Error('host HTML browser tab disappeared before activation')
+    }
+    const clientRemotePageId = await page.evaluate(
+      ({ fixtureName, worktreeId }) => {
+        const state = window.__store?.getState()
+        const workspace = (state?.browserTabsByWorktree[worktreeId] ?? []).find((tab) =>
+          tab.url.endsWith(`/${fixtureName}`)
+        )
+        const browserPage = workspace
+          ? (state?.browserPagesByWorkspace[workspace.id] ?? [])[0]
+          : null
+        return browserPage
+          ? (state?.remoteBrowserPageHandlesByPageId[browserPage.id]?.remotePageId ?? null)
+          : null
+      },
+      { fixtureName: FIXTURE_NAME, worktreeId }
+    )
+    expect(clientRemotePageId).toBe(hostBrowserTab.browserPageId)
+    const content = await page.evaluate(
+      async ({ browserPageId, environmentId, worktreeId }) =>
+        window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'browser.eval',
+          params: {
+            worktree: `id:${worktreeId}`,
+            page: browserPageId,
+            expression: 'document.querySelector("h1")?.textContent'
+          },
+          timeoutMs: 15_000
+        }),
+      {
+        browserPageId: hostBrowserTab.browserPageId,
+        environmentId: client.environmentId,
+        worktreeId
+      }
+    )
+    expect(content).toMatchObject({ ok: true, result: { result: 'paired html focus' } })
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            ({ browserTabId, environmentId }) => {
+              const state = window.__store?.getState()
+              return (state?.browserPagesByWorkspace[browserTabId] ?? []).some((browserPage) => {
+                const handle = state?.remoteBrowserPageHandlesByPageId[browserPage.id]
+                return (
+                  handle?.environmentId === environmentId ||
+                  browserPage.browserRuntimeEnvironmentId === environmentId
+                )
+              })
+            },
+            { browserTabId: tabIds.browserId, environmentId: client.environmentId }
+          ),
+        { timeout: 30_000, message: 'client lost remote browser ownership before activation' }
+      )
+      .toBe(true)
+    await page.locator(`[data-tab-id="${tabIds.browserId}"]`).click()
+
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({ environmentId, fixtureName, worktreeId }) => {
+              const state = window.__store?.getState()
+              if (!state) {
+                return null
+              }
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              const activeGroup = (state.groupsByWorktree[worktreeId] ?? []).find(
+                (group) => group.id === state.activeGroupIdByWorktree[worktreeId]
+              )
+              const activeUnified = (state.unifiedTabsByWorktree[worktreeId] ?? []).find(
+                (tab) => tab.id === activeGroup?.activeTabId
+              )
+              const hostActive = response.ok
+                ? response.result.tabs.find((tab) => tab.id === response.result.activeTabId)
+                : null
+              return {
+                activeGroupType: activeUnified?.contentType ?? null,
+                activeTabType: state.activeTabTypeByWorktree[worktreeId] ?? null,
+                hostActiveHtml:
+                  hostActive?.type === 'browser' && hostActive.url.endsWith(`/${fixtureName}`)
+              }
+            },
+            { environmentId: client!.environmentId, fixtureName: FIXTURE_NAME, worktreeId }
+          ),
+        { timeout: 30_000, message: 'browser click did not remain authoritative' }
+      )
+      .toEqual({ activeGroupType: 'browser', activeTabType: 'browser', hostActiveHtml: true })
+    await expect(page.getByTestId('remote-browser-frame')).toBeVisible()
+
+    const browserTab = page.locator(`[data-tab-id="${tabIds.browserId}"]`)
+    await browserTab.click({ button: 'right' })
+    await page.getByRole('menuitem', { name: 'Close', exact: true }).click()
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({
+              environmentId,
+              hostTabId,
+              sourceGroupId,
+              unifiedTabId,
+              workspaceId,
+              worktreeId
+            }) => {
+              const state = window.__store?.getState()
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              return {
+                clientUnifiedPresent: (state?.unifiedTabsByWorktree[worktreeId] ?? []).some(
+                  (tab) => tab.id === unifiedTabId
+                ),
+                clientWorkspacePresent: (state?.browserTabsByWorktree[worktreeId] ?? []).some(
+                  (tab) => tab.id === workspaceId
+                ),
+                hostTabPresent: response.ok
+                  ? response.result.tabs.some((tab) => tab.id === hostTabId)
+                  : true,
+                sourceGroupPresent: (state?.groupsByWorktree[worktreeId] ?? []).some(
+                  (group) => group.id === sourceGroupId
+                )
+              }
+            },
+            {
+              environmentId: client!.environmentId,
+              hostTabId: hostBrowserTab.id,
+              sourceGroupId,
+              unifiedTabId: htmlTabInventory.clientUnifiedTabs[0]!.id,
+              workspaceId: htmlTabInventory.clientWorkspaceIds[0]!,
+              worktreeId
+            }
+          ),
+        { timeout: 30_000, message: 'remote HTML browser close did not converge cleanly' }
+      )
+      .toEqual({
+        clientUnifiedPresent: false,
+        clientWorkspacePresent: false,
+        hostTabPresent: false,
+        sourceGroupPresent: true
+      })
+    await expect(browserTab).toHaveCount(0)
+    await expect(page.locator(`[data-tab-id="${tabIds.terminalId}"]`)).toBeVisible()
+    await expect(page.locator(`[data-tab-id="${sourceEditor.tabId}"]`)).toBeVisible()
+    await expect(
+      page.locator(`[data-tab-group-body-id="${sourceGroupId}"] .monaco-editor`)
+    ).toBeVisible()
+  } finally {
+    await client?.dispose()
+  }
+})
diff --git a/tests/e2e/paired-remote-terminal-browser-link.spec.ts b/tests/e2e/paired-remote-terminal-browser-link.spec.ts
new file mode 100644
index 00000000000..44d0d3484f1
--- /dev/null
+++ b/tests/e2e/paired-remote-terminal-browser-link.spec.ts
@@ -0,0 +1,368 @@
+import { createServer, type Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import type { Page } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedElectronClient,
+  type PairedElectronClient
+} from './helpers/paired-electron-client'
+import {
+  readPanelNavigationObserver,
+  startPanelNavigationObserver,
+  stopPanelNavigationObserver
+} from './helpers/plugin-panel-navigation-observer'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  execInTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForTerminalOutput
+} from './helpers/terminal'
+
+const PAGE_MARKER = 'remote terminal browser owner'
+const TERMINAL_MARKER = 'remote-terminal-still-live-after-browser-close'
+
+async function readTabInventory(
+  page: Page,
+  environmentId: string,
+  worktreeId: string
+): Promise<{
+  clientBrowserWorkspaces: number
+  clientBrowserTabs: number
+  clientTerminalTabs: number
+  hostBrowserTabs: number
+  hostTerminalTabs: number
+}> {
+  return page.evaluate(
+    async ({ environmentId, worktreeId }) => {
+      const state = window.__store?.getState()
+      const response = await window.api.runtimeEnvironments.call({
+        selector: environmentId,
+        method: 'session.tabs.list',
+        params: { worktree: `id:${worktreeId}` },
+        timeoutMs: 15_000
+      })
+      return {
+        clientBrowserWorkspaces: (state?.browserTabsByWorktree[worktreeId] ?? []).length,
+        clientBrowserTabs: (state?.unifiedTabsByWorktree[worktreeId] ?? []).filter(
+          (tab) => tab.contentType === 'browser'
+        ).length,
+        clientTerminalTabs: (state?.tabsByWorktree[worktreeId] ?? []).length,
+        hostBrowserTabs: response.ok
+          ? response.result.tabs.filter((tab) => tab.type === 'browser').length
+          : -1,
+        hostTerminalTabs: response.ok
+          ? response.result.tabs.filter((tab) => tab.type === 'terminal').length
+          : -1
+      }
+    },
+    { environmentId, worktreeId }
+  )
+}
+
+async function startPageServer(): Promise<{ server: Server; url: string }> {
+  const server = createServer((_request, response) => {
+    response.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+    response.end(`<!doctype html><html><body><h1>${PAGE_MARKER}</h1></body></html>`)
+  })
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => {
+      server.off('error', reject)
+      resolve()
+    })
+  })
+  const address = server.address() as AddressInfo
+  return { server, url: `http://127.0.0.1:${address.port}/remote-terminal` }
+}
+
+async function closePageServer(server: Server): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()))
+  })
+}
+
+async function findTerminalLinkTarget(page: Page, link: string): Promise<{ x: number; y: number }> {
+  return page.evaluate((targetLink) => {
+    const state = window.__store?.getState()
+    const worktreeId = state?.activeWorktreeId
+    const tabId = worktreeId ? state?.activeTabIdByWorktree?.[worktreeId] : null
+    const manager = tabId ? window.__paneManagers?.get(tabId) : null
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    const screen = pane?.terminal.element?.querySelector<HTMLElement>('.xterm-screen') ?? null
+    if (!pane || !screen) {
+      throw new Error('paired terminal screen unavailable')
+    }
+    const buffer = pane.terminal.buffer.active
+    for (let row = 0; row < pane.terminal.rows; row += 1) {
+      const text = buffer.getLine(buffer.viewportY + row)?.translateToString(false) ?? ''
+      const column = text.indexOf(targetLink)
+      if (column === -1) {
+        continue
+      }
+      const cell = pane.terminal.dimensions?.css.cell
+      if (!cell?.width || !cell.height) {
+        throw new Error('paired terminal cell dimensions unavailable')
+      }
+      const rect = screen.getBoundingClientRect()
+      return {
+        x: rect.left + (column + targetLink.length / 2) * cell.width,
+        y: rect.top + (row + 0.5) * cell.height
+      }
+    }
+    throw new Error('paired terminal link unavailable')
+  }, link)
+}
+
+function remoteTerminalHandle(ptyId: string): string {
+  const separator = ptyId.indexOf('@@')
+  if (!ptyId.startsWith('remote:') || separator === -1) {
+    throw new Error(`Expected runtime-owned PTY id, received ${ptyId}`)
+  }
+  return decodeURIComponent(ptyId.slice(separator + 2))
+}
+
+test('opens a paired-runtime terminal link on its owning host', async ({
+  orcaPage,
+  testRepoPath
+}, testInfo) => {
+  test.setTimeout(240_000)
+  const fixture = await startPageServer()
+  let client: PairedElectronClient | null = null
+  let observerActive = false
+  try {
+    await waitForSessionReady(orcaPage)
+    await waitForActiveWorktree(orcaPage)
+    await ensureTerminalVisible(orcaPage)
+    await waitForActiveTerminalManager(orcaPage)
+    const hostPtyId = await waitForActivePanePtyId(orcaPage)
+    await execInTerminal(orcaPage, hostPtyId, `printf '%s\\n' ${JSON.stringify(fixture.url)}`)
+    await waitForTerminalOutput(orcaPage, fixture.url)
+
+    const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+    client = await launchPairedElectronClient(offer, testInfo, 'Remote terminal browser link')
+    const page = client.page
+    const worktreeId = await expect
+      .poll(
+        () =>
+          page.evaluate((repoPath) => {
+            const state = window.__store?.getState()
+            return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+          }, testRepoPath),
+        { timeout: 60_000, message: 'paired client never received the host worktree' }
+      )
+      .not.toBeNull()
+      .then(() =>
+        page.evaluate((repoPath) => {
+          const state = window.__store?.getState()
+          return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+        }, testRepoPath)
+      )
+    if (!worktreeId) {
+      throw new Error('paired client worktree disappeared after discovery')
+    }
+    await page.evaluate(
+      async ({ environmentId, worktreeId }) => {
+        const state = window.__store?.getState()
+        state?.setActiveWorktree(worktreeId, `runtime:${environmentId}`)
+        await state?.updateSettings({
+          openLinksInApp: true,
+          terminalLinkActionPopoverEnabled: true
+        })
+      },
+      { environmentId: client.environmentId, worktreeId }
+    )
+    await ensureTerminalVisible(page, 30_000)
+    await waitForActiveTerminalManager(page, 30_000)
+    await waitForTerminalOutput(page, fixture.url, 30_000)
+    const clientPtyId = await waitForActivePanePtyId(page, 30_000)
+    expect(clientPtyId.startsWith(`remote:${client.environmentId}@@`)).toBe(true)
+
+    const baseline = await readTabInventory(page, client.environmentId, worktreeId)
+    await startPanelNavigationObserver(client.app, page.url())
+    observerActive = true
+
+    const target = await findTerminalLinkTarget(page, fixture.url)
+    await page.mouse.move(target.x, target.y)
+    await expect(page.locator('.xterm-hover')).toHaveCount(1)
+    await page.mouse.click(target.x, target.y)
+    const actionPopover = page.locator('[data-terminal-link-action-popover]')
+    await expect(actionPopover).toBeVisible()
+    await expect(actionPopover.locator('[data-terminal-link-destination]')).toHaveText(fixture.url)
+    await expect(
+      actionPopover.getByRole('button').filter({ hasText: 'System Browser' })
+    ).toBeVisible()
+    const orcaBrowserAction = actionPopover.getByRole('button').filter({ hasText: 'Orca Browser' })
+    await expect(orcaBrowserAction).toBeVisible()
+    await orcaBrowserAction.click()
+
+    const identity = await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({ environmentId, url, worktreeId }) => {
+              const state = window.__store?.getState()
+              const workspace = (state?.browserTabsByWorktree[worktreeId] ?? []).find(
+                (tab) => tab.url === url
+              )
+              const browserPage = workspace
+                ? (state?.browserPagesByWorkspace[workspace.id] ?? [])[0]
+                : null
+              const handle = browserPage
+                ? state?.remoteBrowserPageHandlesByPageId[browserPage.id]
+                : null
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              const hostTab = response.ok
+                ? response.result.tabs.find((tab) => tab.type === 'browser' && tab.url === url)
+                : null
+              return workspace && browserPage && handle && hostTab?.type === 'browser'
+                ? {
+                    clientPageId: browserPage.id,
+                    clientRuntimeId: browserPage.browserRuntimeEnvironmentId,
+                    clientWorkspaceId: workspace.id,
+                    hostPageId: hostTab.browserPageId,
+                    hostTabId: hostTab.id,
+                    remoteEnvironmentId: handle.environmentId,
+                    remotePageId: handle.remotePageId
+                  }
+                : null
+            },
+            { environmentId: client!.environmentId, url: fixture.url, worktreeId }
+          ),
+        { timeout: 60_000, message: 'terminal link never became one host-owned browser tab' }
+      )
+      .not.toBeNull()
+      .then(() =>
+        page.evaluate(
+          async ({ environmentId, url, worktreeId }) => {
+            const state = window.__store!.getState()
+            const workspace = state.browserTabsByWorktree[worktreeId]!.find(
+              (tab) => tab.url === url
+            )!
+            const browserPage = state.browserPagesByWorkspace[workspace.id]![0]!
+            const handle = state.remoteBrowserPageHandlesByPageId[browserPage.id]!
+            const response = await window.api.runtimeEnvironments.call({
+              selector: environmentId,
+              method: 'session.tabs.list',
+              params: { worktree: `id:${worktreeId}` },
+              timeoutMs: 15_000
+            })
+            if (!response.ok) {
+              throw new Error('host tab inventory unavailable')
+            }
+            const hostTab = response.result.tabs.find(
+              (tab) => tab.type === 'browser' && tab.url === url
+            )!
+            return {
+              clientPageId: browserPage.id,
+              clientRuntimeId: browserPage.browserRuntimeEnvironmentId,
+              clientWorkspaceId: workspace.id,
+              hostPageId: hostTab.type === 'browser' ? hostTab.browserPageId : null,
+              hostTabId: hostTab.id,
+              remoteEnvironmentId: handle.environmentId,
+              remotePageId: handle.remotePageId
+            }
+          },
+          { environmentId: client!.environmentId, url: fixture.url, worktreeId }
+        )
+      )
+
+    expect(identity.clientRuntimeId).toBe(client.environmentId)
+    expect(identity.remoteEnvironmentId).toBe(client.environmentId)
+    expect(identity.remotePageId).toBe(identity.hostPageId)
+    const finalInventory = await readTabInventory(page, client.environmentId, worktreeId)
+    expect(finalInventory).toEqual({
+      clientBrowserWorkspaces: baseline.clientBrowserWorkspaces + 1,
+      clientBrowserTabs: baseline.clientBrowserTabs + 1,
+      clientTerminalTabs: baseline.clientTerminalTabs,
+      hostBrowserTabs: baseline.hostBrowserTabs + 1,
+      hostTerminalTabs: baseline.hostTerminalTabs
+    })
+    expect((await readPanelNavigationObserver(client.app)).externalUrls).toEqual([])
+
+    const content = await page.evaluate(
+      async ({ browserPageId, environmentId, worktreeId }) =>
+        window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'browser.eval',
+          params: {
+            worktree: `id:${worktreeId}`,
+            page: browserPageId,
+            expression: 'document.querySelector("h1")?.textContent'
+          },
+          timeoutMs: 15_000
+        }),
+      {
+        browserPageId: identity.hostPageId!,
+        environmentId: client.environmentId,
+        worktreeId
+      }
+    )
+    expect(content).toMatchObject({ ok: true, result: { result: PAGE_MARKER } })
+
+    const browserTab = page.locator(`[data-tab-id="${identity.clientWorkspaceId}"]`)
+    await browserTab.click()
+    await expect
+      .poll(() =>
+        page.evaluate((worktreeId) => {
+          const state = window.__store?.getState()
+          return {
+            browserWorkspaceId: state?.activeBrowserTabIdByWorktree[worktreeId] ?? null,
+            tabType: state?.activeTabTypeByWorktree[worktreeId] ?? null
+          }
+        }, worktreeId)
+      )
+      .toEqual({ browserWorkspaceId: identity.clientWorkspaceId, tabType: 'browser' })
+    await expect(
+      page.locator(`[data-browser-overlay-tab-id="${identity.clientWorkspaceId}"]`)
+    ).toHaveCSS('opacity', '1')
+
+    await browserTab.hover()
+    await browserTab.locator('button').click()
+    await expect
+      .poll(() => readTabInventory(page, client!.environmentId, worktreeId), {
+        timeout: 30_000,
+        message: 'host and client browser inventories did not return to baseline'
+      })
+      .toEqual(baseline)
+
+    await ensureTerminalVisible(page, 30_000)
+    await waitForActiveTerminalManager(page, 30_000)
+    expect(await waitForActivePanePtyId(page, 30_000)).toBe(clientPtyId)
+    const send = await page.evaluate(
+      async ({ environmentId, terminal, text }) =>
+        window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'terminal.send',
+          params: {
+            terminal,
+            text,
+            enter: true,
+            client: { id: 'remote-browser-close-e2e', type: 'desktop' }
+          },
+          timeoutMs: 15_000
+        }),
+      {
+        environmentId: client.environmentId,
+        terminal: remoteTerminalHandle(clientPtyId),
+        text: `printf '%s\\n' ${JSON.stringify(TERMINAL_MARKER)}`
+      }
+    )
+    expect(send).toMatchObject({ ok: true, result: { send: { accepted: true } } })
+    await waitForTerminalOutput(page, TERMINAL_MARKER, 30_000)
+    expect(await readTabInventory(page, client.environmentId, worktreeId)).toEqual(baseline)
+    expect((await readPanelNavigationObserver(client.app)).externalUrls).toEqual([])
+  } finally {
+    if (observerActive && client) {
+      await stopPanelNavigationObserver(client.app).catch(() => undefined)
+    }
+    await client?.dispose()
+    await closePageServer(fixture.server)
+  }
+})
diff --git a/tests/e2e/paired-runtime-version-skew.spec.ts b/tests/e2e/paired-runtime-version-skew.spec.ts
new file mode 100644
index 00000000000..bfd9cc96f27
--- /dev/null
+++ b/tests/e2e/paired-runtime-version-skew.spec.ts
@@ -0,0 +1,217 @@
+import { expect, test } from './helpers/orca-app'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedElectronClient,
+  type PairedElectronClient
+} from './helpers/paired-electron-client'
+import { createRestartSession } from './helpers/orca-restart'
+
+/**
+ * Journey 12, live half: two REAL Orca processes at DIFFERENT versions talking
+ * over the real desktop-pairing transport. The in-process wire suite under
+ * `tests/e2e/cross-version-wire/` pairs two builds inside one Node process; this
+ * spec pairs two builds as two operating-system processes.
+ *
+ * `ORCA_J12_OLD_APP_ROOT` must point at a second, fully built checkout of an
+ * older release. The spec refuses to run rather than silently degrading into a
+ * same-version pairing, which would look green and prove nothing.
+ */
+const oldAppRoot = process.env.ORCA_J12_OLD_APP_ROOT?.trim()
+
+test.skip(!oldAppRoot, 'Set ORCA_J12_OLD_APP_ROOT to a built older-release checkout')
+
+test.describe.configure({ mode: 'serial' })
+
+type PaneCoordinates = {
+  worktreeId: string
+  tabId: string
+  leafId: string
+  paneKey: string
+}
+
+/** Handle plus the identity of the process actually behind it. */
+type PaneShellIdentity = {
+  handle: string
+  ptyId: string | null
+  /** `$$` reported by the shell itself through the production terminal path. */
+  shellPid: string
+  /**
+   * Kernel start time of that pid. Journey 1 established that ids alone prove
+   * nothing: a replacement shell can reuse a pane id, a leaf id and even a pid.
+   */
+  shellStartTime: string
+}
+
+async function readClientVersion(client: PairedElectronClient): Promise<string> {
+  return client.app.evaluate(({ app }) => app.getVersion())
+}
+
+async function callHub(
+  client: PairedElectronClient,
+  method: string,
+  params: Record<string, unknown>
+): Promise<Record<string, unknown>> {
+  return client.page.evaluate(
+    ({ environmentId, method, params }) =>
+      window.api.runtimeEnvironments.call({ selector: environmentId, method, params }),
+    { environmentId: client.environmentId, method, params }
+  ) as Promise<Record<string, unknown>>
+}
+
+async function readPaneCoordinates(client: PairedElectronClient): Promise<PaneCoordinates> {
+  const coordinates = await client.page.evaluate(() => {
+    const state = window.__store?.getState()
+    const worktreeId = state?.activeWorktreeId ?? null
+    const tabs = worktreeId ? (state?.tabsByWorktree[worktreeId] ?? []) : []
+    const tabId = state?.activeTabId ?? tabs[0]?.id ?? null
+    const manager = tabId ? window.__paneManagers?.get(tabId) : null
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    const leafId = pane?.leafId ?? null
+    return { worktreeId, tabId, leafId }
+  })
+  if (!coordinates.worktreeId || !coordinates.tabId || !coordinates.leafId) {
+    // Known gap: the restart fixture launches a HUB with no workspace, so the
+    // paired client has nothing to mirror. The nested-runtime specs get theirs
+    // from the docker SSH repo; this spec still needs that seeding step.
+    throw new Error(`Paired client has no resolvable pane: ${JSON.stringify(coordinates)}`)
+  }
+  return {
+    worktreeId: coordinates.worktreeId,
+    tabId: coordinates.tabId,
+    leafId: coordinates.leafId,
+    paneKey: `${coordinates.tabId}:${coordinates.leafId}`
+  }
+}
+
+/**
+ * Ask the shell itself who it is, through `terminal.send` / `terminal.read` —
+ * the same runtime methods the product uses. A pid alone can be recycled, so the
+ * probe also reports the kernel's start time for that pid.
+ */
+async function readPaneShellIdentity(
+  client: PairedElectronClient,
+  pane: PaneCoordinates,
+  marker: string
+): Promise<PaneShellIdentity> {
+  const resolved = (await callHub(client, 'terminal.resolvePane', {
+    paneKey: pane.paneKey,
+    worktreeId: pane.worktreeId
+  })) as { ok?: boolean; result?: { terminal?: { handle?: string; ptyId?: string | null } } }
+  const terminal = resolved.result?.terminal
+  if (!terminal?.handle) {
+    throw new Error(`HUB did not resolve pane ${pane.paneKey}: ${JSON.stringify(resolved)}`)
+  }
+  const send = await callHub(client, 'terminal.send', {
+    terminal: terminal.handle,
+    text: `printf '${marker}%s %s\\n' "$$" "$(ps -o lstart= -p $$ | tr -s ' ' '_')"\n`,
+    client: { id: 'j12-live-skew', type: 'desktop' }
+  })
+  if (send.ok !== true) {
+    throw new Error(`terminal.send failed: ${JSON.stringify(send)}`)
+  }
+  let captured: { pid: string; startTime: string } | null = null
+  await expect
+    .poll(
+      async () => {
+        const read = (await callHub(client, 'terminal.read', {
+          terminal: terminal.handle,
+          lines: 400
+        })) as { result?: { read?: { content?: string } } }
+        const content = read.result?.read?.content ?? ''
+        const match = [...content.matchAll(new RegExp(`${marker}(\\d+) (\\S+)`, 'g'))].at(-1)
+        if (!match) {
+          return false
+        }
+        captured = { pid: match[1], startTime: match[2] }
+        return true
+      },
+      { timeout: 30_000 }
+    )
+    .toBe(true)
+  if (!captured) {
+    throw new Error(`Shell never reported its identity for marker ${marker}`)
+  }
+  return {
+    handle: terminal.handle,
+    ptyId: terminal.ptyId ?? null,
+    shellPid: captured.pid,
+    shellStartTime: captured.startTime
+  }
+}
+
+test('an older paired client keeps its HUB shell across a HUB restart', async ({
+  orcaAppExtraEnv: _orcaAppExtraEnv
+}, testInfo) => {
+  test.setTimeout(600_000)
+  const hub = createRestartSession(testInfo)
+  let client: PairedElectronClient | null = null
+  let hubLaunch: Awaited<ReturnType<typeof hub.launch>> | null = null
+  try {
+    hubLaunch = await hub.launch()
+    await hubLaunch.page.waitForFunction(
+      () => window.__store?.getState().workspaceSessionReady === true,
+      null,
+      { timeout: 60_000 }
+    )
+    const hubVersion = await hubLaunch.app.evaluate(({ app }) => app.getVersion())
+    const offer = await createRuntimeDesktopPairingOffer(hubLaunch.page)
+    client = await launchPairedElectronClient(offer, testInfo, 'J12 old paired client', oldAppRoot)
+    const clientVersion = await readClientVersion(client)
+
+    // Vacuity guard: a same-version pairing would pass every assertion below
+    // while proving nothing about skew.
+    expect(
+      clientVersion,
+      `Paired client at ${oldAppRoot} reports the same version as the HUB (${hubVersion}); ` +
+        'this run would not exercise any version skew.'
+    ).not.toBe(hubVersion)
+
+    console.log(`[j12-live] HUB=${hubVersion} pairedClient=${clientVersion}`)
+    console.log(
+      `[j12-live] hub worktrees=${JSON.stringify(
+        await hubLaunch.page.evaluate(() =>
+          Object.values(window.__store?.getState().worktreesByRepo ?? {})
+            .flat()
+            .map((worktree) => worktree.id)
+        )
+      )}`
+    )
+
+    const pane = await readPaneCoordinates(client)
+    const before = await readPaneShellIdentity(client, pane, `J12_BEFORE_${Date.now()}_`)
+    const preRestartEnvironmentId = client.environmentId
+
+    await hub.close(hubLaunch.app)
+    hubLaunch = await hub.launch()
+    await hubLaunch.page.waitForFunction(
+      () => window.__store?.getState().workspaceSessionReady === true,
+      null,
+      { timeout: 60_000 }
+    )
+    const recovered = await client.page.evaluate(async (environmentId) => {
+      const store = window.__store
+      if (!store) {
+        return false
+      }
+      if (!(await store.getState().refreshRuntimeEnvironmentStatus(environmentId))) {
+        return false
+      }
+      return store.getState().switchRuntimeEnvironment(environmentId)
+    }, preRestartEnvironmentId)
+    expect(recovered).toBe(true)
+
+    const after = await readPaneShellIdentity(client, pane, `J12_AFTER_${Date.now()}_`)
+
+    // A `terminal.recoverPane` would mint a new handle and a new shell. Ids
+    // matching is not enough: the start time proves it is the same process.
+    expect(after.handle).toBe(before.handle)
+    expect(after.shellPid).toBe(before.shellPid)
+    expect(after.shellStartTime).toBe(before.shellStartTime)
+  } finally {
+    await client?.dispose()
+    if (hubLaunch) {
+      await hub.close(hubLaunch.app)
+    }
+    await hub.dispose()
+  }
+})
diff --git a/tests/e2e/paired-startup-exec-readiness.spec.ts b/tests/e2e/paired-startup-exec-readiness.spec.ts
new file mode 100644
index 00000000000..cd96de038ce
--- /dev/null
+++ b/tests/e2e/paired-startup-exec-readiness.spec.ts
@@ -0,0 +1,184 @@
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import type { Page } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+import { launchHeadlessPairedRuntimeHost } from './helpers/headless-paired-runtime-host'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedWebClient
+} from './helpers/paired-electron-client'
+import {
+  callStartupExecRuntime,
+  closeStartupExecTerminal,
+  createStartupExecTerminal,
+  expectStartupExecRecovery,
+  installZshExecProfile
+} from './helpers/startup-exec-readiness-oracle'
+
+test.skip(process.platform === 'win32', 'Paired startup-exec readiness uses POSIX shells.')
+
+async function waitForWorktree(page: Page, id: string): Promise<void> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(
+          (worktreeId) =>
+            window.__store
+              ?.getState()
+              .allWorktrees()
+              .some((candidate) => candidate.id === worktreeId),
+          id
+        ),
+      { timeout: 30_000 }
+    )
+    .toBe(true)
+  await expect
+    .poll(
+      async () => {
+        const listed = await callStartupExecRuntime<{ worktrees: { id: string }[] }>(
+          page,
+          'worktree.list',
+          {}
+        )
+        return listed.worktrees.some((candidate) => candidate.id === id)
+      },
+      { timeout: 30_000 }
+    )
+    .toBe(true)
+}
+
+function expectLedger(ledgerPath: string): void {
+  const [pid, tty] = readFileSync(ledgerPath, 'utf8').trim().split('|')
+  expect(Number(pid)).toBeGreaterThan(1)
+  expect(tty).toMatch(/^\/dev\//)
+}
+
+async function releaseExecBarrier(
+  startedPath: string,
+  releasePath: string,
+  ledgerPath: string
+): Promise<void> {
+  await expect
+    .poll(
+      () =>
+        existsSync(startedPath)
+          ? 'started'
+          : existsSync(ledgerPath)
+            ? readFileSync(ledgerPath, 'utf8').trim()
+            : 'pending',
+      { timeout: 30_000 }
+    )
+    .toBe('started')
+  expect(existsSync(ledgerPath)).toBe(false)
+  writeFileSync(releasePath, '')
+}
+
+function cleanupExecBarrier(startedPath: string, releasePath: string): void {
+  rmSync(startedPath, { force: true })
+  rmSync(releasePath, { force: true })
+}
+
+test('recovers startup exec through a headed paired desktop owner @headful', async ({
+  electronApp,
+  orcaPage
+}) => {
+  test.setTimeout(90_000)
+  const runId = `headed_${Date.now()}`
+  const homePath = await electronApp.evaluate(({ app }) => app.getPath('home'))
+  const ledgerPath = path.join(homePath, `.sta4067-${runId}.ledger`)
+  const startedPath = path.join(homePath, `.sta4067-${runId}.started`)
+  const releasePath = path.join(homePath, `.sta4067-${runId}.release`)
+  const removeProfile = installZshExecProfile(homePath, runId, { releasePath, startedPath })
+  const worktreeId = await orcaPage.evaluate(() => window.__store?.getState().activeWorktreeId)
+  if (!worktreeId) {
+    throw new Error('Headed owner has no active worktree')
+  }
+  const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+  const client = await launchPairedWebClient(electronApp, offer)
+  let terminal: string | null = null
+  try {
+    await waitForWorktree(client.page, worktreeId)
+    const created = await createStartupExecTerminal(
+      client.page,
+      worktreeId,
+      runId,
+      ledgerPath,
+      'paired-client',
+      '/bin/zsh',
+      { ORCA_ORIG_ZDOTDIR: homePath, ORCA_ZSHENV_SOURCE_DIR: homePath }
+    )
+    terminal = created.terminal
+    await releaseExecBarrier(startedPath, releasePath, ledgerPath)
+    await expectStartupExecRecovery(client.page, created, runId)
+    expectLedger(ledgerPath)
+  } finally {
+    await closeStartupExecTerminal(orcaPage, terminal)
+    await client.dispose()
+    removeProfile()
+    cleanupExecBarrier(startedPath, releasePath)
+  }
+})
+
+test('recovers the same startup exec through an isolated headless orca serve', async ({
+  testRepoPath
+}) => {
+  test.setTimeout(120_000)
+  const runId = `headless_${Date.now()}`
+  const host = await launchHeadlessPairedRuntimeHost()
+  let terminal: string | null = null
+  let removeProfile: (() => void) | undefined
+  let client: Awaited<ReturnType<typeof launchPairedWebClient>> | undefined
+  let startedPath = ''
+  let releasePath = ''
+  try {
+    const homePath = await host.app.evaluate(({ app }) => app.getPath('home'))
+    const ledgerPath = path.join(homePath, `.sta4067-${runId}.ledger`)
+    startedPath = path.join(homePath, `.sta4067-${runId}.started`)
+    releasePath = path.join(homePath, `.sta4067-${runId}.release`)
+    removeProfile = installZshExecProfile(homePath, runId, { releasePath, startedPath })
+    client = await launchPairedWebClient(host.app, host.offer, { waitForWorkspace: false })
+    await host.client.call('repo.add', { path: testRepoPath, kind: 'git' })
+    await client.page.locator('[data-worktree-sidebar]').waitFor({
+      state: 'visible',
+      timeout: 30_000
+    })
+    await expect
+      .poll(
+        () => client.page.evaluate(() => window.__store?.getState().allWorktrees()[0]?.id ?? null),
+        { timeout: 30_000 }
+      )
+      .not.toBeNull()
+    const worktreeId = await client.page.evaluate(
+      () => window.__store?.getState().allWorktrees()[0]?.id ?? null
+    )
+    if (!worktreeId) {
+      throw new Error('Headless owner did not publish its worktree')
+    }
+    const created = await createStartupExecTerminal(
+      client.page,
+      worktreeId,
+      runId,
+      ledgerPath,
+      'paired-client',
+      '/bin/zsh',
+      { ORCA_ORIG_ZDOTDIR: homePath, ORCA_ZSHENV_SOURCE_DIR: homePath }
+    )
+    terminal = created.terminal
+    await releaseExecBarrier(startedPath, releasePath, ledgerPath)
+    await expectStartupExecRecovery(client.page, created, runId)
+    expectLedger(ledgerPath)
+  } finally {
+    try {
+      if (client) {
+        await closeStartupExecTerminal(client.page, terminal)
+        await client.dispose()
+      }
+      removeProfile?.()
+      if (startedPath) {
+        cleanupExecBarrier(startedPath, releasePath)
+      }
+    } finally {
+      await host.dispose()
+    }
+  }
+})
diff --git a/tests/e2e/paired-web-add-project-unavailable-host.spec.ts b/tests/e2e/paired-web-add-project-unavailable-host.spec.ts
new file mode 100644
index 00000000000..771feffdde7
--- /dev/null
+++ b/tests/e2e/paired-web-add-project-unavailable-host.spec.ts
@@ -0,0 +1,158 @@
+import type { ElectronApplication, Page, TestInfo } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+import {
+  launchHeadlessPairedRuntimeHost,
+  type HeadlessPairedRuntimeHost
+} from './helpers/headless-paired-runtime-host'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedWebClient,
+  type PairedWebClient,
+  type RuntimeDesktopPairingOffer
+} from './helpers/paired-electron-client'
+import { waitForSessionReady } from './helpers/store'
+
+test.skip(
+  process.env.ORCA_E2E_WEB_CLIENT !== '1',
+  'Run with ORCA_E2E_WEB_CLIENT=1 so the paired web client is built'
+)
+
+type HostHealth = 'blocked' | 'disconnected'
+
+async function setOnlyRuntimeHostHealth(page: Page, health: HostHealth): Promise<string> {
+  return page.evaluate((nextHealth) => {
+    const store = window.__store
+    if (!store) {
+      throw new Error('Paired web client store unavailable')
+    }
+    const state = store.getState()
+    const environment = state.runtimeEnvironments[0]
+    if (!environment) {
+      throw new Error('Paired web client has no configured runtime')
+    }
+    const current = state.runtimeStatusByEnvironmentId.get(environment.id)
+    if (nextHealth === 'blocked' && !current?.status) {
+      throw new Error('Paired web runtime status unavailable for compatibility fault')
+    }
+    store.setState({
+      runtimeStatusByEnvironmentId: new Map(state.runtimeStatusByEnvironmentId).set(
+        environment.id,
+        nextHealth === 'blocked'
+          ? {
+              ...current,
+              checkedAt: Date.now(),
+              status: {
+                ...current!.status!,
+                protocolVersion: 0,
+                runtimeProtocolVersion: 0
+              }
+            }
+          : { ...current, checkedAt: Date.now(), status: null }
+      )
+    })
+    return environment.name
+  }, health)
+}
+
+async function assertCreationActionsDisabled(args: {
+  health: HostHealth
+  hostName: string
+  page: Page
+  testInfo: TestInfo
+  topology: 'headed' | 'headless'
+}): Promise<void> {
+  await args.page
+    .getByRole('button', { name: /Add Project/i })
+    .first()
+    .click()
+  const dialog = args.page.getByRole('dialog', { name: /Add a project/i })
+  await expect(dialog).toBeVisible()
+  const hostPicker = dialog.getByRole('combobox')
+  await expect(hostPicker).toContainText(args.hostName)
+  await expect(hostPicker).toContainText(
+    args.health === 'blocked' ? 'Update needed' : 'Disconnected'
+  )
+  await expect(dialog.getByRole('button', { name: /Browse folder|Browse host/i })).toBeDisabled()
+  await expect(dialog.getByRole('button', { name: /Clone from URL/i })).toBeDisabled()
+  await expect(dialog.getByRole('button', { name: /Create new project/i })).toBeDisabled()
+
+  await hostPicker.click()
+  const hostOption = args.page
+    .locator('[cmdk-item][aria-disabled="true"]')
+    .filter({ hasText: args.hostName })
+  await expect(hostOption).toHaveAttribute('aria-disabled', 'true')
+  await expect(hostOption).toContainText(args.health === 'blocked' ? 'Update Orca' : 'Disconnected')
+  await args.page.keyboard.press('Escape')
+  await args.page.screenshot({
+    path: args.testInfo.outputPath(`${args.topology}-paired-web-add-project-${args.health}.png`),
+    fullPage: true
+  })
+  await dialog.getByRole('button', { name: 'Close' }).click()
+  await expect(dialog).toBeHidden()
+}
+
+async function runUnavailableHostJourney(args: {
+  app: ElectronApplication
+  offer: RuntimeDesktopPairingOffer
+  testInfo: TestInfo
+  topology: 'headed' | 'headless'
+}): Promise<void> {
+  let client: PairedWebClient | null = null
+  try {
+    client = await launchPairedWebClient(args.app, args.offer)
+    await args.app.evaluate(({ BrowserWindow }) => {
+      BrowserWindow.getAllWindows().forEach((window) => window.show())
+    })
+    const hostName = await setOnlyRuntimeHostHealth(client.page, 'blocked')
+    await assertCreationActionsDisabled({
+      health: 'blocked',
+      hostName,
+      page: client.page,
+      testInfo: args.testInfo,
+      topology: args.topology
+    })
+    expect(await setOnlyRuntimeHostHealth(client.page, 'disconnected')).toBe(hostName)
+    await assertCreationActionsDisabled({
+      health: 'disconnected',
+      hostName,
+      page: client.page,
+      testInfo: args.testInfo,
+      topology: args.topology
+    })
+  } finally {
+    await client?.dispose()
+  }
+}
+
+test('disables paired-web Add Project for a blocked or unavailable headed host @headful', async ({
+  electronApp,
+  orcaPage
+}, testInfo) => {
+  test.setTimeout(240_000)
+  await waitForSessionReady(orcaPage)
+  const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+  await runUnavailableHostJourney({
+    app: electronApp,
+    offer,
+    testInfo,
+    topology: 'headed'
+  })
+})
+
+test('keeps paired-web Add Project disabled for a headless unavailable host', async ({
+  testRepoPath
+}, testInfo) => {
+  test.setTimeout(240_000)
+  const host: HeadlessPairedRuntimeHost = await launchHeadlessPairedRuntimeHost()
+  try {
+    await host.client.call('repo.add', { path: testRepoPath, kind: 'git' })
+    await runUnavailableHostJourney({
+      app: host.app,
+      offer: host.offer,
+      testInfo,
+      topology: 'headless'
+    })
+  } finally {
+    await host.dispose()
+  }
+})
diff --git a/tests/e2e/remote-agent-session-focus-authority.spec.ts b/tests/e2e/remote-agent-session-focus-authority.spec.ts
index 2b007fddd98..4fb4c3e7ae8 100644
--- a/tests/e2e/remote-agent-session-focus-authority.spec.ts
+++ b/tests/e2e/remote-agent-session-focus-authority.spec.ts
@@ -140,7 +140,7 @@ async function readRenderedTabOrder(page: Page): Promise<string[]> {
 
 function expectImmediatelyAfter(order: string[], predecessor: string, created: string): void {
   const predecessorIndex = order.indexOf(predecessor)
-  if (predecessorIndex < 0) {
+  if (predecessorIndex === -1) {
     throw new Error(
       `placement predecessor ${predecessor} missing before ${created}: ${JSON.stringify(order)}`
     )
diff --git a/tests/e2e/ssh-disconnected-pane-affordance.spec.ts b/tests/e2e/ssh-disconnected-pane-affordance.spec.ts
new file mode 100644
index 00000000000..417bf56e14c
--- /dev/null
+++ b/tests/e2e/ssh-disconnected-pane-affordance.spec.ts
@@ -0,0 +1,391 @@
+/**
+ * STA-3077 goalpost S3's affordance — an unreachable pane says so, offers two
+ * actions, and destroys nothing.
+ *
+ * Before S3, `handlePtyReattachFailure` answered any reattach failure with a
+ * synthetic `pty:exit { code: -1 }`, cleared provider state, deleted ownership
+ * and expired the lease: four claims about a process nobody had observed, on a
+ * shell that was usually still running. Collapsing that left the pane with no
+ * signal at all, so the pane now renders as disconnected with exactly two
+ * explicit actions — "Try again" and "Start a new terminal" — and its copy may
+ * never assert the shell exited, because a failed attach is not result data.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * HELD AS `fixme`: THE STATE IS NOT INDUCIBLE FROM THE HOST TODAY.
+ *
+ * The banner needs one narrow state — the SSH target reporting itself CONNECTED
+ * while a single pane's `pty.attach` fails with an error that does not prove the
+ * session gone. `TerminalPane` suppresses this banner entirely while
+ * `showSshReconnectOverlay` is true, so any fault that takes the connection down
+ * with it produces the connection-level overlay instead and never reaches here.
+ *
+ * Two host-side faults were driven against the real Docker relay and neither
+ * lands in that state:
+ *
+ *  1. Stop the detached relay (SIGSTOP) and remount the pane. The relay keeps
+ *     every shell, but the client reads the silent host as gone, reinstalls a
+ *     relay beside it, and the SSH target drops to `connecting`. The pane's
+ *     connect gate then DEFERS rather than attaching, so no attach fails at all;
+ *     the pane shows "SSH connection required". Measured, not assumed: the run
+ *     that produced this note timed out on the locator below with that overlay
+ *     on screen. That fault is still worth having, and it is what
+ *     ssh-reattach-does-not-resume-agent-twice.spec.ts uses to prove the
+ *     non-destructive half of S3 — the shell stays alive, the lease stays
+ *     claimable, and no second shell is launched.
+ *  2. Sever the transport. Same shape: the target leaves `connected`, the gate
+ *     defers, and the reattach that eventually runs succeeds.
+ *
+ * What would reach it is a fault that leaves the mux healthy and fails ONE pty:
+ * the relay answering `sourceRecovery.restoreRequired` for a single id, which
+ * today only arises from a delivery-record divergence between two client
+ * generations. There is no seam to force that from a test without adding one in
+ * `src/`, which this change is not allowed to do. The oracle is kept whole and
+ * held rather than deleted, so it runs the day such a seam exists.
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * MUTATIONS THAT MUST REDDEN THIS FILE ONCE IT RUNS:
+ *  - `reattach-failure-classification.ts`: make `isProvenSshSessionGoneError`
+ *    return true for every error. The pane respawns silently, so no banner
+ *    appears and the census gains a second shell.
+ *  - `TerminalPaneDisconnectedBanner.tsx`: reword the `ssh-pane` copy to say the
+ *    terminal exited, or drop either action. Clause 2 or clause 1 reddens.
+ *  - `ssh-relay-session.ts`: restore the destructive block in
+ *    `handlePtyReattachFailure`. Clause 3 reddens on the expired lease.
+ */
+import type { Locator, Page, TestInfo } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  sendToTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneIdentitySnapshot,
+  type PaneIdentitySnapshot
+} from './helpers/terminal'
+import {
+  describeSshRemotePtyLeases,
+  findSshRemotePtyLeaseForLeaf,
+  readSshRemotePtyLeases,
+  resolveOrcaProfileStateFile
+} from './helpers/ssh-remote-pty-lease-file'
+import {
+  cleanupDockerSshRelayTarget,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import { connectDockerSshRelayTarget } from './helpers/docker-ssh-relay-connection'
+import { readDockerSshRelayProcessSnapshot } from './helpers/docker-ssh-relay-processes'
+import { resumeDockerSshRelay, stallDockerSshRelay } from './helpers/docker-ssh-relay-stall'
+import {
+  countDockerSshRelayRemoteStreamWriters,
+  describeDockerSshRelayRemotePtys,
+  readDockerSshRelayRemotePtys
+} from './helpers/docker-ssh-relay-remote-ptys'
+import {
+  installRemotePaneLaunchTranscript,
+  readRemotePaneLaunchPids
+} from './helpers/remote-pane-launch-transcript'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+const UNREACHABLE_PANE_INDUCTION_UNAVAILABLE =
+  'No host-side fault leaves the SSH target connected while one pane attach fails; see the file header.'
+// Why: the relay must outlive the fault. If it exits with the client the remote
+// shells die too, and a dead shell makes "the banner overclaims" untestable.
+const RELAY_GRACE_PERIOD_SECONDS = 900
+// The banner is only reachable after the pane's `pty.attach` gives up, which
+// costs one mux request timeout.
+const UNREACHABLE_PANE_TIMEOUT_MS = 150_000
+
+/**
+ * The copy constraint as an oracle. A failed attach is not result data, so the
+ * pane may not carry a result verb (STYLEGUIDE.md:236). Enforced here rather
+ * than in review, because the tempting reword is exactly the old lie.
+ */
+const DEATH_VERB = /exit|died|dead|terminated|killed|crashed/i
+/** The wire tokens the classification runs on must never reach the user. */
+const WIRE_TOKEN = /SSH_[A-Z_]+/
+
+test.use({ seedTestRepo: false })
+
+type UnreachableRemotePane = {
+  remote: Awaited<ReturnType<typeof connectDockerSshRelayTarget>>
+  snapshot: PaneIdentitySnapshot
+  paneKey: string
+  leafId: string
+  ptyId: string
+  pid: number
+  startTicks: number
+  relayPid: number
+  stateFile: string
+  banner: Locator
+}
+
+/** Rebuild the pane's renderer over its live PTY — the app's own recovery seam. */
+async function remountTerminalTabForRecovery(page: Page, tabId: string): Promise<void> {
+  const remounted = await page.evaluate((tabId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Store unavailable')
+    }
+    return state.remountTerminalTabForRecovery(tabId)
+  }, tabId)
+  expect(remounted, 'the terminal tab refused to remount, so no reattach was attempted').toBe(true)
+}
+
+/**
+ * A connected remote workspace with one streaming pane whose host has stopped
+ * answering. Why the pane must stream: an idle pane reattaches as 'existing' and
+ * never enters the source re-establishment the field failure came through.
+ */
+async function openUnreachableRemotePane(
+  page: Page,
+  app: Parameters<typeof resolveOrcaProfileStateFile>[0],
+  target: DockerSshRelayTarget
+): Promise<UnreachableRemotePane> {
+  installRemotePaneLaunchTranscript(target)
+
+  await waitForSessionReady(page)
+  const remote = await connectDockerSshRelayTarget(page, target, {
+    relayGracePeriodSeconds: RELAY_GRACE_PERIOD_SECONDS
+  })
+  await expect.poll(() => waitForActiveWorktree(page), { timeout: 30_000 }).toBe(remote.worktreeId)
+  await ensureTerminalVisible(page, 45_000)
+  await waitForActiveTerminalManager(page, 60_000)
+  await waitForActivePanePtyId(page, 60_000)
+
+  const snapshot = await waitForPaneIdentitySnapshot(page, 1)
+  const pane = snapshot.panes[0]
+  if (!pane?.ptyId) {
+    throw new Error('The remote workspace opened no pane with a PTY')
+  }
+  const paneKey = `${snapshot.tabId}:${pane.leafId}`
+
+  const streamMarker = `SSH_AFFORDANCE_STREAM_${Date.now()}`
+  await sendToTerminal(
+    page,
+    pane.ptyId,
+    `node -e "setInterval(()=>process.stdout.write('${streamMarker}_'+Date.now()+'\\n'),100)" &\r`
+  )
+  await expect
+    .poll(() => countDockerSshRelayRemoteStreamWriters(target, streamMarker), {
+      timeout: 60_000,
+      message: 'the remote pane never started streaming'
+    })
+    .toBe(1)
+
+  // Anti-vacuity for every "no second shell" clause below: the host records one
+  // launch for this pane now, so a later count of one means nothing was added.
+  await expect
+    .poll(() => readRemotePaneLaunchPids(target, paneKey).length, {
+      timeout: 60_000,
+      message: 'the host recorded no shell launch for the pane, so its transcript proves nothing'
+    })
+    .toBe(1)
+
+  const shell = readDockerSshRelayRemotePtys(target).find((entry) => entry.paneKey === paneKey)
+  if (!shell) {
+    throw new Error(`The relay hosts no remote shell for pane ${paneKey}`)
+  }
+  const relay = readDockerSshRelayProcessSnapshot(target)
+  if (!relay) {
+    throw new Error('No detached relay to stall')
+  }
+
+  stallDockerSshRelay(target, relay.relayPid)
+  await remountTerminalTabForRecovery(page, snapshot.tabId)
+
+  return {
+    remote,
+    snapshot,
+    paneKey,
+    leafId: pane.leafId,
+    ptyId: pane.ptyId,
+    pid: shell.pid,
+    startTicks: shell.startTicks,
+    relayPid: relay.relayPid,
+    stateFile: await resolveOrcaProfileStateFile(app),
+    banner: page.locator('[data-terminal-pane-disconnected-variant="ssh-pane"]')
+  }
+}
+
+test.describe('an unreachable SSH pane offers two actions and destroys nothing', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH tests.')
+  test.skip(process.platform === 'win32', 'Docker SSH faults use POSIX SSH tooling.')
+
+  test('the pane reports itself disconnected without claiming the shell exited', async ({
+    orcaPage,
+    electronApp
+  }, testInfo: TestInfo) => {
+    test.fixme(true, UNREACHABLE_PANE_INDUCTION_UNAVAILABLE)
+    test.setTimeout(600_000)
+    let target: DockerSshRelayTarget | null = null
+    let stalledRelayPid: number | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      const relayTarget = target
+      const unreachable = await openUnreachableRemotePane(orcaPage, electronApp, relayTarget)
+      stalledRelayPid = unreachable.relayPid
+
+      // 1. The pane says it is disconnected, in the SSH variant, with both actions.
+      await expect(
+        unreachable.banner,
+        'the unreachable pane showed no disconnected affordance'
+      ).toBeVisible({ timeout: UNREACHABLE_PANE_TIMEOUT_MS })
+      await expect(
+        unreachable.banner,
+        'the disconnected pane is still advertising automatic retries'
+      ).toHaveAttribute('data-terminal-remote-runtime-reconnect-banner', 'disconnected')
+      await expect(unreachable.banner.getByRole('button', { name: 'Try again' })).toBeVisible()
+      await expect(
+        unreachable.banner.getByRole('button', { name: 'Start a new terminal' })
+      ).toBeVisible()
+
+      // 2. Copy constraint. Nothing here observed an exit, so nothing may report one.
+      const copy = (await unreachable.banner.textContent()) ?? ''
+      expect(copy.trim(), 'the disconnected banner rendered no copy at all').not.toBe('')
+      expect(copy, 'the disconnected banner claims the shell is gone').not.toMatch(DEATH_VERB)
+      expect(copy, 'the disconnected banner leaks a wire token').not.toMatch(WIRE_TOKEN)
+      testInfo.annotations.push({ type: 'ssh-disconnected-pane-copy', description: copy })
+
+      // 3. The claim under the copy: the shell is alive and the lease is not retired.
+      const shellsWhileUnreachable = readDockerSshRelayRemotePtys(relayTarget)
+      expect(
+        shellsWhileUnreachable.filter(
+          (shell) => shell.pid === unreachable.pid && shell.startTicks === unreachable.startTicks
+        ),
+        'the failed reattach killed the shell the pane owns'
+      ).toHaveLength(1)
+      const lease = findSshRemotePtyLeaseForLeaf(
+        unreachable.stateFile,
+        unreachable.remote.targetId,
+        unreachable.leafId
+      )
+      expect(lease, 'the failed reattach dropped the pane lease').toBeDefined()
+      expect(lease?.state, 'the failed reattach expired a lease over a running shell').not.toBe(
+        'expired'
+      )
+      expect(lease?.state, 'the failed reattach retired a lease over a running shell').not.toBe(
+        'terminated'
+      )
+      expect(
+        readRemotePaneLaunchPids(relayTarget, unreachable.paneKey),
+        'the failed reattach launched a second shell for the pane'
+      ).toHaveLength(1)
+      testInfo.annotations.push({
+        type: 'ssh-disconnected-pane-unreachable',
+        description: `${describeDockerSshRelayRemotePtys(shellsWhileUnreachable)} leases=${describeSshRemotePtyLeases(
+          readSshRemotePtyLeases(unreachable.stateFile, unreachable.remote.targetId)
+        )}`
+      })
+
+      // 4. 'Try again' reattaches the same shell once the host can answer again.
+      resumeDockerSshRelay(relayTarget, unreachable.relayPid)
+      stalledRelayPid = null
+      await unreachable.banner.getByRole('button', { name: 'Try again' }).click()
+      await expect(unreachable.banner, 'the banner outlived a successful retry').toBeHidden({
+        timeout: UNREACHABLE_PANE_TIMEOUT_MS
+      })
+      await waitForActiveTerminalManager(orcaPage, 60_000)
+      const recovered = await waitForPaneIdentitySnapshot(orcaPage, 1)
+      expect(recovered.panes[0]?.ptyId, 'the retry bound the pane to a different session').toBe(
+        unreachable.ptyId
+      )
+      expect(
+        readDockerSshRelayRemotePtys(relayTarget).map(
+          (shell) => `${shell.paneKey ?? '-'}=${shell.pid}@${shell.startTicks}`
+        ),
+        'the retry added or replaced a remote shell'
+      ).toEqual([`${unreachable.paneKey}=${unreachable.pid}@${unreachable.startTicks}`])
+      expect(
+        readRemotePaneLaunchPids(relayTarget, unreachable.paneKey),
+        'the retry launched a second shell for the pane'
+      ).toHaveLength(1)
+    } finally {
+      if (target && stalledRelayPid !== null) {
+        resumeDockerSshRelay(target, stalledRelayPid)
+      }
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+
+  // The other action, and the reason it is not styled as a loss: it adds a shell
+  // rather than replacing one, and the pane the user had is still the pane the
+  // user has.
+  test('starting a new terminal adds exactly one shell and leaves the panes alone', async ({
+    orcaPage,
+    electronApp
+  }, testInfo: TestInfo) => {
+    test.fixme(true, UNREACHABLE_PANE_INDUCTION_UNAVAILABLE)
+    test.setTimeout(600_000)
+    let target: DockerSshRelayTarget | null = null
+    let stalledRelayPid: number | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      const relayTarget = target
+      const unreachable = await openUnreachableRemotePane(orcaPage, electronApp, relayTarget)
+      stalledRelayPid = unreachable.relayPid
+
+      await expect(
+        unreachable.banner,
+        'the unreachable pane showed no disconnected affordance'
+      ).toBeVisible({ timeout: UNREACHABLE_PANE_TIMEOUT_MS })
+
+      resumeDockerSshRelay(relayTarget, unreachable.relayPid)
+      stalledRelayPid = null
+      await unreachable.banner.getByRole('button', { name: 'Start a new terminal' }).click()
+
+      // Exactly one more shell: the one the user asked for. The old shell is left
+      // running, which is what makes "starting a new one leaves it alone" true.
+      await expect
+        .poll(() => readRemotePaneLaunchPids(relayTarget, unreachable.paneKey).length, {
+          timeout: UNREACHABLE_PANE_TIMEOUT_MS,
+          message: 'starting a new terminal did not settle at exactly one additional launch'
+        })
+        .toBe(2)
+      expect(
+        readDockerSshRelayRemotePtys(relayTarget).filter(
+          (shell) => shell.pid === unreachable.pid && shell.startTicks === unreachable.startTicks
+        ),
+        'starting a new terminal killed the shell it promised to leave alone'
+      ).toHaveLength(1)
+      expect(
+        readDockerSshRelayRemotePtys(relayTarget),
+        'starting a new terminal changed the host by more than one shell'
+      ).toHaveLength(2)
+
+      // The pane count is a user-visible promise: a new shell is not a new pane.
+      const paneCount = await orcaPage.evaluate((worktreeId) => {
+        const state = window.__store?.getState()
+        if (!state) {
+          throw new Error('Store unavailable')
+        }
+        type LayoutNode =
+          | { type: 'leaf'; leafId: string }
+          | { type: 'split'; first: LayoutNode; second: LayoutNode }
+          | null
+        const collectLeafIds = (node: LayoutNode): string[] =>
+          !node
+            ? []
+            : node.type === 'leaf'
+              ? [node.leafId]
+              : [...collectLeafIds(node.first), ...collectLeafIds(node.second)]
+        return (state.tabsByWorktree[worktreeId] ?? []).reduce((total, tab) => {
+          const leaves = collectLeafIds(
+            (state.terminalLayoutsByTabId[tab.id]?.root ?? null) as LayoutNode
+          )
+          return total + Math.max(leaves.length, 1)
+        }, 0)
+      }, unreachable.remote.worktreeId)
+      expect(paneCount, 'starting a new terminal surfaced a pane the user never opened').toBe(1)
+      testInfo.annotations.push({
+        type: 'ssh-disconnected-pane-new-terminal',
+        description: describeDockerSshRelayRemotePtys(readDockerSshRelayRemotePtys(relayTarget))
+      })
+    } finally {
+      if (target && stalledRelayPid !== null) {
+        resumeDockerSshRelay(target, stalledRelayPid)
+      }
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+})
diff --git a/tests/e2e/ssh-lazy-discovery-skipped-host-restart.spec.ts b/tests/e2e/ssh-lazy-discovery-skipped-host-restart.spec.ts
new file mode 100644
index 00000000000..b16ef4001ee
--- /dev/null
+++ b/tests/e2e/ssh-lazy-discovery-skipped-host-restart.spec.ts
@@ -0,0 +1,661 @@
+/**
+ * Journey 3 — lazy discovery and a restart that skipped a host.
+ *
+ * Two real OpenSSH containers. Host A stays in use; host B is left offline by
+ * the user before the app quits, with two live panes and their remote shells
+ * still running on its container. The app then restarts.
+ *
+ * Three clauses, one per test, so a regression in one of them cannot be hidden
+ * by another's failure:
+ *
+ *  1. NOT PROBED EAGERLY. Startup dials host A (the positive control — without
+ *     it, "nothing dialed B" would be vacuous) and never touches host B. That
+ *     is measured on B's own container: sshd's cumulative accepted-auth log, a
+ *     live census of `sshd: root@` sessions, and a census of Orca's
+ *     `relay.js --connect` bridges. No app log line is trusted for this.
+ *  2. LAZY REDISCOVERY RESTORES ONLY THAT HOST. Revealing B's workspace is what
+ *     dials it, and what comes back is exactly the two panes it had — the same
+ *     PTY ids, and the same shells by pid AND kernel start time, each still
+ *     answering on its own pane. Ids alone would not notice a look-alike
+ *     respawn, so every pane reports its own `$$` back through the production
+ *     write path after the restore.
+ *  3. NO ADOPTION. Nothing host-current (a local PTY id) and nothing of host A's
+ *     is bound to, named under, or running for host B, and A is untouched by
+ *     B's late discovery.
+ *
+ * `mode: 'serial'` with a shared two-launch fixture: a red first test reports
+ * the others as "did not run", which is a skip and not a pass. Each test
+ * re-establishes what it needs, so any one of them can be run alone.
+ *
+ * Watched failing (2026-08-08, macOS 26.3.1 arm64, Docker 29.6.1):
+ *  - dropping the `disconnected`/`auth-failed` exclusion in
+ *    `buildActiveConnectionIdsAtShutdown` reddens test 1 (host B is dialed at
+ *    startup: auths 2 -> 3, one sshd session, one relay bridge) and only the
+ *    trailing timing assertion of test 2; test 3 stays green when run alone.
+ *  - resolving the durable pane owner from the host-current partition instead of
+ *    the host's (`resolvePersistedStablePaneOwner`) reddens tests 2 and 3 —
+ *    host B's panes never rebind — while test 1 stays green in the same run.
+ * No mutation was found that reddens test 3 alone; see the journey write-up.
+ */
+import type { ElectronApplication, Page, TestInfo } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { ensureTerminalVisible, switchToWorktree, waitForSessionReady } from './helpers/store'
+import {
+  readPaneIdentitySnapshot,
+  sendToTerminal,
+  splitActiveTerminalPane,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneIdentitySnapshot
+} from './helpers/terminal'
+import { readDurablePaneBindings, sshExecutionHostId } from './helpers/remote-pane-durable-session'
+import { readDurablePartitionPtyIds } from './helpers/docker-ssh-relay-host-partition'
+import {
+  cleanupDockerSshRelayTarget,
+  execDockerSshRelayTargetCommand,
+  shellQuote,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import {
+  connectDockerSshRelayTarget,
+  disconnectDockerSshRelayTarget
+} from './helpers/docker-ssh-relay-connection'
+import { readDockerSshRelayRemotePtys } from './helpers/docker-ssh-relay-remote-ptys'
+import {
+  describeDockerSshRemoteShellIdentities,
+  readDockerSshRemoteShellIdentities,
+  type DockerSshRemoteShellIdentity
+} from './helpers/docker-ssh-remote-shell-identity'
+import {
+  describeDockerSshHostProbeObservation,
+  readDockerSshHostProbeObservation,
+  type DockerSshHostProbeObservation
+} from './helpers/docker-ssh-host-probe-observations'
+import { createRestartSession } from './helpers/orca-restart'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+const PANE_COUNT = 2
+// Why: the relay has to outlive the app. If it exited with the client, host B's
+// shells would die at quit and "restore the same process" would be untestable.
+const RELAY_GRACE_PERIOD_SECONDS = 900
+const NO_PROBE_WINDOW_MS = 20_000
+const NO_PROBE_SAMPLE_MS = 1_000
+
+test.use({ seedTestRepo: false })
+
+type HostRecord = {
+  label: 'A' | 'B'
+  target: DockerSshRelayTarget
+  targetId: string
+  hostId: string
+  worktreeId: string
+  tabId: string
+  tabIds: string[]
+  leafIds: string[]
+  ptyIdByLeafId: Record<string, string>
+  shells: DockerSshRemoteShellIdentity[]
+  reportedPidByLeafId: Record<string, number>
+  durableBindings: string[]
+}
+
+type ProbeSample = {
+  observation: DockerSshHostProbeObservation
+  rendererStatus: string | null
+}
+
+type Journey = {
+  page: Page
+  hostA: HostRecord
+  hostB: HostRecord
+  probeBaselineA: DockerSshHostProbeObservation
+  probeBaselineB: DockerSshHostProbeObservation
+  probeAfterStartupA: DockerSshHostProbeObservation
+  startupSamplesB: ProbeSample[]
+  shellsBAfterDisconnect: string[]
+  shutdownNamesHostB: boolean
+}
+
+let journey: Journey | null = null
+
+/**
+ * The app's own answer for "am I connected to this host", from both places that
+ * hold one: main drops its state entirely on an explicit disconnect (null), so
+ * the renderer store — the map that decides what gets reconnected at startup —
+ * is read as well.
+ */
+async function readSshStatus(page: Page, targetId: string): Promise<string | null> {
+  return page.evaluate(async (targetId) => {
+    const mainStatus = (await window.api.ssh.getState({ targetId }))?.status ?? null
+    const storeStatus = window.__store?.getState().sshConnectionStates.get(targetId)?.status ?? null
+    return mainStatus === 'connected' || storeStatus === 'connected'
+      ? 'connected'
+      : (mainStatus ?? storeStatus)
+  }, targetId)
+}
+
+function ptyIdBelongsToTarget(ptyId: string, targetId: string): boolean {
+  return ptyId.startsWith(`ssh:${encodeURIComponent(targetId)}@@`)
+}
+
+/**
+ * Makes the shell behind one pane say who it is, through `pty.write` — the same
+ * path a keystroke takes. Returns the pid the shell reported.
+ *
+ * Why re-send on every poll: a shell that is mid-prompt or just reattached can
+ * swallow the first line, and one lost keystroke would read as a dead pane.
+ */
+async function reportShellPid(
+  page: Page,
+  target: DockerSshRelayTarget,
+  ptyId: string,
+  phase: string
+): Promise<number> {
+  const stamp = `/tmp/orca-j3-${phase}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`
+  await expect
+    .poll(
+      async () => {
+        await sendToTerminal(page, ptyId, `printf '%s\\n' "$$" > ${stamp}\r`)
+        return execDockerSshRelayTargetCommand(
+          target,
+          `cat ${shellQuote(stamp)} 2>/dev/null || printf ''`
+        ).trim()
+      },
+      {
+        timeout: 90_000,
+        intervals: [1_000],
+        message: `pane ${ptyId} never reported its shell pid (${phase})`
+      }
+    )
+    .toMatch(/^\d+$/)
+  return Number(execDockerSshRelayTargetCommand(target, `cat ${shellQuote(stamp)}`).trim())
+}
+
+async function readWorktreeTabIds(page: Page, worktreeId: string): Promise<string[]> {
+  return page.evaluate(
+    (worktreeId) =>
+      (window.__store?.getState().tabsByWorktree[worktreeId] ?? []).map((tab) => tab.id),
+    worktreeId
+  )
+}
+
+/** Opens one more terminal tab on a remote worktree and waits for its shell. */
+async function openExtraRemoteTab(page: Page, worktreeId: string): Promise<string> {
+  const tabId = await page.evaluate((worktreeId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Store unavailable')
+    }
+    const tab = state.createTab(worktreeId, undefined, undefined, { activate: true })
+    state.setActiveTab(tab.id)
+    state.setActiveTabType('terminal')
+    return tab.id
+  }, worktreeId)
+  await waitForActiveTerminalManager(page, 60_000)
+  await waitForActivePanePtyId(page, 60_000)
+  return tabId
+}
+
+async function closeTab(page: Page, tabId: string): Promise<void> {
+  await page.evaluate((tabId) => {
+    const store = window.__store
+    if (!store) {
+      throw new Error('Store unavailable')
+    }
+    store.getState().closeTab(tabId)
+  }, tabId)
+  await expect
+    .poll(
+      async () =>
+        page.evaluate(
+          (tabId) =>
+            Object.values(window.__store?.getState().tabsByWorktree ?? {})
+              .flat()
+              .some((tab) => tab.id === tabId),
+          tabId
+        ),
+      { timeout: 30_000, message: `tab ${tabId} was never closed` }
+    )
+    .toBe(false)
+}
+
+/** Connects one container, opens PANE_COUNT panes, and records their identity. */
+async function openHost(
+  page: Page,
+  label: 'A' | 'B',
+  target: DockerSshRelayTarget
+): Promise<HostRecord> {
+  const remote = await connectDockerSshRelayTarget(page, target, {
+    relayGracePeriodSeconds: RELAY_GRACE_PERIOD_SECONDS
+  })
+  await ensureTerminalVisible(page, 45_000)
+  await waitForActiveTerminalManager(page, 60_000)
+  await waitForActivePanePtyId(page, 60_000)
+  if (PANE_COUNT > 1) {
+    await splitActiveTerminalPane(page, 'vertical')
+  }
+  const snapshot = await waitForPaneIdentitySnapshot(page, PANE_COUNT)
+  const leafIds = snapshot.panes.map((pane) => pane.leafId)
+  const ptyIdByLeafId: Record<string, string> = {}
+  for (const pane of snapshot.panes) {
+    if (!pane.ptyId) {
+      throw new Error(`Host ${label} pane ${pane.leafId} has no PTY`)
+    }
+    ptyIdByLeafId[pane.leafId] = pane.ptyId
+  }
+  await expect
+    .poll(() => readDockerSshRelayRemotePtys(target).length, {
+      timeout: 60_000,
+      message: `host ${label} did not settle at one remote shell per pane`
+    })
+    .toBe(PANE_COUNT)
+
+  const reportedPidByLeafId: Record<string, number> = {}
+  for (const leafId of leafIds) {
+    reportedPidByLeafId[leafId] = await reportShellPid(
+      page,
+      target,
+      ptyIdByLeafId[leafId]!,
+      `${label}-before`
+    )
+  }
+  const hostId = sshExecutionHostId(remote.targetId)
+  return {
+    label,
+    target,
+    targetId: remote.targetId,
+    hostId,
+    worktreeId: remote.worktreeId,
+    tabId: snapshot.tabId,
+    tabIds: await readWorktreeTabIds(page, remote.worktreeId),
+    leafIds,
+    ptyIdByLeafId,
+    shells: readDockerSshRemoteShellIdentities(target),
+    reportedPidByLeafId,
+    durableBindings: await readDurablePaneBindings(page, hostId, remote.worktreeId)
+  }
+}
+
+/** The pane→shell map, keyed by leaf id, as `pid@startTicks:bootId`. */
+function shellIdentityByLeafId(
+  host: HostRecord,
+  identities: DockerSshRemoteShellIdentity[]
+): Record<string, string> {
+  const byLeafId: Record<string, string> = {}
+  for (const leafId of host.leafIds) {
+    const shell = identities.find((candidate) => candidate.paneKey?.includes(leafId))
+    byLeafId[leafId] = shell
+      ? `${shell.pid}@${shell.startTicks}:${shell.bootId}`
+      : 'no-shell-for-pane'
+  }
+  return byLeafId
+}
+
+/** The surface that needs host B. Safe to call twice; later calls are no-ops. */
+async function revealHostB(page: Page, hostB: HostRecord): Promise<void> {
+  await switchToWorktree(page, hostB.worktreeId)
+  await ensureTerminalVisible(page, 60_000)
+  await expect
+    .poll(() => readSshStatus(page, hostB.targetId), {
+      timeout: 180_000,
+      message: 'revealing host B did not trigger its lazy discovery'
+    })
+    .toBe('connected')
+  await waitForActiveTerminalManager(page, 120_000)
+  await waitForActivePanePtyId(page, 120_000)
+}
+
+function requireJourney(): Journey {
+  if (!journey) {
+    throw new Error('Journey 3 setup did not complete')
+  }
+  return journey
+}
+
+test.describe.serial('Lazy discovery and skipped-host restart', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH tests.')
+  test.skip(process.platform === 'win32', 'Docker SSH uses POSIX SSH tooling.')
+
+  let targetA: DockerSshRelayTarget | null = null
+  let targetB: DockerSshRelayTarget | null = null
+  let restart: ReturnType<typeof createRestartSession> | null = null
+  let secondApp: ElectronApplication | null = null
+
+  // oxlint-disable-next-line no-empty-pattern -- This journey owns both Electron launches.
+  test.beforeAll(async ({}, testInfo: TestInfo) => {
+    test.setTimeout(900_000)
+    let firstApp: ElectronApplication | null = null
+    try {
+      targetA = startDockerSshRelayTarget(testInfo)
+      targetB = startDockerSshRelayTarget(testInfo)
+      restart = createRestartSession(testInfo)
+
+      const first = await restart.launch()
+      firstApp = first.app
+      await waitForSessionReady(first.page, 60_000)
+      const hostA = await openHost(first.page, 'A', targetA)
+      const hostB = await openHost(first.page, 'B', targetB)
+
+      // A third pane on host B, in its own tab, that the user closes while the
+      // host is offline. Its lease stays live (nothing could prove the remote
+      // shell died), so the restore has a session it must NOT bring back.
+      const retiredTabId = await openExtraRemoteTab(first.page, hostB.worktreeId)
+
+      // The user goes back to host A and leaves host B offline.
+      await switchToWorktree(first.page, hostA.worktreeId)
+      await ensureTerminalVisible(first.page, 45_000)
+      await disconnectDockerSshRelayTarget(first.page, hostB.targetId)
+      await expect
+        .poll(() => readSshStatus(first.page, hostB.targetId), {
+          timeout: 60_000,
+          message: 'host B still reported itself connected after an explicit disconnect'
+        })
+        .not.toBe('connected')
+      // Unknown is not dead: a disconnect must not have destroyed B's shells.
+      const shellsBAfterDisconnect = describeDockerSshRemoteShellIdentities(
+        readDockerSshRemoteShellIdentities(targetB)
+      )
+
+      await closeTab(first.page, retiredTabId)
+      hostB.tabIds = await readWorktreeTabIds(first.page, hostB.worktreeId)
+      hostB.durableBindings = await readDurablePaneBindings(
+        first.page,
+        hostB.hostId,
+        hostB.worktreeId
+      )
+      hostB.shells = readDockerSshRemoteShellIdentities(targetB)
+
+      await first.page.evaluate(() => window.dispatchEvent(new Event('beforeunload')))
+      // Why the poll waits only on host A: whether the persisted set also names
+      // the host the user left offline is the thing under test, so it is
+      // recorded here and asserted in the test rather than waited for here.
+      await expect
+        .poll(
+          async () =>
+            first.page.evaluate(async (targetIdA) => {
+              const session = await window.api.session.get()
+              return (session.activeConnectionIdsAtShutdown ?? []).includes(targetIdA)
+            }, hostA.targetId),
+          { timeout: 20_000, message: 'the host in use was not persisted for reconnect' }
+        )
+        .toBe(true)
+      const shutdownNamesHostB = await first.page.evaluate(async (targetIdB) => {
+        const session = await window.api.session.get()
+        return (session.activeConnectionIdsAtShutdown ?? []).includes(targetIdB)
+      }, hostB.targetId)
+
+      await restart.close(firstApp)
+      firstApp = null
+
+      // Counters are read after the quit so anything the relaunch does is new.
+      // Why poll: the quit has to have taken every client-held transport with
+      // it, or "no new connection to host B" could be satisfied by an old one.
+      await expect
+        .poll(() => readDockerSshHostProbeObservation(targetB!).transportProcesses, {
+          timeout: 60_000,
+          message: 'a client SSH transport to host B outlived the app'
+        })
+        .toEqual([])
+      const probeBaselineA = readDockerSshHostProbeObservation(targetA)
+      const probeBaselineB = readDockerSshHostProbeObservation(targetB)
+
+      const sampleStartedAt = Date.now()
+      const second = await restart.launch()
+      secondApp = second.app
+      const startupSamplesB: ProbeSample[] = []
+      const sampleB = async (): Promise<void> => {
+        startupSamplesB.push({
+          observation: readDockerSshHostProbeObservation(targetB!),
+          rendererStatus: await readSshStatus(second.page, hostB.targetId).catch(() => null)
+        })
+      }
+      await waitForSessionReady(second.page, 120_000)
+      // Sample while startup dials host A, then keep sampling past it: a probe
+      // that arrives late is still an eager probe.
+      await expect
+        .poll(
+          async () => {
+            await sampleB()
+            return readSshStatus(second.page, hostA.targetId)
+          },
+          {
+            timeout: 180_000,
+            intervals: [NO_PROBE_SAMPLE_MS],
+            message: 'host A did not reconnect at startup; the no-probe check would be vacuous'
+          }
+        )
+        .toBe('connected')
+      const deadline = Date.now() + NO_PROBE_WINDOW_MS
+      while (Date.now() < deadline) {
+        await sampleB()
+        await second.page.waitForTimeout(NO_PROBE_SAMPLE_MS)
+      }
+      await sampleB()
+
+      journey = {
+        page: second.page,
+        hostA,
+        hostB,
+        probeBaselineA,
+        probeBaselineB,
+        probeAfterStartupA: readDockerSshHostProbeObservation(targetA),
+        startupSamplesB,
+        shellsBAfterDisconnect,
+        shutdownNamesHostB
+      }
+      const receipt = [
+        `[journey3] host A ${describeDockerSshHostProbeObservation(probeBaselineA)} -> ${describeDockerSshHostProbeObservation(journey.probeAfterStartupA)}`,
+        `[journey3] host B ${describeDockerSshHostProbeObservation(probeBaselineB)} -> ${describeDockerSshHostProbeObservation(startupSamplesB.at(-1)!.observation)} over ${startupSamplesB.length} samples in ${Math.round((Date.now() - sampleStartedAt) / 1000)}s`,
+        `[journey3] host B shells before quit: ${describeDockerSshRemoteShellIdentities(hostB.shells).join(' ')}`,
+        `[journey3] host B pane pids: ${JSON.stringify(hostB.reportedPidByLeafId)}`
+      ].join('\n')
+      console.log(receipt)
+      testInfo.annotations.push({ type: 'journey3-startup', description: receipt })
+    } catch (error) {
+      if (firstApp && restart) {
+        await restart.close(firstApp)
+      }
+      throw error
+    }
+  })
+
+  test.afterAll(async () => {
+    if (secondApp && restart) {
+      await restart.close(secondApp)
+    }
+    if (restart) {
+      await restart.dispose()
+    }
+    cleanupDockerSshRelayTarget(targetA)
+    cleanupDockerSshRelayTarget(targetB)
+    journey = null
+  })
+
+  test('leaves a configured but unused host unprobed across restart', async () => {
+    test.setTimeout(120_000)
+    const {
+      probeBaselineA,
+      probeAfterStartupA,
+      probeBaselineB,
+      startupSamplesB,
+      hostB,
+      shutdownNamesHostB
+    } = requireJourney()
+
+    expect(
+      shutdownNamesHostB,
+      'the persisted shutdown set names the host the user left offline, so startup will dial it'
+    ).toBe(false)
+
+    // Positive control: startup really does dial the host it was using.
+    expect(
+      probeAfterStartupA.acceptedAuths,
+      'startup did not authenticate to host A, so "host B was not dialed" would prove nothing'
+    ).toBeGreaterThan(probeBaselineA.acceptedAuths)
+
+    expect(startupSamplesB.length).toBeGreaterThan(4)
+    for (const [index, sample] of startupSamplesB.entries()) {
+      expect(
+        sample.observation.acceptedAuths,
+        `host B was authenticated to at startup (sample ${index})`
+      ).toBe(probeBaselineB.acceptedAuths)
+      expect(
+        sample.observation.sshdSessions,
+        `host B had a live sshd session at startup (sample ${index})`
+      ).toBe(0)
+      expect(
+        sample.observation.connectBridges,
+        `a relay transport bridge was opened to host B at startup (sample ${index})`
+      ).toBe(0)
+      expect(
+        sample.rendererStatus,
+        `the app reported host B as ${sample.rendererStatus} at startup (sample ${index})`
+      ).not.toBe('connected')
+    }
+
+    // Unknown is not dead, twice over: not at the disconnect, not at the quit.
+    expect(
+      requireJourney().shellsBAfterDisconnect,
+      'disconnecting host B destroyed its remote shells'
+    ).toEqual(describeDockerSshRemoteShellIdentities(hostB.shells))
+    expect(
+      describeDockerSshRemoteShellIdentities(readDockerSshRemoteShellIdentities(hostB.target)),
+      'host B lost or gained a remote shell while it was skipped'
+    ).toEqual(describeDockerSshRemoteShellIdentities(hostB.shells))
+  })
+
+  test('restores exactly the skipped host sessions when its surface is touched', async () => {
+    test.setTimeout(600_000)
+    const { page, hostB, probeBaselineB } = requireJourney()
+    const beforeReveal = readDockerSshHostProbeObservation(hostB.target)
+
+    await revealHostB(page, hostB)
+
+    // Only its own sessions: the tab the user closed while the host was offline
+    // still holds a live lease, and it must not be grafted back as UI.
+    expect(
+      await readWorktreeTabIds(page, hostB.worktreeId),
+      'host B came back with a different set of tabs than the user left'
+    ).toEqual(hostB.tabIds)
+
+    const snapshot = await readPaneIdentitySnapshot(page)
+    expect(snapshot?.tabId, 'host B restored a different tab').toBe(hostB.tabId)
+    expect(
+      snapshot?.panes.map((pane) => pane.leafId).sort(),
+      'host B did not restore exactly its own panes'
+    ).toEqual([...hostB.leafIds].sort())
+    expect(
+      Object.fromEntries(snapshot!.panes.map((pane) => [pane.leafId, pane.ptyId])),
+      'host B panes rebound to different PTYs'
+    ).toEqual(hostB.ptyIdByLeafId)
+
+    const restoredIdentities = readDockerSshRemoteShellIdentities(hostB.target)
+    expect(
+      describeDockerSshRemoteShellIdentities(restoredIdentities),
+      'host B did not come back with exactly the shells it had'
+    ).toEqual(describeDockerSshRemoteShellIdentities(hostB.shells))
+    expect(
+      shellIdentityByLeafId(hostB, restoredIdentities),
+      'a host B pane is served by a different process than before the restart'
+    ).toEqual(shellIdentityByLeafId(hostB, hostB.shells))
+
+    // The strongest observable: each pane's own shell answers, and it is the
+    // same process — not a look-alike wearing the same ids.
+    const reportedPidByLeafId: Record<string, number> = {}
+    for (const leafId of hostB.leafIds) {
+      reportedPidByLeafId[leafId] = await reportShellPid(
+        page,
+        hostB.target,
+        hostB.ptyIdByLeafId[leafId]!,
+        'B-after'
+      )
+    }
+    expect(
+      reportedPidByLeafId,
+      'a restored host B pane is talking to a different shell process'
+    ).toEqual(hostB.reportedPidByLeafId)
+
+    expect(
+      await readDurablePaneBindings(page, hostB.hostId, hostB.worktreeId),
+      'host B durable pane bindings changed across the skipped restart'
+    ).toEqual(hostB.durableBindings)
+
+    // Last, because it is the timing half of the clause rather than the
+    // restoration half: the touch is what dialed the host, and nothing before it.
+    expect(beforeReveal.acceptedAuths, 'host B was dialed before anything asked for it').toBe(
+      probeBaselineB.acceptedAuths
+    )
+    expect(
+      readDockerSshHostProbeObservation(hostB.target).acceptedAuths,
+      'revealing host B did not produce a new authentication on its container'
+    ).toBeGreaterThan(probeBaselineB.acceptedAuths)
+    console.log(
+      `[journey3] host B restored: ${describeDockerSshRemoteShellIdentities(restoredIdentities).join(' ')} pids=${JSON.stringify(reportedPidByLeafId)} auths ${probeBaselineB.acceptedAuths} -> ${readDockerSshHostProbeObservation(hostB.target).acceptedAuths}`
+    )
+  })
+
+  test('adopts neither host-current nor sibling-host state on rediscovery', async () => {
+    test.setTimeout(600_000)
+    const { page, hostA, hostB } = requireJourney()
+    await revealHostB(page, hostB)
+
+    // Every id host B's panes hold names host B.
+    const snapshot = await readPaneIdentitySnapshot(page)
+    expect(snapshot?.panes.length, 'host B has no panes to check for adoption').toBe(PANE_COUNT)
+    for (const pane of snapshot?.panes ?? []) {
+      expect(
+        pane.ptyId && ptyIdBelongsToTarget(pane.ptyId, hostB.targetId),
+        `host B pane ${pane.leafId} is bound to ${pane.ptyId}, which is not host B's`
+      ).toBe(true)
+    }
+
+    // Nothing of host A's is named anywhere in host B's durable partition, and
+    // nothing host-current (a local, unscoped PTY id) either.
+    const partitionIds = await readDurablePartitionPtyIds(page, hostB.hostId)
+    // Why: an empty partition would satisfy both filters below without proving
+    // anything, so the census has to have found host B's own ids first.
+    expect(
+      partitionIds.length,
+      "host B's durable partition named no PTY at all"
+    ).toBeGreaterThanOrEqual(PANE_COUNT)
+    expect(
+      partitionIds.filter((id) => ptyIdBelongsToTarget(id, hostA.targetId)),
+      "host A's PTY ids appeared in host B's durable partition"
+    ).toEqual([])
+    expect(
+      partitionIds.filter((id) => !ptyIdBelongsToTarget(id, hostB.targetId)),
+      "host B's durable partition names a PTY that is not host B's"
+    ).toEqual([])
+
+    // No shell on host B's container claims host A's workspace.
+    for (const shell of readDockerSshRemoteShellIdentities(hostB.target)) {
+      expect(shell.worktreeId, 'a host A worktree is running on host B').not.toBe(hostA.worktreeId)
+      expect(shell.tabId, 'a host A tab is running on host B').not.toBe(hostA.tabId)
+    }
+
+    // Host A is untouched by host B's late discovery, and still its own host.
+    expect(
+      describeDockerSshRemoteShellIdentities(readDockerSshRemoteShellIdentities(hostA.target)),
+      "host B's discovery changed host A's remote shells"
+    ).toEqual(describeDockerSshRemoteShellIdentities(hostA.shells))
+    expect(
+      await readDurablePaneBindings(page, hostA.hostId, hostA.worktreeId),
+      "host B's discovery changed host A's durable pane bindings"
+    ).toEqual(hostA.durableBindings)
+    const reportedPidByLeafId: Record<string, number> = {}
+    for (const leafId of hostA.leafIds) {
+      reportedPidByLeafId[leafId] = await reportShellPid(
+        page,
+        hostA.target,
+        hostA.ptyIdByLeafId[leafId]!,
+        'A-after'
+      )
+    }
+    expect(reportedPidByLeafId, "host A's panes are no longer talking to their own shells").toEqual(
+      hostA.reportedPidByLeafId
+    )
+    console.log(
+      `[journey3] host B partition ids: ${partitionIds.join(' ')}\n[journey3] host A after B's discovery: ${describeDockerSshRemoteShellIdentities(readDockerSshRemoteShellIdentities(hostA.target)).join(' ')} pids=${JSON.stringify(reportedPidByLeafId)}`
+    )
+  })
+})
diff --git a/tests/e2e/ssh-maxsessions-remote-pid-binding-identity.spec.ts b/tests/e2e/ssh-maxsessions-remote-pid-binding-identity.spec.ts
new file mode 100644
index 00000000000..26e6c33b367
--- /dev/null
+++ b/tests/e2e/ssh-maxsessions-remote-pid-binding-identity.spec.ts
@@ -0,0 +1,739 @@
+/**
+ * Journey 6: Docker OpenSSH with `MaxSessions=1`.
+ *
+ * The container's sshd permits exactly one concurrent session channel per
+ * network connection, which is what makes a multiplexing failure observable
+ * rather than silent: anything that needs a second channel must open a second
+ * connection, and the connection census sees it.
+ *
+ * Four clauses, one test each, all independent (own container, own profile), so
+ * a red one cannot report the others as "did not run":
+ *
+ *   1. A transport disconnect keeps the same remote PID and the exact binding.
+ *   2. A client restart keeps the same remote PID and the exact binding.
+ *   3. An authority reconnect holding a lease no durable pane owns leaves that
+ *      shell running and unbound instead of grafting the pane back.
+ *   4. A restarted authority imports the owned panes exactly and leaves the
+ *      unresolved one visible and recoverable rather than killing it.
+ *
+ * Why 3 and 4 are separate tests and not one: after a client restart the unowned
+ * PTY has no consumer left in the new process, so its source recovery cannot
+ * complete and the reattach returns before the binding write. The graft risk
+ * that `mayCreate: false` fences is therefore only reachable on 3, and 4 is a
+ * forward guard for that clause while remaining a real oracle for "imports
+ * exactly" and "destroys nothing".
+ *
+ * The PID is read on the container twice over, and both readings must agree:
+ * the pane's own shell reports `$$` through the production write path onto the
+ * container filesystem, and a /proc census reports the pid the relay hosts for
+ * that pane key. Each pid carries its kernel start time, so a recycled pid
+ * cannot pass as a survivor — ids matching proves nothing.
+ *
+ * Discrimination, measured rather than asserted. Two guard removals each redden
+ * one clause and leave the others green in the same run:
+ *   A. `src/main/ssh/ssh-relay-session.ts` `restoreReattachedPtyRuntime` — drop
+ *      `mayCreate: false` from the reattach binding write. Test 3 fails with the
+ *      unowned leaf grafted into the `local` partition; tests 1, 2 and 4 pass.
+ *   C. `ssh-relay-session.ts` `beginShutdownDetach` — mark leases `terminated`
+ *      instead of `detached` at quit, the classic unknown-treated-as-dead. Tests
+ *      2 and 4 fail with a cold-spawned shell beside the surviving one; tests 1
+ *      and 3 pass.
+ *
+ * Test 1 is a forward guard, stated plainly. Two further removals left it green:
+ * publishing `SSH_SESSION_EXPIRED` in place of `SSH_SOURCE_RESTORE_REQUIRED`
+ * (`ssh-pty-provider.ts`), and making `isProvenSshSessionGoneError` return true
+ * for every error. Neither is reachable here, because a sever that leaves the
+ * detached relay holding its delivery record reattaches through the checkpoint
+ * path and no reattach failure is ever classified. Inducing `restoreRequired`
+ * needs a lost or mismatched delivery record, which this fault does not produce.
+ *
+ * Run with an isolated TMPDIR: `global-setup.ts` keys its seeded-repo pointer on
+ * a machine-global tmpdir path, so a concurrent run can both fabricate and mask
+ * a red.
+ */
+import type { ElectronApplication, Page, TestInfo } from '@stablyai/playwright-test'
+import { randomUUID } from 'node:crypto'
+import { test, expect } from './helpers/orca-app'
+import { createRestartSession } from './helpers/orca-restart'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  sendToTerminal,
+  splitActiveTerminalPane,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneIdentitySnapshot,
+  type PaneIdentitySnapshot
+} from './helpers/terminal'
+import { readDurablePaneBindings, sshExecutionHostId } from './helpers/remote-pane-durable-session'
+import { seedUnboundRemotePtyLease } from './helpers/unbound-remote-pty-lease'
+import {
+  findSshRemotePtyLeaseForLeaf,
+  readSshRemotePtyLeases,
+  resolveOrcaProfileStateFile
+} from './helpers/ssh-remote-pty-lease-file'
+import {
+  cleanupDockerSshRelayTarget,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import {
+  connectDockerSshRelayTarget,
+  reconnectDockerSshRelayTarget
+} from './helpers/docker-ssh-relay-connection'
+import { severDockerSshRelayTransport } from './helpers/docker-ssh-relay-processes'
+import {
+  countDockerSshRelayRemoteStreamWriters,
+  readDockerSshRelayRemotePtys
+} from './helpers/docker-ssh-relay-remote-ptys'
+import { readDockerSshdSessionCap } from './helpers/docker-ssh-relay-sshd-session-cap'
+import { readRemoteShellPid } from './helpers/docker-ssh-remote-shell-pid'
+import {
+  bindingIdentityOf,
+  describeRemoteWorkspaceCensus,
+  readRemoteWorkspaceCensus,
+  type RemoteWorkspaceCensus,
+  type RemoteWorkspaceCensusScope
+} from './helpers/docker-ssh-relay-workspace-census'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+const MAX_SESSIONS = 1
+const PANE_COUNT = 2
+// Why: the relay must outlive every fault. If it exits with the client the
+// remote shells die too and reconnect degrades to a cold spawn, which is not
+// the path this journey bounds.
+const RELAY_GRACE_PERIOD_SECONDS = 900
+// Why: a graft or a late respawn lands after reattach reports ready, so every
+// dimension is re-read once the dust settles rather than the instant a wait passes.
+const SETTLE_MS = 6_000
+
+test.use({ seedTestRepo: false })
+
+type PaneShellIdentity = {
+  leafId: string
+  ptyId: string
+  /** Reported by the shell itself and confirmed by the container's /proc census. */
+  pid: number
+  startTicks: number
+}
+
+async function waitForSshConnected(page: Page, targetId: string, timeoutMs: number): Promise<void> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(
+          async (targetId) => (await window.api.ssh.getState({ targetId }))?.status ?? null,
+          targetId
+        ),
+      { timeout: timeoutMs, message: 'SSH target never reported itself connected' }
+    )
+    .toBe('connected')
+}
+
+/**
+ * Ask every pane's shell for its own pid and confirm it against the pid the
+ * relay hosts for that pane key. Disagreement means the pane is writing to a
+ * process other than the one the host attributes to it.
+ */
+async function readPaneShellIdentities(
+  page: Page,
+  target: DockerSshRelayTarget,
+  snapshot: PaneIdentitySnapshot,
+  phase: string
+): Promise<PaneShellIdentity[]> {
+  const identities: PaneShellIdentity[] = []
+  for (const pane of snapshot.panes) {
+    if (!pane.ptyId) {
+      throw new Error(`Pane ${pane.leafId} has no PTY to ask`)
+    }
+    const reportedPid = await readRemoteShellPid(page, target, {
+      ptyId: pane.ptyId,
+      probePath: `/tmp/orca-j6-shell-pid-${phase}-${pane.leafId}`
+    })
+    const paneKey = `${snapshot.tabId}:${pane.leafId}`
+    const hosted = readDockerSshRelayRemotePtys(target).find((pty) => pty.paneKey === paneKey)
+    if (!hosted) {
+      throw new Error(`The relay hosts no remote shell for pane ${paneKey}`)
+    }
+    expect(
+      hosted.pid,
+      `pane ${paneKey} answered from a process the relay does not host for it`
+    ).toBe(reportedPid)
+    identities.push({
+      leafId: pane.leafId,
+      ptyId: pane.ptyId,
+      pid: reportedPid,
+      startTicks: hosted.startTicks
+    })
+  }
+  return identities.sort((left, right) => left.leafId.localeCompare(right.leafId))
+}
+
+type StreamingRemoteWorkspace = {
+  remote: Awaited<ReturnType<typeof connectDockerSshRelayTarget>>
+  snapshot: PaneIdentitySnapshot
+  scope: RemoteWorkspaceCensusScope
+}
+
+/**
+ * A connected remote workspace with PANE_COUNT panes, each carrying a live
+ * output source. Why every pane must stream: an idle pane reattaches as
+ * 'existing' and never enters the source re-establishment that used to read as
+ * expiry and respawn the shell. The writer is backgrounded so the shell keeps
+ * its prompt and can still answer for its own pid after a fault.
+ */
+async function openStreamingRemotePanes(
+  page: Page,
+  app: ElectronApplication,
+  target: DockerSshRelayTarget
+): Promise<StreamingRemoteWorkspace> {
+  await waitForSessionReady(page)
+  const remote = await connectDockerSshRelayTarget(page, target, {
+    relayGracePeriodSeconds: RELAY_GRACE_PERIOD_SECONDS
+  })
+  await expect.poll(() => waitForActiveWorktree(page), { timeout: 30_000 }).toBe(remote.worktreeId)
+  await ensureTerminalVisible(page, 45_000)
+  await waitForActiveTerminalManager(page, 60_000)
+  await waitForActivePanePtyId(page, 60_000)
+
+  await splitActiveTerminalPane(page, 'vertical')
+  const snapshot = await waitForPaneIdentitySnapshot(page, PANE_COUNT)
+
+  const streamMarker = `SSH_MAXSESSIONS_STREAM_${Date.now()}`
+  for (const pane of snapshot.panes) {
+    if (!pane.ptyId) {
+      throw new Error(`Pane ${pane.leafId} has no PTY to stream from`)
+    }
+    await sendToTerminal(
+      page,
+      pane.ptyId,
+      `node -e "setInterval(()=>process.stdout.write('${streamMarker}_'+Date.now()+'\\n'),100)" &\r`
+    )
+  }
+  await expect
+    .poll(() => countDockerSshRelayRemoteStreamWriters(target, streamMarker), {
+      timeout: 60_000,
+      message: 'remote panes did not start streaming before the first fault'
+    })
+    .toBe(PANE_COUNT)
+  await expect
+    .poll(() => readDockerSshRelayRemotePtys(target).length, {
+      timeout: 60_000,
+      message: 'remote shells did not settle at one per pane'
+    })
+    .toBe(PANE_COUNT)
+
+  return {
+    remote,
+    snapshot,
+    scope: {
+      target,
+      hostId: sshExecutionHostId(remote.targetId),
+      worktreeId: remote.worktreeId,
+      targetId: remote.targetId,
+      stateFile: await resolveOrcaProfileStateFile(app)
+    }
+  }
+}
+
+/** Persist the renderer snapshot the way a real quit does, then prove it landed. */
+async function persistBeforeQuit(page: Page, targetId: string, worktreeId: string): Promise<void> {
+  await page.evaluate(() => window.dispatchEvent(new Event('beforeunload')))
+  await expect
+    .poll(
+      () =>
+        page.evaluate(
+          async ({ targetId, worktreeId }) => {
+            const persisted = await window.api.session.get()
+            return (
+              persisted.activeConnectionIdsAtShutdown?.includes(targetId) === true &&
+              (persisted.tabsByWorktree[worktreeId]?.length ?? 0) > 0
+            )
+          },
+          { targetId, worktreeId }
+        ),
+      { timeout: 15_000, message: 'the SSH workspace was not persisted before quit' }
+    )
+    .toBe(true)
+}
+
+async function settleRestoredRemoteWorkspace(
+  page: Page,
+  remote: { targetId: string; worktreeId: string }
+): Promise<PaneIdentitySnapshot> {
+  await waitForSessionReady(page, 60_000)
+  await expect.poll(() => waitForActiveWorktree(page), { timeout: 60_000 }).toBe(remote.worktreeId)
+  await waitForSshConnected(page, remote.targetId, 120_000)
+  await ensureTerminalVisible(page, 45_000)
+  await waitForActiveTerminalManager(page, 60_000)
+  await waitForActivePanePtyId(page, 60_000)
+  return waitForPaneIdentitySnapshot(page, PANE_COUNT)
+}
+
+function expectSameShells(actual: PaneShellIdentity[], expected: PaneShellIdentity[]): void {
+  expect(
+    actual.map((identity) => `${identity.leafId}=${identity.pid}@${identity.startTicks}`),
+    'a pane is bound to a different remote process than before the fault'
+  ).toEqual(expected.map((identity) => `${identity.leafId}=${identity.pid}@${identity.startTicks}`))
+}
+
+function expectCapSlotsBounded(
+  census: RemoteWorkspaceCensus,
+  baseline: RemoteWorkspaceCensus,
+  label: string
+): void {
+  // Why a bound and not equality: under MaxSessions=1 every concurrent host
+  // operation legitimately needs its own connection, so the count breathes. A
+  // leak is monotone growth, and at least one connection must remain or the
+  // relay bridge is gone.
+  expect(census.sshdConnectionCount, `${label} left no SSH connection to the host`).toBeGreaterThan(
+    0
+  )
+  expect(census.sshdConnectionCount, `${label} leaked SSH session-cap slots`).toBeLessThanOrEqual(
+    baseline.sshdConnectionCount
+  )
+}
+
+type UnownedRemotePty = {
+  leafId: string
+  ptyId: string
+  attachedAt: number
+  /** Census taken with the unowned shell already live, so it is part of the baseline. */
+  baseline: RemoteWorkspaceCensus
+}
+
+/** `leafId -> lastAttachedAt` for every live lease on the target. */
+function readLeaseAttachStamps(stateFile: string, targetId: string): Record<string, number> {
+  return Object.fromEntries(
+    readSshRemotePtyLeases(stateFile, targetId).map((lease) => [
+      lease.leafId ?? '-',
+      lease.lastAttachedAt ?? 0
+    ])
+  )
+}
+
+/**
+ * The divergence this journey's third clause is about: a live lease and a live
+ * remote shell that no durable pane names. Seeded rather than induced — closing
+ * a pane over a downed link takes `pty:kill`'s tombstone branch instead, and
+ * every oracle downstream then passes vacuously.
+ */
+async function seedUnownedStreamingRemotePty(
+  page: Page,
+  target: DockerSshRelayTarget,
+  workspace: StreamingRemoteWorkspace
+): Promise<UnownedRemotePty> {
+  const { remote, snapshot, scope } = workspace
+  const unbound = await seedUnboundRemotePtyLease(page, {
+    targetId: remote.targetId,
+    hostId: scope.hostId,
+    worktreeId: remote.worktreeId,
+    tabId: snapshot.tabId,
+    leafId: randomUUID()
+  })
+  const marker = `SSH_MAXSESSIONS_UNOWNED_${Date.now()}`
+  await sendToTerminal(
+    page,
+    unbound.ptyId,
+    `node -e "setInterval(()=>process.stdout.write('${marker}_'+Date.now()+'\\n'),100)" &\r`
+  )
+  await expect
+    .poll(() => countDockerSshRelayRemoteStreamWriters(target, marker), {
+      timeout: 60_000,
+      message: 'the unowned remote PTY never started streaming'
+    })
+    .toBe(1)
+  await expect
+    .poll(() => readDockerSshRelayRemotePtys(target).length, {
+      timeout: 60_000,
+      message: 'the relay did not settle at one shell per pane plus the unowned one'
+    })
+    .toBe(PANE_COUNT + 1)
+
+  // The unowned shell is the pane-key-less one: ORCA_PANE_KEY is injected by the
+  // pane launch path, which a leaf that never becomes a pane never runs.
+  expect(
+    readDockerSshRelayRemotePtys(target).filter((pty) => pty.paneKey === null),
+    'the unowned remote shell is not separable from the pane-owned ones'
+  ).toHaveLength(1)
+  const lease = findSshRemotePtyLeaseForLeaf(scope.stateFile, remote.targetId, unbound.leafId)
+  expect(lease?.state, 'the unowned remote PTY never took a live lease').toBe('attached')
+  const baseline = await readRemoteWorkspaceCensus(page, scope)
+  expect(
+    baseline.durableBindings.filter((binding) => binding.includes(unbound.leafId)),
+    'no durable partition may name the unowned leaf'
+  ).toHaveLength(0)
+  return {
+    leafId: unbound.leafId,
+    ptyId: unbound.ptyId,
+    attachedAt: lease?.lastAttachedAt ?? 0,
+    baseline
+  }
+}
+
+/** A graft can land and be overwritten by a later renderer snapshot, so sample
+ *  continuously: a poll that needs one matching read would miss it. */
+async function expectDurableBindingsHoldFor(
+  page: Page,
+  scope: RemoteWorkspaceCensusScope,
+  expected: string[],
+  windowMs: number
+): Promise<void> {
+  const deadline = Date.now() + windowMs
+  let samples = 0
+  while (Date.now() < deadline) {
+    expect(
+      await readDurablePaneBindings(page, scope.hostId, scope.worktreeId),
+      'a durable pane was grafted for a lease no pane owns'
+    ).toEqual(expected)
+    samples += 1
+    await page.waitForTimeout(500)
+  }
+  expect(samples).toBeGreaterThan(10)
+}
+
+test.describe('Docker OpenSSH MaxSessions=1 remote PID and binding identity', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH tests.')
+  test.skip(process.platform === 'win32', 'Docker SSH journeys use POSIX SSH tooling.')
+
+  test('the same remote PID and exact binding survive a transport disconnect', async (// oxlint-disable-next-line no-empty-pattern -- this test owns its Electron launch.
+  {}, testInfo: TestInfo) => {
+    test.setTimeout(600_000)
+    const session = createRestartSession(testInfo)
+    let target: DockerSshRelayTarget | null = null
+    let app: ElectronApplication | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo, { sshdMaxSessions: MAX_SESSIONS })
+      const relayTarget = target
+      expect(
+        readDockerSshdSessionCap(relayTarget).maxSessions,
+        'the container did not enforce the session cap this journey is about'
+      ).toBe(MAX_SESSIONS)
+
+      const launch = await session.launch()
+      app = launch.app
+      const { remote, snapshot, scope } = await openStreamingRemotePanes(
+        launch.page,
+        launch.app,
+        relayTarget
+      )
+      const baselineShells = await readPaneShellIdentities(
+        launch.page,
+        relayTarget,
+        snapshot,
+        'boot'
+      )
+      const baseline = await readRemoteWorkspaceCensus(launch.page, scope)
+      expect(baseline.paneIds).toHaveLength(PANE_COUNT)
+      testInfo.annotations.push({
+        type: 'maxsessions-disconnect-baseline',
+        description: describeRemoteWorkspaceCensus(baseline)
+      })
+
+      severDockerSshRelayTransport(relayTarget)
+      await waitForSshConnected(launch.page, remote.targetId, 180_000)
+      await ensureTerminalVisible(launch.page, 45_000)
+      await waitForActiveTerminalManager(launch.page, 60_000)
+      await waitForActivePanePtyId(launch.page, 60_000)
+
+      await expect
+        .poll(async () => bindingIdentityOf(await readRemoteWorkspaceCensus(launch.page, scope)), {
+          timeout: 120_000,
+          message: 'the transport disconnect changed the remote shells, panes, bindings or leases'
+        })
+        .toEqual(bindingIdentityOf(baseline))
+
+      // Poll returns on its first passing probe, so sit out the settle window
+      // and re-read every dimension a late graft or respawn could still move.
+      await launch.page.waitForTimeout(SETTLE_MS)
+      const settled = await readRemoteWorkspaceCensus(launch.page, scope)
+      expect(
+        bindingIdentityOf(settled),
+        'the transport disconnect changed the workspace after settling'
+      ).toEqual(bindingIdentityOf(baseline))
+      expectCapSlotsBounded(settled, baseline, 'the transport disconnect')
+
+      const reconnectedSnapshot = await waitForPaneIdentitySnapshot(launch.page, PANE_COUNT)
+      expectSameShells(
+        await readPaneShellIdentities(launch.page, relayTarget, reconnectedSnapshot, 'reconnect'),
+        baselineShells
+      )
+      testInfo.annotations.push({
+        type: 'maxsessions-disconnect-settled',
+        description: describeRemoteWorkspaceCensus(settled)
+      })
+    } finally {
+      if (app) {
+        await session.close(app)
+      }
+      await session.dispose()
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+
+  test('the same remote PID and exact binding survive a client restart', async (// oxlint-disable-next-line no-empty-pattern -- this test owns both Electron launches.
+  {}, testInfo: TestInfo) => {
+    test.setTimeout(600_000)
+    const session = createRestartSession(testInfo)
+    let target: DockerSshRelayTarget | null = null
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo, { sshdMaxSessions: MAX_SESSIONS })
+      const relayTarget = target
+      expect(readDockerSshdSessionCap(relayTarget).maxSessions).toBe(MAX_SESSIONS)
+
+      const first = await session.launch()
+      firstApp = first.app
+      const { remote, snapshot, scope } = await openStreamingRemotePanes(
+        first.page,
+        first.app,
+        relayTarget
+      )
+      const baselineShells = await readPaneShellIdentities(
+        first.page,
+        relayTarget,
+        snapshot,
+        'boot'
+      )
+      const baseline = await readRemoteWorkspaceCensus(first.page, scope)
+      expect(baseline.paneIds).toHaveLength(PANE_COUNT)
+      testInfo.annotations.push({
+        type: 'maxsessions-restart-baseline',
+        description: describeRemoteWorkspaceCensus(baseline)
+      })
+
+      await persistBeforeQuit(first.page, remote.targetId, remote.worktreeId)
+      await session.close(firstApp)
+      firstApp = null
+
+      const second = await session.launch()
+      secondApp = second.app
+      const restoredSnapshot = await settleRestoredRemoteWorkspace(second.page, remote)
+
+      await expect
+        .poll(async () => bindingIdentityOf(await readRemoteWorkspaceCensus(second.page, scope)), {
+          timeout: 120_000,
+          message: 'the client restart changed the remote shells, panes, bindings or leases'
+        })
+        .toEqual(bindingIdentityOf(baseline))
+
+      await second.page.waitForTimeout(SETTLE_MS)
+      const settled = await readRemoteWorkspaceCensus(second.page, scope)
+      expect(
+        bindingIdentityOf(settled),
+        'the client restart changed the workspace after settling'
+      ).toEqual(bindingIdentityOf(baseline))
+      expectCapSlotsBounded(settled, baseline, 'the client restart')
+
+      expectSameShells(
+        await readPaneShellIdentities(second.page, relayTarget, restoredSnapshot, 'restart'),
+        baselineShells
+      )
+      testInfo.annotations.push({
+        type: 'maxsessions-restart-settled',
+        description: describeRemoteWorkspaceCensus(settled)
+      })
+    } finally {
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+
+  // Unknown is not dead. Reconnecting an authority that still holds the
+  // unowned PTY's consumer is where the graft risk lives: the reattach reaches
+  // the binding write, and a write allowed to create would surface a pane the
+  // user never opened.
+  test('an authority reconnect leaves an unowned remote shell running and unbound', async (// oxlint-disable-next-line no-empty-pattern -- this test owns its Electron launch.
+  {}, testInfo: TestInfo) => {
+    test.setTimeout(600_000)
+    const session = createRestartSession(testInfo)
+    let target: DockerSshRelayTarget | null = null
+    let app: ElectronApplication | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo, { sshdMaxSessions: MAX_SESSIONS })
+      const relayTarget = target
+      expect(readDockerSshdSessionCap(relayTarget).maxSessions).toBe(MAX_SESSIONS)
+
+      const launch = await session.launch()
+      app = launch.app
+      const workspace = await openStreamingRemotePanes(launch.page, launch.app, relayTarget)
+      const { remote, scope } = workspace
+      const unowned = await seedUnownedStreamingRemotePty(launch.page, relayTarget, workspace)
+      testInfo.annotations.push({
+        type: 'maxsessions-authority-reconnect-seeded',
+        description: describeRemoteWorkspaceCensus(unowned.baseline)
+      })
+
+      // Why an explicit disconnect and not a transport sever: only the detach
+      // path moves the lease attached -> detached, which makes the flip back to
+      // attached positive proof that the reattach reached this exact lease.
+      await reconnectDockerSshRelayTarget(launch.page, remote.targetId)
+      await waitForSshConnected(launch.page, remote.targetId, 180_000)
+      await ensureTerminalVisible(launch.page, 45_000)
+      await waitForActiveTerminalManager(launch.page, 60_000)
+      await waitForActivePanePtyId(launch.page, 60_000)
+
+      // Vacuity guard: without it a reattach that silently skipped the lease
+      // would be indistinguishable from one that correctly refused to bind it.
+      await expect
+        .poll(
+          () =>
+            findSshRemotePtyLeaseForLeaf(scope.stateFile, remote.targetId, unowned.leafId)
+              ?.lastAttachedAt ?? 0,
+          {
+            timeout: 180_000,
+            message: 'the reconnect never reattached the unowned lease, so the census is vacuous'
+          }
+        )
+        .toBeGreaterThan(unowned.attachedAt)
+
+      await expectDurableBindingsHoldFor(
+        launch.page,
+        scope,
+        unowned.baseline.durableBindings,
+        25_000
+      )
+
+      const settled = await readRemoteWorkspaceCensus(launch.page, scope)
+      expect(settled.remoteShells, 'the reconnect killed or respawned a remote shell').toEqual(
+        unowned.baseline.remoteShells
+      )
+      expect(settled.paneIds, 'the reconnect surfaced a pane the user never opened').toEqual(
+        unowned.baseline.paneIds
+      )
+      expect(settled.tabIds, 'the reconnect changed the workspace tabs').toEqual(
+        unowned.baseline.tabIds
+      )
+      expectCapSlotsBounded(settled, unowned.baseline, 'the authority reconnect')
+      testInfo.annotations.push({
+        type: 'maxsessions-authority-reconnect-settled',
+        description: describeRemoteWorkspaceCensus(settled)
+      })
+    } finally {
+      if (app) {
+        await session.close(app)
+      }
+      await session.dispose()
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+
+  // The other half of the journey's disjunction: a restarted authority imports
+  // the panes it can place exactly, and the one it cannot place stays visible
+  // and recoverable — its lease is not retired and its shell is not killed.
+  test('a restarted authority imports the owned panes exactly and leaves unresolved ownership intact', async (// oxlint-disable-next-line no-empty-pattern -- this test owns both Electron launches.
+  {}, testInfo: TestInfo) => {
+    test.setTimeout(600_000)
+    const session = createRestartSession(testInfo)
+    let target: DockerSshRelayTarget | null = null
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo, { sshdMaxSessions: MAX_SESSIONS })
+      const relayTarget = target
+      expect(readDockerSshdSessionCap(relayTarget).maxSessions).toBe(MAX_SESSIONS)
+
+      const first = await session.launch()
+      firstApp = first.app
+      const workspace = await openStreamingRemotePanes(first.page, first.app, relayTarget)
+      const { remote, snapshot, scope } = workspace
+      const paneShellsBeforeQuit = await readPaneShellIdentities(
+        first.page,
+        relayTarget,
+        snapshot,
+        'boot'
+      )
+      const unowned = await seedUnownedStreamingRemotePty(first.page, relayTarget, workspace)
+      const attachStampsBeforeQuit = readLeaseAttachStamps(scope.stateFile, remote.targetId)
+      testInfo.annotations.push({
+        type: 'maxsessions-restart-unresolved-seeded',
+        description: describeRemoteWorkspaceCensus(unowned.baseline)
+      })
+
+      await persistBeforeQuit(first.page, remote.targetId, remote.worktreeId)
+      await session.close(firstApp)
+      firstApp = null
+
+      const second = await session.launch()
+      secondApp = second.app
+      const restoredSnapshot = await settleRestoredRemoteWorkspace(second.page, remote)
+
+      // Positive proof the restarted authority ran its reattach fan-out over
+      // this target: every owned lease carries a fresh attach stamp. The fan-out
+      // iterates the lease inventory, so the unowned lease was in the same pass.
+      await expect
+        .poll(
+          () => {
+            const stamps = readLeaseAttachStamps(scope.stateFile, remote.targetId)
+            return restoredSnapshot.panes.every(
+              (pane) => (stamps[pane.leafId] ?? 0) > (attachStampsBeforeQuit[pane.leafId] ?? 0)
+            )
+          },
+          {
+            timeout: 180_000,
+            message: 'the restarted authority never reattached the owned leases'
+          }
+        )
+        .toBe(true)
+
+      // Imports exactly: same remote processes, same panes, same bindings.
+      expectSameShells(
+        await readPaneShellIdentities(second.page, relayTarget, restoredSnapshot, 'restart'),
+        paneShellsBeforeQuit
+      )
+      await expectDurableBindingsHoldFor(
+        second.page,
+        scope,
+        unowned.baseline.durableBindings,
+        25_000
+      )
+
+      // Unresolved, not dead: the lease is still there, in a state that can be
+      // resolved later, and its remote shell is untouched.
+      const unownedLease = findSshRemotePtyLeaseForLeaf(
+        scope.stateFile,
+        remote.targetId,
+        unowned.leafId
+      )
+      expect(unownedLease, 'the restarted authority dropped the unowned lease').toBeDefined()
+      expect(
+        unownedLease?.state,
+        'the restarted authority retired a lease whose ownership is only unknown'
+      ).not.toBe('terminated')
+      expect(unownedLease?.state).not.toBe('expired')
+
+      const settled = await readRemoteWorkspaceCensus(second.page, scope)
+      expect(
+        settled.remoteShells,
+        'the restarted authority killed or respawned a remote shell'
+      ).toEqual(unowned.baseline.remoteShells)
+      expect(
+        settled.paneIds,
+        'the restarted authority surfaced a pane the user never opened'
+      ).toEqual(unowned.baseline.paneIds)
+      expect(settled.tabIds, 'the restarted authority changed the workspace tabs').toEqual(
+        unowned.baseline.tabIds
+      )
+      expectCapSlotsBounded(settled, unowned.baseline, 'the authority restart')
+      testInfo.annotations.push({
+        type: 'maxsessions-restart-unresolved-settled',
+        description: `${describeRemoteWorkspaceCensus(settled)} unownedLease=${unownedLease?.state}`
+      })
+    } finally {
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+})
diff --git a/tests/e2e/ssh-reattach-does-not-resume-agent-twice.spec.ts b/tests/e2e/ssh-reattach-does-not-resume-agent-twice.spec.ts
new file mode 100644
index 00000000000..35f97894f58
--- /dev/null
+++ b/tests/e2e/ssh-reattach-does-not-resume-agent-twice.spec.ts
@@ -0,0 +1,244 @@
+/**
+ * STA-3077 goalpost S3 — a reattach failure may not become a respawn — and S8,
+ * which removed the last path that granted one without being asked.
+ *
+ * The reported failure: a coding agent was resumed twice into one transcript.
+ * The mechanism is a converging decision. A reattach that failed for any reason
+ * was read as proof the session had gone, so `handlePtyReattachFailure` sent the
+ * pane a synthetic `pty:exit { code: -1 }`, the pane read that as a death, and
+ * the cold-restore resume ran with the same provider session id over a shell
+ * that was still running. Two agent processes then appended to one transcript.
+ * Respawn now requires proof; everything else stays unresolved.
+ *
+ * WHAT IS PROXIED, AND WHY. A real coding agent cannot be driven here: the
+ * Docker OpenSSH fixture ships no agent binary and there is no provider session
+ * to resume, so "one transcript, two resumes" has no literal form in this
+ * harness. The observable moves one level down, to the thing that must happen
+ * before an agent can be resumed twice — a SECOND shell launching for a pane
+ * that already has one. The host records every launch itself
+ * (helpers/remote-pane-launch-transcript.ts), so the count is taken on the
+ * container and owes the app nothing.
+ *
+ * THE FAULT. The detached relay is stopped, not killed. It keeps every shell it
+ * hosts (SIGSTOP suspends one process, not its children) and answers nothing.
+ * The client treats the silent host as gone and reinstalls a relay beside it, so
+ * the pane's session is one the new relay has never heard of, over a shell that
+ * is provably still running on the container — which is exactly the state the
+ * fabricated exit used to lie about.
+ *
+ * MUTATIONS THAT MUST REDDEN THIS FILE:
+ *  - `src/main/ssh/ssh-relay-session.ts`: restore the destructive block in
+ *    `handlePtyReattachFailure`. The fabricated exit reaches the pane, which
+ *    cold-restores over a live shell and the host records a second launch.
+ *  - `src/renderer/.../reattach-failure-classification.ts`: make
+ *    `isProvenSshSessionGoneError` return true for every error, and the pane's
+ *    own reattach arm respawns instead of holding.
+ *  - `src/main/runtime/orca-runtime.ts`: reinstate the recovery grant S8 deleted
+ *    from `recoverTerminalPane`, with its id comparison normalized so it can
+ *    actually fire; a disconnected pane then starts a replacement on its own.
+ */
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  sendToTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneIdentitySnapshot
+} from './helpers/terminal'
+import {
+  findSshRemotePtyLeaseForLeaf,
+  describeSshRemotePtyLeases,
+  readSshRemotePtyLeases,
+  resolveOrcaProfileStateFile
+} from './helpers/ssh-remote-pty-lease-file'
+import {
+  cleanupDockerSshRelayTarget,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import { connectDockerSshRelayTarget } from './helpers/docker-ssh-relay-connection'
+import { readDockerSshRelayProcessSnapshot } from './helpers/docker-ssh-relay-processes'
+import { resumeDockerSshRelay, stallDockerSshRelay } from './helpers/docker-ssh-relay-stall'
+import {
+  countDockerSshRelayRemoteStreamWriters,
+  describeDockerSshRelayRemotePtys,
+  readDockerSshRelayRemotePtys
+} from './helpers/docker-ssh-relay-remote-ptys'
+import {
+  installRemotePaneLaunchTranscript,
+  readRemotePaneLaunchPids
+} from './helpers/remote-pane-launch-transcript'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+// Why: the relay must outlive the fault. If it exits with the client the remote
+// shells die too, and a respawn over a corpse is not the defect this bounds.
+const RELAY_GRACE_PERIOD_SECONDS = 900
+// The pane has to give up on a host that answers nothing, which costs a mux
+// request timeout before anything is classified.
+const UNREACHABLE_PANE_TIMEOUT_MS = 180_000
+// A respawn can land late, after the failure is classified. One sample would
+// miss it, so every clause is held over a window instead.
+const HOLD_WINDOW_MS = 25_000
+
+test.use({ seedTestRepo: false })
+
+/** Rebuild the pane's renderer over its live PTY — the app's own recovery seam. */
+async function remountTerminalTabForRecovery(page: Page, tabId: string): Promise<void> {
+  const remounted = await page.evaluate((tabId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Store unavailable')
+    }
+    return state.remountTerminalTabForRecovery(tabId)
+  }, tabId)
+  expect(remounted, 'the terminal tab refused to remount, so no reattach was attempted').toBe(true)
+}
+
+test.describe('a failed SSH reattach never starts a second shell for the pane', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH tests.')
+  test.skip(process.platform === 'win32', 'Docker SSH faults use POSIX SSH tooling.')
+
+  test('a host that stops answering leaves the pane on the shell it already had', async ({
+    orcaPage,
+    electronApp
+  }, testInfo: TestInfo) => {
+    test.setTimeout(600_000)
+    let target: DockerSshRelayTarget | null = null
+    let stalledRelayPid: number | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      const relayTarget = target
+      installRemotePaneLaunchTranscript(relayTarget)
+
+      await waitForSessionReady(orcaPage)
+      const remote = await connectDockerSshRelayTarget(orcaPage, relayTarget, {
+        relayGracePeriodSeconds: RELAY_GRACE_PERIOD_SECONDS
+      })
+      await expect
+        .poll(() => waitForActiveWorktree(orcaPage), { timeout: 30_000 })
+        .toBe(remote.worktreeId)
+      await ensureTerminalVisible(orcaPage, 45_000)
+      await waitForActiveTerminalManager(orcaPage, 60_000)
+      await waitForActivePanePtyId(orcaPage, 60_000)
+
+      const snapshot = await waitForPaneIdentitySnapshot(orcaPage, 1)
+      const pane = snapshot.panes[0]
+      if (!pane?.ptyId) {
+        throw new Error('The remote workspace opened no pane with a PTY')
+      }
+      const paneKey = `${snapshot.tabId}:${pane.leafId}`
+      const stateFile = await resolveOrcaProfileStateFile(electronApp)
+
+      // Why the pane must stream: an idle pane reattaches as 'existing' and never
+      // enters the source re-establishment the field failure came through.
+      const streamMarker = `SSH_RESUME_ONCE_STREAM_${Date.now()}`
+      await sendToTerminal(
+        orcaPage,
+        pane.ptyId,
+        `node -e "setInterval(()=>process.stdout.write('${streamMarker}_'+Date.now()+'\\n'),100)" &\r`
+      )
+      await expect
+        .poll(() => countDockerSshRelayRemoteStreamWriters(relayTarget, streamMarker), {
+          timeout: 60_000,
+          message: 'the remote pane never started streaming'
+        })
+        .toBe(1)
+
+      // Anti-vacuity. Every clause below counts launches; had the host recorded
+      // none, "still exactly one" would prove nothing at all.
+      await expect
+        .poll(() => readRemotePaneLaunchPids(relayTarget, paneKey).length, {
+          timeout: 60_000,
+          message: 'the host recorded no shell launch for the pane, so its transcript is inert'
+        })
+        .toBe(1)
+      const launchPid = readRemotePaneLaunchPids(relayTarget, paneKey)[0]
+      const shell = readDockerSshRelayRemotePtys(relayTarget).find(
+        (entry) => entry.paneKey === paneKey
+      )
+      if (!shell) {
+        throw new Error(`The relay hosts no remote shell for pane ${paneKey}`)
+      }
+      // Cross-checks the transcript against the process census: the pid the host
+      // logged at launch is the pid the relay hosts for this pane.
+      expect(
+        shell.pid,
+        'the launch the host recorded is not the shell the relay hosts for this pane'
+      ).toBe(launchPid)
+      const shellIdentity = `${shell.pid}@${shell.startTicks}`
+      testInfo.annotations.push({
+        type: 'ssh-resume-once-baseline',
+        description: `${describeDockerSshRelayRemotePtys(readDockerSshRelayRemotePtys(relayTarget))} launches=1`
+      })
+
+      const relay = readDockerSshRelayProcessSnapshot(relayTarget)
+      if (!relay) {
+        throw new Error('No detached relay to stall')
+      }
+      stallDockerSshRelay(relayTarget, relay.relayPid)
+      stalledRelayPid = relay.relayPid
+      await remountTerminalTabForRecovery(orcaPage, snapshot.tabId)
+
+      // Vacuity guard: the pane has to actually lose its host before "it kept its
+      // shell" means anything. This overlay is the user-visible proof it did —
+      // without it, a pane that quietly reattached would pass every clause below.
+      await expect(
+        orcaPage.locator('[data-terminal-ssh-reconnect-banner]').first(),
+        'the pane never lost its host, so the clauses below are vacuous'
+      ).toBeVisible({ timeout: UNREACHABLE_PANE_TIMEOUT_MS })
+
+      /** Everything a duplicate resume would move, read from the host and from disk. */
+      const expectNoSecondShell = (label: string): void => {
+        expect(
+          readRemotePaneLaunchPids(relayTarget, paneKey),
+          `${label} launched a second shell for pane ${paneKey}`
+        ).toEqual([launchPid])
+        expect(
+          readDockerSshRelayRemotePtys(relayTarget)
+            .filter((entry) => entry.paneKey === paneKey)
+            .map((entry) => `${entry.pid}@${entry.startTicks}`),
+          `${label} killed or replaced the shell the pane owns`
+        ).toEqual([shellIdentity])
+        // Unknown is not dead: the lease must stay claimable so a later reattach
+        // can still find this shell.
+        const lease = findSshRemotePtyLeaseForLeaf(stateFile, remote.targetId, pane.leafId)
+        expect(lease, `${label} dropped the pane lease`).toBeDefined()
+        expect(lease?.state, `${label} expired a lease over a running shell`).not.toBe('expired')
+        expect(lease?.state, `${label} retired a lease over a running shell`).not.toBe('terminated')
+      }
+
+      // Sample continuously rather than poll-until-equal: a respawn that lands
+      // and is later tidied up would satisfy a poll needing one matching read.
+      const deadline = Date.now() + HOLD_WINDOW_MS
+      let samples = 0
+      while (Date.now() < deadline) {
+        expectNoSecondShell('the unreachable host')
+        samples += 1
+        await orcaPage.waitForTimeout(500)
+      }
+      expect(samples).toBeGreaterThan(10)
+
+      // The host comes back and nothing is granted automatically: a disconnected
+      // pane refuses to respawn on its own (S8), so the only route to a second
+      // shell is the user asking for one.
+      resumeDockerSshRelay(relayTarget, relay.relayPid)
+      stalledRelayPid = null
+      await orcaPage.waitForTimeout(HOLD_WINDOW_MS)
+      expectNoSecondShell('the host returning')
+      testInfo.annotations.push({
+        type: 'ssh-resume-once-settled',
+        description: `${describeDockerSshRelayRemotePtys(
+          readDockerSshRelayRemotePtys(relayTarget)
+        )} launches=${readRemotePaneLaunchPids(relayTarget, paneKey).length} leases=${describeSshRemotePtyLeases(
+          readSshRemotePtyLeases(stateFile, remote.targetId)
+        )}`
+      })
+    } finally {
+      if (target && stalledRelayPid !== null) {
+        resumeDockerSshRelay(target, stalledRelayPid)
+      }
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+})
diff --git a/tests/e2e/ssh-reconnect-pane-cardinality-across-partitions.spec.ts b/tests/e2e/ssh-reconnect-pane-cardinality-across-partitions.spec.ts
new file mode 100644
index 00000000000..2b8138248d5
--- /dev/null
+++ b/tests/e2e/ssh-reconnect-pane-cardinality-across-partitions.spec.ts
@@ -0,0 +1,349 @@
+/**
+ * STA-3077 goalpost S4 — one durable partition per (target, pane).
+ *
+ * The reported failure: reconnecting an SSH host multiplied the user's
+ * terminals, 2 -> 19 -> 20 across three reconnects. The mechanism was a pane
+ * binding with two homes. Main's spawn wrote `ssh:<targetId>`, the relay's
+ * reattach write passed no hostId and landed in `local`, and the renderer has
+ * always published SSH pane membership to `local`. Supersession read the
+ * partition no live writer maintained, saw the arriving lease disagree with a
+ * stale pty id, and bailed — so it silently no-opped and every reconnect left
+ * another live lease behind, with a shell and a pane to match.
+ *
+ * The mutation that must redden this file: in `src/main/ipc/pty.ts`, restore
+ * the ssh-first-then-local hedge in `durablyBoundPtyIdForPane` and give the
+ * spawn upserts their `ssh:<targetId>` hostId back. The divergent copy then
+ * reappears, supersession stops firing, and `distinctBoundPtyIdsByLeaf` /
+ * `liveLeasesByLeaf` grow past one per pane.
+ *
+ * Why this spec exists beside ssh-reconnect-pane-cardinality.spec.ts: that file
+ * faults the transport with a kill, which reconnects with every lease still
+ * marked attached. The user reported *reconnecting the host*, which is a clean
+ * disconnect followed by a connect. Only the detach path moves a lease
+ * attached -> detached and runs supersession on the way back, so this is the
+ * shape the defect actually lived on, and it is the shape driven here — three
+ * times, because the report counted three reconnects.
+ *
+ * Every clause is an observable: panes the user can see, leases on disk,
+ * bindings in the durable session, and shells counted on the container itself.
+ */
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  sendToTerminal,
+  splitActiveTerminalPane,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneIdentitySnapshot,
+  type PaneIdentitySnapshot
+} from './helpers/terminal'
+import { readDurablePaneBindings, sshExecutionHostId } from './helpers/remote-pane-durable-session'
+import {
+  describeSshRemotePtyLeases,
+  readSshRemotePtyLeases,
+  resolveOrcaProfileStateFile
+} from './helpers/ssh-remote-pty-lease-file'
+import {
+  cleanupDockerSshRelayTarget,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import {
+  connectDockerSshRelayTarget,
+  reconnectDockerSshRelayTarget
+} from './helpers/docker-ssh-relay-connection'
+import {
+  countDockerSshRelayRemoteStreamWriters,
+  describeDockerSshRelayRemotePtys,
+  readDockerSshRelayRemotePtys
+} from './helpers/docker-ssh-relay-remote-ptys'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+const PANE_COUNT = 2
+// The reported repro shape: 2 -> 19 -> 20 was counted over three reconnects.
+const RECONNECT_CYCLES = 3
+// Why: the relay must outlive every reconnect. If it exits with the client the
+// remote shells die too and reconnect degrades to a cold spawn, which is not
+// the path this spec bounds.
+const RELAY_GRACE_PERIOD_SECONDS = 900
+// Why: a graft lands after reattach reports ready, so every dimension is
+// re-read once the dust settles rather than the instant a wait passes.
+const SETTLE_MS = 6_000
+
+test.use({ seedTestRepo: false })
+
+/** Leases that could still claim a shell. Terminated and expired ones cannot. */
+function liveLeasesByLeaf(stateFile: string, targetId: string): Record<string, string[]> {
+  const byLeaf: Record<string, string[]> = {}
+  for (const lease of readSshRemotePtyLeases(stateFile, targetId)) {
+    if (lease.state === 'terminated' || lease.state === 'expired') {
+      continue
+    }
+    const leafId = lease.leafId ?? '<no-leaf>'
+    byLeaf[leafId] = [...(byLeaf[leafId] ?? []), `${lease.ptyId}=${lease.state}`].sort()
+  }
+  return byLeaf
+}
+
+/**
+ * `leafId -> the distinct pty ids any durable partition binds it to`.
+ *
+ * Two partitions naming the same leaf is tolerable while they agree; naming it
+ * twice with different shells is the divergence supersession failed to resolve,
+ * and it is what a user reads as a pane that came back doubled.
+ */
+async function distinctBoundPtyIdsByLeaf(
+  page: Page,
+  hostId: string,
+  worktreeId: string
+): Promise<Record<string, string[]>> {
+  const byLeaf: Record<string, Set<string>> = {}
+  for (const binding of await readDurablePaneBindings(page, hostId, worktreeId)) {
+    // `<partition> <tabId>/<leafId>=<ptyId>`
+    const [, pane] = binding.split(' ')
+    const [paneKey, ptyId] = (pane ?? '').split('=')
+    const leafId = (paneKey ?? '').split('/')[1]
+    if (!leafId || !ptyId) {
+      throw new Error(`Unparsable durable pane binding: ${binding}`)
+    }
+    byLeaf[leafId] = (byLeaf[leafId] ?? new Set<string>()).add(ptyId)
+  }
+  return Object.fromEntries(
+    Object.entries(byLeaf).map(([leafId, ptyIds]) => [leafId, [...ptyIds].sort()])
+  )
+}
+
+/** `tabId/leafId` for every pane the user can see in the workspace, plus its tabs. */
+async function readRemotePaneCensus(
+  page: Page,
+  worktreeId: string
+): Promise<{ tabIds: string[]; paneIds: string[] }> {
+  return page.evaluate((worktreeId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Store unavailable')
+    }
+    type LayoutNode =
+      | { type: 'leaf'; leafId: string }
+      | { type: 'split'; first: LayoutNode; second: LayoutNode }
+      | null
+    const collectLeafIds = (node: LayoutNode): string[] =>
+      !node
+        ? []
+        : node.type === 'leaf'
+          ? [node.leafId]
+          : [...collectLeafIds(node.first), ...collectLeafIds(node.second)]
+    const tabs = state.tabsByWorktree[worktreeId] ?? []
+    const paneIds = tabs.flatMap((tab) => {
+      const leafIds = collectLeafIds(
+        (state.terminalLayoutsByTabId[tab.id]?.root ?? null) as LayoutNode
+      )
+      // `root: null` is the implicit single-pane layout a fresh tab carries
+      // until it is first split, so it still counts as one visible pane.
+      return leafIds.length > 0
+        ? leafIds.map((leafId) => `${tab.id}/${leafId}`)
+        : [`${tab.id}/<root>`]
+    })
+    return { tabIds: tabs.map((tab) => tab.id).sort(), paneIds: paneIds.sort() }
+  }, worktreeId)
+}
+
+async function waitForSshConnected(page: Page, targetId: string, timeoutMs: number): Promise<void> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(
+          async (targetId) => (await window.api.ssh.getState({ targetId }))?.status ?? null,
+          targetId
+        ),
+      { timeout: timeoutMs, message: 'SSH target never reported itself connected' }
+    )
+    .toBe('connected')
+}
+
+/**
+ * A connected remote workspace with PANE_COUNT panes, each carrying a live
+ * output source. Why every pane must stream: an idle pane reattaches as
+ * 'existing' and never enters the source re-establishment the field failure
+ * came through. The writer is backgrounded so the shell keeps its prompt.
+ */
+async function openStreamingRemotePanes(
+  page: Page,
+  target: DockerSshRelayTarget
+): Promise<{
+  remote: Awaited<ReturnType<typeof connectDockerSshRelayTarget>>
+  snapshot: PaneIdentitySnapshot
+}> {
+  await waitForSessionReady(page)
+  const remote = await connectDockerSshRelayTarget(page, target, {
+    relayGracePeriodSeconds: RELAY_GRACE_PERIOD_SECONDS
+  })
+  await expect.poll(() => waitForActiveWorktree(page), { timeout: 30_000 }).toBe(remote.worktreeId)
+  await ensureTerminalVisible(page, 45_000)
+  await waitForActiveTerminalManager(page, 60_000)
+  await waitForActivePanePtyId(page, 60_000)
+
+  await splitActiveTerminalPane(page, 'vertical')
+  const snapshot = await waitForPaneIdentitySnapshot(page, PANE_COUNT)
+
+  const streamMarker = `SSH_PARTITION_STREAM_${Date.now()}`
+  for (const pane of snapshot.panes) {
+    if (!pane.ptyId) {
+      throw new Error(`Pane ${pane.leafId} has no PTY to stream from`)
+    }
+    await sendToTerminal(
+      page,
+      pane.ptyId,
+      `node -e "setInterval(()=>process.stdout.write('${streamMarker}_'+Date.now()+'\\n'),100)" &\r`
+    )
+  }
+  await expect
+    .poll(() => countDockerSshRelayRemoteStreamWriters(target, streamMarker), {
+      timeout: 60_000,
+      message: 'remote panes did not start streaming before the first reconnect'
+    })
+    .toBe(PANE_COUNT)
+  await expect
+    .poll(() => readDockerSshRelayRemotePtys(target).length, {
+      timeout: 60_000,
+      message: 'remote shells did not settle at one per pane before the first reconnect'
+    })
+    .toBe(PANE_COUNT)
+  return { remote, snapshot }
+}
+
+test.describe('SSH reconnect cardinality with one durable partition per pane', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH tests.')
+  test.skip(process.platform === 'win32', 'Docker SSH reconnect uses POSIX SSH tooling.')
+
+  test('three reconnects add no pane, no live lease and no remote shell', async ({
+    orcaPage,
+    electronApp
+  }, testInfo: TestInfo) => {
+    test.setTimeout(600_000)
+    let target: DockerSshRelayTarget | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      const relayTarget = target
+      const { remote, snapshot } = await openStreamingRemotePanes(orcaPage, relayTarget)
+      const hostId = sshExecutionHostId(remote.targetId)
+      const stateFile = await resolveOrcaProfileStateFile(electronApp)
+      const leafIds = snapshot.panes.map((pane) => pane.leafId)
+      const paneKeys = leafIds.map((leafId) => `${snapshot.tabId}:${leafId}`)
+      const shellIdentity = (shell: { paneKey: string | null; pid: number; startTicks: number }) =>
+        `${shell.paneKey ?? '-'}=${shell.pid}@${shell.startTicks}`
+
+      const baselinePanes = await readRemotePaneCensus(orcaPage, remote.worktreeId)
+      expect(baselinePanes.paneIds).toHaveLength(PANE_COUNT)
+      const baselineShells = readDockerSshRelayRemotePtys(relayTarget)
+      // Ties every later clause to a real starting point: the whole spec is
+      // vacuous if the panes never owned a shell in the first place.
+      for (const paneKey of paneKeys) {
+        expect(
+          baselineShells.filter((shell) => shell.paneKey === paneKey),
+          `pane ${paneKey} did not start out owning exactly one remote shell`
+        ).toHaveLength(1)
+      }
+      const baselineBindings = await distinctBoundPtyIdsByLeaf(orcaPage, hostId, remote.worktreeId)
+      for (const leafId of leafIds) {
+        expect(
+          baselineBindings[leafId] ?? [],
+          `pane ${leafId} must start out durably bound to exactly one shell`
+        ).toHaveLength(1)
+      }
+      testInfo.annotations.push({
+        type: 'ssh-partition-cardinality-baseline',
+        description: `${describeDockerSshRelayRemotePtys(baselineShells)} leases=${describeSshRemotePtyLeases(
+          readSshRemotePtyLeases(stateFile, remote.targetId)
+        )}`
+      })
+
+      /** Every dimension a duplicated pane binding moves, re-read from its owner. */
+      const assertCardinalityHolds = async (label: string): Promise<void> => {
+        const panes = await readRemotePaneCensus(orcaPage, remote.worktreeId)
+        expect(panes.paneIds, `${label} changed the panes the user can see`).toEqual(
+          baselinePanes.paneIds
+        )
+        expect(panes.tabIds, `${label} changed the workspace tabs`).toEqual(baselinePanes.tabIds)
+
+        const leases = liveLeasesByLeaf(stateFile, remote.targetId)
+        for (const leafId of leafIds) {
+          expect(
+            leases[leafId] ?? [],
+            `${label} left more than one live lease naming pane ${snapshot.tabId}/${leafId}`
+          ).toHaveLength(1)
+        }
+        expect(
+          Object.keys(leases).sort(),
+          `${label} left a live lease for a pane that does not exist`
+        ).toEqual([...leafIds].sort())
+
+        const shells = readDockerSshRelayRemotePtys(relayTarget)
+        for (const paneKey of paneKeys) {
+          expect(
+            shells.filter((shell) => shell.paneKey === paneKey),
+            `${label} left the host running more than one shell for pane ${paneKey}`
+          ).toHaveLength(1)
+        }
+        expect(shells, `${label} changed the number of shells the host runs`).toHaveLength(
+          PANE_COUNT
+        )
+
+        // The pane may legitimately be bound to a successor shell, but never to
+        // two at once: that is the divergence a user reads as a doubled terminal.
+        const bindings = await distinctBoundPtyIdsByLeaf(orcaPage, hostId, remote.worktreeId)
+        for (const leafId of leafIds) {
+          expect(
+            bindings[leafId] ?? [],
+            `${label} left pane ${leafId} durably bound to more than one shell`
+          ).toHaveLength(1)
+        }
+        expect(
+          Object.keys(bindings).sort(),
+          `${label} durably bound a pane the user never opened`
+        ).toEqual([...leafIds].sort())
+      }
+
+      for (let cycle = 1; cycle <= RECONNECT_CYCLES; cycle += 1) {
+        await reconnectDockerSshRelayTarget(orcaPage, remote.targetId)
+        await waitForSshConnected(orcaPage, remote.targetId, 180_000)
+        await ensureTerminalVisible(orcaPage, 45_000)
+        await waitForActiveTerminalManager(orcaPage, 60_000)
+        await waitForActivePanePtyId(orcaPage, 60_000)
+
+        // Poll first: a duplicate can land after reattach reports ready, and a
+        // single read taken the instant the wait passes would miss it.
+        await expect
+          .poll(() => readDockerSshRelayRemotePtys(relayTarget).length, {
+            timeout: 120_000,
+            message: `reconnect ${cycle} changed the number of shells the host runs`
+          })
+          .toBe(PANE_COUNT)
+        await assertCardinalityHolds(`reconnect ${cycle}`)
+
+        // Poll returns on its first passing probe, so sit out the settle window
+        // and re-read every dimension a late graft could still move. Attributing
+        // it to the reconnect that caused it beats letting it leak into the next
+        // cycle, where the count is already suspect.
+        await orcaPage.waitForTimeout(SETTLE_MS)
+        await assertCardinalityHolds(`reconnect ${cycle} after settling`)
+        testInfo.annotations.push({
+          type: `ssh-partition-cardinality-reconnect-${cycle}`,
+          description: `${describeDockerSshRelayRemotePtys(
+            readDockerSshRelayRemotePtys(relayTarget)
+          )} leases=${describeSshRemotePtyLeases(readSshRemotePtyLeases(stateFile, remote.targetId))}`
+        })
+      }
+
+      // Closing the loop on the report itself: after the third reconnect the
+      // host runs exactly the shells it ran before the first one.
+      expect(
+        readDockerSshRelayRemotePtys(relayTarget).map(shellIdentity).sort(),
+        `${RECONNECT_CYCLES} reconnects replaced or multiplied the remote shells`
+      ).toEqual(baselineShells.map(shellIdentity).sort())
+    } finally {
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+})
diff --git a/tests/e2e/ssh-reconnect-pane-cardinality.spec.ts b/tests/e2e/ssh-reconnect-pane-cardinality.spec.ts
new file mode 100644
index 00000000000..f150950d081
--- /dev/null
+++ b/tests/e2e/ssh-reconnect-pane-cardinality.spec.ts
@@ -0,0 +1,424 @@
+/**
+ * Pane and remote-PTY cardinality across reconnects, against a real OpenSSH
+ * container.
+ *
+ * Two tests, with different standing:
+ *
+ * 1. 'adds no panes and no remote PTYs across repeated reconnects' is a forward
+ *    guard only. It passes with and without the STA-3077 fixes: a cleanly
+ *    severed transport reconnects without producing the divergence that grafted
+ *    panes in the field. It still earns its place by counting the shells the
+ *    relay hosts, on the container, and pinning their PIDs.
+ *
+ * 2. 'leaves a lease whose durable pane is gone unbound…' discriminates. It
+ *    seeds the divergence — a live lease and a live remote shell that no durable
+ *    pane names — and fails on a tree without the fix, where reattach grafts the
+ *    pane back through persistPtyBinding's creating branches. The graft lands in
+ *    the 'local' partition, because the reattach call site passes no hostId, so
+ *    the census reads both partitions; one alone passes on either tree.
+ */
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { randomUUID } from 'node:crypto'
+import { test, expect } from './helpers/orca-app'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  sendToTerminal,
+  splitActiveTerminalPane,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneIdentitySnapshot
+} from './helpers/terminal'
+import { readDurablePaneBindings, sshExecutionHostId } from './helpers/remote-pane-durable-session'
+import { seedUnboundRemotePtyLease } from './helpers/unbound-remote-pty-lease'
+import {
+  describeSshRemotePtyLeases,
+  findSshRemotePtyLeaseForLeaf,
+  readSshRemotePtyLeases,
+  resolveOrcaProfileStateFile
+} from './helpers/ssh-remote-pty-lease-file'
+import {
+  cleanupDockerSshRelayTarget,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import {
+  connectDockerSshRelayTarget,
+  reconnectDockerSshRelayTarget
+} from './helpers/docker-ssh-relay-connection'
+import { severDockerSshRelayTransport } from './helpers/docker-ssh-relay-processes'
+import {
+  countDockerSshRelayRemoteStreamWriters,
+  describeDockerSshRelayRemotePtys,
+  readDockerSshRelayRemotePtys
+} from './helpers/docker-ssh-relay-remote-ptys'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+const PANE_COUNT = 2
+const RECONNECT_CYCLES = 3
+// Why: the relay must outlive every fault. If it exits with the client the
+// remote shells die too, reconnect degrades to a cold spawn, and the reattach
+// path this spec exists to bound is never entered.
+const RELAY_GRACE_PERIOD_SECONDS = 900
+// Why: a graft lands after reattach reports ready, so the census has to be
+// re-read once the dust settles rather than the instant the wait passes.
+const SETTLE_MS = 6_000
+
+test.use({ seedTestRepo: false })
+
+async function waitForSshReconnected(page: Page, targetId: string): Promise<void> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(
+          async (targetId) => (await window.api.ssh.getState({ targetId }))?.status ?? null,
+          targetId
+        ),
+      {
+        timeout: 120_000,
+        message: 'SSH target did not reconnect after its transport was severed'
+      }
+    )
+    .toBe('connected')
+}
+
+/** Every terminal pane the user can see in a workspace, keyed tab/leaf. */
+type RemotePaneCensus = {
+  tabIds: string[]
+  paneIds: string[]
+}
+
+async function readRemotePaneCensus(page: Page, worktreeId: string): Promise<RemotePaneCensus> {
+  return page.evaluate((worktreeId) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('Store unavailable')
+    }
+    type LayoutNode =
+      | { type: 'leaf'; leafId: string }
+      | { type: 'split'; first: LayoutNode; second: LayoutNode }
+      | null
+    const collectLeafIds = (node: LayoutNode): string[] => {
+      if (!node) {
+        return []
+      }
+      return node.type === 'leaf'
+        ? [node.leafId]
+        : [...collectLeafIds(node.first), ...collectLeafIds(node.second)]
+    }
+    const tabs = state.tabsByWorktree[worktreeId] ?? []
+    const paneIds = tabs.flatMap((tab) => {
+      const leafIds = collectLeafIds(
+        (state.terminalLayoutsByTabId[tab.id]?.root ?? null) as LayoutNode
+      )
+      // Why: `root: null` is the implicit single-pane layout a fresh tab carries
+      // until it is first split, so it still counts as one visible pane.
+      return leafIds.length > 0
+        ? leafIds.map((leafId) => `${tab.id}/${leafId}`)
+        : [`${tab.id}/<root>`]
+    })
+    return { tabIds: tabs.map((tab) => tab.id), paneIds: paneIds.sort() }
+  }, worktreeId)
+}
+
+type StreamingRemoteWorkspace = {
+  remote: Awaited<ReturnType<typeof connectDockerSshRelayTarget>>
+  paneSnapshot: Awaited<ReturnType<typeof waitForPaneIdentitySnapshot>>
+  baselinePanes: RemotePaneCensus
+  baselineRemotePtys: ReturnType<typeof readDockerSshRelayRemotePtys>
+}
+
+/** A connected remote workspace with PANE_COUNT panes, each streaming output. */
+async function openStreamingRemotePanes(
+  page: Page,
+  relayTarget: DockerSshRelayTarget
+): Promise<StreamingRemoteWorkspace> {
+  await waitForSessionReady(page)
+  const remote = await connectDockerSshRelayTarget(page, relayTarget, {
+    relayGracePeriodSeconds: RELAY_GRACE_PERIOD_SECONDS
+  })
+  await expect.poll(() => waitForActiveWorktree(page), { timeout: 30_000 }).toBe(remote.worktreeId)
+  await ensureTerminalVisible(page, 45_000)
+  await waitForActiveTerminalManager(page, 60_000)
+  await waitForActivePanePtyId(page, 60_000)
+
+  await splitActiveTerminalPane(page, 'vertical')
+  const paneSnapshot = await waitForPaneIdentitySnapshot(page, PANE_COUNT)
+  const baselinePanes = await readRemotePaneCensus(page, remote.worktreeId)
+  expect(baselinePanes.paneIds).toHaveLength(PANE_COUNT)
+
+  // Why every pane must be streaming: an idle pane carries no output source,
+  // so its reattach sends no recovery checkpoint and the relay answers
+  // 'existing'. Only a live source can come back needing re-establishment,
+  // which is the outcome that used to read as expiry and respawn the shell.
+  const streamMarker = `SSH_RECONNECT_STREAM_${Date.now()}`
+  for (const pane of paneSnapshot.panes) {
+    if (!pane.ptyId) {
+      throw new Error(`Pane ${pane.leafId} has no PTY to stream from`)
+    }
+    await sendToTerminal(
+      page,
+      pane.ptyId,
+      `node -e "setInterval(()=>process.stdout.write('${streamMarker}_'+Date.now()+'\\n'),25)"\r`
+    )
+  }
+  await expect
+    .poll(() => countDockerSshRelayRemoteStreamWriters(relayTarget, streamMarker), {
+      timeout: 60_000,
+      message: 'remote panes did not start streaming before the first transport fault'
+    })
+    .toBe(PANE_COUNT)
+
+  // The remote census is the reporter's oracle: shells the relay hosts right
+  // now, counted on the container rather than inferred from app state.
+  await expect
+    .poll(() => readDockerSshRelayRemotePtys(relayTarget).length, {
+      timeout: 60_000,
+      message: 'remote shells did not settle at one per pane before the first reconnect'
+    })
+    .toBe(PANE_COUNT)
+  return {
+    remote,
+    paneSnapshot,
+    baselinePanes,
+    baselineRemotePtys: readDockerSshRelayRemotePtys(relayTarget)
+  }
+}
+
+// STA-3077: reconnecting an SSH-backed workspace must be cardinality-neutral.
+// The report had relay PTYs go 2 -> 19 -> 20 over three reconnects while panes
+// the user never opened appeared alongside them, so both counts are asserted
+// against the same fixed workspace after every cycle.
+test.describe('SSH reconnect pane and remote PTY cardinality', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH tests.')
+  test.skip(process.platform === 'win32', 'Docker SSH reconnect uses POSIX SSH tooling.')
+
+  test('adds no panes and no remote PTYs across repeated reconnects', async ({
+    orcaPage
+  }, testInfo: TestInfo) => {
+    test.setTimeout(480_000)
+    let target: DockerSshRelayTarget | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      const relayTarget = target
+      const { remote, baselinePanes, baselineRemotePtys } = await openStreamingRemotePanes(
+        orcaPage,
+        relayTarget
+      )
+      const baselinePids = baselineRemotePtys.map((pty) => pty.pid)
+      testInfo.annotations.push({
+        type: 'ssh-reconnect-cardinality-baseline',
+        description: describeDockerSshRelayRemotePtys(baselineRemotePtys)
+      })
+
+      for (let cycle = 1; cycle <= RECONNECT_CYCLES; cycle += 1) {
+        severDockerSshRelayTransport(relayTarget)
+        await waitForSshReconnected(orcaPage, remote.targetId)
+        await ensureTerminalVisible(orcaPage, 45_000)
+        await waitForActiveTerminalManager(orcaPage, 60_000)
+        await waitForActivePanePtyId(orcaPage, 60_000)
+
+        // Poll rather than sample once: a leaked pane or a duplicate shell can
+        // land after reattach reports ready, and a single read would miss it.
+        await expect
+          .poll(() => readDockerSshRelayRemotePtys(relayTarget).map((pty) => pty.pid), {
+            timeout: 90_000,
+            message: `reconnect ${cycle} changed the live remote shells`
+          })
+          .toEqual(baselinePids)
+        await expect
+          .poll(async () => (await readRemotePaneCensus(orcaPage, remote.worktreeId)).paneIds, {
+            timeout: 30_000,
+            message: `reconnect ${cycle} changed the visible terminal panes`
+          })
+          .toEqual(baselinePanes.paneIds)
+        expect(
+          (await readRemotePaneCensus(orcaPage, remote.worktreeId)).tabIds,
+          `reconnect ${cycle} changed the workspace tabs`
+        ).toEqual(baselinePanes.tabIds)
+
+        // Why not poll here: poll returns on its first passing probe, so
+        // re-polling a value that already matched waits 0ms and observes
+        // nothing. Sit out the settle window, then re-read every dimension a
+        // late graft could move, so it is attributed to the reconnect that
+        // caused it instead of leaking into the next cycle.
+        await orcaPage.waitForTimeout(SETTLE_MS)
+        const settled = await readRemotePaneCensus(orcaPage, remote.worktreeId)
+        expect(
+          readDockerSshRelayRemotePtys(relayTarget).map((pty) => pty.pid),
+          `reconnect ${cycle} changed the remote shells after settling`
+        ).toEqual(baselinePids)
+        expect(
+          settled.paneIds,
+          `reconnect ${cycle} changed the visible terminal panes after settling`
+        ).toEqual(baselinePanes.paneIds)
+        expect(
+          settled.tabIds,
+          `reconnect ${cycle} changed the workspace tabs after settling`
+        ).toEqual(baselinePanes.tabIds)
+      }
+
+      testInfo.annotations.push({
+        type: 'ssh-reconnect-cardinality-final',
+        description: `${RECONNECT_CYCLES} reconnects: ${describeDockerSshRelayRemotePtys(
+          readDockerSshRelayRemotePtys(relayTarget)
+        )}`
+      })
+    } finally {
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+
+  // The divergence the field hit: a live lease and a live remote shell that no
+  // durable pane names. Reconnect must reattach without inventing the pane back,
+  // and without killing the shell it can no longer place.
+  //
+  // The precondition is seeded, not induced. Inducing it by closing a pane over
+  // a severed transport is a race the induction loses: once the sever tears the
+  // SSH providers down, `pty:kill` takes its tombstone branch and terminates the
+  // lease, reattach never fans out over it, and every oracle downstream passes
+  // vacuously on both trees. See helpers/unbound-remote-pty-lease.ts.
+  //
+  // Why an explicit disconnect/reconnect rather than a transport sever: only the
+  // detach path moves the lease attached -> detached, which makes the flip back
+  // to attached positive proof that reattach reached this exact lease. A severed
+  // link reconnects with the lease still marked attached, so nothing on disk
+  // separates "reattached and refused to bind" from "never visited".
+  test('leaves a lease whose durable pane is gone unbound instead of grafting the pane back', async ({
+    orcaPage,
+    electronApp
+  }, testInfo: TestInfo) => {
+    test.setTimeout(480_000)
+    let target: DockerSshRelayTarget | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      const relayTarget = target
+      const { remote, paneSnapshot } = await openStreamingRemotePanes(orcaPage, relayTarget)
+      const hostId = sshExecutionHostId(remote.targetId)
+      const stateFile = await resolveOrcaProfileStateFile(electronApp)
+      const readBindings = (): Promise<string[]> =>
+        readDurablePaneBindings(orcaPage, hostId, remote.worktreeId)
+      const livePids = (): number[] =>
+        readDockerSshRelayRemotePtys(relayTarget)
+          .map((pty) => pty.pid)
+          .sort((left, right) => left - right)
+
+      const unbound = await seedUnboundRemotePtyLease(orcaPage, {
+        targetId: remote.targetId,
+        hostId,
+        worktreeId: remote.worktreeId,
+        tabId: paneSnapshot.tabId,
+        leafId: randomUUID()
+      })
+      // A live source, like the panes: an idle PTY reattaches as 'existing' and
+      // never enters the source re-establishment the field failure came through.
+      const unboundMarker = `SSH_UNBOUND_STREAM_${Date.now()}`
+      await sendToTerminal(
+        orcaPage,
+        unbound.ptyId,
+        `node -e "setInterval(()=>process.stdout.write('${unboundMarker}_'+Date.now()+'\\n'),100)"\r`
+      )
+      await expect
+        .poll(() => countDockerSshRelayRemoteStreamWriters(relayTarget, unboundMarker), {
+          timeout: 60_000,
+          message: 'the unbound remote PTY never started streaming'
+        })
+        .toBe(1)
+      await expect
+        .poll(() => readDockerSshRelayRemotePtys(relayTarget).length, {
+          timeout: 60_000,
+          message: 'the relay did not settle at one shell per pane plus the unbound one'
+        })
+        .toBe(PANE_COUNT + 1)
+      const seededPtys = readDockerSshRelayRemotePtys(relayTarget)
+      const seededPids = seededPtys.map((pty) => pty.pid).sort((left, right) => left - right)
+      // The seeded shell is the pane-key-less one: ORCA_PANE_KEY is injected by
+      // the pane launch path, which a leaf that never becomes a pane never runs.
+      for (const pane of paneSnapshot.panes) {
+        expect(
+          seededPtys.map((pty) => pty.paneKey),
+          `pane ${pane.leafId} lost the remote shell it owns`
+        ).toContain(`${paneSnapshot.tabId}:${pane.leafId}`)
+      }
+      expect(
+        seededPtys.filter((pty) => pty.paneKey === null),
+        'the seeded remote shell is not separable from the pane-owned ones'
+      ).toHaveLength(1)
+      testInfo.annotations.push({
+        type: 'ssh-reconnect-unbound-lease-seeded',
+        description: describeDockerSshRelayRemotePtys(seededPtys)
+      })
+
+      const seededLease = findSshRemotePtyLeaseForLeaf(stateFile, remote.targetId, unbound.leafId)
+      expect(seededLease?.state, 'the seeded remote PTY never took a live lease').toBe('attached')
+      const attachedBeforeReconnect = seededLease?.lastAttachedAt ?? 0
+      const bindingsBeforeReconnect = await readBindings()
+      expect(
+        bindingsBeforeReconnect.filter((binding) => binding.includes(unbound.leafId)),
+        'no durable partition may name the unbound leaf before the reconnect'
+      ).toHaveLength(0)
+      for (const pane of paneSnapshot.panes) {
+        expect(
+          bindingsBeforeReconnect.filter((binding) => binding.includes(pane.leafId)),
+          `pane ${pane.leafId} must start out durably bound`
+        ).not.toHaveLength(0)
+      }
+
+      await reconnectDockerSshRelayTarget(orcaPage, remote.targetId)
+      await waitForSshReconnected(orcaPage, remote.targetId)
+      await ensureTerminalVisible(orcaPage, 45_000)
+      await waitForActiveTerminalManager(orcaPage, 60_000)
+      await waitForActivePanePtyId(orcaPage, 60_000)
+
+      // Vacuity guard. Detach marked this lease 'detached'; only reattachKnownPtys
+      // marks it 'attached' again, and only after visiting it. Without this, a
+      // reattach that silently skipped the lease would be indistinguishable from
+      // one that correctly refused to bind it, and the census below would prove
+      // nothing.
+      await expect
+        .poll(
+          () =>
+            findSshRemotePtyLeaseForLeaf(stateFile, remote.targetId, unbound.leafId)
+              ?.lastAttachedAt ?? 0,
+          {
+            timeout: 120_000,
+            message:
+              'reconnect never reattached the unbound lease, so the pane census below is vacuous'
+          }
+        )
+        .toBeGreaterThan(attachedBeforeReconnect)
+      testInfo.annotations.push({
+        type: 'ssh-reconnect-unbound-lease-reattached',
+        description: describeSshRemotePtyLeases(readSshRemotePtyLeases(stateFile, remote.targetId))
+      })
+
+      // Sample continuously rather than poll-until-equal: a graft that lands and
+      // is later overwritten by a renderer snapshot would satisfy a poll that
+      // only needs one matching read, and the defect would pass unnoticed.
+      const deadline = Date.now() + 25_000
+      let samples = 0
+      while (Date.now() < deadline) {
+        expect(
+          await readBindings(),
+          'reconnect grafted a durable pane for a lease no pane owns'
+        ).toEqual(bindingsBeforeReconnect)
+        samples += 1
+        await orcaPage.waitForTimeout(500)
+      }
+      expect(samples).toBeGreaterThan(10)
+
+      // Unknown is not dead: the unbound shell keeps running, so a later reattach
+      // can still claim it once a durable pane names it again.
+      expect(livePids(), 'the unbound remote shell was killed or respawned').toEqual(seededPids)
+      expect(
+        (await readRemotePaneCensus(orcaPage, remote.worktreeId)).paneIds,
+        'reconnect surfaced a pane the user never opened'
+      ).toHaveLength(PANE_COUNT)
+      testInfo.annotations.push({
+        type: 'ssh-reconnect-unbound-lease-final',
+        description: describeDockerSshRelayRemotePtys(readDockerSshRelayRemotePtys(relayTarget))
+      })
+    } finally {
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+})
diff --git a/tests/e2e/ssh-startup-exec-readiness.spec.ts b/tests/e2e/ssh-startup-exec-readiness.spec.ts
new file mode 100644
index 00000000000..e77c9afd67f
--- /dev/null
+++ b/tests/e2e/ssh-startup-exec-readiness.spec.ts
@@ -0,0 +1,111 @@
+import { expect, test } from './helpers/orca-app'
+import {
+  connectDockerSshRelayTarget,
+  reconnectDockerSshRelayTarget
+} from './helpers/docker-ssh-relay-connection'
+import {
+  cleanupDockerSshRelayTarget,
+  execDockerSshRelayTargetControlCommand,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget,
+  writeDockerSshRelayTargetFile
+} from './helpers/docker-ssh-relay-target'
+import {
+  bashExecProfileContents,
+  closeStartupExecTerminal,
+  createStartupExecTerminal,
+  expectStartupCommandQueuedByCompatibilityFallback,
+  expectStartupExecRecovery
+} from './helpers/startup-exec-readiness-oracle'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import { waitForActiveTerminalManager } from './helpers/terminal'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+
+test.describe('startup exec readiness over live SSH', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH E2E.')
+  test.skip(process.platform === 'win32', 'Docker SSH E2E uses POSIX ssh tooling.')
+
+  test('survives an SSH reconnect while the replacement shell is not ready @headful', async ({
+    orcaPage
+  }, testInfo) => {
+    test.setTimeout(150_000)
+    const runId = `ssh_${Date.now()}`
+    const startedPath = `/tmp/sta4067-${runId}.started`
+    const releasePath = `/tmp/sta4067-${runId}.release`
+    const ledgerPath = `/tmp/sta4067-${runId}.ledger`
+    let target: DockerSshRelayTarget | null = null
+    let terminal: string | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      await waitForSessionReady(orcaPage)
+      await waitForActiveWorktree(orcaPage)
+      const remote = await connectDockerSshRelayTarget(orcaPage, target, {
+        relayGracePeriodSeconds: 15
+      })
+      await ensureTerminalVisible(orcaPage, 45_000)
+      await waitForActiveTerminalManager(orcaPage, 60_000)
+      writeDockerSshRelayTargetFile(
+        target,
+        '/root/.bash_profile',
+        bashExecProfileContents(runId, { releasePath, startedPath })
+      )
+      const created = await createStartupExecTerminal(
+        orcaPage,
+        remote.worktreeId,
+        runId,
+        ledgerPath,
+        'owning-client'
+      )
+      terminal = created.terminal
+      await expect
+        .poll(
+          () =>
+            execDockerSshRelayTargetControlCommand(
+              target!,
+              `if test -e '${startedPath}'; then echo ready; else echo pending; fi`
+            ),
+          { timeout: 30_000 }
+        )
+        .toBe('ready')
+      await expectStartupCommandQueuedByCompatibilityFallback(orcaPage, created)
+      expect(
+        execDockerSshRelayTargetControlCommand(
+          target,
+          `if test ! -e '${ledgerPath}'; then echo pending; else cat '${ledgerPath}'; fi`
+        )
+      ).toBe('pending')
+
+      await reconnectDockerSshRelayTarget(orcaPage, remote.targetId)
+      execDockerSshRelayTargetControlCommand(target, `: > '${releasePath}'`)
+      await expect
+        .poll(
+          () =>
+            execDockerSshRelayTargetControlCommand(
+              target!,
+              `if test -e '${ledgerPath}'; then cat '${ledgerPath}'; else echo pending; fi`
+            ),
+          { timeout: 8_000 }
+        )
+        .toMatch(/^[0-9]+\|\/dev\/pts\/[0-9]+$/)
+      await expectStartupExecRecovery(orcaPage, created, runId)
+
+      const [pidText, tty] = execDockerSshRelayTargetControlCommand(
+        target,
+        `cat '${ledgerPath}'`
+      ).split('|')
+      const pid = Number(pidText)
+      expect(pid).toBeGreaterThan(1)
+      expect(tty).toMatch(/^\/dev\/pts\/[0-9]+$/)
+      expect(execDockerSshRelayTargetControlCommand(target, `readlink '/proc/${pid}/exe'`)).toMatch(
+        /\/bash$/
+      )
+      expect(
+        execDockerSshRelayTargetControlCommand(target, `ps -o tpgid= -p '${pid}' | tr -d ' '`)
+      ).toBe(String(pid))
+    } finally {
+      await closeStartupExecTerminal(orcaPage, terminal)
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+})
diff --git a/tests/e2e/ssh-two-hosts-isolation.spec.ts b/tests/e2e/ssh-two-hosts-isolation.spec.ts
new file mode 100644
index 00000000000..95b2364dc9c
--- /dev/null
+++ b/tests/e2e/ssh-two-hosts-isolation.spec.ts
@@ -0,0 +1,360 @@
+/**
+ * Journey 7 — two independent Docker SSH hosts, live at the same time, in one
+ * app.
+ *
+ * Two real OpenSSH containers, two SSH targets, two remote repos, and two panes
+ * each — one streaming, one at a prompt. The spec asserts the boundary in both
+ * directions: nothing host A owns appears under host B, and severing host A's
+ * transport leaves host B's connection, panes, durable bindings, remote shells,
+ * and — the part a state census cannot see — host B's ability to run a command
+ * completely untouched.
+ *
+ * Host A's shells are counted too, on host A's own container: a severed
+ * transport is not proof that anything died, so they must still be there when
+ * it comes back.
+ *
+ * What this spec does NOT discriminate against, and why: the blast radius of a
+ * PTY-level delivery failure. Severing a transport is the only fault reachable
+ * from outside the app, and it cannot produce a rejected delivery frame whose
+ * recovery budget then runs out — that needs a relay publishing a source header
+ * this client never installed. `src/main/ssh/ssh-relay-session-two-host-delivery-isolation.integration.test.ts`
+ * injects exactly that on the relay wire and owns that half of Journey 4.
+ */
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import {
+  ensureTerminalVisible,
+  switchToWorktree,
+  waitForActiveWorktree,
+  waitForSessionReady
+} from './helpers/store'
+import {
+  sendToTerminal,
+  splitActiveTerminalPane,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneIdentitySnapshot
+} from './helpers/terminal'
+import { readDurablePaneBindings, sshExecutionHostId } from './helpers/remote-pane-durable-session'
+import { readDurablePartitionPtyIds } from './helpers/docker-ssh-relay-host-partition'
+import {
+  cleanupDockerSshRelayTarget,
+  execDockerSshRelayTargetCommand,
+  shellQuote,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import { connectDockerSshRelayTarget } from './helpers/docker-ssh-relay-connection'
+import { severDockerSshRelayTransport } from './helpers/docker-ssh-relay-processes'
+import {
+  countDockerSshRelayRemoteStreamWriters,
+  describeDockerSshRelayRemotePtys,
+  readDockerSshRelayRemotePtys
+} from './helpers/docker-ssh-relay-remote-ptys'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+const PANE_COUNT = 2
+// Why: the relay must outlive the fault. If it exits with the client the remote
+// shells die too and the fault stops being a containment question.
+const RELAY_GRACE_PERIOD_SECONDS = 900
+// Why: contamination lands after the fault handler returns, so every dimension
+// is re-read across a window rather than sampled once.
+const CONTAINMENT_WINDOW_MS = 20_000
+const CONTAINMENT_SAMPLE_MS = 1_000
+
+test.use({ seedTestRepo: false })
+
+type RemoteHost = {
+  label: 'A' | 'B'
+  target: DockerSshRelayTarget
+  remote: Awaited<ReturnType<typeof connectDockerSshRelayTarget>>
+  hostId: string
+  tabId: string
+  ptyIds: string[]
+  /** Pane 0 runs the endless writer; pane 1 stays a usable shell. */
+  commandPtyId: string
+  streamMarker: string
+  remotePids: number[]
+}
+
+function ptyIdBelongsToTarget(ptyId: string, targetId: string): boolean {
+  return ptyId.startsWith(`ssh:${encodeURIComponent(targetId)}@@`)
+}
+
+async function readSshStatus(page: Page, targetId: string): Promise<string | null> {
+  return page.evaluate(
+    async (targetId) => (await window.api.ssh.getState({ targetId }))?.status ?? null,
+    targetId
+  )
+}
+
+/** Connects one container and opens PANE_COUNT panes on it, one of them streaming. */
+async function openRemoteHost(
+  page: Page,
+  label: 'A' | 'B',
+  target: DockerSshRelayTarget
+): Promise<RemoteHost> {
+  const remote = await connectDockerSshRelayTarget(page, target, {
+    relayGracePeriodSeconds: RELAY_GRACE_PERIOD_SECONDS
+  })
+  await expect.poll(() => waitForActiveWorktree(page), { timeout: 30_000 }).toBe(remote.worktreeId)
+  await ensureTerminalVisible(page, 45_000)
+  await waitForActiveTerminalManager(page, 60_000)
+  await waitForActivePanePtyId(page, 60_000)
+  await splitActiveTerminalPane(page, 'vertical')
+  const snapshot = await waitForPaneIdentitySnapshot(page, PANE_COUNT)
+
+  const ptyIds = snapshot.panes.map((pane) => {
+    if (!pane.ptyId) {
+      throw new Error(`Host ${label} pane ${pane.leafId} has no PTY`)
+    }
+    return pane.ptyId
+  })
+
+  // Why one streaming pane: an idle host carries no output source, so a fault
+  // never reaches the delivery machinery whose blast radius this journey
+  // bounds. The sibling pane is left at a prompt so the host stays usable.
+  const streamMarker = `TWO_HOST_${label}_${Date.now()}`
+  await sendToTerminal(
+    page,
+    ptyIds[0]!,
+    `node -e "setInterval(()=>process.stdout.write('${streamMarker}_'+Date.now()+'\\n'),25)"\r`
+  )
+  await expect
+    .poll(() => countDockerSshRelayRemoteStreamWriters(target, streamMarker), {
+      timeout: 60_000,
+      message: `host ${label} pane did not start streaming`
+    })
+    .toBe(1)
+  await expect
+    .poll(() => readDockerSshRelayRemotePtys(target).length, {
+      timeout: 60_000,
+      message: `host ${label} did not settle at one remote shell per pane`
+    })
+    .toBe(PANE_COUNT)
+
+  return {
+    label,
+    target,
+    remote,
+    hostId: sshExecutionHostId(remote.targetId),
+    tabId: snapshot.tabId,
+    ptyIds,
+    commandPtyId: ptyIds[1]!,
+    streamMarker,
+    remotePids: readDockerSshRelayRemotePtys(target).map((pty) => pty.pid)
+  }
+}
+
+/**
+ * Runs a command through the host's own pane and proves it executed on that
+ * host's container — the one dimension no amount of persisted state can fake.
+ */
+async function proveHostRunsCommands(page: Page, host: RemoteHost, phase: string): Promise<string> {
+  const stamp = `/tmp/orca-two-host-${host.label}-${phase}-${Date.now()}`
+  await expect
+    .poll(
+      async () => {
+        // Why resend on every probe: a shell that is mid-prompt, parked, or
+        // reattaching can swallow the first line, and one lost keystroke would
+        // read as a dead host.
+        await sendToTerminal(page, host.commandPtyId, `touch ${stamp}\r`)
+        return execDockerSshRelayTargetCommand(
+          host.target,
+          `test -e ${shellQuote(stamp)} && printf yes || printf no`
+        )
+      },
+      {
+        timeout: 60_000,
+        intervals: [1_000],
+        message: `host ${host.label} could not run a command through its own pane (${phase})`
+      }
+    )
+    .toBe('yes')
+  return stamp
+}
+
+function assertStampIsLocalToHost(stamp: string, elsewhere: DockerSshRelayTarget): void {
+  expect(
+    execDockerSshRelayTargetCommand(
+      elsewhere,
+      `test -e ${shellQuote(stamp)} && printf yes || printf no`
+    ),
+    `a command run on one host reached the other container (${stamp})`
+  ).toBe('no')
+}
+
+test.describe('Two independent Docker SSH hosts', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH tests.')
+  test.skip(process.platform === 'win32', 'Docker SSH uses POSIX SSH tooling.')
+
+  test('keep sessions disjoint and contain one host transport failure', async ({
+    orcaPage
+  }, testInfo: TestInfo) => {
+    test.setTimeout(900_000)
+    let targetA: DockerSshRelayTarget | null = null
+    let targetB: DockerSshRelayTarget | null = null
+    try {
+      targetA = startDockerSshRelayTarget(testInfo)
+      targetB = startDockerSshRelayTarget(testInfo)
+      await waitForSessionReady(orcaPage)
+
+      const hostA = await openRemoteHost(orcaPage, 'A', targetA)
+      const hostB = await openRemoteHost(orcaPage, 'B', targetB)
+      const containerA = targetA
+      const containerB = targetB
+
+      // --- both hosts live at once, and nothing is shared -------------------
+      expect(await readSshStatus(orcaPage, hostA.remote.targetId)).toBe('connected')
+      expect(await readSshStatus(orcaPage, hostB.remote.targetId)).toBe('connected')
+      expect(hostA.remote.targetId).not.toBe(hostB.remote.targetId)
+      expect(hostA.remote.repoId).not.toBe(hostB.remote.repoId)
+      expect(hostA.remote.worktreeId).not.toBe(hostB.remote.worktreeId)
+      expect(hostA.tabId).not.toBe(hostB.tabId)
+      expect(hostA.ptyIds.filter((id) => hostB.ptyIds.includes(id))).toEqual([])
+      for (const host of [hostA, hostB]) {
+        for (const ptyId of host.ptyIds) {
+          expect(
+            ptyIdBelongsToTarget(ptyId, host.remote.targetId),
+            `host ${host.label} pane PTY ${ptyId} is not scoped to its own target`
+          ).toBe(true)
+        }
+      }
+
+      // Remote shells: each container hosts exactly its own panes and nothing
+      // stamped with the other host's workspace.
+      for (const [host, other] of [
+        [hostA, hostB],
+        [hostB, hostA]
+      ] as const) {
+        const ptys = readDockerSshRelayRemotePtys(host.target)
+        expect(ptys, `host ${host.label} shell count`).toHaveLength(PANE_COUNT)
+        for (const pty of ptys) {
+          expect(pty.worktreeId, `host ${host.label} shell ${pty.pid} worktree`).toBe(
+            host.remote.worktreeId
+          )
+          expect(pty.tabId, `host ${host.label} shell ${pty.pid} tab`).toBe(host.tabId)
+          expect(pty.worktreeId).not.toBe(other.remote.worktreeId)
+        }
+        expect(
+          countDockerSshRelayRemoteStreamWriters(host.target, other.streamMarker),
+          `host ${other.label}'s output writers appeared on host ${host.label}'s container`
+        ).toBe(0)
+      }
+
+      // Durable state: no id minted by one host is named under the other.
+      const bindingsA = await readDurablePaneBindings(
+        orcaPage,
+        hostA.hostId,
+        hostA.remote.worktreeId
+      )
+      const bindingsB = await readDurablePaneBindings(
+        orcaPage,
+        hostB.hostId,
+        hostB.remote.worktreeId
+      )
+      expect(bindingsA).not.toHaveLength(0)
+      expect(bindingsB).not.toHaveLength(0)
+      const assertPartitionsAreDisjoint = async (): Promise<void> => {
+        for (const [host, other] of [
+          [hostA, hostB],
+          [hostB, hostA]
+        ] as const) {
+          const ids = await readDurablePartitionPtyIds(orcaPage, host.hostId)
+          expect(
+            ids.filter((id) => ptyIdBelongsToTarget(id, other.remote.targetId)),
+            `host ${other.label}'s PTY ids appeared in host ${host.label}'s durable partition`
+          ).toEqual([])
+        }
+      }
+      await assertPartitionsAreDisjoint()
+
+      const stampA = await proveHostRunsCommands(orcaPage, hostA, 'baseline')
+      const stampB = await proveHostRunsCommands(orcaPage, hostB, 'baseline')
+      assertStampIsLocalToHost(stampA, containerB)
+      assertStampIsLocalToHost(stampB, containerA)
+      testInfo.annotations.push({
+        type: 'two-host-baseline',
+        description: `A=[${describeDockerSshRelayRemotePtys(readDockerSshRelayRemotePtys(containerA))}] B=[${describeDockerSshRelayRemotePtys(readDockerSshRelayRemotePtys(containerB))}]`
+      })
+
+      // --- sever host A, then hold host B to every baseline ----------------
+      severDockerSshRelayTransport(containerA)
+      // Why switch: reattach only runs for a revealed workspace, so host A has
+      // to be the one on screen while host B rides out the fault in the
+      // background — the arrangement in which a leak is easiest to miss.
+      await switchToWorktree(orcaPage, hostA.remote.worktreeId)
+
+      const deadline = Date.now() + CONTAINMENT_WINDOW_MS
+      let samples = 0
+      while (Date.now() < deadline) {
+        expect(
+          await readSshStatus(orcaPage, hostB.remote.targetId),
+          'host B left connected while host A was severed'
+        ).toBe('connected')
+        expect(
+          readDockerSshRelayRemotePtys(containerB).map((pty) => pty.pid),
+          'host B lost or gained a remote shell while host A was severed'
+        ).toEqual(hostB.remotePids)
+        expect(
+          await readDurablePaneBindings(orcaPage, hostB.hostId, hostB.remote.worktreeId),
+          'host B durable pane bindings changed while host A was severed'
+        ).toEqual(bindingsB)
+        // Unknown is not dead: host A's shells outlive its transport.
+        expect(
+          readDockerSshRelayRemotePtys(containerA).map((pty) => pty.pid),
+          'host A shells were destroyed by its own transport fault'
+        ).toEqual(hostA.remotePids)
+        await assertPartitionsAreDisjoint()
+        samples += 1
+        await orcaPage.waitForTimeout(CONTAINMENT_SAMPLE_MS)
+      }
+      expect(samples).toBeGreaterThan(4)
+
+      // The dimension no census covers: host B must still be able to work.
+      const stampBDuringFault = await proveHostRunsCommands(orcaPage, hostB, 'during-fault')
+      assertStampIsLocalToHost(stampBDuringFault, containerA)
+      expect(
+        countDockerSshRelayRemoteStreamWriters(containerB, hostB.streamMarker),
+        'host B stopped streaming while host A was severed'
+      ).toBe(1)
+
+      // --- host A recovers without disturbing host B ------------------------
+      await expect
+        .poll(() => readSshStatus(orcaPage, hostA.remote.targetId), {
+          timeout: 180_000,
+          message: 'host A did not reconnect after its transport was severed'
+        })
+        .toBe('connected')
+      await ensureTerminalVisible(orcaPage, 45_000)
+      await waitForActiveTerminalManager(orcaPage, 60_000)
+      await waitForActivePanePtyId(orcaPage, 60_000)
+
+      expect(
+        readDockerSshRelayRemotePtys(containerA).map((pty) => pty.pid),
+        'host A reconnect changed its own remote shells'
+      ).toEqual(hostA.remotePids)
+      expect(
+        readDockerSshRelayRemotePtys(containerB).map((pty) => pty.pid),
+        'host A reconnect changed host B remote shells'
+      ).toEqual(hostB.remotePids)
+      expect(
+        await readDurablePaneBindings(orcaPage, hostB.hostId, hostB.remote.worktreeId),
+        'host A reconnect changed host B durable pane bindings'
+      ).toEqual(bindingsB)
+      await assertPartitionsAreDisjoint()
+
+      const stampAAfter = await proveHostRunsCommands(orcaPage, hostA, 'after-recovery')
+      const stampBAfter = await proveHostRunsCommands(orcaPage, hostB, 'after-recovery')
+      assertStampIsLocalToHost(stampAAfter, containerB)
+      assertStampIsLocalToHost(stampBAfter, containerA)
+      testInfo.annotations.push({
+        type: 'two-host-final',
+        description: `A=[${describeDockerSshRelayRemotePtys(readDockerSshRelayRemotePtys(containerA))}] B=[${describeDockerSshRelayRemotePtys(readDockerSshRelayRemotePtys(containerB))}]`
+      })
+    } finally {
+      cleanupDockerSshRelayTarget(targetA)
+      cleanupDockerSshRelayTarget(targetB)
+    }
+  })
+})
diff --git a/tests/e2e/ssh-unreachable-pane-recovery.spec.ts b/tests/e2e/ssh-unreachable-pane-recovery.spec.ts
new file mode 100644
index 00000000000..1252d40a565
--- /dev/null
+++ b/tests/e2e/ssh-unreachable-pane-recovery.spec.ts
@@ -0,0 +1,191 @@
+/**
+ * The decisive gate for the unreachable-pane affordance (STA-3077 / PR #13326).
+ *
+ * `ssh-disconnected-pane-affordance.spec.ts` holds its two decisive cases at `fixme` because the
+ * state was not inducible: the banner needs the SSH target CONNECTED while exactly one pane's
+ * `pty.attach` fails with an error that does not prove the shell exited, and every host-side fault
+ * tried takes the whole connection down instead. This spec induces that state deliberately — see
+ * `helpers/ssh-pane-incarnation-fault.ts` — so the behaviour can be OBSERVED rather than argued
+ * from reading the code, which is how several oracles on this branch ended up green for the wrong
+ * reason.
+ *
+ * What is pinned here:
+ *   1. the card appears at all, with the connection healthy (the induction itself);
+ *   2. reaching that state kills nothing and adds nothing on the host; and
+ *   3. "Start a new terminal" on a pane whose shell turns out to be ALIVE reconnects the user to
+ *      it and says so, instead of silently handing back the old shell under a label promising a
+ *      blank one, and without adding a second shell.
+ */
+import { expect, test, type ElectronApplication, type TestInfo } from '@stablyai/playwright-test'
+import { createRestartSession } from './helpers/orca-restart'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneIdentitySnapshot
+} from './helpers/terminal'
+import { resolveOrcaProfileStateFile } from './helpers/ssh-remote-pty-lease-file'
+import {
+  cleanupDockerSshRelayTarget,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import { connectDockerSshRelayTarget } from './helpers/docker-ssh-relay-connection'
+import { readDockerSshRelayRemotePtys } from './helpers/docker-ssh-relay-remote-ptys'
+import {
+  installRemotePaneLaunchTranscript,
+  readRemotePaneLaunchPids
+} from './helpers/remote-pane-launch-transcript'
+import { recordForeignShellIdentityForPane } from './helpers/ssh-pane-incarnation-fault'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+// Why: the relay must outlive the app quit. If it exited with the client the remote shell would
+// die too, and a dead shell cannot test a card whose whole claim is "we cannot reach it".
+const RELAY_GRACE_PERIOD_SECONDS = 900
+const BANNER = '[data-terminal-pane-disconnected-variant="ssh-pane"]'
+
+test.describe('an unreachable SSH pane recovers rather than being replaced', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH tests.')
+  test.skip(process.platform === 'win32', 'Docker SSH faults use POSIX SSH tooling.')
+
+  test('a pane whose recorded shell the host cannot match offers recovery, and recovering it adds no shell', async (// oxlint-disable-next-line no-empty-pattern -- this test owns both Electron launches
+  {}, testInfo: TestInfo) => {
+    test.setTimeout(600_000)
+    const restart = createRestartSession(testInfo)
+    let target: DockerSshRelayTarget | null = null
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      const relayTarget = target
+      installRemotePaneLaunchTranscript(relayTarget)
+
+      const firstLaunch = await restart.launch()
+      firstApp = firstLaunch.app
+      await waitForSessionReady(firstLaunch.page)
+      const remote = await connectDockerSshRelayTarget(firstLaunch.page, relayTarget, {
+        relayGracePeriodSeconds: RELAY_GRACE_PERIOD_SECONDS
+      })
+      await expect
+        .poll(() => waitForActiveWorktree(firstLaunch.page), { timeout: 30_000 })
+        .toBe(remote.worktreeId)
+      await waitForActiveTerminalManager(firstLaunch.page, 60_000)
+      await waitForActivePanePtyId(firstLaunch.page, 60_000)
+
+      const snapshot = await waitForPaneIdentitySnapshot(firstLaunch.page, 1)
+      const pane = snapshot.panes[0]
+      if (!pane?.ptyId) {
+        throw new Error('The remote workspace opened no pane with a PTY')
+      }
+      const paneKey = `${snapshot.tabId}:${pane.leafId}`
+
+      // Anti-vacuity for every "no second shell" clause below: the host records exactly one launch
+      // for this pane now, so a later count of one proves nothing was added rather than proving the
+      // transcript was never wired up.
+      await expect
+        .poll(() => readRemotePaneLaunchPids(relayTarget, paneKey).length, {
+          timeout: 60_000,
+          message: 'the host recorded no launch for the pane, so its transcript proves nothing'
+        })
+        .toBe(1)
+      const shellBefore = readDockerSshRelayRemotePtys(relayTarget).find(
+        (entry) => entry.paneKey === paneKey
+      )
+      if (!shellBefore) {
+        throw new Error(`The relay hosts no remote shell for pane ${paneKey}`)
+      }
+
+      // Resolved while the app is still up: the helper asks the live app for its profile path.
+      const stateFile = await resolveOrcaProfileStateFile(firstApp)
+
+      await restart.close(firstApp)
+      firstApp = null
+
+      // The induction. The relay and its shell are untouched and still running; only the pane's
+      // RECORD of which shell is its own is made unmatchable.
+      const rewritten = recordForeignShellIdentityForPane(stateFile, paneKey, remote.targetId)
+      // Either route is enough to fence: the pane-driven restore sends the binding's incarnation,
+      // the relay-session reconnect sends the lease's. But at least ONE must have held an identity,
+      // or the rewrite changed nothing and every clause below would pass for the wrong reason.
+      expect(
+        Boolean(rewritten.paneIncarnationBefore) || rewritten.leasesRewritten > 0,
+        `nothing recorded a shell identity to make unmatchable — ${rewritten.diagnostics}`
+      ).toBe(true)
+
+      const mainLog: string[] = []
+      const secondLaunch = await restart.launch({
+        onStderr: (chunk) => {
+          for (const line of chunk.split('\n')) {
+            if (
+              /ssh-pty|spawn\(\)|identity mismatch|not found|stable pane|owner_changed|pty:spawn/i.test(
+                line
+              )
+            ) {
+              mainLog.push(line.trim())
+            }
+          }
+        }
+      })
+      secondApp = secondLaunch.app
+      await waitForSessionReady(secondLaunch.page, 60_000)
+      await expect
+        .poll(() => waitForActiveWorktree(secondLaunch.page), { timeout: 60_000 })
+        .toBe(remote.worktreeId)
+
+      // 1. The card appears. This is the state that was previously not inducible.
+      const banner = secondLaunch.page.locator(BANNER)
+      await expect(banner, 'the pane showed no disconnected affordance').toBeVisible({
+        timeout: 180_000
+      })
+
+      // 2. Reaching it destroyed nothing and created nothing on the host.
+      expect(
+        readDockerSshRelayRemotePtys(relayTarget).filter(
+          (shell) => shell.pid === shellBefore.pid && shell.startTicks === shellBefore.startTicks
+        ),
+        'the unreachable pane killed the shell it cannot prove is gone'
+      ).toHaveLength(1)
+      expect(
+        readRemotePaneLaunchPids(relayTarget, paneKey),
+        'reaching the card launched a second shell for the pane'
+      ).toHaveLength(1)
+
+      // 3. The shell is alive, so this action recovers it. The user is told that, and no second
+      //    shell is created — the pane keeps the terminal it already had.
+      await banner.getByRole('button', { name: 'Start a new terminal' }).click()
+
+      // The recorded shell cannot be reached, so this action must CREATE one rather than attach
+      // the unreachable one first — which is what left the button doing nothing at all.
+      await expect(banner, 'the card stayed up after the pane was given a new shell').toBeHidden({
+        timeout: 180_000
+      })
+      await expect
+        .poll(() => readRemotePaneLaunchPids(relayTarget, paneKey).length, {
+          timeout: 120_000,
+          message: 'starting a new terminal never launched a shell for the pane'
+        })
+        .toBe(2)
+
+      // The old shell is unproven, not dead: it keeps running, unbound, for the cleanup surface.
+      expect(
+        readDockerSshRelayRemotePtys(relayTarget).filter(
+          (shell) => shell.pid === shellBefore.pid && shell.startTicks === shellBefore.startTicks
+        ),
+        'starting a new terminal killed the shell it cannot prove is gone'
+      ).toHaveLength(1)
+      expect(
+        readDockerSshRelayRemotePtys(relayTarget),
+        'starting a new terminal changed the host by more than the one shell it promised'
+      ).toHaveLength(2)
+    } finally {
+      if (firstApp) {
+        await restart.close(firstApp)
+      }
+      if (secondApp) {
+        await restart.close(secondApp)
+      }
+      cleanupDockerSshRelayTarget(target)
+      await restart.dispose()
+    }
+  })
+})
diff --git a/tests/e2e/terminal-hidden-tui-visual-restore.spec.ts b/tests/e2e/terminal-hidden-tui-visual-restore.spec.ts
index 96476cb0cd2..a78f4e81fa1 100644
--- a/tests/e2e/terminal-hidden-tui-visual-restore.spec.ts
+++ b/tests/e2e/terminal-hidden-tui-visual-restore.spec.ts
@@ -28,7 +28,7 @@ type HiddenTuiWindow = Window & {
   __terminalPtyOutputDebug?: {
     reset: () => void
     snapshot: () => {
-      hiddenRendererMode2031ReplyCount: number
+      hiddenRendererSkipCount: number
     }
   }
 }
diff --git a/tests/e2e/terminal-link-hover-after-worktree-return.spec.ts b/tests/e2e/terminal-link-hover-after-worktree-return.spec.ts
index 70912388cba..ee5ebe81079 100644
--- a/tests/e2e/terminal-link-hover-after-worktree-return.spec.ts
+++ b/tests/e2e/terminal-link-hover-after-worktree-return.spec.ts
@@ -56,7 +56,7 @@ async function locateHoverProbe(page: Page, needle: string): Promise<HoverProbe>
         continue
       }
       const idx = line.translateToString(true).indexOf(needle)
-      if (idx >= 0) {
+      if (idx !== -1) {
         hit = { row, col: idx }
         break
       }
diff --git a/tests/e2e/terminal-paste-ownership.spec.ts b/tests/e2e/terminal-paste-ownership.spec.ts
index 5df66cbce04..56c65a139aa 100644
--- a/tests/e2e/terminal-paste-ownership.spec.ts
+++ b/tests/e2e/terminal-paste-ownership.spec.ts
@@ -114,7 +114,7 @@ async function rightClickActiveTerminalSurface(page: Page): Promise<void> {
 
 async function installClipboardReadTerminalBlurRepro(app: ElectronApplication): Promise<void> {
   await app.evaluate(({ BrowserWindow, ipcMain }) => {
-    type ClipboardReadHandler = (event: unknown, ...args: unknown[]) => Promise<unknown> | unknown
+    type ClipboardReadHandler = (event: unknown, ...args: unknown[]) => unknown
     const global = globalThis as unknown as {
       __orcaOriginalClipboardReadTextHandler?: ClipboardReadHandler
     }
@@ -152,7 +152,7 @@ async function installClipboardReadTerminalBlurRepro(app: ElectronApplication):
 
 async function restoreClipboardReadTerminalBlurRepro(app: ElectronApplication): Promise<void> {
   await app.evaluate(({ ipcMain }) => {
-    type ClipboardReadHandler = (event: unknown, ...args: unknown[]) => Promise<unknown> | unknown
+    type ClipboardReadHandler = (event: unknown, ...args: unknown[]) => unknown
     const global = globalThis as unknown as {
       __orcaOriginalClipboardReadTextHandler?: ClipboardReadHandler
     }
diff --git a/tests/e2e/terminal-tab-switch-visual-restore.spec.ts b/tests/e2e/terminal-tab-switch-visual-restore.spec.ts
index 4f0d2a5df11..938dc852179 100644
--- a/tests/e2e/terminal-tab-switch-visual-restore.spec.ts
+++ b/tests/e2e/terminal-tab-switch-visual-restore.spec.ts
@@ -60,7 +60,6 @@ type SchedulerDebugWindow = Window & {
 type HiddenOutputDebugSnapshot = {
   hiddenRendererSkipCount: number
   hiddenRendererSkippedChars: number
-  hiddenRendererMode2031ReplyCount: number
 }
 
 type HiddenOutputRecoveryWindow = Window & {
diff --git a/tests/e2e/worktree-card-downward-drag.spec.ts b/tests/e2e/worktree-card-downward-drag.spec.ts
new file mode 100644
index 00000000000..b5cb685a4a6
--- /dev/null
+++ b/tests/e2e/worktree-card-downward-drag.spec.ts
@@ -0,0 +1,278 @@
+import path from 'node:path'
+import type { Page } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { waitForSessionReady } from './helpers/store'
+
+const SYNTHETIC_COUNT = 60
+
+type PreviewOffsetSample = {
+  worktreeId: string
+  targetOffset: number
+  renderedOffset: number
+}
+
+async function seedVirtualizedManualWorktrees(page: Page): Promise<{
+  sourceId: string
+  nextId: string
+  idPrefix: string
+}> {
+  const repo = await page.evaluate(() => {
+    const store = window.__store
+    if (!store) {
+      throw new Error('window.__store is not available')
+    }
+    const state = store.getState()
+    const repo = state.repos[0]
+    if (!repo) {
+      throw new Error('Expected a seeded e2e repo')
+    }
+    return { id: repo.id, path: repo.path }
+  })
+  const now = Date.now()
+  const syntheticWorktrees = Array.from({ length: SYNTHETIC_COUNT }, (_, index) => {
+    const suffix = String(index).padStart(2, '0')
+    const worktreePath = path.join(repo.path, '..', `downward-drag-${suffix}`)
+    return {
+      id: `${repo.id}::downward-drag-${suffix}`,
+      instanceId: `downward-drag-${suffix}`,
+      repoId: repo.id,
+      path: worktreePath,
+      displayName: `Downward drag ${suffix}`,
+      comment: '',
+      linkedIssue: null,
+      linkedPR: null,
+      linkedLinearIssue: null,
+      isArchived: false,
+      isUnread: false,
+      isPinned: false,
+      sortOrder: 100_000 - index,
+      manualOrder: 100_000 - index,
+      lastActivityAt: now - index,
+      head: '0000000000000000000000000000000000000000',
+      branch: `downward-drag-${suffix}`,
+      isBare: false,
+      isMainWorktree: false
+    }
+  })
+  await page.evaluate(
+    ({ repoId, worktrees }) => {
+      const store = window.__store
+      if (!store) {
+        throw new Error('window.__store is not available')
+      }
+      const state = store.getState()
+      const seededWorktrees = (state.worktreesByRepo[repoId] ?? []).map((worktree, index) => ({
+        ...worktree,
+        manualOrder: -1_000 - index
+      }))
+
+      store.setState({
+        groupBy: 'none',
+        sortBy: 'manual',
+        showActiveOnly: false,
+        showSleepingWorkspaces: true,
+        hideDefaultBranchWorkspace: false,
+        filterRepoIds: [],
+        sidebarOpen: true,
+        worktreesByRepo: {
+          ...state.worktreesByRepo,
+          [repoId]: [...worktrees, ...seededWorktrees]
+        },
+        updateWorktreesMeta: async (updatesByWorktreeId) => {
+          store.setState((current) => ({
+            sortEpoch: current.sortEpoch + 1,
+            worktreesByRepo: Object.fromEntries(
+              Object.entries(current.worktreesByRepo).map(([repoId, worktrees]) => [
+                repoId,
+                worktrees.map((worktree) => ({
+                  ...worktree,
+                  ...updatesByWorktreeId.get(worktree.id)
+                }))
+              ])
+            )
+          }))
+        }
+      })
+    },
+    { repoId: repo.id, worktrees: syntheticWorktrees }
+  )
+  const sourceId = syntheticWorktrees[0]!.id
+  return {
+    sourceId,
+    nextId: syntheticWorktrees[1]!.id,
+    idPrefix: sourceId.slice(0, -2)
+  }
+}
+
+async function sampleMountedPreviewOffsets(
+  page: Page,
+  sourceId: string
+): Promise<PreviewOffsetSample[][]> {
+  return page.evaluate(async (draggedId) => {
+    const scroller = document.querySelector<HTMLElement>('[data-worktree-sidebar]')
+    if (!scroller) {
+      throw new Error('Worktree sidebar is not available')
+    }
+    const samples: PreviewOffsetSample[][] = []
+    for (let frame = 0; frame < 20; frame++) {
+      await new Promise<void>((resolve) => requestAnimationFrame(() => resolve()))
+      if (document.querySelector(`[data-worktree-drag-id=${JSON.stringify(draggedId)}]`)) {
+        continue
+      }
+      const frameSamples = [
+        ...document.querySelectorAll<HTMLElement>('[data-worktree-virtual-row]')
+      ].flatMap((row) => {
+        const rowRect = row.getBoundingClientRect()
+        const scrollerRect = scroller.getBoundingClientRect()
+        if (rowRect.bottom <= scrollerRect.top || rowRect.top >= scrollerRect.bottom) {
+          return []
+        }
+        const worktree = row.querySelector<HTMLElement>('[data-worktree-drag-id]')
+        const worktreeId = worktree?.getAttribute('data-worktree-drag-id')
+        const rowStart = Number(row.dataset.worktreeVirtualRowStart)
+        const matches = [...row.style.transform.matchAll(/translateY\((-?[\d.]+)px\)/g)]
+        const targetOffset = Number(matches[1]?.[1] ?? 0)
+        const renderedTop = new DOMMatrixReadOnly(getComputedStyle(row).transform).m42
+        const renderedOffset = renderedTop - rowStart
+        return worktreeId &&
+          Number.isFinite(rowStart) &&
+          Number.isFinite(targetOffset) &&
+          Number.isFinite(renderedOffset)
+          ? [{ worktreeId, targetOffset, renderedOffset }]
+          : []
+      })
+      if (frameSamples.length > 0) {
+        samples.push(frameSamples)
+      }
+    }
+    return samples
+  }, sourceId)
+}
+
+test('dragging a virtualized worktree downward keeps rows stable', async ({ orcaPage }) => {
+  await waitForSessionReady(orcaPage)
+  await orcaPage.setViewportSize({ width: 1_000, height: 620 })
+  const { sourceId, nextId, idPrefix } = await seedVirtualizedManualWorktrees(orcaPage)
+  const scroller = orcaPage.locator('[data-worktree-sidebar]')
+  const source = orcaPage.locator(
+    `[data-worktree-sidebar] [data-worktree-id=${JSON.stringify(sourceId)}]`
+  )
+  await scroller.evaluate((element) => {
+    element.scrollTop = 0
+    element.dispatchEvent(new Event('scroll', { bubbles: true }))
+  })
+  await expect(source).toBeVisible()
+
+  const sourceBox = await source.evaluate((element) => {
+    const rect = element.getBoundingClientRect()
+    return { x: rect.left, y: rect.top, width: rect.width, height: rect.height }
+  })
+  const nextSource = orcaPage.locator(
+    `[data-worktree-sidebar] [data-worktree-id=${JSON.stringify(nextId)}]`
+  )
+  const sourceStride = await nextSource.evaluate(
+    (element, sourceTop) => element.getBoundingClientRect().top - sourceTop,
+    sourceBox.y
+  )
+  expect(Number.isFinite(sourceStride)).toBe(true)
+  expect(sourceStride).toBeGreaterThan(1)
+  const scrollerBox = await scroller.evaluate((element) => {
+    const rect = element.getBoundingClientRect()
+    return { x: rect.left, y: rect.top, width: rect.width, height: rect.height }
+  })
+
+  await orcaPage.mouse.move(sourceBox.x + sourceBox.width / 2, sourceBox.y + sourceBox.height / 2)
+  await orcaPage.mouse.down()
+  try {
+    const edgeX = scrollerBox.x + 2
+    const edgeY = scrollerBox.y + scrollerBox.height - 8
+    // Keep the pointer in the edge zone while the renderer advances autoscroll.
+    for (let step = 0; step < 12; step++) {
+      await orcaPage.mouse.move(edgeX, edgeY, { steps: 2 })
+      if ((await source.count()) === 0) {
+        break
+      }
+      await orcaPage.waitForTimeout(100)
+    }
+    if ((await source.count()) > 0) {
+      for (let step = 0; step < 8 && (await source.count()) > 0; step++) {
+        await scroller.evaluate((element) => {
+          element.scrollTop = Math.min(
+            element.scrollHeight,
+            element.scrollTop + element.clientHeight
+          )
+          element.dispatchEvent(new Event('scroll', { bubbles: true }))
+        })
+        await orcaPage.waitForTimeout(100)
+      }
+    }
+    await expect
+      .poll(() => source.count(), {
+        timeout: 10_000,
+        message: 'Downward autoscroll did not virtualize the dragged source row'
+      })
+      .toBe(0)
+
+    const samples = await sampleMountedPreviewOffsets(orcaPage, sourceId)
+    expect(samples.length).toBeGreaterThan(0)
+    const observationsById = new Map<string, PreviewOffsetSample[]>()
+    for (const sample of samples.flat()) {
+      const distanceFromValidTarget = Math.min(
+        Math.abs(sample.targetOffset),
+        Math.abs(sample.targetOffset + sourceStride)
+      )
+      expect(distanceFromValidTarget).toBeLessThanOrEqual(1)
+      expect(sample.renderedOffset).toBeGreaterThanOrEqual(-sourceStride - 2)
+      expect(sample.renderedOffset).toBeLessThanOrEqual(2)
+      const observations = observationsById.get(sample.worktreeId) ?? []
+      observations.push(sample)
+      observationsById.set(sample.worktreeId, observations)
+    }
+
+    const recurrentRows = [...observationsById.values()].filter(
+      (observations) => observations.length > 1
+    )
+    expect(recurrentRows.length).toBeGreaterThan(0)
+    expect(
+      recurrentRows.some((observations) =>
+        observations.some((sample) => sample.renderedOffset <= -sourceStride * 0.8)
+      )
+    ).toBe(true)
+    for (const observations of recurrentRows) {
+      let renderedReversal = 0
+      for (let index = 1; index < observations.length; index++) {
+        renderedReversal += Math.max(
+          0,
+          observations[index]!.renderedOffset - observations[index - 1]!.renderedOffset
+        )
+      }
+      expect(renderedReversal).toBeLessThanOrEqual(sourceStride)
+    }
+  } finally {
+    await orcaPage.mouse.up()
+  }
+
+  await expect(orcaPage.locator('[data-worktree-sidebar-drag-preview="true"]')).toHaveCount(0)
+  await expect(orcaPage.locator('html')).not.toHaveAttribute(
+    'data-worktree-sidebar-pointer-dragging'
+  )
+  await scroller.evaluate((element) => {
+    element.scrollTop = 0
+    element.dispatchEvent(new Event('scroll', { bubbles: true }))
+  })
+  await expect
+    .poll(
+      () =>
+        scroller
+          .locator('[role="option"]')
+          .evaluateAll(
+            (options, prefix) =>
+              options
+                .map((option) => option.getAttribute('data-worktree-id'))
+                .find((worktreeId) => worktreeId?.startsWith(prefix)) ?? null,
+            idPrefix
+          ),
+      { message: 'The downward drop did not move the source away from the first slot' }
+    )
+    .toBe(nextId)
+})
diff --git a/tests/playwright.daemon-liveness.local.config.ts b/tests/playwright.daemon-liveness.local.config.ts
new file mode 100644
index 00000000000..e10de11b372
--- /dev/null
+++ b/tests/playwright.daemon-liveness.local.config.ts
@@ -0,0 +1,13 @@
+import { defineConfig } from '@playwright/test'
+
+// Local discrimination-run config only: these specs drive real daemon processes
+// directly and need no Electron app build, so globalSetup is deliberately absent.
+export default defineConfig({
+  testDir: './e2e',
+  timeout: 180_000,
+  expect: { timeout: 15_000 },
+  workers: 1,
+  retries: 0,
+  reporter: 'list',
+  projects: [{ name: 'daemon-node', testMatch: '**/daemon-restart-session-liveness.spec.ts' }]
+})
diff --git a/tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs b/tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs
new file mode 100644
index 00000000000..1b2cbcae38c
--- /dev/null
+++ b/tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs
@@ -0,0 +1,398 @@
+#!/usr/bin/env node
+/**
+ * Ground-truth repro harness for issue #9993: color-scheme (CSI ?997;1n) replies
+ * leaking into a child process' stdin under fish.
+ *
+ * Simulates Orca's terminal pipeline around a REAL fish shell:
+ *   node-pty  ->  scanMode2031ReplyDecision() (the real scanner from
+ *                 src/shared/terminal-color-scheme-protocol.ts)
+ *             ->  reply `CSI ?997;1n` written back to the PTY, optionally after
+ *                 a delay that models the renderer IPC round-trip.
+ *
+ * Requires Node >= 22.18 (native TypeScript type stripping) so the real .ts
+ * scanner can be imported without a build step.
+ *
+ * Usage:
+ *   node tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs [options]
+ *
+ *   --delay=<ms>        reply delay; 0 = synchronous in-process (default 0)
+ *   --shell=<path>      fish binary (default /opt/homebrew/bin/fish)
+ *   --user-config       use the caller's real fish config (Tide etc.) instead of
+ *                       an isolated minimal config
+ *   --prompt-cmd        add an external command substitution to fish_prompt, so
+ *                       the prompt itself forces extra tty handoffs
+ *   --no-probes         do NOT answer DA1/DA2/CPR/XTVERSION/OSC 10/11 (fish then
+ *                       stalls 10s on its DA1 wait)
+ *   --accept-delay=<ms> gap between typing the command and pressing Enter (300)
+ *   --paste             send command + Enter in a single write (paste-like)
+ *   --no-reply          never answer 2031 (control run)
+ *   --json              append a machine-readable summary
+ */
+
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { createRequire } from 'node:module'
+
+const require = createRequire(import.meta.url)
+const REPO_ROOT = path.resolve(import.meta.dirname, '../../..')
+
+const pty = require(path.join(REPO_ROOT, 'node_modules/node-pty'))
+const { INITIAL_MODE_2031_REPLY_SCAN_STATE, mode2031SequenceFor, scanMode2031ReplyDecision } =
+  await import(path.join(REPO_ROOT, 'src/shared/terminal-color-scheme-protocol.ts'))
+
+// ---------------------------------------------------------------- args
+
+const argv = process.argv.slice(2)
+const flag = (name) => argv.includes(`--${name}`)
+const opt = (name, fallback) => {
+  const hit = argv.find((a) => a.startsWith(`--${name}=`))
+  return hit === undefined ? fallback : hit.slice(name.length + 3)
+}
+
+const REPLY_DELAY_MS = Number(opt('delay', '0'))
+const SHELL = opt('shell', '/opt/homebrew/bin/fish')
+const USE_USER_CONFIG = flag('user-config')
+const ANSWER_PROBES = !flag('no-probes')
+const REPLY_ENABLED = !flag('no-reply')
+const EMIT_JSON = flag('json')
+const ACCEPT_DELAY_MS = Number(opt('accept-delay', '300'))
+const PASTE = flag('paste')
+const PROMPT_CMD = flag('prompt-cmd')
+const TYPEAHEAD = flag('typeahead')
+const TYPEAHEAD_AT_MS = Number(opt('typeahead-at', '150'))
+const SETTLE_MS = Number(opt('settle', '400'))
+
+const PROMPT_MARK = 'HARNESS> '
+const CHILD_CMD = `python3 -c 'import sys; d=sys.stdin.readline(); print("GOT:", repr(d))'`
+
+// ---------------------------------------------------------------- tracing
+
+const t0 = process.hrtime.bigint()
+const ms = () => Number(process.hrtime.bigint() - t0) / 1e6
+const stamp = () => ms().toFixed(3).padStart(10, ' ')
+
+const trace = []
+function log(dir, label, detail) {
+  const line = `[${stamp()}ms] ${dir.padEnd(12)} ${label}${detail ? ` ${detail}` : ''}`
+  trace.push(line)
+  console.log(line)
+}
+
+function esc(s) {
+  let out = ''
+  for (const ch of s) {
+    const c = ch.codePointAt(0)
+    if (ch === '\x1b') {
+      out += '\\e'
+    } else if (ch === '\n') {
+      out += '\\n'
+    } else if (ch === '\r') {
+      out += '\\r'
+    } else if (ch === '\t') {
+      out += '\\t'
+    } else if (c < 0x20 || c === 0x7f) {
+      out += `\\x${c.toString(16).padStart(2, '0')}`
+    } else if (c === 0x9b) {
+      out += '\\x9b'
+    } else {
+      out += ch
+    }
+  }
+  return out
+}
+
+const CHUNK_PRINT_CAP = 1200
+function escCapped(s) {
+  const e = esc(s)
+  return e.length > CHUNK_PRINT_CAP
+    ? `${e.slice(0, CHUNK_PRINT_CAP)}…<+${e.length - CHUNK_PRINT_CAP} esc-chars>`
+    : e
+}
+
+// ---------------------------------------------------------------- fish config
+
+let configHome = null
+const env = { ...process.env, TERM: 'xterm-256color', COLORTERM: 'truecolor', LANG: 'en_US.UTF-8' }
+delete env.FISH_HISTORY
+if (!USE_USER_CONFIG) {
+  configHome = mkdtempSync(path.join(tmpdir(), 'fish-2031-'))
+  mkdirSync(path.join(configHome, 'fish'), { recursive: true })
+  // Plain prompt: no Tide, no async prompt machinery. fish core still toggles
+  // DEC 2031 in tty_handoff.rs regardless of the prompt.
+  const promptBody = PROMPT_CMD
+    ? `set -l __x (/bin/echo -n ok); printf '${PROMPT_MARK}'`
+    : `printf '${PROMPT_MARK}'`
+  writeFileSync(
+    path.join(configHome, 'fish/config.fish'),
+    [
+      'set -g fish_greeting ""',
+      `function fish_prompt; ${promptBody}; end`,
+      'function fish_right_prompt; end',
+      ''
+    ].join('\n')
+  )
+  env.XDG_CONFIG_HOME = configHome
+  env.XDG_DATA_HOME = path.join(configHome, 'data')
+}
+
+// ---------------------------------------------------------------- pty
+
+log(
+  'HARNESS',
+  'config',
+  JSON.stringify({
+    shell: SHELL,
+    replyDelayMs: REPLY_DELAY_MS,
+    acceptDelayMs: ACCEPT_DELAY_MS,
+    paste: PASTE,
+    promptCmd: PROMPT_CMD,
+    replyEnabled: REPLY_ENABLED,
+    userConfig: USE_USER_CONFIG,
+    answerProbes: ANSWER_PROBES,
+    xdgConfigHome: configHome
+  })
+)
+
+const term = pty.spawn(SHELL, ['-l', '-i'], {
+  name: 'xterm-256color',
+  cols: 120,
+  rows: 30,
+  cwd: REPO_ROOT,
+  env
+})
+
+let scanState = INITIAL_MODE_2031_REPLY_SCAN_STATE
+let all = ''
+let replyCount = 0
+const replyEvents = []
+const decisionEvents = []
+let phase = 'boot'
+let chunkSeq = 0
+let lastDecision = null
+let staleReplyCount = 0
+
+function ptyWrite(bytes, label) {
+  log('HARNESS->PTY', label, `"${esc(bytes)}"`)
+  term.write(bytes)
+}
+
+function sendMode2031Reply(reason) {
+  replyCount += 1
+  // Stale = the scanner has already seen fish's `CSI ?2031l` (tty handed to a child)
+  // by the time this reply actually reaches the PTY. That reply lands in the child's stdin.
+  const stale = lastDecision === 'unsubscribed'
+  if (stale) {
+    staleReplyCount += 1
+  }
+  replyEvents.push({ at: ms(), phase, reason, delayMs: REPLY_DELAY_MS, stale })
+  ptyWrite(
+    mode2031SequenceFor('dark'),
+    `reply#${replyCount} CSI ?997;1n (${reason}, phase=${phase}${stale ? ', STALE: fish already sent ?2031l' : ''})`
+  )
+}
+
+// Modest emulation of the other terminal replies fish may probe for.
+function answerProbes(data) {
+  if (!ANSWER_PROBES) {
+    return
+  }
+  // oxlint-disable no-control-regex -- terminal escape sequences require control chars
+  if (/\x1b\[(?:0)?c/.test(data)) {
+    ptyWrite('\x1b[?62;4;6;22c', 'probe reply DA1')
+  }
+  if (/\x1b\[>(?:0)?c/.test(data)) {
+    ptyWrite('\x1b[>1;95;0c', 'probe reply DA2')
+  }
+  if (/\x1b\[(?:6n)/.test(data)) {
+    ptyWrite('\x1b[1;1R', 'probe reply CPR')
+  }
+  if (/\x1b\[>q/.test(data)) {
+    ptyWrite('\x1bP>|orca-harness(1)\x1b\\', 'probe reply XTVERSION')
+  }
+  if (/\x1b\]10;\?/.test(data)) {
+    ptyWrite('\x1b]10;rgb:ffff/ffff/ffff\x1b\\', 'probe reply OSC 10')
+  }
+  if (/\x1b\]11;\?/.test(data)) {
+    ptyWrite('\x1b]11;rgb:1e1e/1e1e/1e1e\x1b\\', 'probe reply OSC 11')
+  }
+  // oxlint-enable no-control-regex
+}
+
+term.onData((data) => {
+  const seq = ++chunkSeq
+  all += data
+  // oxlint-disable-next-line no-control-regex -- terminal escape sequences require control chars
+  const mode2031ToggleRe = /\x1b\[\?([0-9;]+)([hl])/g
+  const toggles = [...data.matchAll(mode2031ToggleRe)]
+    .filter((m) => m[1].split(';').some((p) => Number(p) === 2031))
+    .map((m) => `?2031${m[2]}`)
+  log(
+    'PTY->SCANNER',
+    `chunk#${seq} len=${data.length}${toggles.length ? ` toggles=[${toggles.join(',')}]` : ''}`,
+    `"${escCapped(data)}"`
+  )
+
+  const before = scanState
+  const result = scanMode2031ReplyDecision(scanState, data)
+  scanState = result.state
+  if (result.decision || before.pendingSubscribe !== scanState.pendingSubscribe || scanState.tail) {
+    log(
+      'SCANNER',
+      `chunk#${seq} decision=${result.decision ?? 'null'}`,
+      `state={tail:"${esc(scanState.tail)}",pendingSubscribe:${scanState.pendingSubscribe}}`
+    )
+  }
+  if (result.decision) {
+    lastDecision = result.decision
+    decisionEvents.push({ at: ms(), seq, decision: result.decision, phase })
+  }
+
+  if (REPLY_ENABLED && result.decision === 'subscribed') {
+    if (REPLY_DELAY_MS <= 0) {
+      sendMode2031Reply(`chunk#${seq} sync`)
+    } else {
+      setTimeout(() => sendMode2031Reply(`chunk#${seq} +${REPLY_DELAY_MS}ms`), REPLY_DELAY_MS)
+    }
+  }
+  answerProbes(data)
+})
+
+let exitInfo = null
+term.onExit((e) => {
+  exitInfo = e
+  log('PTY', 'exit', JSON.stringify(e))
+})
+
+// ---------------------------------------------------------------- driving
+
+const sleep = (n) => new Promise((r) => setTimeout(r, n))
+async function waitFor(pred, timeoutMs, what) {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    if (pred()) {
+      return true
+    }
+    await sleep(10)
+  }
+  log('HARNESS', 'TIMEOUT', `waiting for ${what}`)
+  return false
+}
+
+const countPrompts = () => all.split(PROMPT_MARK).length - 1
+
+try {
+  phase = 'boot'
+  await waitFor(() => all.includes(PROMPT_MARK), 15000, 'first prompt')
+  await sleep(SETTLE_MS)
+
+  let promptsBeforeAccept
+  let repliesBeforeAccept
+  let decisionsBeforeAccept
+  let outLenBeforeAccept
+
+  if (TYPEAHEAD) {
+    // Most realistic leak window: queue the command while an external command
+    // still owns the tty. fish redraws the prompt (`CSI ?2031h`) and consumes the
+    // buffered line in the same breath, so the handoff to the child happens
+    // sub-millisecond after the subscribe.
+    phase = 'pre-command'
+    log('HARNESS', 'MARK', '--- running `sleep 0.4` so the next line is typed ahead ---')
+    ptyWrite('sleep 0.4\r', 'pre-command')
+    await sleep(TYPEAHEAD_AT_MS)
+
+    promptsBeforeAccept = countPrompts()
+    repliesBeforeAccept = replyCount
+    decisionsBeforeAccept = decisionEvents.length
+    outLenBeforeAccept = all.length
+
+    phase = 'prompt-accept'
+    log('HARNESS', 'MARK', '--- type-ahead: command + Enter while sleep still owns the tty ---')
+    ptyWrite(`${CHILD_CMD}\r`, 'typeahead command + Enter')
+  } else if (PASTE) {
+    promptsBeforeAccept = countPrompts()
+    repliesBeforeAccept = replyCount
+    decisionsBeforeAccept = decisionEvents.length
+    outLenBeforeAccept = all.length
+    phase = 'prompt-accept'
+    log('HARNESS', 'MARK', '--- pasting command + Enter in one write (prompt-accept) ---')
+    ptyWrite(`${CHILD_CMD}\r`, 'paste command + Enter')
+  } else {
+    phase = 'type-command'
+    log('HARNESS', 'MARK', '--- typing child command (no Enter yet) ---')
+    ptyWrite(CHILD_CMD, 'type command')
+    await sleep(ACCEPT_DELAY_MS)
+
+    promptsBeforeAccept = countPrompts()
+    repliesBeforeAccept = replyCount
+    decisionsBeforeAccept = decisionEvents.length
+    outLenBeforeAccept = all.length
+
+    phase = 'prompt-accept'
+    log('HARNESS', 'MARK', '--- pressing Enter (prompt-accept -> tty handoff to child) ---')
+    ptyWrite('\r', 'Enter')
+  }
+  await sleep(1200)
+
+  const repliesDuringAccept = replyCount - repliesBeforeAccept
+  const decisionsDuringAccept = decisionEvents.length - decisionsBeforeAccept
+
+  phase = 'child-stdin'
+  log('HARNESS', 'MARK', '--- typing hello + Enter into the child ---')
+  ptyWrite('hello\r', 'child stdin')
+  await sleep(1500)
+
+  phase = 'teardown'
+  // python's repr renders ESC as the 4 literal chars \x1b, so match on the printed form.
+  const gotLine = (all.slice(outLenBeforeAccept).match(/GOT: '[^\r\n]*/) ?? [])[0] ?? null
+  log('HARNESS', 'RESULT GOT-line', gotLine === null ? '<none captured>' : `"${esc(gotLine)}"`)
+  const leaked = gotLine !== null && /\\x1b|\\033|\\u001b/.test(gotLine)
+  const leaked997 = gotLine !== null && gotLine.includes('997;1n')
+  log('HARNESS', 'RESULT leaked-escape-bytes-into-stdin', String(leaked))
+  log('HARNESS', 'RESULT leaked-CSI-997-1n-into-stdin', String(leaked997))
+  log(
+    'HARNESS',
+    'RESULT replies',
+    JSON.stringify({
+      total: replyCount,
+      duringPromptAccept: repliesDuringAccept,
+      decisionsDuringPromptAccept: decisionsDuringAccept,
+      staleReplies: staleReplyCount,
+      promptsBeforeAccept
+    })
+  )
+
+  ptyWrite('exit\r', 'exit')
+  await waitFor(() => exitInfo !== null, 3000, 'shell exit')
+  try {
+    term.kill()
+  } catch {}
+
+  if (EMIT_JSON) {
+    console.log(
+      `\n__JSON__${JSON.stringify({
+        delayMs: REPLY_DELAY_MS,
+        mode: TYPEAHEAD ? 'typeahead' : PASTE ? 'paste' : 'typed',
+        acceptDelayMs: ACCEPT_DELAY_MS,
+        promptCmd: PROMPT_CMD,
+        replyEnabled: REPLY_ENABLED,
+        userConfig: USE_USER_CONFIG,
+        answerProbes: ANSWER_PROBES,
+        gotLine,
+        leaked,
+        leaked997,
+        totalReplies: replyCount,
+        staleReplies: staleReplyCount,
+        repliesDuringPromptAccept: repliesDuringAccept,
+        decisions: decisionEvents,
+        replies: replyEvents
+      })}`
+    )
+  }
+} finally {
+  if (configHome) {
+    rmSync(configHome, { recursive: true, force: true })
+  }
+}
+
+process.exit(0)
diff --git a/tests/tools/win-crash-survival-e2e/cli-args.mjs b/tests/tools/win-crash-survival-e2e/cli-args.mjs
index 2a289d7893e..e3533342e4d 100644
--- a/tests/tools/win-crash-survival-e2e/cli-args.mjs
+++ b/tests/tools/win-crash-survival-e2e/cli-args.mjs
@@ -119,7 +119,7 @@ function validateArgShape(argv) {
 
 function takeValue(argv, flag) {
   const idx = argv.indexOf(flag)
-  if (idx < 0) {
+  if (idx === -1) {
     return undefined
   }
   const value = argv[idx + 1]
diff --git a/tests/tools/win-update-e2e/cli-args.mjs b/tests/tools/win-update-e2e/cli-args.mjs
index 510bac5a899..d6310e8d159 100644
--- a/tests/tools/win-update-e2e/cli-args.mjs
+++ b/tests/tools/win-update-e2e/cli-args.mjs
@@ -190,7 +190,7 @@ function validate(opts, installDirFlagPresent) {
 
 function takeValue(argv, flag) {
   const idx = argv.indexOf(flag)
-  if (idx < 0) {
+  if (idx === -1) {
     return undefined
   }
   const value = argv[idx + 1]
diff --git a/tests/tools/win-update-e2e/daemon-processes.mjs b/tests/tools/win-update-e2e/daemon-processes.mjs
index f7d43cc9b44..d292c0f24b8 100644
--- a/tests/tools/win-update-e2e/daemon-processes.mjs
+++ b/tests/tools/win-update-e2e/daemon-processes.mjs
@@ -148,7 +148,7 @@ function normalizeArray(raw) {
 
 function parseUserDataArg(argv) {
   const idx = argv.indexOf('--user-data')
-  return idx >= 0 && argv[idx + 1] ? argv[idx + 1] : defaultUserDataDir()
+  return idx !== -1 && argv[idx + 1] ? argv[idx + 1] : defaultUserDataDir()
 }
 
 function runStandalone(argv) {
@@ -161,7 +161,7 @@ function runStandalone(argv) {
   console.log(JSON.stringify(pidFiles, null, 2))
 
   const scopeIdx = argv.indexOf('--scope')
-  const scope = scopeIdx >= 0 && argv[scopeIdx + 1] ? argv[scopeIdx + 1] : ''
+  const scope = scopeIdx !== -1 && argv[scopeIdx + 1] ? argv[scopeIdx + 1] : ''
   const processes = findDaemonProcesses(scope)
   console.log(
     `[daemon-processes] live daemon processes${scope ? ` scoped to "${scope}"` : ''} (${processes.length}):`